Skip to content

chore: release - #1513

Open
openstack-experimental-release-plz[bot] wants to merge 1 commit into
mainfrom
release-plz-2026-10-13T05-56-00Z
Open

openstack-experimental-release-plz[bot] wants to merge 1 commit into
mainfrom
release-plz-2026-10-13T05-56-00Z

Conversation

@openstack-experimental-release-plz

@openstack-experimental-release-plz openstack-experimental-release-plz Bot commented Oct 13, 2026 •

Copy link
Copy Markdown
Contributor

🤖 New release

  • openstack-keystone-tls-provider: 0.1.0
  • oslo-config: 0.1.0
  • openstack-keystone-telemetry: 0.1.0
  • cadf: 0.1.0
  • openstack-keystone-config: 0.1.0
  • openstack-keystone-core-types: 0.1.1
  • openstack-keystone-api-types: 0.1.0 -> 0.1.1 (✓ API compatible changes)
  • openstack-keystone-auth-plugin-core: 0.1.0
  • openstack-keystone-auth-plugin-runtime: 0.1.0
  • openstack-keystone-key-repository: 0.1.0
  • openstack-keystone-local-emergency-store: 0.1.0
  • openstack-keystone-storage-api: 0.1.0
  • openstack-keystone-core: 0.1.1 -> 0.1.2 (✓ API compatible changes)
  • openstack-keystone-storage-crypto: 0.1.0
  • openstack-keystone-storage-crypto-pkcs11: 0.1.0
  • openstack-keystone-storage-crypto-tpm: 0.1.0
  • openstack-keystone-distributed-storage: 0.1.0 -> 0.1.1 (✓ API compatible changes)
  • openstack-keystone-api-key-driver-raft: 0.1.0
  • openstack-keystone-password-hashing: 0.1.0
  • openstack-keystone-appcred-driver-sql: 0.1.0
  • openstack-keystone-assignment-driver-sql: 0.1.0
  • openstack-keystone-assignment-driver-openfga: 0.1.0
  • openstack-keystone-catalog-driver-sql: 0.1.0
  • openstack-keystone-credential-driver-sql: 0.1.0
  • openstack-keystone-auth-plugin-identity-driver-raft: 0.1.0
  • openstack-keystone-domain-config-driver-fs: 0.1.0
  • openstack-keystone-domain-config-driver-sql: 0.1.0
  • openstack-keystone-federation-driver-sql: 0.1.0
  • openstack-keystone-identity-driver-ldap: 0.1.0
  • openstack-keystone-identity-driver-sql: 0.1.0
  • openstack-keystone-idmapping-driver-sql: 0.1.0
  • openstack-keystone-k8s-auth-driver-raft: 0.1.0
  • openstack-keystone-k8s-auth-driver-sql: 0.1.0
  • openstack-keystone-limit-driver-sql: 0.1.0
  • openstack-keystone-mapping-driver-raft: 0.1.0
  • openstack-keystone-oauth2-client-driver-raft: 0.1.0
  • openstack-keystone-oauth2-key-driver-raft: 0.1.0
  • openstack-keystone-oauth2-session-driver-raft: 0.1.0
  • openstack-keystone-policy-store-driver-sql: 0.1.0
  • openstack-keystone-resource-driver-sql: 0.1.0
  • openstack-keystone-revoke-driver-sql: 0.1.0
  • openstack-keystone-role-driver-sql: 0.1.0
  • openstack-keystone-scim-driver-raft: 0.1.0
  • openstack-keystone-token-driver-fernet: 0.1.1
  • openstack-keystone-token-driver-jws: 0.1.0
  • openstack-keystone-token-restriction-driver-sql: 0.1.0
  • openstack-keystone-trust-driver-sql: 0.1.0
  • openstack-keystone-webauthn: 0.1.0
  • openstack-keystone: 0.1.1 -> 0.1.2 (✓ API compatible changes)
  • openstack-keystone-cli-manage: 0.1.0
Changelog

openstack-keystone-tls-provider

0.1.0 - 2026-10-16

Added

  • (fips) Further improve fips support (#1544)
  • Make TLS and storage crypto provider selectable (#1543)

oslo-config

0.1.0 - 2026-10-16

Added

  • Make TLS and storage crypto provider selectable (#1543)
  • Enable OpenTelemetry metrics and traces support (#1456)
  • (oslo.config) Generalize oslo-config crate (#1429)

openstack-keystone-telemetry

0.1.0 - 2026-10-16

Added

  • Make TLS and storage crypto provider selectable (#1543)
  • Enable OpenTelemetry metrics and traces support (#1456)

cadf

0.1.0 - 2026-10-16

Added

  • (fips) Further improve fips support (#1544)
  • Make TLS and storage crypto provider selectable (#1543)
  • Enable OpenTelemetry metrics and traces support (#1456)
  • (cadf) Use DSP0262 names on the wire (#1419)
  • (audit) Add opt-in per-request perimeter record (#1415)

Fixed

  • (oauth2) Check client on device grant redeem (#1435)
  • (audit) Polish the CADF crate (#1424)

Other

  • (audit) Assert live audit spool records (#1422)
  • (audit) Cover startup seal, quarantine, hooks (#1410)
  • (cadf) Move audit startup into runtime (#1406)
  • (cadf) Own the audit configuration (#1405)
  • (cadf) Parameterize the service identity (#1400)
  • (audit) Rename audit crate to cadf (#1399)

openstack-keystone-config

0.1.0 - 2026-10-16

Added

  • (oauth2) Add enabled switch and domain filter (#1537)
  • (oauth2) Add user_code backoff on /device (#1514)
  • (oauth2) back-channel/front-channel logout and upstream IdP logout (#1505)
  • (oauth2) Harden SSO sessions (#1490)
  • (oauth2) Add SSO session and RP logout (#1475)
  • (oauth2) Add TOTP second factor to OP login (#1473)
  • (oauth2) Add client display metadata (#1472)
  • (oauth2) Brand and localize the login pages (#1471)
  • (oauth2) Add operator login page templates (#1470)
  • (oslo.config) Generalize oslo-config crate (#1429)
  • (limit) Add unified limits (#1407)
  • (audit) Add HMAC key rotation and node checks (#1382)
  • (audit) Add an RFC 5424 syslog sink (#1381)
  • (audit) Make channel and spool limits configurable (#1380)
  • (audit) Add an enabled switch (#1379)
  • (audit) Ship sealed spool segments to a sink (#1374)
  • (oauth2) Cap refresh families and revalidate user (#1360)
  • (oauth2-session) Add expired record janitor (#1359)
  • (raft) Add backup restore (#1352)
  • (devstack) Pilot ksm SPIFFE mTLS transport (#1239)
  • Hot-reload fs per-domain config files (#1225)
  • (adr0034) Route assignment ops per domain (#1219)
  • (adr0034) Add per-domain driver config surface (#1216)
  • (assignment) Add OpenFGA assignment driver (#1206)
  • (domain-config) Add resolution layer (#1199)
  • (domain-config) Add filesystem driver (#1197)
  • (spiffe) Derive spiffe claims (#1193)
  • Add vendor data JWT API for SPIRE integration (#1192)
  • (core) Reconnect database connection on new config (#1188)
  • (policy) Implement legacy Policy API (/v3/policies) (#1127)
  • Add domain config types and backend trait (#1138)
  • (adr0031) Add HTTP request metrics (#1134)
  • (config) Support configurable log file rotation (#1128)
  • Add connection_debug to tune SQL query logging (#1109)
  • (pagination) Add pagination to remaining places (#1106)
  • (config) Revoke Vault token on shutdown (#1088)
  • Generalize marker pagination for v3/v4 lists (#1086)
  • (config) Add Vault-backed configuration (#1051)
  • (logging) Add native journald log writer (#1081)
  • (identity) Add PATCH to few resources (#1076)
  • (ldap) Add LDAP identity driver (#1047)
  • (adr0028) Add local-quorum-bypass emergency rotation (#1032)
  • Add catalog CRUD API and bootstrap support (#1029)
  • (adr0026) Add RFC 8628 Device Authorization Grant (#1023)
  • (adr0026) Add authorization code flow with PKCE (#1015)
  • (adr0026) Add client_credentials token endpoint (#1014)
  • (adr0026) Phase 2 client registration & OIDC discovery (#1013)
  • (adr0026) Phase 0 token abstraction and JWS driver (#1010)
  • (api) capture client IP via proxy headers & SPIFFE (Start capturing client information in the request processing #358 follow-up) (#908)
  • (identity) Add per-user auth rate limiting (#996)
  • (adr0025) Complete imlpementation (#969)
  • (api) Add global IP rate limiting framework (ADR-0022 phase 1) (#846)
  • (scim) Harden RFC 7644 compliance, add docs (#968)
  • (adr0025) Phase 1 (1.1+1.2) (#952)
  • (security) Wrap secrets with secrecy crate (#369) (#912)
  • (scim) ADR 0024 - Phase 5 (#951)
  • (scim) ADR 0024 - Phase 1+2 (#925)
  • (fernet) Unify credential/token key repositories (#915)
  • Start ADR 0025 immplementation (#911)
  • (credential) Implement Phase 3 of ADR 0019 (#909)
  • Prepare PKCS#11/TPM KEK support in storage (#907)
  • (credential) Implement ADR 0019 phases 1-2 (#897)
  • Implement stateless SCIM ingress auth (ADR 0021) (#891)
  • (auth) Password hashing parity with Python Keystone (#859)
  • (audit) Implement CADF audit framework Phase 2 (#872)
  • (storage) SPIFFE checks, RBAC, rate limiting, auto-join (#861)
  • (storage) Harden preflight and erase dev KEK (#860)
  • Add bootstrap cli command (#809)
  • (mapping) ADR-0020 (mapping engine) phase 1 (#794)
  • Add inter-provider event notification system (#784)
  • Add SO_PEERCRED peer credential validation (#775)
  • Validate password for compliance conformity (#774)
  • Enforce minimum range boundaries for security
  • Add role-imply rest api (#750)
  • Add user update functionality (#747)
  • Make drivers more dynamic (#737)
  • Add keystone container with opa and policies (#738)
  • Add Admin interface over the UDS (#735)
  • Add spiffe provider (#733)
  • Introduce SecurityContext (#710)
  • Add skeleton for the spiffe mTLS integration (#695)
  • Implement ConfigManager for config watching (#691)
  • Improve the code (#686)
  • Add k8s-auth raft driver (#676)
  • Add raft support under skaffold (#667)
  • Introduce raft backend for webauthn (#658)
  • Introduce the keystone-manage cli managing raft (#656)

Fixed

  • (auth-plugins) Raise default invocation rate limits (#1437)
  • (oauth2) Pin issuer to public_endpoint (#1436)
  • (oauth2) Rate limit device_code token grant (#1434)
  • (storage) Authorize Raft and Storage gRPC callers (#1418)
  • (raft) Rotate audit key per DEK epoch (#1362)
  • (audit) Stop spool replay from looping into itself (#1350)
  • (raft) Fail closed on stale ReadIndex reads (#1341)
  • Next round of security review fixes (#1241)
  • (adr0034) Post implementation fixes (#1223)
  • Avoid blocking notify's event thread in watch_loop (#1125)
  • Fix flaky test (#1110)
  • (security) Address security review findings (#1049)
  • (passkey) Prevent user enumeration (#905)

Other

  • (config) Pin reload and overlay behaviour (#1421)
  • (cadf) Own the audit configuration (#1405)
  • (audit) Cover spool, rotation and hook paths (#1391)
  • Fix clippy lints across workspace (#1361)
  • (config) Fix flaky notify watcher tests (#1112)
  • Revise documentation layout (#1069)
  • Moves health and metrics endpoints to dedicated listener on separate port (#910)
  • Move jsonwebtoken to keystone crate (#820)
  • mapping engine phase 3 - migrate SPIFFE (#811)
  • Rename identity_mapping to idmapping (#788)
  • Replace Regex with str::find for db connection (#760)
  • Redesign SecurityContext with two-phase validation (#717)
  • Split out remaining sql drivers (#633)
  • Split config into standalone crate (#628)

openstack-keystone-core-types

0.1.1 - 2026-10-16

Added

  • (oauth2) back-channel/front-channel logout and upstream IdP logout (#1505)
  • (oauth2) Use control-plane aud for tokens (#1498)
  • (oauth2) Add back-channel logout (#1493)
  • (oauth2) Add federated sign-in to device page (#1491)
  • (oauth2) Harden SSO sessions (#1490)
  • (oauth2) Remember consent per client (#1476)
  • (oauth2) Add SSO session and RP logout (#1475)
  • (oauth2) Add federated sign-in to OP login (#1474)
  • (oauth2) Add TOTP second factor to OP login (#1473)
  • (oauth2) Add client display metadata (#1472)
  • (resource) Add enabled filter to project list (#1453)
  • (identity) Add enabled filter to user list (#1451)
  • (oauth2) Rotate signing keys automatically (#1440)
  • Implement authc by app credential (#1187)
  • (limit) Add unified limits (#1407)
  • (oauth2) Populate id_token profile claims (#1408)
  • (oauth2) Revoke refresh families on lifecycle (#1404)
  • (audit) Fix initiator and outcome fidelity (#1387)
  • (audit) Audit remaining provider mutations (#1386)
  • (oauth2) Add RFC 7009 token revocation endpoint (#1369)
  • (oauth2) Cap refresh families and revalidate user (#1360)
  • (oauth2-session) Add expired record janitor (#1359)
  • Hot-reload fs per-domain config files (#1225)
  • (adr0034) Route assignment ops per domain (#1219)
  • (adr0034) Build per-instance assignment backends (#1218)
  • (adr0034) Add per-domain driver config surface (#1216)
  • Resolve local/public ids for non-default backends (#1207)
  • (assignment) Add OpenFGA assignment driver (#1206)
  • (idmapping) Add id-mapping write paths (#1205)
  • (domain-config) Dispatch identity ops per domain (#1202)
  • (domain-config) Add resolution layer (#1199)
  • (domain-config) Add filesystem driver (#1197)
  • Add vendor data JWT API for SPIRE integration (#1192)
  • Add domain config SQL driver (#1139)
  • (policy) Implement legacy Policy API (/v3/policies) (#1127)
  • Add domain config types and backend trait (#1138)
  • Add cargo-fuzz targets (#1130)
  • Add OS-EP-FILTER provider CRUD to the catalog (#1075)
  • (pagination) Add pagination to remaining places (#1106)
  • Add immutable option for project, domain, role (#1097)
  • Generalize marker pagination for v3/v4 lists (#1086)
  • (identity) Add trust create/delete and REST CRUD (#1079)
  • (catalog) Expose /v3/regions REST API (#1078)
  • (identity) Add PATCH to few resources (#1076)
  • (ldap) Add LDAP identity driver (#1047)
  • (test) Add tempest identity compatibility (#998)
  • (adr0028) Add local-quorum-bypass emergency rotation (#1032)
  • Add catalog CRUD API and bootstrap support (#1029)
  • (adr0026) Add RFC 8628 Device Authorization Grant (#1023)
  • (adr0026) Phase 6a (#1017)
  • (adr0026) Add Phase 5 offline token verification (#1016)
  • (adr0026) Add authorization code flow with PKCE (#1015)
  • (adr0026) Add client_credentials token endpoint (#1014)
  • (adr0026) Phase 2 client registration & OIDC discovery (#1013)
  • (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
  • (adr0026) Phase 0 token abstraction and JWS driver (#1010)
  • (identity) Add per-user auth rate limiting (#996)
  • (adr0025) Complete imlpementation (#969)
  • (api) Add global IP rate limiting framework (ADR-0022 phase 1) (#846)
  • (adr0025) Phase 1 (1.1+1.2) (#952)
  • (security) Wrap secrets with secrecy crate (#369) (#912)
  • (scim) ADR 0024 - Phase 4 (protocol surface completion) (#929)
  • (scim) ADR 0024 - Phase 3 (#928)
  • (scim) ADR 0024 - Phase 1+2 (#925)
  • (credential) Implement Phase 3 of ADR 0019 (#909)
  • (credential) Implement ADR 0019 phases 1-2 (#897)
  • Implement stateless SCIM ingress auth (ADR 0021) (#891)
  • Audit framework (ADR-0023) phase 3 (#880)
  • (audit) Implement CADF audit framework Phase 2 (#872)
  • Migrate federation to new mapping engine (#839)
  • Add access rule CRD to appcred provider (#806)
  • ADR-0020 mapping phase 4 (#818)
  • (mapping) ADR-0020 (mapping engine) phase 1 (#794)
  • Add endpoint CRUD to catalog provider (#785)
  • Add inter-provider event notification system (#784)
  • Add service CRUD to the catalog provider (#773)
  • Validate password for compliance conformity (#774)
  • Return 401 on roleless scoped contexts (#742)
  • Add region CRUD to catalog SQL driver (#761)
  • Add role-imply rest api (#750)
  • Add role imply API (#749)
  • Add user update functionality (#747)
  • Add spiffe binding API (#740)
  • Add Admin interface over the UDS (#735)
  • Add spiffe provider (#733)
  • Expand role info in expand_implied_roles (#730)
  • Introduce SecurityContext (#710)
  • Improve the code (#686)
  • Add k8s-auth raft driver (#676)
  • Introduce the keystone-manage cli managing raft (#656)

Fixed

  • (notification) Rework notification implementation (#1506)
  • (application_credential) Accept tempest create payloads (#1446)
  • (oauth2) Revoke refresh families on client delete/disable (#1363)
  • (oauth2-session) Tombstone revoked refresh families (#1358)
  • Next round of security review fixes (#1241)
  • Use proper token issued_at time (#1194)
  • Register UserType in OpenAPI components schema (#1151)
  • Fix ID sanitizer and capture client IP in audit (#1126)
  • (api) Default enabled/domain_id on create (#1073)
  • (security) Address security review findings (#1049)
  • (federation) Allow long external unique_id values (#1033)
  • Unify ApiClient scope validation, fix nextest filter (#947)
  • Finalize ADR 0021 work (#906)
  • Resolve raft replication state races (#884)
  • (k8s_auth) Flatten k8s.aud claim from JWT TokenReview (#834)
  • Align "extra" property handling (#787)

Other

  • Feature/system assignment group (#796)
  • Fix clippy lints across workspace (#1361)
  • (api) Harden v3 authorization and authentication coverage (#1166)
  • (identity) Remove service account API methods (#1152)
  • Extend workspace unsafe/unwrap/expect lints (#1120)
  • Revise documentation layout (#1069)
  • (security) Close mutation-testing gaps in auth/policy (#1056)
  • Move jsonwebtoken to keystone crate (#820)
  • mapping engine phase 3 - migrate SPIFFE (#811)
  • Rename identity_mapping to idmapping (#788)
  • Make resolve_implied_roles optional (#764)
  • Redesign SecurityContext with two-phase validation (#717)
  • Unify state initialization in test (#642)
  • Small optimization of the derives (#638)
  • Split the core-types crate (#640)

openstack-keystone-api-types

0.1.1 - 2026-10-16

Added

  • (oauth2) Add bulk session revocation (#1539)
  • (oauth2) back-channel/front-channel logout and upstream IdP logout (#1505)
  • (oauth2) Use control-plane aud for tokens (#1498)
  • (oauth2) Add back-channel logout (#1493)
  • (oauth2) Remember consent per client (#1476)
  • (oauth2) Add SSO session and RP logout (#1475)
  • (oauth2) Add client display metadata (#1472)
  • (resource) Add enabled filter to project list (#1453)
  • (identity) Add enabled filter to user list (#1451)
  • Implement authc by app credential (#1187)
  • (limit) Add unified limits (#1407)
  • (devstack) Pilot ksm SPIFFE mTLS transport (#1239)
  • (assignment) Add OpenFGA assignment driver (#1206)
  • (domain-config) Dispatch identity ops per domain (#1202)
  • (domain-config) Add configuration API (#1201)
  • Add vendor data JWT API for SPIRE integration (#1192)
  • (api) Log response body for all 4xx/5xx errors (#1171)
  • (api) Log error details in IntoResponse (#1169)
  • (policy) Implement legacy Policy API (/v3/policies) (#1127)
  • Filter user listing by type (#813)
  • (loadtest) Add more auth tests (#1119)
  • (pagination) Add pagination to remaining places (#1106)
  • Add immutable option for project, domain, role (#1097)
  • Generalize marker pagination for v3/v4 lists (#1086)
  • (identity) Add trust create/delete and REST CRUD (#1079)
  • (catalog) Expose /v3/regions REST API (#1078)
  • (identity) Add PATCH to few resources (#1076)
  • (ldap) Add LDAP identity driver (#1047)
  • (test) Add tempest identity compatibility (#998)
  • (adr0028) Add local-quorum-bypass emergency rotation (#1032)
  • Add catalog CRUD API and bootstrap support (#1029)
  • (adr0026) Extend keystone-manage oauth2 CLI (#1020)
  • (adr0026) Phase 6a (#1017)
  • (adr0026) Add client_credentials token endpoint (#1014)
  • (adr0026) Phase 2 client registration & OIDC discovery (#1013)
  • (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
  • (identity) Add per-user auth rate limiting (#996)
  • (adr0025) Complete imlpementation (#969)
  • (identity) Implement user password change endpoint (#970)
  • (api) Add global IP rate limiting framework (ADR-0022 phase 1) (#846)
  • (adr0025) Phase 1 (1.1+1.2) (#952)
  • (security) Wrap secrets with secrecy crate (#369) (#912)
  • (scim) ADR 0024 - Phase 5 (#951)
  • (scim) ADR 0024 - Phase 1+2 (#925)
  • (credential) Implement Phase 3 of ADR 0019 (#909)
  • ADR 0021 admin surface, simulate-access, and janitor (#896)
  • Implement stateless SCIM ingress auth (ADR 0021) (#891)
  • Migrate federation to new mapping engine (#839)
  • ADR-0020 mapping phase 4 (#818)
  • (mapping) ADR-0020 phase 2 (#807)
  • (mapping) ADR-0020 (mapping engine) phase 1 (#794)
  • Validate password for compliance conformity (#774)
  • Add system-user-role assignments API (#762)
  • Add role-imply rest api (#750)
  • Add user update functionality (#747)
  • Add api to list user roles on project (#639)
  • Add domain CRUD operations (#743)
  • Add spiffe binding API (#740)
  • Add spiffe provider (#733)
  • Introduce SecurityContext (#710)
  • Add skeleton for the spiffe mTLS integration (#695)
  • Improve the code (#686)

Fixed

  • (notification) Rework notification implementation (#1506)
  • (resource) Reject project names over 64 chars (#1455)
  • (resource) Align domain and project response shape (#1454)
  • (application_credential) Accept tempest create payloads (#1446)
  • Next round of security review fixes (#1241)
  • (api-types) Allow empty domain description (#1237)
  • (types) Remove invalid PartialEq from AppCred wrappers (#1191)
  • (logging) Surface 5xx causes at error level (#1172)
  • Register UserType in OpenAPI components schema (#1151)
  • Map raft-not-available to proper HTTP status codes (#1149)
  • (api) Fix pagination limit, filters, and rows (#1115)
  • Address multiple tempest failures (#1083)
  • (api) Default enabled/domain_id on create (#1073)
  • (security) Address security review findings (#1049)
  • (federation) Allow long external unique_id values (#1033)
  • Unify ApiClient scope validation, fix nextest filter (#947)
  • Finalize ADR 0021 work (#906)

Other

  • Feature/system assignment group (#796)
  • Fix clippy lints across workspace (#1361)
  • (api) Harden v3 authorization and authentication coverage (#1166)
  • (identity) Remove service account API methods (#1152)
  • Feature/expose app credential (#948)
  • (api) Expand v3 coverage and enforce EC2 token restrictions (#1084)
  • Extend workspace unsafe/unwrap/expect lints (#1120)
  • (test) Improve testing of the oauth2 OP (#1024)
  • Move jsonwebtoken to keystone crate (#820)
  • (tests) Reorganize integration_api tests (#815)
  • mapping engine phase 3 - migrate SPIFFE (#811)
  • Rename identity_mapping to idmapping (#788)
  • Further align workspace features (#772)
  • Make resolve_implied_roles optional (#764)
  • Redesign SecurityContext with two-phase validation (#717)
  • Small optimization of the derives (#638)
  • Split the core-types crate (#640)
  • Introduce features in api-types crate (#624)
  • Slim down api-types crate (#622)

openstack-keystone-auth-plugin-core

0.1.0 - 2026-10-16

Other

  • Split extism out of core's dependency tree (#1148)

openstack-keystone-auth-plugin-runtime

0.1.0 - 2026-10-16

Added

  • (fips) Further improve fips support (#1544)
  • (adr0025) Complete imlpementation (#969)

Fixed

  • Match real app-cred id field in route plugin (#1242)

Other

  • Split extism out of core's dependency tree (#1148)

openstack-keystone-key-repository

0.1.0 - 2026-10-16

Added

  • (fips) Further improve fips support (#1544)
  • (adr0026) Add previous-key and JTI-revocation janitor (#1021)
  • (adr0026) Add Phase 5 offline token verification (#1016)
  • (adr0026) Add client_credentials token endpoint (#1014)
  • (adr0026) Phase 0 token abstraction and JWS driver (#1010)
  • (scim) ADR 0024 - Phase 1+2 (#925)
  • (fernet) Unify credential/token key repositories (#915)

Fixed

  • (deps) Bump p256 to 0.14, unpin rand_core (#1247)
  • Widen Fernet key index from i8 to u32 (#1080)
  • Support macOS dev builds and fs watcher shutdown (#1009)

Other

  • Fix clippy lints across workspace (#1361)
  • (deps) bump pem from 3.0.6 to 4.0.0 (#1162)
  • (deps) bump pkcs8 from 0.10.2 to 0.11.0 (#1061)

openstack-keystone-local-emergency-store

0.1.0 - 2026-10-16

Added

  • (test) Add tempest identity compatibility (#998)
  • (adr0028) Add local-quorum-bypass emergency rotation (#1032)

Other

  • Extend workspace unsafe/unwrap/expect lints (#1120)

openstack-keystone-storage-api

0.1.0 - 2026-10-16

Added

  • (storage) Add opt-in stale local reads (#1532)
  • Enable OpenTelemetry metrics and traces support (#1456)
  • (storage) Gate readiness on Raft health (#1450)
  • (storage) Add ephemeral state machine records (#1198)
  • (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
  • (storage) Cert validity and SVID TTL enforcement (#886)
  • (storage) SPIFFE checks, RBAC, rate limiting, auto-join (#861)
  • (storage) Complete ADR-0016-v2 (#844)
  • (storage) implement ADR 0016-v2 Phases 1-4 — encrypted storage with quarantine (#840)

Fixed

  • (raft) Fail closed on stale ReadIndex reads (#1341)
  • (webauthn) Rotate raft ceremony-state keyspaces (#890)

Other

  • (storage) Split large modules and tests (#1466)
  • Extend workspace unsafe/unwrap/expect lints (#1120)
  • (storage) Decouple core from storage (#832)

openstack-keystone-core

0.1.2 - 2026-10-16

Added

  • (fips) Further improve fips support (#1544)
  • (oauth2) Add Prometheus metrics (#1540)
  • (oauth2) Add enabled switch and domain filter (#1537)
  • (deps) Make extism an optional feature (#1536)
  • (oauth2) Add user_code backoff on /device (#1514)
  • (oauth2) back-channel/front-channel logout and upstream IdP logout (#1505)
  • (oauth2) Use control-plane aud for tokens (#1498)
  • (oauth2) Add back-channel logout (#1493)
  • (oauth2) Add federated sign-in to device page (#1491)
  • (oauth2) Harden SSO sessions (#1490)
  • (oauth2) Remember consent per client (#1476)
  • (oauth2) Add SSO session and RP logout (#1475)
  • (oauth2) Add federated sign-in to OP login (#1474)
  • (oauth2) Add TOTP second factor to OP login (#1473)
  • (oauth2) Add client display metadata (#1472)
  • Enable OpenTelemetry metrics and traces support (#1456)
  • (oauth2) Add OIDC userinfo endpoint (#1442)
  • (oauth2) Rotate signing keys automatically (#1440)
  • (oauth2) Add RFC 7662 token introspection (#1439)
  • Implement authc by app credential (#1187)
  • (oslo.config) Generalize oslo-config crate (#1429)
  • (cadf) Use DSP0262 names on the wire (#1419)
  • (limit) Add unified limits (#1407)
  • (oauth2) Populate id_token profile claims (#1408)
  • (oauth2) Revoke refresh families on lifecycle (#1404)
  • (audit) Align audit schema and vectors (#1389)
  • (audit) Add perimeter completion record (#1388)
  • (audit) Fix initiator and outcome fidelity (#1387)
  • (audit) Audit remaining provider mutations (#1386)
  • (oauth2) Add RFC 7009 token revocation endpoint (#1369)
  • (oauth2) Cap refresh families and revalidate user (#1360)
  • (oauth2-session) Add expired record janitor (#1359)
  • (oauth2) Add secondary indexes to raft driver (#1327)
  • Hot-reload fs per-domain config files (#1225)
  • (adr0034) Reload assignment bundle on config change (#1220)
  • (adr0034) Route assignment ops per domain (#1219)
  • (adr0034) Build per-instance assignment backends (#1218)
  • (adr0034) Gate sources on domain_config (#1217)
  • Resolve local/public ids for non-default backends (#1207)
  • (assignment) Add OpenFGA assignment driver (#1206)
  • (idmapping) Add id-mapping write paths (#1205)
  • (domain-config) Dispatch identity ops per domain (#1202)
  • (domain-config) Add configuration API (#1201)
  • (domain-config) Add resolution layer (#1199)
  • (spiffe) Derive spiffe claims (#1193)
  • Add vendor data JWT API for SPIRE integration (#1192)
  • (core) Reconnect database connection on new config (#1188)
  • (metrics) Add shared Prometheus primitives crate (#1186)
  • Add domain config SQL driver (#1139)
  • (policy) Implement legacy Policy API (/v3/policies) (#1127)
  • Add domain config types and backend trait (#1138)
  • Add SCIM scenarios; Fix findings (#1136)
  • Add cargo-fuzz targets (#1130)
  • Add SPIFFE SVID health check to readiness probe (#1121)
  • Add OS-EP-FILTER provider CRUD to the catalog (#1075)
  • Add per-request cache framework (ADR 0030) (#1114)
  • Auto-register backend drivers via inventory (#1105)
  • Add immutable option for project, domain, role (#1097)
  • (config) Revoke Vault token on shutdown (#1088)
  • (identity) Add trust create/delete and REST CRUD (#1079)
  • (identity) Add PATCH to few resources (#1076)
  • (tempest) Improve tempest testing (#1046)
  • (test) Add tempest identity compatibility (#998)
  • (adr0028) Add local-quorum-bypass emergency rotation (#1032)
  • (adr0026) Add RFC 8628 Device Authorization Grant (#1023)
  • (adr0026) Add previous-key and JTI-revocation janitor (#1021)
  • (adr0026) Phase 6a (#1017)
  • (adr0026) Add Phase 5 offline token verification (#1016)
  • (adr0026) Add authorization code flow with PKCE (#1015)
  • (adr0026) Add client_credentials token endpoint (#1014)
  • (adr0026) Phase 2 client registration & OIDC discovery (#1013)
  • (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
  • (adr0026) Phase 0 token abstraction and JWS driver (#1010)
  • (api) capture client IP via proxy headers & SPIFFE (Start capturing client information in the request processing #358 follow-up) (#908)
  • (identity) Add per-user auth rate limiting (#996)
  • (adr0025) Complete imlpementation (#969)
  • (api) Add global IP rate limiting framework (ADR-0022 phase 1) (#846)
  • (adr0025) Phase 1 (1.1+1.2) (#952)
  • (security) Wrap secrets with secrecy crate (#369) (#912)
  • (scim) ADR 0024 - Phase 5 (#951)
  • (scim) ADR 0024 - Phase 4 (protocol surface completion) (#929)
  • (scim) ADR 0024 - Phase 3 (#928)
  • (scim) ADR 0024 - Phase 1+2 (#925)
  • (credential) Implement Phase 3 of ADR 0019 (#909)
  • (credential) Implement ADR 0019 phases 1-2 (#897)
  • ADR 0021 admin surface, simulate-access, and janitor (#896)
  • Implement stateless SCIM ingress auth (ADR 0021) (#891)
  • (audit) Complete ADR-0023 audit implementation (#887)
  • (storage) Cert validity and SVID TTL enforcement (#886)
  • Audit framework (ADR-0023) phase 3 (#880)
  • (auth) Password hashing parity with Python Keystone (#859)
  • (audit) Implement CADF audit framework Phase 2 (#872)
  • Migrate federation to new mapping engine (#839)
  • Add access rule CRD to appcred provider (#806)
  • ADR-0020 mapping phase 4 (#818)
  • Add bootstrap cli command (#809)
  • (mapping) ADR-0020 (mapping engine) phase 1 (#794)
  • Add endpoint CRUD to catalog provider (#785)
  • Add inter-provider event notification system (#784)
  • Add service CRUD to the catalog provider (#773)
  • Validate password for compliance conformity (#774)
  • Return 401 on roleless scoped contexts (#742)
  • Add region CRUD to catalog SQL driver (#761)
  • Add timing attack protection and failed auth tracking (#758)
  • Add role-imply rest api (#750)
  • Add role imply API (#749)
  • Add user update functionality (#747)
  • Add domain CRUD operations (#743)
  • Add spiffe binding API (#740)
  • Normalize the policy enforcer structure (#741)
  • Make drivers more dynamic (#737)
  • Add Admin interface over the UDS (#735)
  • Add spiffe provider (#733)
  • Expand role info in expand_implied_roles (#730)
  • Introduce SecurityContext (#710)
  • Talk to OPA over unix socket (#701)
  • Add skeleton for the spiffe mTLS integration (#695)
  • Implement ConfigManager for config watching (#691)
  • Improve the code (#686)
  • Add k8s-auth raft driver (#676)
  • Add basic healthcheck endpoint (#671)
  • Make raft storage available through state (#657)

Fixed

  • (oauth2) Keep device backoff tracking at its cap (#1518)
  • (notification) Rework notification implementation (#1506)
  • (oauth2) Clear logout relying parties atomically (#1496)
  • (oauth2) Pin issuer to public_endpoint (#1436)
  • (oauth2) Check client on device grant redeem (#1435)
  • (audit) Polish the CADF crate (#1424)
  • (audit) Keep request context in WASM host calls (#1414)
  • (audit) Record variant names as reasons (#1384)
  • (oauth2) Check refresh token owner bef

@github-actions

github-actions Bot commented Oct 13, 2026 •

Copy link
Copy Markdown

🦢 Load Test Results

Goose Attack Report

Plan Overview

Action Started Stopped Elapsed Users
Increasing 26-10-16 18:18:24 26-10-16 18:18:46 00:00:22 0 → 45
Maintaining 26-10-16 18:18:46 26-10-16 18:19:17 00:00:31 45
Decreasing 26-10-16 18:19:17 26-10-16 18:19:17 00:00:00 0 ← 45

Request Metrics

Method Name # Requests # Fails Average (ms) Min (ms) Max (ms) RPS Failures/s
DELETE DELETE /v3/auth/tokens 54 0 449.26 225 609 1.80 0.00
DELETE DELETE /v3/projects/:id (teardown) 1 0 289.00 289 289 0.03 0.00
DELETE DELETE /v3/roles/:id (teardown) 1 0 191.00 191 191 0.03 0.00
DELETE DELETE /v3/users/:id (teardown) 2 0 308.00 263 353 0.07 0.00
DELETE DELETE /v4/mappings/rulesets/:mapping_id (cc teardown) 1 0 345.00 345 345 0.03 0.00
DELETE DELETE /v4/mappings/rulesets/:mapping_id (teardown) 1 0 371.00 371 371 0.03 0.00
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (cc teardown) 1 0 221.00 221 221 0.03 0.00
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown) 1 0 515.00 515 515 0.03 0.00
GET 591 0 491.82 315 730 19.70 0.00
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 45 31 366.38 2 988 1.50 1.03
GET GET /v3/auth/tokens (validate new) 54 0 456.19 319 661 1.80 0.00
GET GET /v3/auth/tokens (validate revoked) 54 0 394.20 28 590 1.80 0.00
GET GET /v3/projects/:id 66 0 459.06 297 666 2.20 0.00
GET GET /v3/projects/:id (catalog) 102 0 453.30 284 660 3.40 0.00
GET GET /v3/role_assignments 53 0 457.60 320 596 1.77 0.00
GET GET /v3/role_assignments?role.id 51 0 439.65 289 653 1.70 0.00
GET GET /v3/role_assignments?scope.domain.id 51 0 432.16 316 557 1.70 0.00
GET GET /v3/role_assignments?user.id 52 0 426.29 292 561 1.73 0.00
GET GET /v3/roles 134 0 454.58 316 746 4.47 0.00
GET GET /v3/roles/:id 68 0 446.44 296 597 2.27 0.00
GET GET /v3/users/:id 125 0 485.16 354 706 4.17 0.00
GET GET /v3/users/:id (catalog) 126 0 478.87 329 617 4.20 0.00
GET GET /v4/api-keys 29 0 469.59 383 611 0.97 0.00
GET GET /v4/api-keys/:client_id 30 0 570.47 423 710 1.00 0.00
GET GET /v4/mappings/rulesets 31 0 477.29 347 638 1.03 0.00
GET GET /v4/mappings/rulesets/:mapping_id 31 0 498.68 317 667 1.03 0.00
GET GET /v4/oauth2/:domain_id/.well-known/openid-configuration 489 0 91.44 15 188 16.30 0.00
GET GET /v4/oauth2/:domain_id/clients 32 0 475.81 354 569 1.07 0.00
GET GET /v4/oauth2/:domain_id/clients/:provider_id 32 0 470.72 344 599 1.07 0.00
GET GET /v4/oauth2/:domain_id/jwks 490 0 92.59 15 219 16.33 0.00
GET GET /v4/scim_realms 20 0 473.45 347 650 0.67 0.00
GET GET /v4/scim_realms/:domain_id/:provider_id 20 0 464.00 359 545 0.67 0.00
POST POST /v3/auth/tokens 52 0 427.25 298 566 1.73 0.00
POST POST /v3/auth/tokens (password, invalid) 36 0 851.61 466 1226 1.20 0.00
POST POST /v3/auth/tokens (password, project-scoped) 60 0 1136.78 763 1540 2.00 0.00
POST POST /v3/auth/tokens (password, unscoped) 57 0 976.91 444 1762 1.90 0.00
POST POST /v3/auth/tokens (rescope to system) 118 0 515.26 374 745 3.93 0.00
POST POST /v3/auth/tokens (rescope, invalid project) 72 0 424.15 273 583 2.40 0.00
POST POST /v3/auth/tokens (system-scoped, bootstrap admin) 56 0 1111.80 591 1981 1.87 0.00
POST POST /v4/api-keys/:client_id/revoke (teardown) 1 0 401.00 401 401 0.03 0.00
POST POST /v4/oauth2/:domain_id/device_authorization 138 0 218.21 61 371 4.60 0.00
POST POST /v4/oauth2/:domain_id/token (client_credentials) 12 0 1150.33 794 1427 0.40 0.00
PUT PUT /v4/scim_realms/:domain_id/:provider_id 20 0 585.60 400 714 0.67 0.00
Aggregated 3460 31 389.03 2 1981 115.33 1.03

Response Time Metrics

Method Name 50%ile (ms) 60%ile (ms) 70%ile (ms) 80%ile (ms) 90%ile (ms) 95%ile (ms) 99%ile (ms) 100%ile (ms)
DELETE DELETE /v3/auth/tokens 450 460 490 500 500 600 600 600
DELETE DELETE /v3/projects/:id (teardown) 289 289 289 289 289 289 289 289
DELETE DELETE /v3/roles/:id (teardown) 191 191 191 191 191 191 191 191
DELETE DELETE /v3/users/:id (teardown) 263 263 263 350 350 350 350 350
DELETE DELETE /v4/mappings/rulesets/:mapping_id (cc teardown) 345 345 345 345 345 345 345 345
DELETE DELETE /v4/mappings/rulesets/:mapping_id (teardown) 371 371 371 371 371 371 371 371
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (cc teardown) 221 221 221 221 221 221 221 221
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown) 515 515 515 515 515 515 515 515
GET 480 500 500 600 600 600 700 700
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 400 450 600 600 700 800 988 988
GET GET /v3/auth/tokens (validate new) 450 450 480 500 500 600 600 661
GET GET /v3/auth/tokens (validate revoked) 390 400 430 460 500 500 590 590
GET GET /v3/projects/:id 450 470 490 500 600 600 600 666
GET GET /v3/projects/:id (catalog) 440 460 480 500 500 600 600 660
GET GET /v3/role_assignments 450 470 500 500 500 596 596 596
GET GET /v3/role_assignments?role.id 420 450 480 500 500 500 600 653
GET GET /v3/role_assignments?scope.domain.id 420 450 460 500 500 500 500 557
GET GET /v3/role_assignments?user.id 420 440 460 500 500 500 500 561
GET GET /v3/roles 450 460 480 500 500 600 600 700
GET GET /v3/roles/:id 430 450 470 500 500 597 597 597
GET GET /v3/users/:id 480 500 500 500 600 600 600 700
GET GET /v3/users/:id (catalog) 480 500 500 500 600 600 600 600
GET GET /v4/api-keys 440 460 500 500 600 600 600 600
GET GET /v4/api-keys/:client_id 600 600 600 600 600 700 700 700
GET GET /v4/mappings/rulesets 480 490 500 500 600 600 600 600
GET GET /v4/mappings/rulesets/:mapping_id 490 500 500 600 600 600 667 667
GET GET /v4/oauth2/:domain_id/.well-known/openid-configuration 92 100 110 120 140 150 170 188
GET GET /v4/oauth2/:domain_id/clients 480 500 500 500 500 500 569 569
GET GET /v4/oauth2/:domain_id/clients/:provider_id 470 490 500 500 500 599 599 599
GET GET /v4/oauth2/:domain_id/jwks 92 100 110 120 140 160 180 219
GET GET /v4/scim_realms 450 470 500 500 500 600 650 650
GET GET /v4/scim_realms/:domain_id/:provider_id 470 490 500 500 500 500 500 500
POST POST /v3/auth/tokens 410 430 440 490 500 566 566 566
POST POST /v3/auth/tokens (password, invalid) 800 900 1,000 1,000 1,000 1,000 1,000 1,000
POST POST /v3/auth/tokens (password, project-scoped) 1,000 1,000 1,000 1,000 1,000 1,540 1,540 1,540
POST POST /v3/auth/tokens (password, unscoped) 900 1,000 1,000 1,000 1,000 1,000 1,000 1,762
POST POST /v3/auth/tokens (rescope to system) 500 500 600 600 600 600 700 700
POST POST /v3/auth/tokens (rescope, invalid project) 420 440 460 480 500 500 583 583
POST POST /v3/auth/tokens (system-scoped, bootstrap admin) 1,000 1,000 1,000 1,000 1,000 1,981 1,981 1,981
POST POST /v4/api-keys/:client_id/revoke (teardown) 401 401 401 401 401 401 401 401
POST POST /v4/oauth2/:domain_id/device_authorization 220 230 250 260 290 320 360 370
POST POST /v4/oauth2/:domain_id/token (client_credentials) 1,000 1,000 1,000 1,000 1,000 1,000 1,000 1,000
PUT PUT /v4/scim_realms/:domain_id/:provider_id 600 600 600 600 700 700 700 700
Aggregated 420 460 490 500 600 800 1,000 1,981

Status Code Metrics

Method Name Status Codes
DELETE DELETE /v3/auth/tokens 54 [204]
DELETE DELETE /v3/projects/:id (teardown) 1 [204]
DELETE DELETE /v3/roles/:id (teardown) 1 [204]
DELETE DELETE /v3/users/:id (teardown) 2 [204]
DELETE DELETE /v4/mappings/rulesets/:mapping_id (cc teardown) 1 [204]
DELETE DELETE /v4/mappings/rulesets/:mapping_id (teardown) 1 [204]
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (cc teardown) 1 [204]
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown) 1 [204]
GET 591 [200]
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 31 [401], 14 [429]
GET GET /v3/auth/tokens (validate new) 54 [200]
GET GET /v3/auth/tokens (validate revoked) 54 [404]
GET GET /v3/projects/:id 66 [200]
GET GET /v3/projects/:id (catalog) 102 [200]
GET GET /v3/role_assignments 53 [200]
GET GET /v3/role_assignments?role.id 51 [200]
GET GET /v3/role_assignments?scope.domain.id 51 [200]
GET GET /v3/role_assignments?user.id 52 [200]
GET GET /v3/roles 134 [200]
GET GET /v3/roles/:id 68 [200]
GET GET /v3/users/:id 125 [200]
GET GET /v3/users/:id (catalog) 126 [200]
GET GET /v4/api-keys 29 [200]
GET GET /v4/api-keys/:client_id 30 [200]
GET GET /v4/mappings/rulesets 31 [200]
GET GET /v4/mappings/rulesets/:mapping_id 31 [200]
GET GET /v4/oauth2/:domain_id/.well-known/openid-configuration 489 [200]
GET GET /v4/oauth2/:domain_id/clients 32 [200]
GET GET /v4/oauth2/:domain_id/clients/:provider_id 32 [200]
GET GET /v4/oauth2/:domain_id/jwks 490 [200]
GET GET /v4/scim_realms 20 [200]
GET GET /v4/scim_realms/:domain_id/:provider_id 20 [200]
POST POST /v3/auth/tokens 52 [201]
POST POST /v3/auth/tokens (password, invalid) 36 [401]
POST POST /v3/auth/tokens (password, project-scoped) 60 [201]
POST POST /v3/auth/tokens (password, unscoped) 57 [201]
POST POST /v3/auth/tokens (rescope to system) 118 [201]
POST POST /v3/auth/tokens (rescope, invalid project) 72 [401]
POST POST /v3/auth/tokens (system-scoped, bootstrap admin) 56 [201]
POST POST /v4/api-keys/:client_id/revoke (teardown) 1 [200]
POST POST /v4/oauth2/:domain_id/device_authorization 138 [200]
POST POST /v4/oauth2/:domain_id/token (client_credentials) 12 [200]
PUT PUT /v4/scim_realms/:domain_id/:provider_id 20 [200]
Aggregated 2,848 [200], 54 [404], 139 [401], 343 [201], 62 [204], 14 [429]

Transaction Metrics

Transaction # Times Run # Fails Average (ms) Min (ms) Max (ms) RPS Failures/s
ReadHeavy
0.0 0 0 0.00 0 0 0.00 0.00
0.1 84 0 532.50 391 692 2.80 0.00
0.2 84 0 456.68 339 604 2.80 0.00
0.3 86 0 454.88 315 619 2.87 0.00
TokenLifecycle
1.0 0 0 0.00 0 0 0.00 0.00
1.1 54 0 1728.39 1023 1964 1.80 0.00
ValidateToken
2.0 0 0 0.00 0 0 0.00 0.00
2.1 112 0 543.92 380 730 3.73 0.00
UserCRUD
3.0 0 0 0.00 0 0 0.00 0.00
3.1 0 0 0.00 0 0 0.00 0.00
3.2 125 0 485.19 354 706 4.17 0.00
3.3 2 0 308.00 263 353 0.07 0.00
ProjectCRUD
4.0 0 0 0.00 0 0 0.00 0.00
4.1 0 0 0.00 0 0 0.00 0.00
4.2 66 0 459.06 297 666 2.20 0.00
4.3 1 0 289.00 289 289 0.03 0.00
RoleCRUD
5.0 0 0 0.00 0 0 0.00 0.00
5.1 0 0 0.00 0 0 0.00 0.00
5.2 68 0 446.49 297 597 2.27 0.00
5.3 1 0 191.00 191 191 0.03 0.00
RoleList
6.0 0 0 0.00 0 0 0.00 0.00
6.1 134 0 454.62 316 746 4.47 0.00
RoleAssignmentList
7.0 0 0 0.00 0 0 0.00 0.00
7.1 53 0 457.70 320 596 1.77 0.00
7.2 52 0 426.35 292 561 1.73 0.00
7.3 51 0 432.16 316 557 1.70 0.00
7.4 51 0 439.67 289 653 1.70 0.00
UserRead
8.0 0 0 0.00 0 0 0.00 0.00
8.1 125 0 496.04 333 637 4.17 0.00
8.2 126 0 478.88 329 617 4.20 0.00
ProjectRead
9.0 0 0 0.00 0 0 0.00 0.00
9.1 100 0 455.54 326 650 3.33 0.00
9.2 102 0 453.38 284 660 3.40 0.00
PasswordAuth
10.0 57 0 976.95 445 1762 1.90 0.00
10.1 60 0 1136.87 763 1540 2.00 0.00
PasswordAuthNegative
11.0 36 0 851.67 466 1226 1.20 0.00
Rescope
12.0 0 0 0.00 0 0 0.00 0.00
12.1 118 0 515.30 374 745 3.93 0.00
RescopeNegative
13.0 0 0 0.00 0 0 0.00 0.00
13.1 72 0 424.17 273 583 2.40 0.00
SystemScopeAuth
14.0 56 0 1111.84 591 1981 1.87 0.00
ApiKeyCRUD
15.0 0 0 0.00 0 0 0.00 0.00
15.1 0 0 0.00 0 0 0.00 0.00
15.2 30 0 570.53 423 710 1.00 0.00
15.3 29 0 469.59 383 611 0.97 0.00
15.4 1 0 401.00 401 401 0.03 0.00
MappingCRUD
16.0 0 0 0.00 0 0 0.00 0.00
16.1 0 0 0.00 0 0 0.00 0.00
16.2 31 0 498.71 317 667 1.03 0.00
16.3 31 0 477.32 347 638 1.03 0.00
16.4 1 0 371.00 371 371 0.03 0.00
OAuth2ClientCRUD
17.0 0 0 0.00 0 0 0.00 0.00
17.1 0 0 0.00 0 0 0.00 0.00
17.2 32 0 470.75 344 599 1.07 0.00
17.3 32 0 475.81 354 569 1.07 0.00
17.4 1 0 515.00 515 515 0.03 0.00
OAuth2ClientCredentials
18.0 0 0 0.00 0 0 0.00 0.00
18.1 0 0 0.00 0 0 0.00 0.00
18.2 12 0 1150.33 794 1427 0.40 0.00
18.3 1 0 566.00 566 566 0.03 0.00
OAuth2DeviceAuthorization
19.0 138 0 218.23 61 371 4.60 0.00
OAuth2Discovery
20.0 490 0 92.61 15 219 16.33 0.00
20.1 489 0 91.46 15 188 16.30 0.00
ScimRealmRead
21.0 0 0 0.00 0 0 0.00 0.00
21.1 20 0 464.00 359 545 0.67 0.00
21.2 20 0 473.45 347 650 0.67 0.00
21.3 20 0 585.65 400 714 0.67 0.00
ScimSync
22.0 0 0 0.00 0 0 0.00 0.00
22.1 0 0 0.00 0 0 0.00 0.00
22.2 0 0 0.00 0 0 0.00 0.00
22.3 45 0 677.84 245 1018 1.50 0.00
22.4 44 0 0.00 0 0 1.47 0.00
22.5 44 0 0.00 0 0 1.47 0.00
22.6 1 0 0.00 0 0 0.03 0.00
Aggregated 3388 0 397.30 15 1981 112.93 0.00

Scenario Metrics

Transaction # Users # Times Run Average (ms) Min (ms) Max (ms) Scenarios/s Iterations
ReadHeavy 4 83 1446.98 1206 1799 2.77 20.75
TokenLifecycle 3 51 1753.39 1546 1964 1.70 17.00
ValidateToken 2 110 543.65 380 730 3.67 55.00
UserCRUD 2 123 485.67 354 706 4.10 61.50
ProjectCRUD 1 65 459.43 297 666 2.17 65.00
RoleCRUD 1 67 446.48 297 597 2.23 67.00
RoleList 2 132 455.06 316 746 4.40 66.00
RoleAssignmentList 3 51 1762.61 1511 2003 1.70 17.00
UserRead 4 123 980.09 767 1171 4.10 30.75
ProjectRead 3 100 912.71 761 1119 3.33 33.33
PasswordAuth 4 57 2118.46 1419 3008 1.90 14.25
PasswordAuthNegative 1 35 848.31 466 1226 1.17 35.00
Rescope 2 116 516.34 374 745 3.87 58.00
RescopeNegative 1 71 424.77 273 583 2.37 71.00
SystemScopeAuth 2 54 1122.59 591 1981 1.80 27.00
ApiKeyCRUD 1 29 1039.93 896 1199 0.97 29.00
MappingCRUD 1 31 975.58 664 1207 1.03 31.00
OAuth2ClientCRUD 1 32 950.09 801 1100 1.07 32.00
OAuth2ClientCredentials 1 11 2698.64 1967 3165 0.37 11.00
OAuth2DeviceAuthorization 1 137 217.36 61 371 4.57 137.00
OAuth2Discovery 3 488 184.43 34 326 16.27 162.67
ScimRealmRead 1 20 1522.90 1248 1731 0.67 20.00
ScimSync 1 44 684.23 245 1018 1.47 44.00
Aggregated 45 2030 666.29 34 3165 67.67 1105.25

Error Metrics

Method Name # Error
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 49 401 Unauthorized: GET /SCIM/v2/:domain_id/Users (sync reconcile list)
POST POST /SCIM/v2/:domain_id/Users (sync provision) 1 401 Unauthorized: POST /SCIM/v2/:domain_id/Users (sync provision)
POST POST /v3/auth/tokens (password, invalid) 84 401 Unauthorized: POST /v3/auth/tokens (password, invalid)
POST POST /v3/auth/tokens (rescope, invalid project) 182 401 Unauthorized: POST /v3/auth/tokens (rescope, invalid project)
GET GET /v3/auth/tokens (validate revoked) 192 404 Not Found: GET /v3/auth/tokens (validate revoked)
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 32 429 Too Many Requests: GET /SCIM/v2/:domain_id/Users (sync reconcile list)

View full report

@github-actions

github-actions Bot commented Oct 13, 2026 •

Copy link
Copy Markdown

🧪 Tempest Identity Compatibility Results (advisory, non-blocking)

rust

Totals
======
Ran: 130 tests in 42.3806 sec.
 - Passed: 71
 - Skipped: 4
 - Expected Fail: 0
 - Unexpected Success: 0
 - Failed: 55
Sum of execute time for each test: 39.7830 sec.
Failed test IDs
===== FAILED TESTS (target=rust) =====
tempest.api.identity.admin.v3.test_credentials.CredentialsTestJSON.test_credentials_create_get_update_delete[id-7cd59bf9-bda4-4c72-9467-d21cab278355,smoke]
tempest.api.identity.admin.v3.test_default_project_id.TestDefaultProjectId.test_default_project_id[id-d6110661-6a71-49a7-a453-b5e26640ff6d]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_create_domain_config_and_show_config_groups_and_options[id-9e3ff13c-f597-4f01-9377-d6c06c2a1477]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_create_update_and_delete_domain_config_groups_and_opts[id-c7510fa2-6661-4170-9c6b-4783a80651e9]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_show_default_group_config_and_options[id-11a02bf0-6f94-4380-b3b0-c8dc18fc0d22]
tempest.api.identity.admin.v3.test_list_projects.ListProjectsTestJSON.test_list_projects_with_parent[id-6edc66f5-2941-4a17-9526-4073311c1fac]
tempest.api.identity.admin.v3.test_domains_negative.DomainsNegativeTestJSON.test_create_domain_with_empty_name[id-9018461d-7d24-408d-b3fe-ae37e8cd5c9e,negative]
setUpClass (tempest.api.identity.admin.v3.test_endpoint_groups.EndPointGroupsTest)
tempest.api.identity.admin.v3.test_domains_negative.DomainsNegativeTestJSON.test_create_domain_with_name_length_over_64[id-37b1bbf2-d664-4785-9a11-333438586eae,negative]
tempest.api.identity.admin.v3.test_domains_negative.DomainsNegativeTestJSON.test_delete_active_domain[gate,id-1f3fbff5-4e44-400d-9ca1-d953f05f609b,negative]
tempest.api.identity.admin.v3.test_domains_negative.DomainsNegativeTestJSON.test_delete_non_existent_domain[id-43781c07-764f-4cf2-a405-953c1916f605,negative]
tempest.api.identity.admin.v3.test_domains_negative.DomainsNegativeTestJSON.test_domain_create_duplicate[id-e6f9e4a2-4f36-4be8-bdbc-4e199ae29427,negative]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_check_revoke_roles_on_projects_group[id-26021436-d5a4-4256-943c-ded01e0d4b45]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_check_revoke_roles_on_projects_user[id-18b70e45-7687-4b72-8277-b8f1a47d7591]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_check_revoke_roles_on_domains_group[id-c7a8dda2-be50-4fb4-9a9c-e830771078b1]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_check_revoke_roles_on_domains_user[id-4e6f0366-97c8-423c-b2be-41eae6ac91c8]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_revoke_user_roles_on_domain[id-3acf666e-5354-42ac-8e17-8b68893bcd36]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_revoke_user_roles_on_project_tree[id-9f02ccd9-9b57-46b4-8f77-dd5a736f3a06]
tempest.api.identity.admin.v3.test_groups.GroupsV3TestJSON.test_group_users_add_list_delete[id-1598521a-2f36-4606-8df9-30772bd51339,smoke]
tempest.api.identity.admin.v3.test_groups.GroupsV3TestJSON.test_list_user_groups[id-64573281-d26a-4a52-b899-503cb0f4e4ec]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_create_and_show_consumer[id-c8307ea6-a86c-47fd-ae7b-5b3b2caca76d]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_delete_consumer[id-fdfa1b7f-2a31-4354-b2c7-f6ae20554f93]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_list_consumers[id-09ca50de-78f2-4ffb-ac71-f2254036b2b8]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_update_consumer[id-080a9b1a-c009-47c0-9979-5305bf72e3dc]
tempest.api.identity.admin.v3.test_project_tags.IdentityV3ProjectTagsTest.test_list_update_delete_project_tags[id-7c123aac-999d-416a-a0fb-84b915ab10de]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_assignments_for_domain_roles[id-3859df7e-5b78-4e4d-b10e-214c8953842a]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_assignments_for_implied_roles_create_delete[id-c8828027-df48-4021-95df-b65b92c7429e]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_group_on_domain[id-4bf8a70b-e785-413a-ad53-9f91ce02faa7]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_group_on_project[id-cbf11737-1904-4690-9613-97bcbb3df1c4]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_user_on_domain[id-6c9a2940-3625-43a3-ac02-5dcec62ef3bd]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_implied_domain_roles[id-eb1e1c24-1bc4-4d47-9748-e127a1852c82]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_implied_roles_create_check_show_delete[id-c90c316c-d706-4728-bcba-eb1912081b69]
tempest.api.identity.admin.v3.test_projects.ProjectsTestJSON.test_create_is_domain_project[id-a7eb9416-6f9b-4dbb-b71b-7f73aaef59d5]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_role_create_update_show_list[id-18afc6c0-46cf-4911-824e-9989cc056c3a,smoke]
tempest.api.identity.admin.v3.test_projects.ProjectsTestJSON.test_project_create_with_parent[id-1854f9c0-70bc-4d11-a08a-1c789d339e3d]
tempest.api.identity.admin.v3.test_users_negative.UsersNegativeTest.test_create_user_for_non_existent_domain[id-e75f006c-89cc-477b-874d-588e4eab4b17,negative]
tempest.api.identity.admin.v3.test_tokens.TokensV3TestJSON.test_get_available_domain_scopes[id-ec5ecb05-af64-4c04-ac86-4d9f6f12f185]
tempest.api.identity.admin.v3.test_tokens.TokensV3TestJSON.test_rescope_token[id-565fa210-1da1-4563-999b-f7b5b67cf112]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_get_trusts_all[id-4773ebd5-ecbf-4255-b8d8-b63e6f72b65d,smoke]
tempest.api.identity.v3.test_tokens.TokensV3Test.test_validate_token[id-a9512ac3-3909-48a4-b395-11f438e16260]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_api_media_types[id-657c1970-4722-4189-8831-7325f3bc4265,smoke]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_api_version_resources[id-b9232f5e-d9e5-4d97-b96c-28d3db4de1bd,smoke]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_identity_v3_existence[id-79aec9ae-710f-4c54-a4fc-3aa25b4feac3]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_list_api_versions[id-721f480f-35b6-46c7-846e-047e6acea0dc,smoke]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_get_trusts_query[id-6268b345-87ca-47c0-9ce3-37792b43403a]
tempest.api.identity.v3.test_catalog.IdentityCatalogTest.test_catalog_standardization[id-56b57ced-22b8-4127-9b8a-565dfb0207e2]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_expire[id-0ed14b66-cefd-4b5c-a964-65759453e292]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_impersonate[id-5a0a91a4-baef-4a14-baba-59bf4d7fcace]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_noimpersonate[id-ed2a8779-a7ac-49dc-afd7-30f32f936ed2]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_create_application_credential[id-8080c75c-eddc-4786-941a-c2da7039ae61]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_create_application_credential_expires[id-852daf0c-42b5-4239-8466-d193d0543ed3]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_list_application_credentials[id-ff0cd457-6224-46e7-b79e-0ada4964a8a6]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_query_application_credentials[id-9bb5e5cc-5250-493a-8869-8b665f6aa5f6]
setUpClass (tempest.api.identity.v3.test_domains.DefaultDomainTestJSON)
setUpClass (tempest.api.identity.v3.test_ec2_credentials.EC2CredentialsTest)
===== END FAILED TESTS (target=rust) =====

View full run

@github-actions

github-actions Bot commented Oct 13, 2026 •

Copy link
Copy Markdown

🐰 Bencher Report

Projectkeystone
Branchrelease-plz-2026-10-13T05-56-00Z
Testbedubuntu-latest
Click to view all benchmark results
BenchmarkLatencyBenchmark Result
nanoseconds (ns)
(Result Δ%)
Upper Boundary
nanoseconds (ns)
(Limit %)
Command_Serde/apply/remove📈 view plot
🚷 view threshold
130,510.00 ns
(-4.13%)Baseline: 136,136.75 ns
262,212.75 ns
(49.77%)
Command_Serde/apply/set📈 view plot
🚷 view threshold
139,620.00 ns
(-3.56%)Baseline: 144,767.11 ns
254,328.92 ns
(54.90%)
Command_Serde/pack/delete📈 view plot
🚷 view threshold
129.19 ns
(+10.16%)Baseline: 117.27 ns
166.63 ns
(77.53%)
Command_Serde/pack/delete_index📈 view plot
🚷 view threshold
116.85 ns
(+10.79%)Baseline: 105.47 ns
145.94 ns
(80.07%)
Command_Serde/pack/set📈 view plot
🚷 view threshold
210.71 ns
(+11.29%)Baseline: 189.33 ns
272.55 ns
(77.31%)
Command_Serde/pack/set_index📈 view plot
🚷 view threshold
117.23 ns
(+10.57%)Baseline: 106.02 ns
148.38 ns
(79.01%)
Command_Serde/unpack/delete📈 view plot
🚷 view threshold
168.25 ns
(+16.36%)Baseline: 144.59 ns
213.72 ns
(78.73%)
Command_Serde/unpack/delete_index📈 view plot
🚷 view threshold
139.07 ns
(+12.97%)Baseline: 123.10 ns
182.46 ns
(76.22%)
Command_Serde/unpack/set📈 view plot
🚷 view threshold
271.69 ns
(+19.99%)Baseline: 226.42 ns
345.11 ns
(78.72%)
Command_Serde/unpack/set_index📈 view plot
🚷 view threshold
140.13 ns
(+14.47%)Baseline: 122.42 ns
180.87 ns
(77.47%)
Payload_encryption/pack/remove_cmd📈 view plot
🚷 view threshold
124.63 ns
(+13.81%)Baseline: 109.51 ns
162.68 ns
(76.61%)
Payload_encryption/pack/set_cmd📈 view plot
🚷 view threshold
269.56 ns
(+35.43%)Baseline: 199.04 ns
303.28 ns
(88.88%)
Payload_encryption/unpack/remove_cmd📈 view plot
🚷 view threshold
174.41 ns
(+18.52%)Baseline: 147.16 ns
216.12 ns
(80.70%)
Payload_encryption/unpack/set_cmd📈 view plot
🚷 view threshold
297.20 ns
(+28.43%)Baseline: 231.42 ns
351.14 ns
(84.64%)
Raft_1Node_Latency/prefix/1node📈 view plot
🚷 view threshold
2,896,500.00 ns
(-21.32%)Baseline: 3,681,359.53 ns
8,750,233.74 ns
(33.10%)
Raft_1Node_Latency/read/1node📈 view plot
🚷 view threshold
42,852.00 ns
(+23.42%)Baseline: 34,720.00 ns
51,133.42 ns
(83.80%)
Raft_1Node_Latency/remove/1node📈 view plot
🚷 view threshold
353,070.00 ns
(+1.00%)Baseline: 349,573.59 ns
575,201.49 ns
(61.38%)
Raft_1Node_Latency/write/1node📈 view plot
🚷 view threshold
374,300.00 ns
(-2.70%)Baseline: 384,687.97 ns
750,242.57 ns
(49.89%)
build_snapshot/default📈 view plot
🚷 view threshold
2,137.30 ns
(+0.61%)Baseline: 2,124.25 ns
2,866.83 ns
(74.55%)
fernet token/project📈 view plot
🚷 view threshold
1,417.90 ns
(+9.45%)Baseline: 1,295.50 ns
1,774.88 ns
(79.89%)
get_data_keyspace📈 view plot
🚷 view threshold
0.32 ns
(+5.72%)Baseline: 0.30 ns
0.38 ns
(82.00%)
get_db📈 view plot
🚷 view threshold
0.32 ns
(+7.53%)Baseline: 0.30 ns
0.38 ns
(83.37%)
get_fernet_token_timestamp/project📈 view plot
🚷 view threshold
153.27 ns
(+15.02%)Baseline: 133.25 ns
183.07 ns
(83.72%)
get_keyspace📈 view plot
🚷 view threshold
4.21 ns
(-39.97%)Baseline: 7.02 ns
16.43 ns
(25.65%)
🐰 View full continuous benchmarking report in Bencher

@openstack-experimental-release-plz
openstack-experimental-release-plz Bot force-pushed the release-plz-2026-10-13T05-56-00Z branch 24 times, most recently from 88cf207 to 522b559 Compare October 16, 2026 13:55
@openstack-experimental-release-plz
openstack-experimental-release-plz Bot force-pushed the release-plz-2026-10-13T05-56-00Z branch from 522b559 to 85879b7 Compare October 16, 2026 17:41

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants