chore: release by openstack-experimental-release-plz[bot] · Pull Request #754 · openstack-experimental/keystone

openstack-experimental-release-plz · 2026-06-05T09:00:24Z

🤖 New release

oslo-config: 0.1.0
openstack-keystone-telemetry: 0.1.0
cadf: 0.1.0
openstack-keystone-config: 0.1.0
openstack-keystone-core-types: 0.1.1
openstack-keystone-api-types: 0.1.0 -> 0.1.1 (✓ API compatible changes)
openstack-keystone-auth-plugin-core: 0.1.0
openstack-keystone-key-repository: 0.1.0
openstack-keystone-local-emergency-store: 0.1.0
openstack-keystone-storage-api: 0.1.0
openstack-keystone-core: 0.1.1 -> 0.1.2 (✓ API compatible changes)
openstack-keystone-storage-crypto: 0.1.0
openstack-keystone-storage-crypto-pkcs11: 0.1.0
openstack-keystone-storage-crypto-tpm: 0.1.0
openstack-keystone-distributed-storage: 0.1.0 -> 0.1.1 (✓ API compatible changes)
openstack-keystone-api-key-driver-raft: 0.1.0
openstack-keystone-auth-plugin-runtime: 0.1.0
openstack-keystone-password-hashing: 0.1.0
openstack-keystone-appcred-driver-sql: 0.1.0
openstack-keystone-assignment-driver-sql: 0.1.0
openstack-keystone-assignment-driver-openfga: 0.1.0
openstack-keystone-catalog-driver-sql: 0.1.0
openstack-keystone-credential-driver-sql: 0.1.0
openstack-keystone-auth-plugin-identity-driver-raft: 0.1.0
openstack-keystone-domain-config-driver-fs: 0.1.0
openstack-keystone-domain-config-driver-sql: 0.1.0
openstack-keystone-federation-driver-sql: 0.1.0
openstack-keystone-identity-driver-ldap: 0.1.0
openstack-keystone-identity-driver-sql: 0.1.0
openstack-keystone-idmapping-driver-sql: 0.1.0
openstack-keystone-k8s-auth-driver-raft: 0.1.0
openstack-keystone-k8s-auth-driver-sql: 0.1.0
openstack-keystone-limit-driver-sql: 0.1.0
openstack-keystone-mapping-driver-raft: 0.1.0
openstack-keystone-oauth2-client-driver-raft: 0.1.0
openstack-keystone-oauth2-key-driver-raft: 0.1.0
openstack-keystone-oauth2-session-driver-raft: 0.1.0
openstack-keystone-policy-store-driver-sql: 0.1.0
openstack-keystone-resource-driver-sql: 0.1.0
openstack-keystone-revoke-driver-sql: 0.1.0
openstack-keystone-role-driver-sql: 0.1.0
openstack-keystone-scim-driver-raft: 0.1.0
openstack-keystone-token-driver-fernet: 0.1.1
openstack-keystone-token-driver-jws: 0.1.0
openstack-keystone-token-restriction-driver-sql: 0.1.0
openstack-keystone-trust-driver-sql: 0.1.0
openstack-keystone-webauthn: 0.1.0
openstack-keystone: 0.1.1 -> 0.1.2 (✓ API compatible changes)
openstack-keystone-cli-manage: 0.1.0

Changelog

`oslo-config`

0.1.0 - 2026-10-11

Added

Enable OpenTelemetry metrics and traces support (#1456)

(oslo.config) Generalize oslo-config crate (#1429)

`openstack-keystone-telemetry`

0.1.0 - 2026-10-11

Added

Enable OpenTelemetry metrics and traces support (#1456)

`cadf`

0.1.0 - 2026-10-11

Added

Enable OpenTelemetry metrics and traces support (#1456)

(cadf) Use DSP0262 names on the wire (#1419)

(audit) Add opt-in per-request perimeter record (#1415)

Fixed

(oauth2) Check client on device grant redeem (#1435)

(audit) Polish the CADF crate (#1424)

Other

(audit) Assert live audit spool records (#1422)

(audit) Cover startup seal, quarantine, hooks (#1410)

(cadf) Move audit startup into runtime (#1406)

(cadf) Own the audit configuration (#1405)

(cadf) Parameterize the service identity (#1400)

(audit) Rename audit crate to cadf (#1399)

`openstack-keystone-config`

0.1.0 - 2026-10-11

Added

(oauth2) Harden SSO sessions (#1490)

(oauth2) Add SSO session and RP logout (#1475)

(oauth2) Add TOTP second factor to OP login (#1473)

(oauth2) Add client display metadata (#1472)

(oauth2) Brand and localize the login pages (#1471)

(oauth2) Add operator login page templates (#1470)

(oslo.config) Generalize oslo-config crate (#1429)

(limit) Add unified limits (#1407)

(audit) Add HMAC key rotation and node checks (#1382)

(audit) Add an RFC 5424 syslog sink (#1381)

(audit) Make channel and spool limits configurable (#1380)

(audit) Add an enabled switch (#1379)

(audit) Ship sealed spool segments to a sink (#1374)

(oauth2) Cap refresh families and revalidate user (#1360)

(oauth2-session) Add expired record janitor (#1359)

(raft) Add backup restore (#1352)

(devstack) Pilot ksm SPIFFE mTLS transport (#1239)

Hot-reload fs per-domain config files (#1225)

(adr0034) Route assignment ops per domain (#1219)

(adr0034) Add per-domain driver config surface (#1216)

(assignment) Add OpenFGA assignment driver (#1206)

(domain-config) Add resolution layer (#1199)

(domain-config) Add filesystem driver (#1197)

(spiffe) Derive spiffe claims (#1193)

Add vendor data JWT API for SPIRE integration (#1192)

(core) Reconnect database connection on new config (#1188)

(policy) Implement legacy Policy API (/v3/policies) (#1127)

Add domain config types and backend trait (#1138)

(adr0031) Add HTTP request metrics (#1134)

(config) Support configurable log file rotation (#1128)

Add connection_debug to tune SQL query logging (#1109)

(pagination) Add pagination to remaining places (#1106)

(config) Revoke Vault token on shutdown (#1088)

Generalize marker pagination for v3/v4 lists (#1086)

(config) Add Vault-backed configuration (#1051)

(logging) Add native journald log writer (#1081)

(identity) Add PATCH to few resources (#1076)

(ldap) Add LDAP identity driver (#1047)

(adr0028) Add local-quorum-bypass emergency rotation (#1032)

Add catalog CRUD API and bootstrap support (#1029)

(adr0026) Add RFC 8628 Device Authorization Grant (#1023)

(adr0026) Add authorization code flow with PKCE (#1015)

(adr0026) Add client_credentials token endpoint (#1014)

(adr0026) Phase 2 client registration & OIDC discovery (#1013)

(adr0026) Phase 0 token abstraction and JWS driver (#1010)

(api) capture client IP via proxy headers & SPIFFE (Start capturing client information in the request processing #358 follow-up) (#908)

(identity) Add per-user auth rate limiting (#996)

(adr0025) Complete imlpementation (#969)

(api) Add global IP rate limiting framework (ADR-0022 phase 1) (#846)

(scim) Harden RFC 7644 compliance, add docs (#968)

(adr0025) Phase 1 (1.1+1.2) (#952)

(security) Wrap secrets with secrecy crate (#369) (#912)

(scim) ADR 0024 - Phase 5 (#951)

(scim) ADR 0024 - Phase 1+2 (#925)

(fernet) Unify credential/token key repositories (#915)

Start ADR 0025 immplementation (#911)

(credential) Implement Phase 3 of ADR 0019 (#909)

Prepare PKCS#11/TPM KEK support in storage (#907)

(credential) Implement ADR 0019 phases 1-2 (#897)

Implement stateless SCIM ingress auth (ADR 0021) (#891)

(auth) Password hashing parity with Python Keystone (#859)

(audit) Implement CADF audit framework Phase 2 (#872)

(storage) SPIFFE checks, RBAC, rate limiting, auto-join (#861)

(storage) Harden preflight and erase dev KEK (#860)

Add bootstrap cli command (#809)

(mapping) ADR-0020 (mapping engine) phase 1 (#794)

Add inter-provider event notification system (#784)

Add SO_PEERCRED peer credential validation (#775)

Validate password for compliance conformity (#774)

Enforce minimum range boundaries for security

Add role-imply rest api (#750)

Add user update functionality (#747)

Make drivers more dynamic (#737)

Add keystone container with opa and policies (#738)

Add Admin interface over the UDS (#735)

Add spiffe provider (#733)

Introduce SecurityContext (#710)

Add skeleton for the spiffe mTLS integration (#695)

Implement ConfigManager for config watching (#691)

Improve the code (#686)

Add k8s-auth raft driver (#676)

Add raft support under skaffold (#667)

Introduce raft backend for webauthn (#658)

Introduce the keystone-manage cli managing raft (#656)

Fixed

(auth-plugins) Raise default invocation rate limits (#1437)

(oauth2) Pin issuer to public_endpoint (#1436)

(oauth2) Rate limit device_code token grant (#1434)

(storage) Authorize Raft and Storage gRPC callers (#1418)

(raft) Rotate audit key per DEK epoch (#1362)

(audit) Stop spool replay from looping into itself (#1350)

(raft) Fail closed on stale ReadIndex reads (#1341)

Next round of security review fixes (#1241)

(adr0034) Post implementation fixes (#1223)

Avoid blocking notify's event thread in watch_loop (#1125)

Fix flaky test (#1110)

(security) Address security review findings (#1049)

(passkey) Prevent user enumeration (#905)

Other

(config) Pin reload and overlay behaviour (#1421)

(cadf) Own the audit configuration (#1405)

(audit) Cover spool, rotation and hook paths (#1391)

Fix clippy lints across workspace (#1361)

(config) Fix flaky notify watcher tests (#1112)

Revise documentation layout (#1069)

Moves health and metrics endpoints to dedicated listener on separate port (#910)

Move jsonwebtoken to keystone crate (#820)

mapping engine phase 3 - migrate SPIFFE (#811)

Rename identity_mapping to idmapping (#788)

Replace Regex with str::find for db connection (#760)

Redesign SecurityContext with two-phase validation (#717)

Split out remaining sql drivers (#633)

Split config into standalone crate (#628)

`openstack-keystone-core-types`

0.1.1 - 2026-10-11

Added

(oauth2) Add back-channel logout (#1493)

(oauth2) Add federated sign-in to device page (#1491)

(oauth2) Harden SSO sessions (#1490)

(oauth2) Remember consent per client (#1476)

(oauth2) Add SSO session and RP logout (#1475)

(oauth2) Add federated sign-in to OP login (#1474)

(oauth2) Add TOTP second factor to OP login (#1473)

(oauth2) Add client display metadata (#1472)

(resource) Add enabled filter to project list (#1453)

(identity) Add enabled filter to user list (#1451)

(oauth2) Rotate signing keys automatically (#1440)

Implement authc by app credential (#1187)

(limit) Add unified limits (#1407)

(oauth2) Populate id_token profile claims (#1408)

(oauth2) Revoke refresh families on lifecycle (#1404)

(audit) Fix initiator and outcome fidelity (#1387)

(audit) Audit remaining provider mutations (#1386)

(oauth2) Add RFC 7009 token revocation endpoint (#1369)

(oauth2) Cap refresh families and revalidate user (#1360)

(oauth2-session) Add expired record janitor (#1359)

Hot-reload fs per-domain config files (#1225)

(adr0034) Route assignment ops per domain (#1219)

(adr0034) Build per-instance assignment backends (#1218)

(adr0034) Add per-domain driver config surface (#1216)

Resolve local/public ids for non-default backends (#1207)

(assignment) Add OpenFGA assignment driver (#1206)

(idmapping) Add id-mapping write paths (#1205)

(domain-config) Dispatch identity ops per domain (#1202)

(domain-config) Add resolution layer (#1199)

(domain-config) Add filesystem driver (#1197)

Add vendor data JWT API for SPIRE integration (#1192)

Add domain config SQL driver (#1139)

(policy) Implement legacy Policy API (/v3/policies) (#1127)

Add domain config types and backend trait (#1138)

Add cargo-fuzz targets (#1130)

Add OS-EP-FILTER provider CRUD to the catalog (#1075)

(pagination) Add pagination to remaining places (#1106)

Add immutable option for project, domain, role (#1097)

Generalize marker pagination for v3/v4 lists (#1086)

(identity) Add trust create/delete and REST CRUD (#1079)

(catalog) Expose /v3/regions REST API (#1078)

(identity) Add PATCH to few resources (#1076)

(ldap) Add LDAP identity driver (#1047)

(test) Add tempest identity compatibility (#998)

(adr0028) Add local-quorum-bypass emergency rotation (#1032)

Add catalog CRUD API and bootstrap support (#1029)

(adr0026) Add RFC 8628 Device Authorization Grant (#1023)

(adr0026) Phase 6a (#1017)

(adr0026) Add Phase 5 offline token verification (#1016)

(adr0026) Add authorization code flow with PKCE (#1015)

(adr0026) Add client_credentials token endpoint (#1014)

(adr0026) Phase 2 client registration & OIDC discovery (#1013)

(adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)

(adr0026) Phase 0 token abstraction and JWS driver (#1010)

(identity) Add per-user auth rate limiting (#996)

(adr0025) Complete imlpementation (#969)

(api) Add global IP rate limiting framework (ADR-0022 phase 1) (#846)

(adr0025) Phase 1 (1.1+1.2) (#952)

(security) Wrap secrets with secrecy crate (#369) (#912)

(scim) ADR 0024 - Phase 4 (protocol surface completion) (#929)

(scim) ADR 0024 - Phase 3 (#928)

(scim) ADR 0024 - Phase 1+2 (#925)

(credential) Implement Phase 3 of ADR 0019 (#909)

(credential) Implement ADR 0019 phases 1-2 (#897)

Implement stateless SCIM ingress auth (ADR 0021) (#891)

Audit framework (ADR-0023) phase 3 (#880)

(audit) Implement CADF audit framework Phase 2 (#872)

Migrate federation to new mapping engine (#839)

Add access rule CRD to appcred provider (#806)

ADR-0020 mapping phase 4 (#818)

(mapping) ADR-0020 (mapping engine) phase 1 (#794)

Add endpoint CRUD to catalog provider (#785)

Add inter-provider event notification system (#784)

Add service CRUD to the catalog provider (#773)

Validate password for compliance conformity (#774)

Return 401 on roleless scoped contexts (#742)

Add region CRUD to catalog SQL driver (#761)

Add role-imply rest api (#750)

Add role imply API (#749)

Add user update functionality (#747)

Add spiffe binding API (#740)

Add Admin interface over the UDS (#735)

Add spiffe provider (#733)

Expand role info in expand_implied_roles (#730)

Introduce SecurityContext (#710)

Improve the code (#686)

Add k8s-auth raft driver (#676)

Introduce the keystone-manage cli managing raft (#656)

Fixed

(application_credential) Accept tempest create payloads (#1446)

(oauth2) Revoke refresh families on client delete/disable (#1363)

(oauth2-session) Tombstone revoked refresh families (#1358)

Next round of security review fixes (#1241)

Use proper token issued_at time (#1194)

Register UserType in OpenAPI components schema (#1151)

Fix ID sanitizer and capture client IP in audit (#1126)

(api) Default enabled/domain_id on create (#1073)

(security) Address security review findings (#1049)

(federation) Allow long external unique_id values (#1033)

Unify ApiClient scope validation, fix nextest filter (#947)

Finalize ADR 0021 work (#906)

Resolve raft replication state races (#884)

(k8s_auth) Flatten k8s.aud claim from JWT TokenReview (#834)

Align "extra" property handling (#787)

Other

Feature/system assignment group (#796)

Fix clippy lints across workspace (#1361)

(api) Harden v3 authorization and authentication coverage (#1166)

(identity) Remove service account API methods (#1152)

Extend workspace unsafe/unwrap/expect lints (#1120)

Revise documentation layout (#1069)

(security) Close mutation-testing gaps in auth/policy (#1056)

Move jsonwebtoken to keystone crate (#820)

mapping engine phase 3 - migrate SPIFFE (#811)

Rename identity_mapping to idmapping (#788)

Make resolve_implied_roles optional (#764)

Redesign SecurityContext with two-phase validation (#717)

Unify state initialization in test (#642)

Small optimization of the derives (#638)

Split the core-types crate (#640)

`openstack-keystone-api-types`

0.1.1 - 2026-10-11

Added

(oauth2) Add back-channel logout (#1493)

(oauth2) Remember consent per client (#1476)

(oauth2) Add SSO session and RP logout (#1475)

(oauth2) Add client display metadata (#1472)

(resource) Add enabled filter to project list (#1453)

(identity) Add enabled filter to user list (#1451)

Implement authc by app credential (#1187)

(limit) Add unified limits (#1407)

(devstack) Pilot ksm SPIFFE mTLS transport (#1239)

(assignment) Add OpenFGA assignment driver (#1206)

(domain-config) Dispatch identity ops per domain (#1202)

(domain-config) Add configuration API (#1201)

Add vendor data JWT API for SPIRE integration (#1192)

(api) Log response body for all 4xx/5xx errors (#1171)

(api) Log error details in IntoResponse (#1169)

(policy) Implement legacy Policy API (/v3/policies) (#1127)

Filter user listing by type (#813)

(loadtest) Add more auth tests (#1119)

(pagination) Add pagination to remaining places (#1106)

Add immutable option for project, domain, role (#1097)

Generalize marker pagination for v3/v4 lists (#1086)

(identity) Add trust create/delete and REST CRUD (#1079)

(catalog) Expose /v3/regions REST API (#1078)

(identity) Add PATCH to few resources (#1076)

(ldap) Add LDAP identity driver (#1047)

(test) Add tempest identity compatibility (#998)

(adr0028) Add local-quorum-bypass emergency rotation (#1032)

Add catalog CRUD API and bootstrap support (#1029)

(adr0026) Extend keystone-manage oauth2 CLI (#1020)

(adr0026) Phase 6a (#1017)

(adr0026) Add client_credentials token endpoint (#1014)

(adr0026) Phase 2 client registration & OIDC discovery (#1013)

(adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)

(identity) Add per-user auth rate limiting (#996)

(adr0025) Complete imlpementation (#969)

(identity) Implement user password change endpoint (#970)

(api) Add global IP rate limiting framework (ADR-0022 phase 1) (#846)

(adr0025) Phase 1 (1.1+1.2) (#952)

(security) Wrap secrets with secrecy crate (#369) (#912)

(scim) ADR 0024 - Phase 5 (#951)

(scim) ADR 0024 - Phase 1+2 (#925)

(credential) Implement Phase 3 of ADR 0019 (#909)

ADR 0021 admin surface, simulate-access, and janitor (#896)

Implement stateless SCIM ingress auth (ADR 0021) (#891)

Migrate federation to new mapping engine (#839)

ADR-0020 mapping phase 4 (#818)

(mapping) ADR-0020 phase 2 (#807)

(mapping) ADR-0020 (mapping engine) phase 1 (#794)

Validate password for compliance conformity (#774)

Add system-user-role assignments API (#762)

Add role-imply rest api (#750)

Add user update functionality (#747)

Add api to list user roles on project (#639)

Add domain CRUD operations (#743)

Add spiffe binding API (#740)

Add spiffe provider (#733)

Introduce SecurityContext (#710)

Add skeleton for the spiffe mTLS integration (#695)

Improve the code (#686)

Fixed

(resource) Reject project names over 64 chars (#1455)

(resource) Align domain and project response shape (#1454)

(application_credential) Accept tempest create payloads (#1446)

Next round of security review fixes (#1241)

(api-types) Allow empty domain description (#1237)

(types) Remove invalid PartialEq from AppCred wrappers (#1191)

(logging) Surface 5xx causes at error level (#1172)

Register UserType in OpenAPI components schema (#1151)

Map raft-not-available to proper HTTP status codes (#1149)

(api) Fix pagination limit, filters, and rows (#1115)

Address multiple tempest failures (#1083)

(api) Default enabled/domain_id on create (#1073)

(security) Address security review findings (#1049)

(federation) Allow long external unique_id values (#1033)

Unify ApiClient scope validation, fix nextest filter (#947)

Finalize ADR 0021 work (#906)

Other

Feature/system assignment group (#796)

Fix clippy lints across workspace (#1361)

(api) Harden v3 authorization and authentication coverage (#1166)

(identity) Remove service account API methods (#1152)

Feature/expose app credential (#948)

(api) Expand v3 coverage and enforce EC2 token restrictions (#1084)

Extend workspace unsafe/unwrap/expect lints (#1120)

(test) Improve testing of the oauth2 OP (#1024)

Move jsonwebtoken to keystone crate (#820)

(tests) Reorganize integration_api tests (#815)

mapping engine phase 3 - migrate SPIFFE (#811)

Rename identity_mapping to idmapping (#788)

Further align workspace features (#772)

Make resolve_implied_roles optional (#764)

Redesign SecurityContext with two-phase validation (#717)

Small optimization of the derives (#638)

Split the core-types crate (#640)

Introduce features in api-types crate (#624)

Slim down api-types crate (#622)

`openstack-keystone-auth-plugin-core`

0.1.0 - 2026-10-11

Other

Split extism out of core's dependency tree (#1148)

`openstack-keystone-key-repository`

0.1.0 - 2026-10-11

Added

(adr0026) Add previous-key and JTI-revocation janitor (#1021)

(adr0026) Add Phase 5 offline token verification (#1016)

(adr0026) Add client_credentials token endpoint (#1014)

(adr0026) Phase 0 token abstraction and JWS driver (#1010)

(scim) ADR 0024 - Phase 1+2 (#925)

(fernet) Unify credential/token key repositories (#915)

Fixed

(deps) Bump p256 to 0.14, unpin rand_core (#1247)

Widen Fernet key index from i8 to u32 (#1080)

Support macOS dev builds and fs watcher shutdown (#1009)

Other

Fix clippy lints across workspace (#1361)

(deps) bump pem from 3.0.6 to 4.0.0 (#1162)

(deps) bump pkcs8 from 0.10.2 to 0.11.0 (#1061)

`openstack-keystone-local-emergency-store`

0.1.0 - 2026-10-11

Added

(test) Add tempest identity compatibility (#998)

(adr0028) Add local-quorum-bypass emergency rotation (#1032)

Other

Extend workspace unsafe/unwrap/expect lints (#1120)

`openstack-keystone-storage-api`

0.1.0 - 2026-10-11

Added

Enable OpenTelemetry metrics and traces support (#1456)

(storage) Gate readiness on Raft health (#1450)

(storage) Add ephemeral state machine records (#1198)

(adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)

(storage) Cert validity and SVID TTL enforcement (#886)

(storage) SPIFFE checks, RBAC, rate limiting, auto-join (#861)

(storage) Complete ADR-0016-v2 (#844)

(storage) implement ADR 0016-v2 Phases 1-4 — encrypted storage with quarantine (#840)

Fixed

(raft) Fail closed on stale ReadIndex reads (#1341)

(webauthn) Rotate raft ceremony-state keyspaces (#890)

Other

(storage) Split large modules and tests (#1466)

Extend workspace unsafe/unwrap/expect lints (#1120)

(storage) Decouple core from storage (#832)

`openstack-keystone-core`

0.1.2 - 2026-10-11

Added

(oauth2) Add back-channel logout (#1493)

(oauth2) Add federated sign-in to device page (#1491)

(oauth2) Harden SSO sessions (#1490)

(oauth2) Remember consent per client (#1476)

(oauth2) Add SSO session and RP logout (#1475)

(oauth2) Add federated sign-in to OP login (#1474)

(oauth2) Add TOTP second factor to OP login (#1473)

(oauth2) Add client display metadata (#1472)

Enable OpenTelemetry metrics and traces support (#1456)

(oauth2) Add OIDC userinfo endpoint (#1442)

(oauth2) Rotate signing keys automatically (#1440)

(oauth2) Add RFC 7662 token introspection (#1439)

Implement authc by app credential (#1187)

(oslo.config) Generalize oslo-config crate (#1429)

(cadf) Use DSP0262 names on the wire (#1419)

(limit) Add unified limits (#1407)

(oauth2) Populate id_token profile claims (#1408)

(oauth2) Revoke refresh families on lifecycle (#1404)

(audit) Align audit schema and vectors (#1389)

(audit) Add perimeter completion record (#1388)

(audit) Fix initiator and outcome fidelity (#1387)

(audit) Audit remaining provider mutations (#1386)

(oauth2) Add RFC 7009 token revocation endpoint (#1369)

(oauth2) Cap refresh families and revalidate user (#1360)

(oauth2-session) Add expired record janitor (#1359)

(oauth2) Add secondary indexes to raft driver (#1327)

Hot-reload fs per-domain config files (#1225)

(adr0034) Reload assignment bundle on config change (#1220)

(adr0034) Route assignment ops per domain (#1219)

(adr0034) Build per-instance assignment backends (#1218)

(adr0034) Gate sources on domain_config (#1217)

Resolve local/public ids for non-default backends (#1207)

(assignment) Add OpenFGA assignment driver (#1206)

(idmapping) Add id-mapping write paths (#1205)

(domain-config) Dispatch identity ops per domain (#1202)

(domain-config) Add configuration API (#1201)

(domain-config) Add resolution layer (#1199)

(spiffe) Derive spiffe claims (#1193)

Add vendor data JWT API for SPIRE integration (#1192)

(core) Reconnect database connection on new config (#1188)

(metrics) Add shared Prometheus primitives crate (#1186)

Add domain config SQL driver (#1139)

(policy) Implement legacy Policy API (/v3/policies) (#1127)

Add domain config types and backend trait (#1138)

Add SCIM scenarios; Fix findings (#1136)

Add cargo-fuzz targets (#1130)

Add SPIFFE SVID health check to readiness probe (#1121)

Add OS-EP-FILTER provider CRUD to the catalog (#1075)

Add per-request cache framework (ADR 0030) (#1114)

Auto-register backend drivers via inventory (#1105)

Add immutable option for project, domain, role (#1097)

(config) Revoke Vault token on shutdown (#1088)

(identity) Add trust create/delete and REST CRUD (#1079)

(identity) Add PATCH to few resources (#1076)

(tempest) Improve tempest testing (#1046)

(test) Add tempest identity compatibility (#998)

(adr0028) Add local-quorum-bypass emergency rotation (#1032)

(adr0026) Add RFC 8628 Device Authorization Grant (#1023)

(adr0026) Add previous-key and JTI-revocation janitor (#1021)

(adr0026) Phase 6a (#1017)

(adr0026) Add Phase 5 offline token verification (#1016)

(adr0026) Add authorization code flow with PKCE (#1015)

(adr0026) Add client_credentials token endpoint (#1014)

(adr0026) Phase 2 client registration & OIDC discovery (#1013)

(adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)

(adr0026) Phase 0 token abstraction and JWS driver (#1010)

(api) capture client IP via proxy headers & SPIFFE (Start capturing client information in the request processing #358 follow-up) (#908)

(identity) Add per-user auth rate limiting (#996)

(adr0025) Complete imlpementation (#969)

(api) Add global IP rate limiting framework (ADR-0022 phase 1) (#846)

(adr0025) Phase 1 (1.1+1.2) (#952)

(security) Wrap secrets with secrecy crate (#369) (#912)

(scim) ADR 0024 - Phase 5 (#951)

(scim) ADR 0024 - Phase 4 (protocol surface completion) (#929)

(scim) ADR 0024 - Phase 3 (#928)

(scim) ADR 0024 - Phase 1+2 (#925)

(credential) Implement Phase 3 of ADR 0019 (#909)

(credential) Implement ADR 0019 phases 1-2 (#897)

ADR 0021 admin surface, simulate-access, and janitor (#896)

Implement stateless SCIM ingress auth (ADR 0021) (#891)

(audit) Complete ADR-0023 audit implementation (#887)

(storage) Cert validity and SVID TTL enforcement (#886)

Audit framework (ADR-0023) phase 3 (#880)

(auth) Password hashing parity with Python Keystone (#859)

(audit) Implement CADF audit framework Phase 2 (#872)

Migrate federation to new mapping engine (#839)

Add access rule CRD to appcred provider (#806)

ADR-0020 mapping phase 4 (#818)

Add bootstrap cli command (#809)

(mapping) ADR-0020 (mapping engine) phase 1 (#794)

Add endpoint CRUD to catalog provider (#785)

Add inter-provider event notification system (#784)

Add service CRUD to the catalog provider (#773)

Validate password for compliance conformity (#774)

Return 401 on roleless scoped contexts (#742)

Add region CRUD to catalog SQL driver (#761)

Add timing attack protection and failed auth tracking (#758)

Add role-imply rest api (#750)

Add role imply API (#749)

Add user update functionality (#747)

Add domain CRUD operations (#743)

Add spiffe binding API (#740)

Normalize the policy enforcer structure (#741)

Make drivers more dynamic (#737)

Add Admin interface over the UDS (#735)

Add spiffe provider (#733)

Expand role info in expand_implied_roles (#730)

Introduce SecurityContext (#710)

Talk to OPA over unix socket (#701)

Add skeleton for the spiffe mTLS integration (#695)

Implement ConfigManager for config watching (#691)

Improve the code (#686)

Add k8s-auth raft driver (#676)

Add basic healthcheck endpoint (#671)

Make raft storage available through state (#657)

Fixed

(oauth2) Clear logout relying parties atomically (#1496)

(oauth2) Pin issuer to public_endpoint (#1436)

(oauth2) Check client on device grant redeem (#1435)

(audit) Polish the CADF crate (#1424)

(audit) Keep request context in WASM host calls (#1414)

(audit) Record variant names as reasons (#1384)

(oauth2) Check refresh token owner before redemption (#1364)

(oauth2) Revoke refresh families on client delete/disable (#1363)

(oauth2-session) Tombstone revoked refresh families (#1358)

(deps) Bump p256 to 0.14, unpin rand_core (#1247)

Match real app-cred id field in route plugin (#1242)

Next round of security review fixes (#1241)

(adr0034) Post implementation fixes (#1223)

Use proper token issued_at time (#1194)

(logging) Surface 5xx causes at error level (#1172)

Register UserType in OpenAPI components schema (#1151)

(api) Fix pagination limit, filters, and rows (#1115)

Fix ID sanitizer and capture client IP in audit (#1126)

(api) Default enabled/domain_id on create (#1073)

(security) Do not allow ec2cred token to do anything (#1071)

(security) Address security review findings (#1049)

(adr0026) Bind Token Exchange grant to the issuing domain (#1019)

Unify ApiClient scope validation, fix nextest filter (#947)

Finalize ADR 0021 work (#906)

(ci) Prepare workflows for merge queue (#902)

Resolve raft replication state races (#884)

(core) Eliminate mapping race condition (#876)

(k8s_auth) Flatten k8s.aud claim from JWT TokenReview (#834)

(auth) Close admin SVID impersonation gap (#833)

Other

Feature/system assignment group (#796)

(limit) Extend unified limits API coverage (#1426)

(audit) Cover startup seal, quarantine, hooks (#1410)

(audit) Rename audit crate to cadf (#1399)

(audit) Cover spool, rotation and hook paths (#1391)

Fix clippy lints across workspace (#1361)

(adr0034) Add per-domain assignment driver tests (#1222)

(deps) Bump argon2 from 0.5.3 to 0.6.0 (#1184)

(identity) Remove service account API methods (#1152)

Feature/expose app credential (#948)

(api) Expand v3 coverage and enforce EC2 token restrictions (#1084)

Split extism out of core's dependency tree (#1148)

Add SECURITY note to important method (#1132)

Extend workspace un

github-actions · 2026-06-05T09:17:47Z

🦢 Load Test Results

Goose Attack Report

Plan Overview

Action	Started	Stopped	Elapsed	Users
Increasing	26-10-11 20:27:58	26-10-11 20:28:21	00:00:23	0 → 45
Maintaining	26-10-11 20:28:21	26-10-11 20:28:51	00:00:30	45
Decreasing	26-10-11 20:28:51	26-10-11 20:28:51	00:00:00	0 ← 45

Request Metrics

Method	Name	# Requests	# Fails	Average (ms)	Min (ms)	Max (ms)	RPS	Failures/s
DELETE	DELETE /v3/auth/tokens	42	0	565.48	396	708	1.40	0.00
DELETE	DELETE /v3/projects/:id (teardown)	1	0	198.00	198	198	0.03	0.00
DELETE	DELETE /v3/roles/:id (teardown)	1	0	93.00	93	93	0.03	0.00
DELETE	DELETE /v3/users/:id (teardown)	2	0	139.50	101	178	0.07	0.00
DELETE	DELETE /v4/mappings/rulesets/:mapping_id (teardown)	1	0	123.00	123	123	0.03	0.00
DELETE	DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown)	1	0	260.00	260	260	0.03	0.00
GET		578	0	609.06	368	858	19.27	0.00
GET	GET /SCIM/v2/:domain_id/Users (sync reconcile list)	1815	1815	16.26	1	772	60.50	60.50
GET	GET /v3/auth/tokens (validate new)	42	0	576.38	425	740	1.40	0.00
GET	GET /v3/auth/tokens (validate revoked)	42	0	530.00	86	704	1.40	0.00
GET	GET /v3/projects/:id	53	0	573.19	435	730	1.77	0.00
GET	GET /v3/projects/:id (catalog)	78	0	577.08	405	724	2.60	0.00
GET	GET /v3/role_assignments	39	0	596.38	492	746	1.30	0.00
GET	GET /v3/role_assignments?role.id	40	0	566.10	376	687	1.33	0.00
GET	GET /v3/role_assignments?scope.domain.id	42	0	561.38	401	719	1.40	0.00
GET	GET /v3/role_assignments?user.id	41	0	527.56	379	715	1.37	0.00
GET	GET /v3/roles	105	0	576.38	436	769	3.50	0.00
GET	GET /v3/roles/:id	53	0	576.11	405	788	1.77	0.00
GET	GET /v3/users/:id	102	0	600.61	459	801	3.40	0.00
GET	GET /v3/users/:id (catalog)	100	0	598.24	275	773	3.33	0.00
GET	GET /v4/api-keys	26	0	573.19	485	748	0.87	0.00
GET	GET /v4/api-keys/:client_id	26	0	592.96	362	751	0.87	0.00
GET	GET /v4/mappings/rulesets	27	0	582.37	418	700	0.90	0.00
GET	GET /v4/mappings/rulesets/:mapping_id	27	0	544.04	382	669	0.90	0.00
GET	GET /v4/oauth2/:domain_id/.well-known/openid-configuration	843	0	54.02	11	231	28.10	0.00
GET	GET /v4/oauth2/:domain_id/clients	27	0	577.26	446	725	0.90	0.00
GET	GET /v4/oauth2/:domain_id/clients/:provider_id	27	0	555.15	454	678	0.90	0.00
GET	GET /v4/oauth2/:domain_id/jwks	844	0	52.10	13	166	28.13	0.00
GET	GET /v4/scim_realms	17	0	581.94	468	718	0.57	0.00
GET	GET /v4/scim_realms/:domain_id/:provider_id	17	0	568.76	445	700	0.57	0.00
POST	POST /v3/auth/tokens	40	0	540.40	412	728	1.33	0.00
POST	POST /v3/auth/tokens (password, invalid)	33	0	924.82	511	1407	1.10	0.00
POST	POST /v3/auth/tokens (password, project-scoped)	57	0	1245.04	560	2075	1.90	0.00
POST	POST /v3/auth/tokens (password, unscoped)	57	0	918.02	578	1554	1.90	0.00
POST	POST /v3/auth/tokens (rescope to system)	95	0	642.15	398	842	3.17	0.00
POST	POST /v3/auth/tokens (rescope, invalid project)	56	0	542.05	402	756	1.87	0.00
POST	POST /v3/auth/tokens (system-scoped, bootstrap admin)	52	0	1196.42	678	1769	1.73	0.00
POST	POST /v4/api-keys/:client_id/revoke (teardown)	1	0	141.00	141	141	0.03	0.00
PUT	PUT /v4/scim_realms/:domain_id/:provider_id	18	0	604.56	457	734	0.60	0.00
	Aggregated	5468	1815	250.87	1	2075	182.27	60.50

Response Time Metrics

Method	Name	50%ile (ms)	60%ile (ms)	70%ile (ms)	80%ile (ms)	90%ile (ms)	95%ile (ms)	99%ile (ms)	100%ile (ms)
DELETE	DELETE /v3/auth/tokens	600	600	600	600	700	700	700	700
DELETE	DELETE /v3/projects/:id (teardown)	198	198	198	198	198	198	198	198
DELETE	DELETE /v3/roles/:id (teardown)	93	93	93	93	93	93	93	93
DELETE	DELETE /v3/users/:id (teardown)	101	101	101	178	178	178	178	178
DELETE	DELETE /v4/mappings/rulesets/:mapping_id (teardown)	123	123	123	123	123	123	123	123
DELETE	DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown)	260	260	260	260	260	260	260	260
GET		600	600	700	700	700	700	800	858
GET	GET /SCIM/v2/:domain_id/Users (sync reconcile list)	7	8	10	12	16	21	450	772
GET	GET /v3/auth/tokens (validate new)	600	600	600	700	700	700	700	700
GET	GET /v3/auth/tokens (validate revoked)	500	500	600	600	600	600	700	700
GET	GET /v3/projects/:id	600	600	600	600	700	700	700	700
GET	GET /v3/projects/:id (catalog)	600	600	600	700	700	700	700	700
GET	GET /v3/role_assignments	600	600	600	600	700	700	700	700
GET	GET /v3/role_assignments?role.id	600	600	600	600	600	687	687	687
GET	GET /v3/role_assignments?scope.domain.id	500	600	600	600	600	700	700	700
GET	GET /v3/role_assignments?user.id	500	500	600	600	600	600	700	700
GET	GET /v3/roles	600	600	600	600	700	700	769	769
GET	GET /v3/roles/:id	600	600	600	700	700	700	700	788
GET	GET /v3/users/:id	600	600	600	700	700	700	800	800
GET	GET /v3/users/:id (catalog)	600	600	600	700	700	700	773	773
GET	GET /v4/api-keys	600	600	600	600	700	700	700	700
GET	GET /v4/api-keys/:client_id	600	600	600	700	700	700	751	751
GET	GET /v4/mappings/rulesets	600	600	600	600	700	700	700	700
GET	GET /v4/mappings/rulesets/:mapping_id	500	600	600	600	600	669	669	669
GET	GET /v4/oauth2/:domain_id/.well-known/openid-configuration	48	55	63	74	90	100	140	230
GET	GET /v4/oauth2/:domain_id/clients	600	600	600	600	700	700	700	700
GET	GET /v4/oauth2/:domain_id/clients/:provider_id	600	600	600	600	600	678	678	678
GET	GET /v4/oauth2/:domain_id/jwks	46	52	61	73	85	100	130	166
GET	GET /v4/scim_realms	600	600	600	700	700	700	700	700
GET	GET /v4/scim_realms/:domain_id/:provider_id	600	600	600	600	600	700	700	700
POST	POST /v3/auth/tokens	500	500	600	600	600	700	700	700
POST	POST /v3/auth/tokens (password, invalid)	900	1,000	1,000	1,000	1,000	1,000	1,000	1,000
POST	POST /v3/auth/tokens (password, project-scoped)	1,000	1,000	1,000	1,000	2,000	2,000	2,000	2,000
POST	POST /v3/auth/tokens (password, unscoped)	900	900	1,000	1,000	1,000	1,000	1,000	1,554
POST	POST /v3/auth/tokens (rescope to system)	600	700	700	700	800	800	800	800
POST	POST /v3/auth/tokens (rescope, invalid project)	500	500	600	600	600	600	700	756
POST	POST /v3/auth/tokens (system-scoped, bootstrap admin)	1,000	1,000	1,000	1,000	1,000	1,769	1,769	1,769
POST	POST /v4/api-keys/:client_id/revoke (teardown)	141	141	141	141	141	141	141	141
PUT	PUT /v4/scim_realms/:domain_id/:provider_id	600	600	700	700	700	700	700	700
	Aggregated	51	85	500	600	700	700	1,000	2,000

Status Code Metrics

Method	Name	Status Codes
DELETE	DELETE /v3/auth/tokens	42 [204]
DELETE	DELETE /v3/projects/:id (teardown)	1 [204]
DELETE	DELETE /v3/roles/:id (teardown)	1 [204]
DELETE	DELETE /v3/users/:id (teardown)	2 [204]
DELETE	DELETE /v4/mappings/rulesets/:mapping_id (teardown)	1 [204]
DELETE	DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown)	1 [204]
GET		578 [200]
GET	GET /SCIM/v2/:domain_id/Users (sync reconcile list)	1,784 [429], 31 [401]
GET	GET /v3/auth/tokens (validate new)	42 [200]
GET	GET /v3/auth/tokens (validate revoked)	42 [404]
GET	GET /v3/projects/:id	53 [200]
GET	GET /v3/projects/:id (catalog)	78 [200]
GET	GET /v3/role_assignments	39 [200]
GET	GET /v3/role_assignments?role.id	40 [200]
GET	GET /v3/role_assignments?scope.domain.id	42 [200]
GET	GET /v3/role_assignments?user.id	41 [200]
GET	GET /v3/roles	105 [200]
GET	GET /v3/roles/:id	53 [200]
GET	GET /v3/users/:id	102 [200]
GET	GET /v3/users/:id (catalog)	100 [200]
GET	GET /v4/api-keys	26 [200]
GET	GET /v4/api-keys/:client_id	26 [200]
GET	GET /v4/mappings/rulesets	27 [200]
GET	GET /v4/mappings/rulesets/:mapping_id	27 [200]
GET	GET /v4/oauth2/:domain_id/.well-known/openid-configuration	843 [200]
GET	GET /v4/oauth2/:domain_id/clients	27 [200]
GET	GET /v4/oauth2/:domain_id/clients/:provider_id	27 [200]
GET	GET /v4/oauth2/:domain_id/jwks	844 [200]
GET	GET /v4/scim_realms	17 [200]
GET	GET /v4/scim_realms/:domain_id/:provider_id	17 [200]
POST	POST /v3/auth/tokens	40 [201]
POST	POST /v3/auth/tokens (password, invalid)	33 [401]
POST	POST /v3/auth/tokens (password, project-scoped)	57 [201]
POST	POST /v3/auth/tokens (password, unscoped)	57 [201]
POST	POST /v3/auth/tokens (rescope to system)	95 [201]
POST	POST /v3/auth/tokens (rescope, invalid project)	56 [401]
POST	POST /v3/auth/tokens (system-scoped, bootstrap admin)	52 [201]
POST	POST /v4/api-keys/:client_id/revoke (teardown)	1 [200]
PUT	PUT /v4/scim_realms/:domain_id/:provider_id	18 [200]
	Aggregated	301 [201], 3,173 [200], 42 [404], 48 [204], 1,784 [429], 120 [401]

Transaction Metrics

Transaction	# Times Run	# Fails	Average (ms)	Min (ms)	Max (ms)	RPS	Failures/s
ReadHeavy
0.0	1	0	24.00	24	24	0.03	0.00
0.1	102	0	617.65	469	768	3.40	0.00
0.2	102	0	583.16	368	775	3.40	0.00
0.3	104	0	582.33	397	757	3.47	0.00
TokenLifecycle
1.0	0	0	0.00	0	0	0.00	0.00
1.1	42	0	2213.90	1709	2496	1.40	0.00
ValidateToken
2.0	0	0	0.00	0	0	0.00	0.00
2.1	90	0	677.12	444	858	3.00	0.00
UserCRUD
3.0	0	0	0.00	0	0	0.00	0.00
3.1	0	0	0.00	0	0	0.00	0.00
3.2	102	0	600.63	459	801	3.40	0.00
3.3	2	0	139.50	101	178	0.07	0.00
ProjectCRUD
4.0	0	0	0.00	0	0	0.00	0.00
4.1	0	0	0.00	0	0	0.00	0.00
4.2	53	0	573.21	435	730	1.77	0.00
4.3	1	0	198.00	198	198	0.03	0.00
RoleCRUD
5.0	0	0	0.00	0	0	0.00	0.00
5.1	0	0	0.00	0	0	0.00	0.00
5.2	53	0	576.13	405	788	1.77	0.00
5.3	1	0	93.00	93	93	0.03	0.00
RoleList
6.0	0	0	0.00	0	0	0.00	0.00
6.1	105	0	576.39	436	769	3.50	0.00
RoleAssignmentList
7.0	0	0	0.00	0	0	0.00	0.00
7.1	39	0	596.41	492	746	1.30	0.00
7.2	41	0	527.56	379	715	1.37	0.00
7.3	42	0	561.43	401	719	1.40	0.00
7.4	40	0	566.17	376	687	1.33	0.00
UserRead
8.0	0	0	0.00	0	0	0.00	0.00
8.1	100	0	618.04	432	791	3.33	0.00
8.2	100	0	598.25	275	773	3.33	0.00
ProjectRead
9.0	0	0	0.00	0	0	0.00	0.00
9.1	80	0	578.34	395	733	2.67	0.00
9.2	78	0	577.10	405	724	2.60	0.00
PasswordAuth
10.0	57	0	918.07	578	1554	1.90	0.00
10.1	57	0	1245.11	560	2075	1.90	0.00
PasswordAuthNegative
11.0	33	0	924.88	511	1407	1.10	0.00
Rescope
12.0	0	0	0.00	0	0	0.00	0.00
12.1	95	0	642.18	398	842	3.17	0.00
RescopeNegative
13.0	0	0	0.00	0	0	0.00	0.00
13.1	56	0	542.09	402	756	1.87	0.00
SystemScopeAuth
14.0	52	0	1196.46	678	1769	1.73	0.00
ApiKeyCRUD
15.0	0	0	0.00	0	0	0.00	0.00
15.1	0	0	0.00	0	0	0.00	0.00
15.2	26	0	592.96	362	751	0.87	0.00
15.3	26	0	573.19	485	748	0.87	0.00
15.4	1	0	141.00	141	141	0.03	0.00
MappingCRUD
16.0	0	0	0.00	0	0	0.00	0.00
16.1	0	0	0.00	0	0	0.00	0.00
16.2	27	0	544.07	382	669	0.90	0.00
16.3	27	0	582.37	418	700	0.90	0.00
16.4	1	0	123.00	123	123	0.03	0.00
OAuth2ClientCRUD
17.0	0	0	0.00	0	0	0.00	0.00
17.1	0	0	0.00	0	0	0.00	0.00
17.2	27	0	555.15	454	678	0.90	0.00
17.3	27	0	577.26	446	725	0.90	0.00
17.4	1	0	260.00	260	260	0.03	0.00
OAuth2Discovery
18.0	844	0	52.13	13	166	28.13	0.00
18.1	843	0	54.04	11	231	28.10	0.00
ScimRealmRead
19.0	0	0	0.00	0	0	0.00	0.00
19.1	17	0	568.82	445	701	0.57	0.00
19.2	17	0	582.00	468	718	0.57	0.00
19.3	18	0	604.61	457	734	0.60	0.00
ScimSync
20.0	0	0	0.00	0	0	0.00	0.00
20.1	0	0	0.00	0	0	0.00	0.00
20.2	0	0	0.00	0	0	0.00	0.00
20.3	1815	0	16.29	1	772	60.50	0.00
20.4	1814	0	0.00	0	0	60.47	0.00
20.5	1814	0	0.00	0	0	60.47	0.00
20.6	1	0	0.00	0	0	0.03	0.00
Aggregated	8974	0	152.86	1	2496	299.13	0.00

Scenario Metrics

Transaction	# Users	# Times Run	Average (ms)	Min (ms)	Max (ms)	Scenarios/s	Iterations
ReadHeavy	6	101	1788.08	1513	2052	3.37	16.83
TokenLifecycle	3	39	2233.87	1979	2496	1.30	13.00
ValidateToken	2	88	680.82	523	858	2.93	44.00
UserCRUD	2	100	600.55	459	801	3.33	50.00
ProjectCRUD	1	52	573.42	435	730	1.73	52.00
RoleCRUD	1	52	578.29	405	788	1.73	52.00
RoleList	2	103	575.93	436	769	3.43	51.50
RoleAssignmentList	3	39	2244.33	2069	2536	1.30	13.00
UserRead	4	99	1224.61	1017	1428	3.30	24.75
ProjectRead	3	77	1157.91	973	1411	2.57	25.67
PasswordAuth	4	54	2196.02	1658	2806	1.80	13.50
PasswordAuthNegative	1	32	931.22	511	1407	1.07	32.00
Rescope	2	93	645.02	481	842	3.10	46.50
RescopeNegative	1	55	542.24	402	756	1.83	55.00
SystemScopeAuth	2	50	1210.88	678	1769	1.67	25.00
ApiKeyCRUD	1	26	1175.27	1008	1314	0.87	26.00
MappingCRUD	1	26	1132.88	975	1296	0.87	26.00
OAuth2ClientCRUD	1	26	1133.38	958	1280	0.87	26.00
OAuth2Discovery	3	841	106.68	28	296	28.03	280.33
ScimRealmRead	1	17	1762.12	1537	1938	0.57	17.00
ScimSync	1	1814	16.30	1	772	60.47	1814.00
Aggregated	45	3784	354.72	1	2806	126.13	2704.08

Error Metrics

Method	Name	#	Error
GET	GET /SCIM/v2/:domain_id/Users (sync reconcile list)	48	401 Unauthorized: GET /SCIM/v2/:domain_id/Users (sync reconcile list)
POST	POST /SCIM/v2/:domain_id/Users (sync provision)	1	401 Unauthorized: POST /SCIM/v2/:domain_id/Users (sync provision)
POST	POST /v3/auth/tokens (password, invalid)	76	401 Unauthorized: POST /v3/auth/tokens (password, invalid)
POST	POST /v3/auth/tokens (rescope, invalid project)	144	401 Unauthorized: POST /v3/auth/tokens (rescope, invalid project)
GET	GET /v3/auth/tokens (validate revoked)	146	404 Not Found: GET /v3/auth/tokens (validate revoked)
GET	GET /SCIM/v2/:domain_id/Users (sync reconcile list)	1931	429 Too Many Requests: GET /SCIM/v2/:domain_id/Users (sync reconcile list)

View full report

github-actions · 2026-06-05T09:29:46Z

Bencher Report

Project	keystone
Branch	release-plz-2026-06-05T09-00-15Z
Testbed	ubuntu-latest

🚨 1 Alert

Benchmark	Measure Units	View	Benchmark Result (Result Δ%)	Upper Boundary (Limit %)
Command_Serde/apply/set	Latency microseconds (µs)	📈 plot 🚷 threshold 🚨 alert (🔔)	267.14 µs (+78.21%) Baseline: 149.90 µs	263.38 µs (101.43%)

Click to view all benchmark results

Benchmark	Latency	Benchmark Result nanoseconds (ns) (Result Δ%)	Upper Boundary nanoseconds (ns) (Limit %)
Command_Serde/apply/remove	📈 view plot 🚷 view threshold	134,430.00 ns (-5.27%) Baseline: 141,902.09 ns	271,411.94 ns (49.53%)
Command_Serde/apply/set	📈 view plot 🚷 view threshold 🚨 view alert (🔔)	267,140.00 ns (+78.21%) Baseline: 149,897.78 ns	263,382.65 ns (101.43%)
Command_Serde/pack/delete	📈 view plot 🚷 view threshold	101.96 ns (-14.77%) Baseline: 119.64 ns	168.17 ns (60.63%)
Command_Serde/pack/delete_index	📈 view plot 🚷 view threshold	92.33 ns (-14.00%) Baseline: 107.36 ns	146.08 ns (63.21%)
Command_Serde/pack/set	📈 view plot 🚷 view threshold	160.82 ns (-16.08%) Baseline: 191.63 ns	270.29 ns (59.50%)
Command_Serde/pack/set_index	📈 view plot 🚷 view threshold	92.23 ns (-14.54%) Baseline: 107.92 ns	148.50 ns (62.10%)
Command_Serde/unpack/delete	📈 view plot 🚷 view threshold	139.31 ns (-5.90%) Baseline: 148.04 ns	215.59 ns (64.62%)
Command_Serde/unpack/delete_index	📈 view plot 🚷 view threshold	119.77 ns (-4.88%) Baseline: 125.92 ns	182.40 ns (65.66%)
Command_Serde/unpack/set	📈 view plot 🚷 view threshold	205.22 ns (-10.74%) Baseline: 229.91 ns	339.75 ns (60.40%)
Command_Serde/unpack/set_index	📈 view plot 🚷 view threshold	118.63 ns (-5.39%) Baseline: 125.39 ns	181.15 ns (65.49%)
Payload_encryption/pack/remove_cmd	📈 view plot 🚷 view threshold	96.40 ns (-14.73%) Baseline: 113.05 ns	164.09 ns (58.75%)
Payload_encryption/pack/set_cmd	📈 view plot 🚷 view threshold	157.74 ns (-23.39%) Baseline: 205.91 ns	315.22 ns (50.04%)
Payload_encryption/unpack/remove_cmd	📈 view plot 🚷 view threshold	148.13 ns (-1.25%) Baseline: 150.00 ns	215.43 ns (68.76%)
Payload_encryption/unpack/set_cmd	📈 view plot 🚷 view threshold	205.18 ns (-12.71%) Baseline: 235.05 ns	350.25 ns (58.58%)
Raft_1Node_Latency/prefix/1node	📈 view plot 🚷 view threshold	1,848,900.00 ns (-44.74%) Baseline: 3,345,600.00 ns	7,279,849.57 ns (25.40%)
Raft_1Node_Latency/read/1node	📈 view plot 🚷 view threshold	26,816.00 ns (-23.78%) Baseline: 35,180.58 ns	51,069.86 ns (52.51%)
Raft_1Node_Latency/remove/1node	📈 view plot 🚷 view threshold	349,500.00 ns (-2.14%) Baseline: 357,141.72 ns	594,850.02 ns (58.75%)
Raft_1Node_Latency/write/1node	📈 view plot 🚷 view threshold	310,110.00 ns (-23.09%) Baseline: 403,209.38 ns	779,986.21 ns (39.76%)
build_snapshot/default	📈 view plot 🚷 view threshold	1,698.50 ns (-18.93%) Baseline: 2,095.00 ns	2,798.60 ns (60.69%)
fernet token/project	📈 view plot 🚷 view threshold	1,136.80 ns (-13.40%) Baseline: 1,312.72 ns	1,764.04 ns (64.44%)
get_data_keyspace	📈 view plot 🚷 view threshold	0.27 ns (-9.42%) Baseline: 0.30 ns	0.38 ns (71.30%)
get_db	📈 view plot 🚷 view threshold	0.27 ns (-9.13%) Baseline: 0.30 ns	0.38 ns (71.47%)
get_fernet_token_timestamp/project	📈 view plot 🚷 view threshold	112.43 ns (-15.76%) Baseline: 133.47 ns	179.64 ns (62.59%)
get_keyspace	📈 view plot 🚷 view threshold	3.52 ns (-44.60%) Baseline: 6.36 ns	15.35 ns (22.95%)

🐰 View full continuous benchmarking report in Bencher

github-actions · 2026-07-17T09:49:10Z

🧪 Tempest Identity Compatibility Results (advisory, non-blocking)

rust

Totals
======
Ran: 131 tests in 35.4800 sec.
 - Passed: 79
 - Skipped: 4
 - Expected Fail: 0
 - Unexpected Success: 0
 - Failed: 48
Sum of execute time for each test: 27.1416 sec.

Failed test IDs

===== FAILED TESTS (target=rust) =====
tempest.api.identity.admin.v3.test_credentials.CredentialsTestJSON.test_credentials_create_get_update_delete[id-7cd59bf9-bda4-4c72-9467-d21cab278355,smoke]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_create_domain_config_and_show_config_groups_and_options[id-9e3ff13c-f597-4f01-9377-d6c06c2a1477]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_create_update_and_delete_domain_config_groups_and_opts[id-c7510fa2-6661-4170-9c6b-4783a80651e9]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_show_default_group_config_and_options[id-11a02bf0-6f94-4380-b3b0-c8dc18fc0d22]
tempest.api.identity.admin.v3.test_default_project_id.TestDefaultProjectId.test_default_project_id[id-d6110661-6a71-49a7-a453-b5e26640ff6d]
setUpClass (tempest.api.identity.admin.v3.test_endpoint_groups.EndPointGroupsTest)
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_check_revoke_roles_on_projects_group[id-26021436-d5a4-4256-943c-ded01e0d4b45]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_check_revoke_roles_on_projects_user[id-18b70e45-7687-4b72-8277-b8f1a47d7591]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_check_revoke_roles_on_domains_group[id-c7a8dda2-be50-4fb4-9a9c-e830771078b1]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_check_revoke_roles_on_domains_user[id-4e6f0366-97c8-423c-b2be-41eae6ac91c8]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_revoke_user_roles_on_domain[id-3acf666e-5354-42ac-8e17-8b68893bcd36]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_revoke_user_roles_on_project_tree[id-9f02ccd9-9b57-46b4-8f77-dd5a736f3a06]
tempest.api.identity.admin.v3.test_groups.GroupsV3TestJSON.test_group_users_add_list_delete[id-1598521a-2f36-4606-8df9-30772bd51339,smoke]
tempest.api.identity.admin.v3.test_groups.GroupsV3TestJSON.test_list_user_groups[id-64573281-d26a-4a52-b899-503cb0f4e4ec]
tempest.api.identity.admin.v3.test_domains.DomainsTestJSON.test_domain_delete_cascades_content[id-d8d318b7-d1b3-4c37-94c5-3c5ba0b121ea]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_create_and_show_consumer[id-c8307ea6-a86c-47fd-ae7b-5b3b2caca76d]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_delete_consumer[id-fdfa1b7f-2a31-4354-b2c7-f6ae20554f93]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_list_consumers[id-09ca50de-78f2-4ffb-ac71-f2254036b2b8]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_update_consumer[id-080a9b1a-c009-47c0-9979-5305bf72e3dc]
tempest.api.identity.admin.v3.test_domains_negative.DomainsNegativeTestJSON.test_delete_active_domain[gate,id-1f3fbff5-4e44-400d-9ca1-d953f05f609b,negative]
tempest.api.identity.admin.v3.test_projects.ProjectsTestJSON.test_create_is_domain_project[id-a7eb9416-6f9b-4dbb-b71b-7f73aaef59d5]
tempest.api.identity.admin.v3.test_projects.ProjectsTestJSON.test_project_create_with_parent[id-1854f9c0-70bc-4d11-a08a-1c789d339e3d]
tempest.api.identity.admin.v3.test_list_projects.ListProjectsTestJSON.test_list_projects_with_parent[id-6edc66f5-2941-4a17-9526-4073311c1fac]
setUpClass (tempest.api.identity.admin.v3.test_services.ServicesTestJSON)
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_api_media_types[id-657c1970-4722-4189-8831-7325f3bc4265,smoke]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_api_version_resources[id-b9232f5e-d9e5-4d97-b96c-28d3db4de1bd,smoke]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_identity_v3_existence[id-79aec9ae-710f-4c54-a4fc-3aa25b4feac3]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_list_api_versions[id-721f480f-35b6-46c7-846e-047e6acea0dc,smoke]
tempest.api.identity.admin.v3.test_tokens.TokensV3TestJSON.test_get_available_domain_scopes[id-ec5ecb05-af64-4c04-ac86-4d9f6f12f185]
tempest.api.identity.admin.v3.test_tokens.TokensV3TestJSON.test_rescope_token[id-565fa210-1da1-4563-999b-f7b5b67cf112]
tempest.api.identity.admin.v3.test_project_tags.IdentityV3ProjectTagsTest.test_list_update_delete_project_tags[id-7c123aac-999d-416a-a0fb-84b915ab10de]
tempest.api.identity.admin.v3.test_users_negative.UsersNegativeTest.test_create_user_for_non_existent_domain[id-e75f006c-89cc-477b-874d-588e4eab4b17,negative]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_get_trusts_all[id-4773ebd5-ecbf-4255-b8d8-b63e6f72b65d,smoke]
tempest.api.identity.v3.test_tokens.TokensV3Test.test_validate_token[id-a9512ac3-3909-48a4-b395-11f438e16260]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_get_trusts_query[id-6268b345-87ca-47c0-9ce3-37792b43403a]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_expire[id-0ed14b66-cefd-4b5c-a964-65759453e292]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_create_application_credential_expires[id-852daf0c-42b5-4239-8466-d193d0543ed3]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_assignments_for_domain_roles[id-3859df7e-5b78-4e4d-b10e-214c8953842a]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_assignments_for_implied_roles_create_delete[id-c8828027-df48-4021-95df-b65b92c7429e]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_group_on_domain[id-4bf8a70b-e785-413a-ad53-9f91ce02faa7]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_group_on_project[id-cbf11737-1904-4690-9613-97bcbb3df1c4]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_impersonate[id-5a0a91a4-baef-4a14-baba-59bf4d7fcace]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_user_on_domain[id-6c9a2940-3625-43a3-ac02-5dcec62ef3bd]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_implied_domain_roles[id-eb1e1c24-1bc4-4d47-9748-e127a1852c82]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_implied_roles_create_check_show_delete[id-c90c316c-d706-4728-bcba-eb1912081b69]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_role_create_update_show_list[id-18afc6c0-46cf-4911-824e-9989cc056c3a,smoke]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_noimpersonate[id-ed2a8779-a7ac-49dc-afd7-30f32f936ed2]
tempest.api.identity.v3.test_catalog.IdentityCatalogTest.test_catalog_standardization[id-56b57ced-22b8-4127-9b8a-565dfb0207e2]
===== END FAILED TESTS (target=rust) =====

View full run

openstack-experimental-release-plz Bot force-pushed the release-plz-2026-06-05T09-00-15Z branch 22 times, most recently from d04a4df to 7fe2614 Compare June 12, 2026 09:11

openstack-experimental-release-plz Bot force-pushed the release-plz-2026-06-05T09-00-15Z branch 6 times, most recently from 3966098 to 805ed8e Compare June 15, 2026 10:08

openstack-experimental-release-plz Bot force-pushed the release-plz-2026-06-05T09-00-15Z branch 28 times, most recently from fd0af7c to 53568cd Compare June 26, 2026 20:00

chore: release

a63adad

Navigation Menu

Repository navigation

chore: release - #754

chore: release#754
openstack-experimental-release-plz[bot] wants to merge 1 commit into
mainfrom
release-plz-2026-06-05T09-00-15Z

openstack-experimental-release-plz Bot commented Jun 5, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 5, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jun 5, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Jul 17, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

0 participants

Conversation

openstack-experimental-release-plz Bot commented Jun 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

🤖 New release

oslo-config

0.1.0 - 2026-10-11

Added

openstack-keystone-telemetry

0.1.0 - 2026-10-11

Added

cadf

0.1.0 - 2026-10-11

Added

Fixed

Other

openstack-keystone-config

0.1.0 - 2026-10-11

Added

Fixed

Other

openstack-keystone-core-types

0.1.1 - 2026-10-11

Added

Fixed

Other

openstack-keystone-api-types

0.1.1 - 2026-10-11

Added

Fixed

Other

openstack-keystone-auth-plugin-core

0.1.0 - 2026-10-11

Other

openstack-keystone-key-repository

0.1.0 - 2026-10-11

Added

Fixed

Other

openstack-keystone-local-emergency-store

0.1.0 - 2026-10-11

Added

Other

openstack-keystone-storage-api

0.1.0 - 2026-10-11

Added

Fixed

Other

openstack-keystone-core

0.1.2 - 2026-10-11

Added

Fixed

Other

Uh oh!

github-actions Bot commented Jun 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Goose Attack Report

Plan Overview

Request Metrics

Response Time Metrics

Status Code Metrics

Transaction Metrics

Scenario Metrics

Error Metrics

Uh oh!

github-actions Bot commented Jun 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Bencher Report

🚨 1 Alert

Uh oh!

github-actions Bot commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This branch has not been deployed

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

openstack-experimental-release-plz Bot commented Jun 5, 2026 •

edited

Loading

`oslo-config`

`openstack-keystone-telemetry`

`cadf`

`openstack-keystone-config`

`openstack-keystone-core-types`

`openstack-keystone-api-types`

`openstack-keystone-auth-plugin-core`

`openstack-keystone-key-repository`

`openstack-keystone-local-emergency-store`

`openstack-keystone-storage-api`

`openstack-keystone-core`

github-actions Bot commented Jun 5, 2026 •

edited

Loading

github-actions Bot commented Jun 5, 2026 •

edited

Loading

github-actions Bot commented Jul 17, 2026 •

edited

Loading