Skip to content

chore: release - #754

Open
openstack-experimental-release-plz[bot] wants to merge 1 commit into
mainfrom
release-plz-2026-06-05T09-00-15Z
Open

chore: release#754
openstack-experimental-release-plz[bot] wants to merge 1 commit into
mainfrom
release-plz-2026-06-05T09-00-15Z

Conversation

@openstack-experimental-release-plz

@openstack-experimental-release-plz openstack-experimental-release-plz Bot commented Jun 5, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🤖 New release

  • openstack-keystone-config: 0.1.0
  • openstack-keystone-core-types: 0.1.1
  • openstack-keystone-api-types: 0.1.0 -> 0.1.1 (✓ API compatible changes)
  • openstack-keystone-audit: 0.1.0
  • openstack-keystone-auth-plugin-core: 0.1.0
  • openstack-keystone-key-repository: 0.1.0
  • openstack-keystone-local-emergency-store: 0.1.0
  • openstack-keystone-metrics: 0.1.0
  • openstack-keystone-storage-api: 0.1.0
  • openstack-keystone-core: 0.1.1 -> 0.1.2 (✓ API compatible changes)
  • openstack-keystone-storage-crypto: 0.1.0
  • openstack-keystone-storage-crypto-pkcs11: 0.1.0
  • openstack-keystone-storage-crypto-tpm: 0.1.0
  • openstack-keystone-distributed-storage: 0.1.0 -> 0.1.1 (✓ API compatible changes)
  • openstack-keystone-api-key-driver-raft: 0.1.0
  • openstack-keystone-auth-plugin-runtime: 0.1.0
  • openstack-keystone-password-hashing: 0.1.0
  • openstack-keystone-appcred-driver-sql: 0.1.0
  • openstack-keystone-assignment-driver-sql: 0.1.0
  • openstack-keystone-assignment-driver-openfga: 0.1.0
  • openstack-keystone-catalog-driver-sql: 0.1.0
  • openstack-keystone-credential-driver-sql: 0.1.0
  • openstack-keystone-auth-plugin-identity-driver-raft: 0.1.0
  • openstack-keystone-domain-config-driver-fs: 0.1.0
  • openstack-keystone-domain-config-driver-sql: 0.1.0
  • openstack-keystone-federation-driver-sql: 0.1.0
  • openstack-keystone-identity-driver-ldap: 0.1.0
  • openstack-keystone-identity-driver-sql: 0.1.0
  • openstack-keystone-idmapping-driver-sql: 0.1.0
  • openstack-keystone-k8s-auth-driver-raft: 0.1.0
  • openstack-keystone-k8s-auth-driver-sql: 0.1.0
  • openstack-keystone-mapping-driver-raft: 0.1.0
  • openstack-keystone-oauth2-client-driver-raft: 0.1.0
  • openstack-keystone-oauth2-key-driver-raft: 0.1.0
  • openstack-keystone-oauth2-session-driver-raft: 0.1.0
  • openstack-keystone-policy-store-driver-sql: 0.1.0
  • openstack-keystone-resource-driver-sql: 0.1.0
  • openstack-keystone-revoke-driver-sql: 0.1.0
  • openstack-keystone-role-driver-sql: 0.1.0
  • openstack-keystone-scim-driver-raft: 0.1.0
  • openstack-keystone-token-driver-fernet: 0.1.1
  • openstack-keystone-token-driver-jws: 0.1.0
  • openstack-keystone-token-restriction-driver-sql: 0.1.0
  • openstack-keystone-trust-driver-sql: 0.1.0
  • openstack-keystone-webauthn: 0.1.0
  • openstack-keystone: 0.1.1 -> 0.1.2 (✓ API compatible changes)
  • openstack-keystone-cli-manage: 0.1.0
Changelog

openstack-keystone-config

0.1.0 - 2026-09-08

Added

  • Hot-reload fs per-domain config files (#1225)
  • (adr0034) Route assignment ops per domain (#1219)
  • (adr0034) Add per-domain driver config surface (#1216)
  • (assignment) Add OpenFGA assignment driver (#1206)
  • (domain-config) Add resolution layer (#1199)
  • (domain-config) Add filesystem driver (#1197)
  • (spiffe) Derive spiffe claims (#1193)
  • Add vendor data JWT API for SPIRE integration (#1192)
  • (core) Reconnect database connection on new config (#1188)
  • (policy) Implement legacy Policy API (/v3/policies) (#1127)
  • Add domain config types and backend trait (#1138)
  • (adr0031) Add HTTP request metrics (#1134)
  • (config) Support configurable log file rotation (#1128)
  • Add connection_debug to tune SQL query logging (#1109)
  • (pagination) Add pagination to remaining places (#1106)
  • (config) Revoke Vault token on shutdown (#1088)
  • Generalize marker pagination for v3/v4 lists (#1086)
  • (config) Add Vault-backed configuration (#1051)
  • (logging) Add native journald log writer (#1081)
  • (identity) Add PATCH to few resources (#1076)
  • (ldap) Add LDAP identity driver (#1047)
  • (adr0028) Add local-quorum-bypass emergency rotation (#1032)
  • Add catalog CRUD API and bootstrap support (#1029)
  • (adr0026) Add RFC 8628 Device Authorization Grant (#1023)
  • (adr0026) Add authorization code flow with PKCE (#1015)
  • (adr0026) Add client_credentials token endpoint (#1014)
  • (adr0026) Phase 2 client registration & OIDC discovery (#1013)
  • (adr0026) Phase 0 token abstraction and JWS driver (#1010)
  • (api) capture client IP via proxy headers & SPIFFE (Start capturing client information in the request processing #358 follow-up) (#908)
  • (identity) Add per-user auth rate limiting (#996)
  • (adr0025) Complete imlpementation (#969)
  • (api) Add global IP rate limiting framework (ADR-0022 phase 1) (#846)
  • (scim) Harden RFC 7644 compliance, add docs (#968)
  • (adr0025) Phase 1 (1.1+1.2) (#952)
  • (security) Wrap secrets with secrecy crate (#369) (#912)
  • (scim) ADR 0024 - Phase 5 (#951)
  • (scim) ADR 0024 - Phase 1+2 (#925)
  • (fernet) Unify credential/token key repositories (#915)
  • Start ADR 0025 immplementation (#911)
  • (credential) Implement Phase 3 of ADR 0019 (#909)
  • Prepare PKCS#11/TPM KEK support in storage (#907)
  • (credential) Implement ADR 0019 phases 1-2 (#897)
  • Implement stateless SCIM ingress auth (ADR 0021) (#891)
  • (auth) Password hashing parity with Python Keystone (#859)
  • (audit) Implement CADF audit framework Phase 2 (#872)
  • (storage) SPIFFE checks, RBAC, rate limiting, auto-join (#861)
  • (storage) Harden preflight and erase dev KEK (#860)
  • Add bootstrap cli command (#809)
  • (mapping) ADR-0020 (mapping engine) phase 1 (#794)
  • Add inter-provider event notification system (#784)
  • Add SO_PEERCRED peer credential validation (#775)
  • Validate password for compliance conformity (#774)
  • Enforce minimum range boundaries for security
  • Add role-imply rest api (#750)
  • Add user update functionality (#747)
  • Make drivers more dynamic (#737)
  • Add keystone container with opa and policies (#738)
  • Add Admin interface over the UDS (#735)
  • Add spiffe provider (#733)
  • Introduce SecurityContext (#710)
  • Add skeleton for the spiffe mTLS integration (#695)
  • Implement ConfigManager for config watching (#691)
  • Improve the code (#686)
  • Add k8s-auth raft driver (#676)
  • Add raft support under skaffold (#667)
  • Introduce raft backend for webauthn (#658)
  • Introduce the keystone-manage cli managing raft (#656)

Fixed

  • (adr0034) Post implementation fixes (#1223)
  • Avoid blocking notify's event thread in watch_loop (#1125)
  • Fix flaky test (#1110)
  • (security) Address security review findings (#1049)
  • (passkey) Prevent user enumeration (#905)

Other

  • (config) Fix flaky notify watcher tests (#1112)
  • Revise documentation layout (#1069)
  • Moves health and metrics endpoints to dedicated listener on separate port (#910)
  • Move jsonwebtoken to keystone crate (#820)
  • mapping engine phase 3 - migrate SPIFFE (#811)
  • Rename identity_mapping to idmapping (#788)
  • Replace Regex with str::find for db connection (#760)
  • Redesign SecurityContext with two-phase validation (#717)
  • Split out remaining sql drivers (#633)
  • Split config into standalone crate (#628)

openstack-keystone-core-types

0.1.1 - 2026-09-08

Added

  • Hot-reload fs per-domain config files (#1225)
  • (adr0034) Route assignment ops per domain (#1219)
  • (adr0034) Build per-instance assignment backends (#1218)
  • (adr0034) Add per-domain driver config surface (#1216)
  • Resolve local/public ids for non-default backends (#1207)
  • (assignment) Add OpenFGA assignment driver (#1206)
  • (idmapping) Add id-mapping write paths (#1205)
  • (domain-config) Dispatch identity ops per domain (#1202)
  • (domain-config) Add resolution layer (#1199)
  • (domain-config) Add filesystem driver (#1197)
  • Add vendor data JWT API for SPIRE integration (#1192)
  • Add domain config SQL driver (#1139)
  • (policy) Implement legacy Policy API (/v3/policies) (#1127)
  • Add domain config types and backend trait (#1138)
  • Add cargo-fuzz targets (#1130)
  • Add OS-EP-FILTER provider CRUD to the catalog (#1075)
  • (pagination) Add pagination to remaining places (#1106)
  • Add immutable option for project, domain, role (#1097)
  • Generalize marker pagination for v3/v4 lists (#1086)
  • (identity) Add trust create/delete and REST CRUD (#1079)
  • (catalog) Expose /v3/regions REST API (#1078)
  • (identity) Add PATCH to few resources (#1076)
  • (ldap) Add LDAP identity driver (#1047)
  • (test) Add tempest identity compatibility (#998)
  • (adr0028) Add local-quorum-bypass emergency rotation (#1032)
  • Add catalog CRUD API and bootstrap support (#1029)
  • (adr0026) Add RFC 8628 Device Authorization Grant (#1023)
  • (adr0026) Phase 6a (#1017)
  • (adr0026) Add Phase 5 offline token verification (#1016)
  • (adr0026) Add authorization code flow with PKCE (#1015)
  • (adr0026) Add client_credentials token endpoint (#1014)
  • (adr0026) Phase 2 client registration & OIDC discovery (#1013)
  • (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
  • (adr0026) Phase 0 token abstraction and JWS driver (#1010)
  • (identity) Add per-user auth rate limiting (#996)
  • (adr0025) Complete imlpementation (#969)
  • (api) Add global IP rate limiting framework (ADR-0022 phase 1) (#846)
  • (adr0025) Phase 1 (1.1+1.2) (#952)
  • (security) Wrap secrets with secrecy crate (#369) (#912)
  • (scim) ADR 0024 - Phase 4 (protocol surface completion) (#929)
  • (scim) ADR 0024 - Phase 3 (#928)
  • (scim) ADR 0024 - Phase 1+2 (#925)
  • (credential) Implement Phase 3 of ADR 0019 (#909)
  • (credential) Implement ADR 0019 phases 1-2 (#897)
  • Implement stateless SCIM ingress auth (ADR 0021) (#891)
  • Audit framework (ADR-0023) phase 3 (#880)
  • (audit) Implement CADF audit framework Phase 2 (#872)
  • Migrate federation to new mapping engine (#839)
  • Add access rule CRD to appcred provider (#806)
  • ADR-0020 mapping phase 4 (#818)
  • (mapping) ADR-0020 (mapping engine) phase 1 (#794)
  • Add endpoint CRUD to catalog provider (#785)
  • Add inter-provider event notification system (#784)
  • Add service CRUD to the catalog provider (#773)
  • Validate password for compliance conformity (#774)
  • Return 401 on roleless scoped contexts (#742)
  • Add region CRUD to catalog SQL driver (#761)
  • Add role-imply rest api (#750)
  • Add role imply API (#749)
  • Add user update functionality (#747)
  • Add spiffe binding API (#740)
  • Add Admin interface over the UDS (#735)
  • Add spiffe provider (#733)
  • Expand role info in expand_implied_roles (#730)
  • Introduce SecurityContext (#710)
  • Improve the code (#686)
  • Add k8s-auth raft driver (#676)
  • Introduce the keystone-manage cli managing raft (#656)

Fixed

  • Use proper token issued_at time (#1194)
  • Register UserType in OpenAPI components schema (#1151)
  • Fix ID sanitizer and capture client IP in audit (#1126)
  • (api) Default enabled/domain_id on create (#1073)
  • (security) Address security review findings (#1049)
  • (federation) Allow long external unique_id values (#1033)
  • Unify ApiClient scope validation, fix nextest filter (#947)
  • Finalize ADR 0021 work (#906)
  • Resolve raft replication state races (#884)
  • (k8s_auth) Flatten k8s.aud claim from JWT TokenReview (#834)
  • Align "extra" property handling (#787)

Other

  • (api) Harden v3 authorization and authentication coverage (#1166)
  • (identity) Remove service account API methods (#1152)
  • Extend workspace unsafe/unwrap/expect lints (#1120)
  • Revise documentation layout (#1069)
  • (security) Close mutation-testing gaps in auth/policy (#1056)
  • Move jsonwebtoken to keystone crate (#820)
  • mapping engine phase 3 - migrate SPIFFE (#811)
  • Rename identity_mapping to idmapping (#788)
  • Make resolve_implied_roles optional (#764)
  • Redesign SecurityContext with two-phase validation (#717)
  • Unify state initialization in test (#642)
  • Small optimization of the derives (#638)
  • Split the core-types crate (#640)

openstack-keystone-api-types

0.1.1 - 2026-09-08

Added

  • (assignment) Add OpenFGA assignment driver (#1206)
  • (domain-config) Dispatch identity ops per domain (#1202)
  • (domain-config) Add configuration API (#1201)
  • Add vendor data JWT API for SPIRE integration (#1192)
  • (api) Log response body for all 4xx/5xx errors (#1171)
  • (api) Log error details in IntoResponse (#1169)
  • (policy) Implement legacy Policy API (/v3/policies) (#1127)
  • Filter user listing by type (#813)
  • (loadtest) Add more auth tests (#1119)
  • (pagination) Add pagination to remaining places (#1106)
  • Add immutable option for project, domain, role (#1097)
  • Generalize marker pagination for v3/v4 lists (#1086)
  • (identity) Add trust create/delete and REST CRUD (#1079)
  • (catalog) Expose /v3/regions REST API (#1078)
  • (identity) Add PATCH to few resources (#1076)
  • (ldap) Add LDAP identity driver (#1047)
  • (test) Add tempest identity compatibility (#998)
  • (adr0028) Add local-quorum-bypass emergency rotation (#1032)
  • Add catalog CRUD API and bootstrap support (#1029)
  • (adr0026) Extend keystone-manage oauth2 CLI (#1020)
  • (adr0026) Phase 6a (#1017)
  • (adr0026) Add client_credentials token endpoint (#1014)
  • (adr0026) Phase 2 client registration & OIDC discovery (#1013)
  • (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
  • (identity) Add per-user auth rate limiting (#996)
  • (adr0025) Complete imlpementation (#969)
  • (identity) Implement user password change endpoint (#970)
  • (api) Add global IP rate limiting framework (ADR-0022 phase 1) (#846)
  • (adr0025) Phase 1 (1.1+1.2) (#952)
  • (security) Wrap secrets with secrecy crate (#369) (#912)
  • (scim) ADR 0024 - Phase 5 (#951)
  • (scim) ADR 0024 - Phase 1+2 (#925)
  • (credential) Implement Phase 3 of ADR 0019 (#909)
  • ADR 0021 admin surface, simulate-access, and janitor (#896)
  • Implement stateless SCIM ingress auth (ADR 0021) (#891)
  • Migrate federation to new mapping engine (#839)
  • ADR-0020 mapping phase 4 (#818)
  • (mapping) ADR-0020 phase 2 (#807)
  • (mapping) ADR-0020 (mapping engine) phase 1 (#794)
  • Validate password for compliance conformity (#774)
  • Add system-user-role assignments API (#762)
  • Add role-imply rest api (#750)
  • Add user update functionality (#747)
  • Add api to list user roles on project (#639)
  • Add domain CRUD operations (#743)
  • Add spiffe binding API (#740)
  • Add spiffe provider (#733)
  • Introduce SecurityContext (#710)
  • Add skeleton for the spiffe mTLS integration (#695)
  • Improve the code (#686)

Fixed

  • (types) Remove invalid PartialEq from AppCred wrappers (#1191)
  • (logging) Surface 5xx causes at error level (#1172)
  • Register UserType in OpenAPI components schema (#1151)
  • Map raft-not-available to proper HTTP status codes (#1149)
  • (api) Fix pagination limit, filters, and rows (#1115)
  • Address multiple tempest failures (#1083)
  • (api) Default enabled/domain_id on create (#1073)
  • (security) Address security review findings (#1049)
  • (federation) Allow long external unique_id values (#1033)
  • Unify ApiClient scope validation, fix nextest filter (#947)
  • Finalize ADR 0021 work (#906)

Other

  • (api) Harden v3 authorization and authentication coverage (#1166)
  • (identity) Remove service account API methods (#1152)
  • Feature/expose app credential (#948)
  • (api) Expand v3 coverage and enforce EC2 token restrictions (#1084)
  • Extend workspace unsafe/unwrap/expect lints (#1120)
  • (test) Improve testing of the oauth2 OP (#1024)
  • Move jsonwebtoken to keystone crate (#820)
  • (tests) Reorganize integration_api tests (#815)
  • mapping engine phase 3 - migrate SPIFFE (#811)
  • Rename identity_mapping to idmapping (#788)
  • Further align workspace features (#772)
  • Make resolve_implied_roles optional (#764)
  • Redesign SecurityContext with two-phase validation (#717)
  • Small optimization of the derives (#638)
  • Split the core-types crate (#640)
  • Introduce features in api-types crate (#624)
  • Slim down api-types crate (#622)

openstack-keystone-audit

0.1.0 - 2026-09-08

Added

  • (audit) Complete ADR-0023 audit implementation (#887)
  • Audit framework (ADR-0023) phase 3 (#880)
  • (audit) Implement CADF audit framework Phase 2 (#872)

Fixed

  • Fix ID sanitizer and capture client IP in audit (#1126)

Other

  • Extend workspace unsafe/unwrap/expect lints (#1120)

openstack-keystone-auth-plugin-core

0.1.0 - 2026-09-08

Other

  • Split extism out of core's dependency tree (#1148)

openstack-keystone-key-repository

0.1.0 - 2026-09-08

Added

  • (adr0026) Add previous-key and JTI-revocation janitor (#1021)
  • (adr0026) Add Phase 5 offline token verification (#1016)
  • (adr0026) Add client_credentials token endpoint (#1014)
  • (adr0026) Phase 0 token abstraction and JWS driver (#1010)
  • (scim) ADR 0024 - Phase 1+2 (#925)
  • (fernet) Unify credential/token key repositories (#915)

Fixed

  • Widen Fernet key index from i8 to u32 (#1080)
  • Support macOS dev builds and fs watcher shutdown (#1009)

Other

  • (deps) bump pem from 3.0.6 to 4.0.0 (#1162)
  • (deps) bump pkcs8 from 0.10.2 to 0.11.0 (#1061)

openstack-keystone-local-emergency-store

0.1.0 - 2026-09-08

Added

  • (test) Add tempest identity compatibility (#998)
  • (adr0028) Add local-quorum-bypass emergency rotation (#1032)

Other

  • Extend workspace unsafe/unwrap/expect lints (#1120)

openstack-keystone-metrics

0.1.0 - 2026-09-08

Added

  • (metrics) Add shared Prometheus primitives crate (#1186)

openstack-keystone-storage-api

0.1.0 - 2026-09-08

Added

  • (storage) Add ephemeral state machine records (#1198)
  • (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
  • (storage) Cert validity and SVID TTL enforcement (#886)
  • (storage) SPIFFE checks, RBAC, rate limiting, auto-join (#861)
  • (storage) Complete ADR-0016-v2 (#844)
  • (storage) implement ADR 0016-v2 Phases 1-4 — encrypted storage with quarantine (#840)

Fixed

  • (webauthn) Rotate raft ceremony-state keyspaces (#890)

Other

  • Extend workspace unsafe/unwrap/expect lints (#1120)
  • (storage) Decouple core from storage (#832)

openstack-keystone-core

0.1.2 - 2026-09-08

Added

  • Hot-reload fs per-domain config files (#1225)
  • (adr0034) Reload assignment bundle on config change (#1220)
  • (adr0034) Route assignment ops per domain (#1219)
  • (adr0034) Build per-instance assignment backends (#1218)
  • (adr0034) Gate sources on domain_config (#1217)
  • Resolve local/public ids for non-default backends (#1207)
  • (assignment) Add OpenFGA assignment driver (#1206)
  • (idmapping) Add id-mapping write paths (#1205)
  • (domain-config) Dispatch identity ops per domain (#1202)
  • (domain-config) Add configuration API (#1201)
  • (domain-config) Add resolution layer (#1199)
  • (spiffe) Derive spiffe claims (#1193)
  • Add vendor data JWT API for SPIRE integration (#1192)
  • (core) Reconnect database connection on new config (#1188)
  • (metrics) Add shared Prometheus primitives crate (#1186)
  • Add domain config SQL driver (#1139)
  • (policy) Implement legacy Policy API (/v3/policies) (#1127)
  • Add domain config types and backend trait (#1138)
  • Add SCIM scenarios; Fix findings (#1136)
  • Add cargo-fuzz targets (#1130)
  • Add SPIFFE SVID health check to readiness probe (#1121)
  • Add OS-EP-FILTER provider CRUD to the catalog (#1075)
  • Add per-request cache framework (ADR 0030) (#1114)
  • Auto-register backend drivers via inventory (#1105)
  • Add immutable option for project, domain, role (#1097)
  • (config) Revoke Vault token on shutdown (#1088)
  • (identity) Add trust create/delete and REST CRUD (#1079)
  • (identity) Add PATCH to few resources (#1076)
  • (tempest) Improve tempest testing (#1046)
  • (test) Add tempest identity compatibility (#998)
  • (adr0028) Add local-quorum-bypass emergency rotation (#1032)
  • (adr0026) Add RFC 8628 Device Authorization Grant (#1023)
  • (adr0026) Add previous-key and JTI-revocation janitor (#1021)
  • (adr0026) Phase 6a (#1017)
  • (adr0026) Add Phase 5 offline token verification (#1016)
  • (adr0026) Add authorization code flow with PKCE (#1015)
  • (adr0026) Add client_credentials token endpoint (#1014)
  • (adr0026) Phase 2 client registration & OIDC discovery (#1013)
  • (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
  • (adr0026) Phase 0 token abstraction and JWS driver (#1010)
  • (api) capture client IP via proxy headers & SPIFFE (Start capturing client information in the request processing #358 follow-up) (#908)
  • (identity) Add per-user auth rate limiting (#996)
  • (adr0025) Complete imlpementation (#969)
  • (api) Add global IP rate limiting framework (ADR-0022 phase 1) (#846)
  • (adr0025) Phase 1 (1.1+1.2) (#952)
  • (security) Wrap secrets with secrecy crate (#369) (#912)
  • (scim) ADR 0024 - Phase 5 (#951)
  • (scim) ADR 0024 - Phase 4 (protocol surface completion) (#929)
  • (scim) ADR 0024 - Phase 3 (#928)
  • (scim) ADR 0024 - Phase 1+2 (#925)
  • (credential) Implement Phase 3 of ADR 0019 (#909)
  • (credential) Implement ADR 0019 phases 1-2 (#897)
  • ADR 0021 admin surface, simulate-access, and janitor (#896)
  • Implement stateless SCIM ingress auth (ADR 0021) (#891)
  • (audit) Complete ADR-0023 audit implementation (#887)
  • (storage) Cert validity and SVID TTL enforcement (#886)
  • Audit framework (ADR-0023) phase 3 (#880)
  • (auth) Password hashing parity with Python Keystone (#859)
  • (audit) Implement CADF audit framework Phase 2 (#872)
  • Migrate federation to new mapping engine (#839)
  • Add access rule CRD to appcred provider (#806)
  • ADR-0020 mapping phase 4 (#818)
  • Add bootstrap cli command (#809)
  • (mapping) ADR-0020 (mapping engine) phase 1 (#794)
  • Add endpoint CRUD to catalog provider (#785)
  • Add inter-provider event notification system (#784)
  • Add service CRUD to the catalog provider (#773)
  • Validate password for compliance conformity (#774)
  • Return 401 on roleless scoped contexts (#742)
  • Add region CRUD to catalog SQL driver (#761)
  • Add timing attack protection and failed auth tracking (#758)
  • Add role-imply rest api (#750)
  • Add role imply API (#749)
  • Add user update functionality (#747)
  • Add domain CRUD operations (#743)
  • Add spiffe binding API (#740)
  • Normalize the policy enforcer structure (#741)
  • Make drivers more dynamic (#737)
  • Add Admin interface over the UDS (#735)
  • Add spiffe provider (#733)
  • Expand role info in expand_implied_roles (#730)
  • Introduce SecurityContext (#710)
  • Talk to OPA over unix socket (#701)
  • Add skeleton for the spiffe mTLS integration (#695)
  • Implement ConfigManager for config watching (#691)
  • Improve the code (#686)
  • Add k8s-auth raft driver (#676)
  • Add basic healthcheck endpoint (#671)
  • Make raft storage available through state (#657)

Fixed

  • (adr0034) Post implementation fixes (#1223)
  • Use proper token issued_at time (#1194)
  • (logging) Surface 5xx causes at error level (#1172)
  • Register UserType in OpenAPI components schema (#1151)
  • (api) Fix pagination limit, filters, and rows (#1115)
  • Fix ID sanitizer and capture client IP in audit (#1126)
  • (api) Default enabled/domain_id on create (#1073)
  • (security) Do not allow ec2cred token to do anything (#1071)
  • (security) Address security review findings (#1049)
  • (adr0026) Bind Token Exchange grant to the issuing domain (#1019)
  • Unify ApiClient scope validation, fix nextest filter (#947)
  • Finalize ADR 0021 work (#906)
  • (ci) Prepare workflows for merge queue (#902)
  • Resolve raft replication state races (#884)
  • (core) Eliminate mapping race condition (#876)
  • (k8s_auth) Flatten k8s.aud claim from JWT TokenReview (#834)
  • (auth) Close admin SVID impersonation gap (#833)

Other

  • (adr0034) Add per-domain assignment driver tests (#1222)
  • (deps) Bump argon2 from 0.5.3 to 0.6.0 (#1184)
  • (identity) Remove service account API methods (#1152)
  • Feature/expose app credential (#948)
  • (api) Expand v3 coverage and enforce EC2 token restrictions (#1084)
  • Split extism out of core's dependency tree (#1148)
  • Add SECURITY note to important method (#1132)
  • Extend workspace unsafe/unwrap/expect lints (#1120)
  • (db) 3 optimizations for DB queries (#1111)
  • (deps) Bump sea-orm and sea-orm-migration to 2.0 (#1089)
  • Revise documentation layout (#1069)
  • (security) Close mutation-testing gaps in auth/policy (#1056)
  • Extract password hashing into own crate (#1055)
  • (test) Improve testing of the oauth2 OP (#1024)
  • (deps) bump scrypt from 0.11.0 to 0.12.0 (#923)
  • Reorganize dockerfile and deps (#857)
  • (core) Remove spiffe crate dependency (#858)
  • Wrap ServiceState under ExecutionContext (#856)
  • (storage) Decouple core from storage (#832)
  • (core) Eliminate XxxProvider enums (#830)
  • Move jsonwebtoken to keystone crate (#820)
  • mapping engine phase 3 - migrate SPIFFE (#811)
  • (deps) bump hmac from 0.12.1 to 0.13.0 (#801)
  • Rename identity_mapping to idmapping (#788)
  • Consolidate password update flows (#778)
  • Further align workspace features (#772)
  • Make resolve_implied_roles optional (#764)
  • Redesign SecurityContext with two-phase validation (#717)
  • (deps) bump jsonwebtoken from 10.3.0 to 10.4.0 (#707)
  • Introduce dynamic plugins (#643)
  • Small optimization of the derives (#638)
  • Split the core-types crate (#640)
  • Split out remaining sql drivers (#633)
  • Split more drivers to separate crates (#632)
  • Drop unnecessary derives to help compilation (#631)
  • Drop unnecessary tracing directives (#627)
  • Split config into standalone crate (#628)
  • Rework http client pool (#629)
  • Make assignment sql driver a standalone crate (#626)
  • Move assignment parameters resolution to driver (#625)
  • Introduce features in api-types crate (#624)
  • Slim down api-types crate (#622)
  • Split out webauthn into crate (#621)
  • Split out token-fernet driver (#620)
  • Prepare slit out of the FernetTokenProvider (#619)
  • Move benchmark into the proper crate (#614)

openstack-keystone-storage-crypto

0.1.0 - 2026-09-08

Added

  • (scim) ADR 0024 - Phase 3 (#928)
  • (storage) Add PKCS#11 KEK provider crate (#917)
  • (storage) Cert validity and SVID TTL enforcement (#886)
  • (audit) Implement CADF audit framework Phase 2 (#872)
  • (storage) SPIFFE checks, RBAC, rate limiting, auto-join (#861)
  • (storage) Harden preflight and erase dev KEK (#860)
  • (storage) Complete ADR-0016-v2 (#844)
  • (storage) implement ADR 0016-v2 Phases 1-4 — encrypted storage with quarantine (#840)

Other

  • Bump deps and whitelist rustsec advisory (#1140)
  • (deps) Batch update dependencies (#875)

openstack-keystone-storage-crypto-pkcs11

0.1.0 - 2026-09-08

Added

  • (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
  • (storage) Add PKCS#11 KEK provider crate (#917)

Other

  • Extend workspace unsafe/unwrap/expect lints (#1120)

openstack-keystone-storage-crypto-tpm

0.1.0 - 2026-09-08

Added

  • (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
  • (storage) Add PKCS#11 KEK provider crate (#917)

Other

  • Extend workspace unsafe/unwrap/expect lints (#1120)

openstack-keystone-distributed-storage

0.1.1 - 2026-09-08

Added

  • (storage) Add ephemeral state machine records (#1198)
  • (metrics) Add shared Prometheus primitives crate (#1186)
  • Add SCIM scenarios; Fix findings (#1136)
  • (test) Add tempest identity compatibility (#998)
  • (adr0028) Add local-quorum-bypass emergency rotation (#1032)
  • (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
  • (storage) Add PKCS#11 KEK provider crate (#917)
  • Prepare PKCS#11/TPM KEK support in storage (#907)
  • Implement background DEK re-encryption pipeline (#898)
  • ADR 0021 admin surface, simulate-access, and janitor (#896)
  • (storage) Cert validity and SVID TTL enforcement (#886)
  • (storage) SPIFFE checks, RBAC, rate limiting, auto-join (#861)
  • (storage) Harden preflight and erase dev KEK (#860)
  • (storage) Add SPIFFE mTLS support to Raft gRPC (#852)
  • (cli) Add cli storage subcommands per ADR 0016-v2 (#850)
  • (storage) Complete ADR-0016-v2 (#844)
  • (storage) implement ADR 0016-v2 Phases 1-4 — encrypted storage with quarantine (#840)
  • (mapping) ADR-0020 phase 2 (#807)
  • (adr) Add updated revision of the DS ADR (#795)
  • (mapping) ADR-0020 (mapping engine) phase 1 (#794)
  • Add skeleton for the spiffe mTLS integration (#695)
  • Implement ConfigManager for config watching (#691)
  • Improve the code (#686)
  • Add k8s-auth raft driver (#676)
  • Add SetIndex/RemoveIndex storage commands (#675)
  • Add basic healthcheck endpoint (#671)
  • Add metadata for raft data (#670)
  • Add transaction support for Raft storage (#669)
  • Add initial benchmarks for the storage (#668)
  • Add raft support under skaffold (#667)
  • Introduce raft backend for webauthn (#658)
  • Prepare raft storage promotion (#659)
  • Make raft storage available through state (#657)
  • Introduce the keystone-manage cli managing raft (#656)

Fixed

  • Support macOS dev builds and fs watcher shutdown (#1009)
  • Finalize ADR 0021 work (#906)
  • (ci) Prepare workflows for merge queue (#902)
  • Further polish storage crate (#892)
  • (webauthn) Rotate raft ceremony-state keyspaces (#890)
  • Resolve raft replication state races (#884)

Other

  • Bump openraft version to 0.10.0.a31 (#1137)
  • Silence some clippy warnings (#1030)
  • (deps) Batch update dependencies (#875)
  • (core) Remove spiffe crate dependency (#858)
  • Add SpiFFE Raft integration test by skaffold (#854)
  • Wrap ServiceState under ExecutionContext (#856)
  • (storage) Decouple core from storage (#832)
  • Update raft drivers mocking (#791)
  • Add mock raft storage for unittest (#790)
  • Make core crates a workspace dependency (#736)
  • Redesign SecurityContext with two-phase validation (#717)
  • (deps) Bump openraft to alpha17 (#641)

openstack-keystone-api-key-driver-raft

0.1.0 - 2026-09-08

Added

  • Auto-register backend drivers via inventory (#1105)
  • Generalize marker pagination for v3/v4 lists (#1086)
  • ADR 0021 admin surface, simulate-access, and janitor (#896)
  • Implement stateless SCIM ingress auth (ADR 0021) (#891)

openstack-keystone-auth-plugin-runtime

0.1.0 - 2026-09-08

Added

  • (adr0025) Complete imlpementation (#969)

Other

  • Split extism out of core's dependency tree (#1148)

openstack-keystone-password-hashing

0.1.0 - 2026-09-08

Other

  • Extract password hashing into own crate (#1055)

openstack-keystone-appcred-driver-sql

0.1.0 - 2026-09-08

Added

  • (core) Reconnect database connection on new config (#1188)
  • Auto-register backend drivers via inventory (#1105)
  • (security) Wrap secrets with secrecy crate (#369) (#912)
  • Add access rule CRD to appcred provider ([#8

@github-actions

github-actions Bot commented Jun 5, 2026 •
edited
Loading

Copy link
Copy Markdown

🦢 Load Test Results

Goose Attack Report

Plan Overview

Action Started Stopped Elapsed Users
Increasing 26-09-08 18:39:55 26-09-08 18:40:17 00:00:22 0 → 45
Maintaining 26-09-08 18:40:17 26-09-08 18:40:47 00:00:30 45
Decreasing 26-09-08 18:40:47 26-09-08 18:40:48 00:00:01 0 ← 45

Request Metrics

Method Name # Requests # Fails Average (ms) Min (ms) Max (ms) RPS Failures/s
DELETE DELETE /v3/auth/tokens 42 0 592.26 354 898 1.40 0.00
DELETE DELETE /v3/projects/:id (teardown) 1 0 200.00 200 200 0.03 0.00
DELETE DELETE /v3/roles/:id (teardown) 1 0 133.00 133 133 0.03 0.00
DELETE DELETE /v3/users/:id (teardown) 2 0 263.00 216 310 0.07 0.00
DELETE DELETE /v4/mappings/rulesets/:mapping_id (teardown) 1 0 201.00 201 201 0.03 0.00
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown) 1 0 98.00 98 98 0.03 0.00
GET 568 0 625.08 328 980 18.93 0.00
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 1737 1737 16.83 1 882 57.90 57.90
GET GET /v3/auth/tokens (validate new) 42 0 590.07 384 885 1.40 0.00
GET GET /v3/auth/tokens (validate revoked) 42 0 497.95 75 692 1.40 0.00
GET GET /v3/projects/:id 52 0 585.29 351 900 1.73 0.00
GET GET /v3/projects/:id (catalog) 78 0 567.54 390 717 2.60 0.00
GET GET /v3/role_assignments 40 0 597.33 433 871 1.33 0.00
GET GET /v3/role_assignments?role.id 40 0 573.28 373 752 1.33 0.00
GET GET /v3/role_assignments?scope.domain.id 40 0 565.80 381 846 1.33 0.00
GET GET /v3/role_assignments?user.id 39 0 573.18 448 809 1.30 0.00
GET GET /v3/roles 104 0 587.72 392 877 3.47 0.00
GET GET /v3/roles/:id 53 0 575.21 377 760 1.77 0.00
GET GET /v3/users/:id 99 0 609.99 327 885 3.30 0.00
GET GET /v3/users/:id (catalog) 96 0 607.18 401 868 3.20 0.00
GET GET /v4/api-keys 25 0 553.44 299 727 0.83 0.00
GET GET /v4/api-keys/:client_id 26 0 652.65 471 873 0.87 0.00
GET GET /v4/mappings/rulesets 27 0 574.33 385 792 0.90 0.00
GET GET /v4/mappings/rulesets/:mapping_id 27 0 566.37 417 746 0.90 0.00
GET GET /v4/oauth2/:domain_id/.well-known/openid-configuration 871 0 51.45 12 184 29.03 0.00
GET GET /v4/oauth2/:domain_id/clients 26 0 589.50 462 700 0.87 0.00
GET GET /v4/oauth2/:domain_id/clients/:provider_id 27 0 578.96 326 773 0.90 0.00
GET GET /v4/oauth2/:domain_id/jwks 872 0 51.36 11 256 29.07 0.00
GET GET /v4/scim_realms 17 0 592.41 430 751 0.57 0.00
GET GET /v4/scim_realms/:domain_id/:provider_id 17 0 561.53 380 700 0.57 0.00
POST POST /v3/auth/tokens 40 0 544.03 391 709 1.33 0.00
POST POST /v3/auth/tokens (password, invalid) 32 0 970.22 674 1517 1.07 0.00
POST POST /v3/auth/tokens (password, project-scoped) 57 0 1194.91 713 1618 1.90 0.00
POST POST /v3/auth/tokens (password, unscoped) 56 0 1013.09 613 1524 1.87 0.00
POST POST /v3/auth/tokens (rescope to system) 93 0 660.20 394 937 3.10 0.00
POST POST /v3/auth/tokens (rescope, invalid project) 57 0 534.21 317 777 1.90 0.00
POST POST /v3/auth/tokens (system-scoped, bootstrap admin) 52 0 1190.79 706 1649 1.73 0.00
POST POST /v3/users (setup) 1 0 1644.00 1644 1644 0.03 0.00
POST POST /v4/api-keys/:client_id/revoke (teardown) 1 0 159.00 159 159 0.03 0.00
PUT PUT /v4/scim_realms/:domain_id/:provider_id 17 0 660.00 495 880 0.57 0.00
Aggregated 5419 1737 254.48 1 1649 180.63 57.90

Response Time Metrics

Method Name 50%ile (ms) 60%ile (ms) 70%ile (ms) 80%ile (ms) 90%ile (ms) 95%ile (ms) 99%ile (ms) 100%ile (ms)
DELETE DELETE /v3/auth/tokens 600 600 600 700 700 700 898 898
DELETE DELETE /v3/projects/:id (teardown) 200 200 200 200 200 200 200 200
DELETE DELETE /v3/roles/:id (teardown) 133 133 133 133 133 133 133 133
DELETE DELETE /v3/users/:id (teardown) 220 220 220 310 310 310 310 310
DELETE DELETE /v4/mappings/rulesets/:mapping_id (teardown) 201 201 201 201 201 201 201 201
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown) 98 98 98 98 98 98 98 98
GET 600 600 700 700 800 800 900 980
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 7 8 10 13 17 25 430 882
GET GET /v3/auth/tokens (validate new) 600 600 600 700 700 700 885 885
GET GET /v3/auth/tokens (validate revoked) 500 500 600 600 600 600 692 692
GET GET /v3/projects/:id 600 600 600 700 700 700 700 900
GET GET /v3/projects/:id (catalog) 600 600 600 600 700 700 700 700
GET GET /v3/role_assignments 600 600 600 700 700 800 871 871
GET GET /v3/role_assignments?role.id 600 600 600 700 700 700 752 752
GET GET /v3/role_assignments?scope.domain.id 600 600 600 600 700 700 800 800
GET GET /v3/role_assignments?user.id 600 600 600 600 700 700 800 800
GET GET /v3/roles 600 600 600 700 700 700 800 877
GET GET /v3/roles/:id 600 600 600 700 700 700 760 760
GET GET /v3/users/:id 600 600 700 700 700 800 885 885
GET GET /v3/users/:id (catalog) 600 600 600 700 700 800 868 868
GET GET /v4/api-keys 600 600 600 600 700 700 700 700
GET GET /v4/api-keys/:client_id 700 700 700 700 800 800 873 873
GET GET /v4/mappings/rulesets 600 600 600 700 700 700 792 792
GET GET /v4/mappings/rulesets/:mapping_id 600 600 600 600 600 700 700 700
GET GET /v4/oauth2/:domain_id/.well-known/openid-configuration 45 52 59 70 85 100 130 180
GET GET /v4/oauth2/:domain_id/clients 600 600 600 600 600 700 700 700
GET GET /v4/oauth2/:domain_id/clients/:provider_id 600 600 600 700 700 700 773 773
GET GET /v4/oauth2/:domain_id/jwks 45 51 60 69 87 100 140 256
GET GET /v4/scim_realms 600 600 600 700 700 700 751 751
GET GET /v4/scim_realms/:domain_id/:provider_id 600 600 600 700 700 700 700 700
POST POST /v3/auth/tokens 500 600 600 600 600 700 700 700
POST POST /v3/auth/tokens (password, invalid) 1,000 1,000 1,000 1,000 1,000 1,000 1,517 1,517
POST POST /v3/auth/tokens (password, project-scoped) 1,000 1,000 1,000 1,000 1,000 1,618 1,618 1,618
POST POST /v3/auth/tokens (password, unscoped) 1,000 1,000 1,000 1,000 1,000 1,000 1,000 1,524
POST POST /v3/auth/tokens (rescope to system) 700 700 700 700 800 800 900 900
POST POST /v3/auth/tokens (rescope, invalid project) 500 500 600 600 700 700 700 777
POST POST /v3/auth/tokens (system-scoped, bootstrap admin) 1,000 1,000 1,000 1,000 1,649 1,649 1,649 1,649
POST POST /v3/users (setup) 1,644 1,644 1,644 1,644 1,644 1,644 1,644 1,644
POST POST /v4/api-keys/:client_id/revoke (teardown) 159 159 159 159 159 159 159 159
PUT PUT /v4/scim_realms/:domain_id/:provider_id 700 700 700 700 800 800 880 880
Aggregated 50 83 500 600 700 800 1,000 1,649

Status Code Metrics

Method Name Status Codes
DELETE DELETE /v3/auth/tokens 42 [204]
DELETE DELETE /v3/projects/:id (teardown) 1 [204]
DELETE DELETE /v3/roles/:id (teardown) 1 [204]
DELETE DELETE /v3/users/:id (teardown) 2 [204]
DELETE DELETE /v4/mappings/rulesets/:mapping_id (teardown) 1 [204]
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown) 1 [204]
GET 568 [200]
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 30 [401], 1,707 [429]
GET GET /v3/auth/tokens (validate new) 42 [200]
GET GET /v3/auth/tokens (validate revoked) 42 [404]
GET GET /v3/projects/:id 52 [200]
GET GET /v3/projects/:id (catalog) 78 [200]
GET GET /v3/role_assignments 40 [200]
GET GET /v3/role_assignments?role.id 40 [200]
GET GET /v3/role_assignments?scope.domain.id 40 [200]
GET GET /v3/role_assignments?user.id 39 [200]
GET GET /v3/roles 104 [200]
GET GET /v3/roles/:id 53 [200]
GET GET /v3/users/:id 99 [200]
GET GET /v3/users/:id (catalog) 96 [200]
GET GET /v4/api-keys 25 [200]
GET GET /v4/api-keys/:client_id 26 [200]
GET GET /v4/mappings/rulesets 27 [200]
GET GET /v4/mappings/rulesets/:mapping_id 27 [200]
GET GET /v4/oauth2/:domain_id/.well-known/openid-configuration 871 [200]
GET GET /v4/oauth2/:domain_id/clients 26 [200]
GET GET /v4/oauth2/:domain_id/clients/:provider_id 27 [200]
GET GET /v4/oauth2/:domain_id/jwks 872 [200]
GET GET /v4/scim_realms 17 [200]
GET GET /v4/scim_realms/:domain_id/:provider_id 17 [200]
POST POST /v3/auth/tokens 40 [201]
POST POST /v3/auth/tokens (password, invalid) 32 [401]
POST POST /v3/auth/tokens (password, project-scoped) 57 [201]
POST POST /v3/auth/tokens (password, unscoped) 56 [201]
POST POST /v3/auth/tokens (rescope to system) 93 [201]
POST POST /v3/auth/tokens (rescope, invalid project) 57 [401]
POST POST /v3/auth/tokens (system-scoped, bootstrap admin) 52 [201]
POST POST /v3/users (setup) 1 [201]
POST POST /v4/api-keys/:client_id/revoke (teardown) 1 [200]
PUT PUT /v4/scim_realms/:domain_id/:provider_id 17 [200]
Aggregated 1,707 [429], 42 [404], 119 [401], 48 [204], 3,204 [200], 299 [201]

Transaction Metrics

Transaction # Times Run # Fails Average (ms) Min (ms) Max (ms) RPS Failures/s
ReadHeavy
0.0 1 0 37.00 37 37 0.03 0.00
0.1 101 0 630.68 396 921 3.37 0.00
0.2 101 0 592.61 391 917 3.37 0.00
0.3 101 0 591.05 387 980 3.37 0.00
TokenLifecycle
1.0 0 0 0.00 0 0 0.00 0.00
1.1 42 0 2225.69 1470 2534 1.40 0.00
ValidateToken
2.0 0 0 0.00 0 0 0.00 0.00
2.1 88 0 698.67 489 974 2.93 0.00
UserCRUD
3.0 0 0 0.00 0 0 0.00 0.00
3.1 1 0 1644.00 1644 1644 0.03 0.00
3.2 99 0 610.01 327 885 3.30 0.00
3.3 2 0 263.00 216 310 0.07 0.00
ProjectCRUD
4.0 0 0 0.00 0 0 0.00 0.00
4.1 0 0 0.00 0 0 0.00 0.00
4.2 52 0 585.33 352 900 1.73 0.00
4.3 1 0 200.00 200 200 0.03 0.00
RoleCRUD
5.0 0 0 0.00 0 0 0.00 0.00
5.1 0 0 0.00 0 0 0.00 0.00
5.2 53 0 575.23 377 760 1.77 0.00
5.3 1 0 133.00 133 133 0.03 0.00
RoleList
6.0 0 0 0.00 0 0 0.00 0.00
6.1 104 0 587.74 392 878 3.47 0.00
RoleAssignmentList
7.0 0 0 0.00 0 0 0.00 0.00
7.1 40 0 597.38 433 871 1.33 0.00
7.2 39 0 573.23 448 809 1.30 0.00
7.3 40 0 565.80 381 846 1.33 0.00
7.4 40 0 573.38 373 752 1.33 0.00
UserRead
8.0 0 0 0.00 0 0 0.00 0.00
8.1 99 0 642.77 422 859 3.30 0.00
8.2 96 0 607.21 401 868 3.20 0.00
ProjectRead
9.0 0 0 0.00 0 0 0.00 0.00
9.1 78 0 598.76 328 913 2.60 0.00
9.2 78 0 567.58 390 717 2.60 0.00
PasswordAuth
10.0 56 0 1013.09 613 1524 1.87 0.00
10.1 57 0 1194.96 713 1618 1.90 0.00
PasswordAuthNegative
11.0 32 0 970.28 674 1517 1.07 0.00
Rescope
12.0 0 0 0.00 0 0 0.00 0.00
12.1 93 0 660.25 394 937 3.10 0.00
RescopeNegative
13.0 0 0 0.00 0 0 0.00 0.00
13.1 57 0 534.25 317 777 1.90 0.00
SystemScopeAuth
14.0 52 0 1190.87 706 1649 1.73 0.00
ApiKeyCRUD
15.0 0 0 0.00 0 0 0.00 0.00
15.1 0 0 0.00 0 0 0.00 0.00
15.2 26 0 652.69 472 873 0.87 0.00
15.3 25 0 553.56 300 727 0.83 0.00
15.4 1 0 159.00 159 159 0.03 0.00
MappingCRUD
16.0 0 0 0.00 0 0 0.00 0.00
16.1 0 0 0.00 0 0 0.00 0.00
16.2 27 0 566.37 417 746 0.90 0.00
16.3 27 0 574.33 385 792 0.90 0.00
16.4 1 0 201.00 201 201 0.03 0.00
OAuth2ClientCRUD
17.0 0 0 0.00 0 0 0.00 0.00
17.1 0 0 0.00 0 0 0.00 0.00
17.2 27 0 578.96 326 773 0.90 0.00
17.3 26 0 589.50 462 700 0.87 0.00
17.4 1 0 98.00 98 98 0.03 0.00
OAuth2Discovery
18.0 872 0 51.39 11 256 29.07 0.00
18.1 871 0 51.48 12 184 29.03 0.00
ScimRealmRead
19.0 0 0 0.00 0 0 0.00 0.00
19.1 17 0 561.53 380 700 0.57 0.00
19.2 17 0 592.47 430 751 0.57 0.00
19.3 17 0 660.06 495 880 0.57 0.00
ScimSync
20.0 0 0 0.00 0 0 0.00 0.00
20.1 0 0 0.00 0 0 0.00 0.00
20.2 0 0 0.00 0 0 0.00 0.00
20.3 1737 0 16.86 1 882 57.90 0.00
20.4 1736 0 0.00 0 0 57.87 0.00
20.5 1736 0 0.00 0 0 57.87 0.00
20.6 1 0 0.00 0 0 0.03 0.00
Aggregated 8769 0 157.26 1 2534 292.30 0.00

Scenario Metrics

Transaction # Users # Times Run Average (ms) Min (ms) Max (ms) Scenarios/s Iterations
ReadHeavy 6 99 1833.92 1452 2278 3.30 16.50
TokenLifecycle 3 39 2264.54 1937 2534 1.30 13.00
ValidateToken 2 86 702.58 489 974 2.87 43.00
UserCRUD 2 97 613.93 327 885 3.23 48.50
ProjectCRUD 1 51 587.65 352 900 1.70 51.00
RoleCRUD 1 52 578.85 377 760 1.73 52.00
RoleList 2 102 591.31 392 878 3.40 51.00
RoleAssignmentList 3 39 2329.82 1838 2623 1.30 13.00
UserRead 4 96 1257.83 1052 1477 3.20 24.00
ProjectRead 3 75 1173.32 873 1486 2.50 25.00
PasswordAuth 4 54 2229.91 1525 2907 1.80 13.50
PasswordAuthNegative 1 31 977.71 674 1517 1.03 31.00
Rescope 2 91 664.29 394 937 3.03 45.50
RescopeNegative 1 56 538.12 380 777 1.87 56.00
SystemScopeAuth 2 50 1203.52 775 1649 1.67 25.00
ApiKeyCRUD 1 25 1210.60 971 1435 0.83 25.00
MappingCRUD 1 26 1152.62 960 1352 0.87 26.00
OAuth2ClientCRUD 1 26 1172.27 789 1394 0.87 26.00
OAuth2Discovery 3 870 103.33 29 297 29.00 290.00
ScimRealmRead 1 16 1833.88 1585 2179 0.53 16.00
ScimSync 1 1736 16.59 1 882 57.87 1736.00
Aggregated 45 3717 363.22 1 2907 123.90 2627.00

Error Metrics

Method Name # Error
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 48 401 Unauthorized: GET /SCIM/v2/:domain_id/Users (sync reconcile list)
POST POST /SCIM/v2/:domain_id/Users (sync provision) 1 401 Unauthorized: POST /SCIM/v2/:domain_id/Users (sync provision)
POST POST /v3/auth/tokens (password, invalid) 74 401 Unauthorized: POST /v3/auth/tokens (password, invalid)
POST POST /v3/auth/tokens (rescope, invalid project) 142 401 Unauthorized: POST /v3/auth/tokens (rescope, invalid project)
GET GET /v3/auth/tokens (validate revoked) 142 404 Not Found: GET /v3/auth/tokens (validate revoked)
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 1780 429 Too Many Requests: GET /SCIM/v2/:domain_id/Users (sync reconcile list)

View full report

@github-actions

github-actions Bot commented Jun 5, 2026 •
edited
Loading

Copy link
Copy Markdown

🐰 Bencher Report

Projectkeystone
Branchrelease-plz-2026-06-05T09-00-15Z
Testbedubuntu-latest
Click to view all benchmark results
BenchmarkLatencyBenchmark Result
nanoseconds (ns)
(Result Δ%)		Upper Boundary
nanoseconds (ns)
(Limit %)
Command_Serde/apply/remove📈 view plot
🚷 view threshold		253,850.00 ns
(-2.17%)Baseline: 259,485.44 ns
1,311,010.78 ns
(19.36%)
Command_Serde/apply/set📈 view plot
🚷 view threshold		271,250.00 ns
(-35.31%)Baseline: 419,296.16 ns
3,209,842.62 ns
(8.45%)
Command_Serde/pack/delete📈 view plot
🚷 view threshold		99.58 ns
(-14.91%)Baseline: 117.04 ns
154.98 ns
(64.26%)
Command_Serde/pack/delete_index📈 view plot
🚷 view threshold		89.41 ns
(-14.34%)Baseline: 104.39 ns
137.28 ns
(65.13%)
Command_Serde/pack/set📈 view plot
🚷 view threshold		159.90 ns
(-15.75%)Baseline: 189.80 ns
245.68 ns
(65.08%)
Command_Serde/pack/set_index📈 view plot
🚷 view threshold		90.06 ns
(-13.71%)Baseline: 104.37 ns
137.64 ns
(65.43%)
Command_Serde/unpack/delete📈 view plot
🚷 view threshold		173.48 ns
(-6.78%)Baseline: 186.10 ns
270.84 ns
(64.05%)
Command_Serde/unpack/delete_index📈 view plot
🚷 view threshold		148.75 ns
(-3.94%)Baseline: 154.85 ns
219.27 ns
(67.84%)
Command_Serde/unpack/set📈 view plot
🚷 view threshold		245.73 ns
(-6.58%)Baseline: 263.03 ns
365.63 ns
(67.21%)
Command_Serde/unpack/set_index📈 view plot
🚷 view threshold		156.95 ns
(+2.93%)Baseline: 152.49 ns
213.82 ns
(73.40%)
Payload_encryption/pack/remove_cmd📈 view plot
🚷 view threshold		91.22 ns
(-17.99%)Baseline: 111.24 ns
150.53 ns
(60.60%)
Payload_encryption/pack/set_cmd📈 view plot
🚷 view threshold		152.11 ns
(-23.42%)Baseline: 198.63 ns
266.76 ns
(57.02%)
Payload_encryption/unpack/remove_cmd📈 view plot
🚷 view threshold		174.09 ns
(-10.59%)Baseline: 194.72 ns
284.72 ns
(61.14%)
Payload_encryption/unpack/set_cmd📈 view plot
🚷 view threshold		242.97 ns
(-10.61%)Baseline: 271.80 ns
380.90 ns
(63.79%)
Raft_1Node_Latency/prefix/1node📈 view plot
🚷 view threshold		1,759,800.00 ns
(-42.30%)Baseline: 3,049,870.92 ns
7,880,083.15 ns
(22.33%)
Raft_1Node_Latency/read/1node📈 view plot
🚷 view threshold		27,028.00 ns
(-27.41%)Baseline: 37,231.41 ns
52,094.76 ns
(51.88%)
Raft_1Node_Latency/remove/1node📈 view plot
🚷 view threshold		496,680.00 ns
(-57.06%)Baseline: 1,156,778.12 ns
11,478,702.70 ns
(4.33%)
Raft_1Node_Latency/write/1node📈 view plot
🚷 view threshold		597,650.00 ns
(-38.00%)Baseline: 963,978.12 ns
7,540,761.93 ns
(7.93%)
build_snapshot/default📈 view plot
🚷 view threshold		91,105.00 ns
(-25.15%)Baseline: 121,715.58 ns
266,946.38 ns
(34.13%)
fernet token/project📈 view plot
🚷 view threshold		1,194.10 ns
(-15.60%)Baseline: 1,414.82 ns
1,817.56 ns
(65.70%)
get_data_keyspace📈 view plot
🚷 view threshold		0.27 ns
(-12.86%)Baseline: 0.31 ns
0.39 ns
(70.27%)
get_db📈 view plot
🚷 view threshold		0.27 ns
(-12.97%)Baseline: 0.31 ns
0.39 ns
(70.16%)
get_fernet_token_timestamp/project📈 view plot
🚷 view threshold		116.47 ns
(-16.49%)Baseline: 139.48 ns
181.99 ns
(64.00%)
get_keyspace📈 view plot
🚷 view threshold		3.67 ns
(-36.64%)Baseline: 5.79 ns
13.03 ns
(28.13%)
🐰 View full continuous benchmarking report in Bencher

@openstack-experimental-release-plz
openstack-experimental-release-plz Bot force-pushed the release-plz-2026-06-05T09-00-15Z branch 22 times, most recently from d04a4df to 7fe2614 Compare June 12, 2026 09:11
@openstack-experimental-release-plz
openstack-experimental-release-plz Bot force-pushed the release-plz-2026-06-05T09-00-15Z branch 6 times, most recently from 3966098 to 805ed8e Compare June 15, 2026 10:08
@openstack-experimental-release-plz
openstack-experimental-release-plz Bot force-pushed the release-plz-2026-06-05T09-00-15Z branch 28 times, most recently from fd0af7c to 53568cd Compare June 26, 2026 20:00
@github-actions

github-actions Bot commented Jul 17, 2026 •
edited
Loading

Copy link
Copy Markdown

🧪 Tempest Identity Compatibility Results (advisory, non-blocking)

rust

Totals
======
Ran: 131 tests in 29.5855 sec.
 - Passed: 64
 - Skipped: 4
 - Expected Fail: 0
 - Unexpected Success: 0
 - Failed: 63
Sum of execute time for each test: 24.0010 sec.
Failed test IDs 
===== FAILED TESTS (target=rust) =====
tempest.api.identity.admin.v3.test_application_credentials.ApplicationCredentialsV3AdminTest.test_create_application_credential_with_roles[id-3b3dd48f-3388-406a-a9e6-4d078a552d0e]
tempest.api.identity.admin.v3.test_credentials.CredentialsTestJSON.test_credentials_create_get_update_delete[id-7cd59bf9-bda4-4c72-9467-d21cab278355,smoke]
tempest.api.identity.admin.v3.test_default_project_id.TestDefaultProjectId.test_default_project_id[id-d6110661-6a71-49a7-a453-b5e26640ff6d]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_create_domain_config_and_show_config_groups_and_options[id-9e3ff13c-f597-4f01-9377-d6c06c2a1477]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_create_update_and_delete_domain_config_groups_and_opts[id-c7510fa2-6661-4170-9c6b-4783a80651e9]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_show_default_group_config_and_options[id-11a02bf0-6f94-4380-b3b0-c8dc18fc0d22]
tempest.api.identity.admin.v3.test_domains.DomainsTestJSON.test_create_domain_without_description[id-2abf8764-309a-4fa9-bc58-201b799817ad]
tempest.api.identity.admin.v3.test_domains.DomainsTestJSON.test_create_update_delete_domain[id-f2f5b44a-82e8-4dad-8084-0661ea3b18cf,smoke]
tempest.api.identity.admin.v3.test_domains_negative.DomainsNegativeTestJSON.test_create_domain_with_name_length_over_64[id-37b1bbf2-d664-4785-9a11-333438586eae,negative]
tempest.api.identity.admin.v3.test_domains_negative.DomainsNegativeTestJSON.test_delete_active_domain[gate,id-1f3fbff5-4e44-400d-9ca1-d953f05f609b,negative]
tempest.api.identity.admin.v3.test_domains.DomainsTestJSON.test_domain_delete_cascades_content[id-d8d318b7-d1b3-4c37-94c5-3c5ba0b121ea]
tempest.api.identity.admin.v3.test_domains.DomainsTestJSON.test_list_domains_filter_by_enabled[id-3fd19840-65c1-43f8-b48c-51bdd066dff9]
setUpClass (tempest.api.identity.admin.v3.test_endpoint_groups.EndPointGroupsTest)
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_assignments_for_domain_roles[id-3859df7e-5b78-4e4d-b10e-214c8953842a]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_assignments_for_implied_roles_create_delete[id-c8828027-df48-4021-95df-b65b92c7429e]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_group_on_domain[id-4bf8a70b-e785-413a-ad53-9f91ce02faa7]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_group_on_project[id-cbf11737-1904-4690-9613-97bcbb3df1c4]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_group_on_system[id-c888fe4f-8018-48db-b959-542225c1b4b6]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_user_on_domain[id-6c9a2940-3625-43a3-ac02-5dcec62ef3bd]
tempest.api.identity.admin.v3.test_groups.GroupsV3TestJSON.test_group_users_add_list_delete[id-1598521a-2f36-4606-8df9-30772bd51339,smoke]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_implied_domain_roles[id-eb1e1c24-1bc4-4d47-9748-e127a1852c82]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_implied_roles_create_check_show_delete[id-c90c316c-d706-4728-bcba-eb1912081b69]
tempest.api.identity.admin.v3.test_groups.GroupsV3TestJSON.test_list_user_groups[id-64573281-d26a-4a52-b899-503cb0f4e4ec]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_role_create_update_show_list[id-18afc6c0-46cf-4911-824e-9989cc056c3a,smoke]
setUpClass (tempest.api.identity.admin.v3.test_list_projects.ListProjectsStaticTestJSON)
tempest.api.identity.admin.v3.test_list_users.UsersV3TestJSON.test_list_users_with_not_enabled[id-bff8bf2f-9408-4ef5-b63a-753c8c2124eb]
tempest.api.identity.admin.v3.test_tokens.TokensV3TestJSON.test_get_available_domain_scopes[id-ec5ecb05-af64-4c04-ac86-4d9f6f12f185]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_check_revoke_roles_on_projects_group[id-26021436-d5a4-4256-943c-ded01e0d4b45]
tempest.api.identity.admin.v3.test_list_projects.ListProjectsTestJSON.test_list_projects_with_enabled[id-0fe7a334-675a-4509-b00e-1c4b95d5dae8]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_check_revoke_roles_on_projects_user[id-18b70e45-7687-4b72-8277-b8f1a47d7591]
tempest.api.identity.admin.v3.test_list_projects.ListProjectsTestJSON.test_list_projects_with_parent[id-6edc66f5-2941-4a17-9526-4073311c1fac]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_check_revoke_roles_on_domains_group[id-c7a8dda2-be50-4fb4-9a9c-e830771078b1]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_check_revoke_roles_on_domains_user[id-4e6f0366-97c8-423c-b2be-41eae6ac91c8]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_revoke_user_roles_on_domain[id-3acf666e-5354-42ac-8e17-8b68893bcd36]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_revoke_user_roles_on_project_tree[id-9f02ccd9-9b57-46b4-8f77-dd5a736f3a06]
tempest.api.identity.admin.v3.test_tokens.TokensV3TestJSON.test_rescope_token[id-565fa210-1da1-4563-999b-f7b5b67cf112]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_create_and_show_consumer[id-c8307ea6-a86c-47fd-ae7b-5b3b2caca76d]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_delete_consumer[id-fdfa1b7f-2a31-4354-b2c7-f6ae20554f93]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_list_consumers[id-09ca50de-78f2-4ffb-ac71-f2254036b2b8]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_update_consumer[id-080a9b1a-c009-47c0-9979-5305bf72e3dc]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_api_media_types[id-657c1970-4722-4189-8831-7325f3bc4265,smoke]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_api_version_resources[id-b9232f5e-d9e5-4d97-b96c-28d3db4de1bd,smoke]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_identity_v3_existence[id-79aec9ae-710f-4c54-a4fc-3aa25b4feac3]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_list_api_versions[id-721f480f-35b6-46c7-846e-047e6acea0dc,smoke]
tempest.api.identity.admin.v3.test_project_tags.IdentityV3ProjectTagsTest.test_list_update_delete_project_tags[id-7c123aac-999d-416a-a0fb-84b915ab10de]
tempest.api.identity.admin.v3.test_projects_negative.ProjectsNegativeStaticTestJSON.test_create_projects_name_length_over_64[id-502b6ceb-b0c8-4422-bf53-f08fdb21e2f0,negative]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_create_application_credential[id-8080c75c-eddc-4786-941a-c2da7039ae61]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_create_application_credential_expires[id-852daf0c-42b5-4239-8466-d193d0543ed3]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_list_application_credentials[id-ff0cd457-6224-46e7-b79e-0ada4964a8a6]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_query_application_credentials[id-9bb5e5cc-5250-493a-8869-8b665f6aa5f6]
tempest.api.identity.admin.v3.test_projects.ProjectsTestJSON.test_create_is_domain_project[id-a7eb9416-6f9b-4dbb-b71b-7f73aaef59d5]
tempest.api.identity.admin.v3.test_projects.ProjectsTestJSON.test_project_create_with_parent[id-1854f9c0-70bc-4d11-a08a-1c789d339e3d]
tempest.api.identity.admin.v3.test_projects.ProjectsTestJSON.test_project_get_equals_list[id-d1db68b6-aebe-4fa0-b79d-d724d2e21162]
tempest.api.identity.v3.test_projects.IdentityV3ProjectsTest.test_list_projects_returns_only_authorized_projects[id-86128d46-e170-4644-866a-cc487f699e1d]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_get_trusts_all[id-4773ebd5-ecbf-4255-b8d8-b63e6f72b65d,smoke]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_get_trusts_query[id-6268b345-87ca-47c0-9ce3-37792b43403a]
tempest.api.identity.v3.test_tokens.TokensV3Test.test_validate_token[id-a9512ac3-3909-48a4-b395-11f438e16260]
tempest.api.identity.admin.v3.test_users.UsersV3TestJSON.test_list_user_projects[id-a831e70c-e35b-430b-92ed-81ebbc5437b8]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_expire[id-0ed14b66-cefd-4b5c-a964-65759453e292]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_impersonate[id-5a0a91a4-baef-4a14-baba-59bf4d7fcace]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_noimpersonate[id-ed2a8779-a7ac-49dc-afd7-30f32f936ed2]
tempest.api.identity.v3.test_catalog.IdentityCatalogTest.test_catalog_standardization[id-56b57ced-22b8-4127-9b8a-565dfb0207e2]
tempest.api.identity.admin.v3.test_users_negative.UsersNegativeTest.test_create_user_for_non_existent_domain[id-e75f006c-89cc-477b-874d-588e4eab4b17,negative]
===== END FAILED TESTS (target=rust) =====

View full run

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants