chore: release

[openstack-experimental-release-plz]

🤖 New release

• openstack-keystone-config: 0.1.0
• openstack-keystone-core-types: 0.1.1
• openstack-keystone-api-types: 0.1.0 -> 0.1.1 (✓ API compatible changes)
• openstack-keystone-audit: 0.1.0
• openstack-keystone-auth-plugin-core: 0.1.0
• openstack-keystone-key-repository: 0.1.0
• openstack-keystone-local-emergency-store: 0.1.0
• openstack-keystone-metrics: 0.1.0
• openstack-keystone-storage-api: 0.1.0
• openstack-keystone-core: 0.1.1 -> 0.1.2 (✓ API compatible changes)
• openstack-keystone-storage-crypto: 0.1.0
• openstack-keystone-storage-crypto-pkcs11: 0.1.0
• openstack-keystone-storage-crypto-tpm: 0.1.0
• openstack-keystone-distributed-storage: 0.1.0 -> 0.1.1 (✓ API compatible changes)
• openstack-keystone-api-key-driver-raft: 0.1.0
• openstack-keystone-auth-plugin-runtime: 0.1.0
• openstack-keystone-password-hashing: 0.1.0
• openstack-keystone-appcred-driver-sql: 0.1.0
• openstack-keystone-assignment-driver-sql: 0.1.0
• openstack-keystone-assignment-driver-openfga: 0.1.0
• openstack-keystone-catalog-driver-sql: 0.1.0
• openstack-keystone-credential-driver-sql: 0.1.0
• openstack-keystone-auth-plugin-identity-driver-raft: 0.1.0
• openstack-keystone-domain-config-driver-fs: 0.1.0
• openstack-keystone-domain-config-driver-sql: 0.1.0
• openstack-keystone-federation-driver-sql: 0.1.0
• openstack-keystone-identity-driver-ldap: 0.1.0
• openstack-keystone-identity-driver-sql: 0.1.0
• openstack-keystone-idmapping-driver-sql: 0.1.0
• openstack-keystone-k8s-auth-driver-raft: 0.1.0
• openstack-keystone-k8s-auth-driver-sql: 0.1.0
• openstack-keystone-mapping-driver-raft: 0.1.0
• openstack-keystone-oauth2-client-driver-raft: 0.1.0
• openstack-keystone-oauth2-key-driver-raft: 0.1.0
• openstack-keystone-oauth2-session-driver-raft: 0.1.0
• openstack-keystone-policy-store-driver-sql: 0.1.0
• openstack-keystone-resource-driver-sql: 0.1.0
• openstack-keystone-revoke-driver-sql: 0.1.0
• openstack-keystone-role-driver-sql: 0.1.0
• openstack-keystone-scim-driver-raft: 0.1.0
• openstack-keystone-token-driver-fernet: 0.1.1
• openstack-keystone-token-driver-jws: 0.1.0
• openstack-keystone-token-restriction-driver-sql: 0.1.0
• openstack-keystone-trust-driver-sql: 0.1.0
• openstack-keystone-webauthn: 0.1.0
• openstack-keystone: 0.1.1 -> 0.1.2 (✓ API compatible changes)
• openstack-keystone-cli-manage: 0.1.0

Changelog

openstack-keystone-config

0.1.0 - 2026-09-04

Added

• (assignment) Add OpenFGA assignment driver (#1206)
• (domain-config) Add resolution layer (#1199)
• (domain-config) Add filesystem driver (#1197)
• (spiffe) Derive spiffe claims (#1193)
• Add vendor data JWT API for SPIRE integration (#1192)
• (core) Reconnect database connection on new config (#1188)
• (policy) Implement legacy Policy API (/v3/policies) (#1127)
• Add domain config types and backend trait (#1138)
• (adr0031) Add HTTP request metrics (#1134)
• (config) Support configurable log file rotation (#1128)
• Add connection_debug to tune SQL query logging (#1109)
• (pagination) Add pagination to remaining places (#1106)
• (config) Revoke Vault token on shutdown (#1088)
• Generalize marker pagination for v3/v4 lists (#1086)
• (config) Add Vault-backed configuration (#1051)
• (logging) Add native journald log writer (#1081)
• (identity) Add PATCH to few resources (#1076)
• (ldap) Add LDAP identity driver (#1047)
• (adr0028) Add local-quorum-bypass emergency rotation (#1032)
• Add catalog CRUD API and bootstrap support (#1029)
• (adr0026) Add RFC 8628 Device Authorization Grant (#1023)
• (adr0026) Add authorization code flow with PKCE (#1015)
• (adr0026) Add client_credentials token endpoint (#1014)
• (adr0026) Phase 2 client registration & OIDC discovery (#1013)
• (adr0026) Phase 0 token abstraction and JWS driver (#1010)
• (api) capture client IP via proxy headers & SPIFFE (Start capturing client information in the request processing #358 follow-up) (#908)
• (identity) Add per-user auth rate limiting (#996)
• (adr0025) Complete imlpementation (#969)
• (api) Add global IP rate limiting framework (ADR-0022 phase 1) (#846)
• (scim) Harden RFC 7644 compliance, add docs (#968)
• (adr0025) Phase 1 (1.1+1.2) (#952)
• (security) Wrap secrets with secrecy crate (#369) (#912)
• (scim) ADR 0024 - Phase 5 (#951)
• (scim) ADR 0024 - Phase 1+2 (#925)
• (fernet) Unify credential/token key repositories (#915)
• Start ADR 0025 immplementation (#911)
• (credential) Implement Phase 3 of ADR 0019 (#909)
• Prepare PKCS#11/TPM KEK support in storage (#907)
• (credential) Implement ADR 0019 phases 1-2 (#897)
• Implement stateless SCIM ingress auth (ADR 0021) (#891)
• (auth) Password hashing parity with Python Keystone (#859)
• (audit) Implement CADF audit framework Phase 2 (#872)
• (storage) SPIFFE checks, RBAC, rate limiting, auto-join (#861)
• (storage) Harden preflight and erase dev KEK (#860)
• Add bootstrap cli command (#809)
• (mapping) ADR-0020 (mapping engine) phase 1 (#794)
• Add inter-provider event notification system (#784)
• Add SO_PEERCRED peer credential validation (#775)
• Validate password for compliance conformity (#774)
• Enforce minimum range boundaries for security
• Add role-imply rest api (#750)
• Add user update functionality (#747)
• Make drivers more dynamic (#737)
• Add keystone container with opa and policies (#738)
• Add Admin interface over the UDS (#735)
• Add spiffe provider (#733)
• Introduce SecurityContext (#710)
• Add skeleton for the spiffe mTLS integration (#695)
• Implement ConfigManager for config watching (#691)
• Improve the code (#686)
• Add k8s-auth raft driver (#676)
• Add raft support under skaffold (#667)
• Introduce raft backend for webauthn (#658)
• Introduce the keystone-manage cli managing raft (#656)

Fixed

• Avoid blocking notify's event thread in watch_loop (#1125)
• Fix flaky test (#1110)
• (security) Address security review findings (#1049)
• (passkey) Prevent user enumeration (#905)

Other

• (config) Fix flaky notify watcher tests (#1112)
• Revise documentation layout (#1069)
• Moves health and metrics endpoints to dedicated listener on separate port (#910)
• Move jsonwebtoken to keystone crate (#820)
• mapping engine phase 3 - migrate SPIFFE (#811)
• Rename identity_mapping to idmapping (#788)
• Replace Regex with str::find for db connection (#760)
• Redesign SecurityContext with two-phase validation (#717)
• Split out remaining sql drivers (#633)
• Split config into standalone crate (#628)

openstack-keystone-core-types

0.1.1 - 2026-09-04

Added

• (assignment) Add OpenFGA assignment driver (#1206)
• (idmapping) Add id-mapping write paths (#1205)
• (domain-config) Dispatch identity ops per domain (#1202)
• (domain-config) Add resolution layer (#1199)
• (domain-config) Add filesystem driver (#1197)
• Add vendor data JWT API for SPIRE integration (#1192)
• Add domain config SQL driver (#1139)
• (policy) Implement legacy Policy API (/v3/policies) (#1127)
• Add domain config types and backend trait (#1138)
• Add cargo-fuzz targets (#1130)
• Add OS-EP-FILTER provider CRUD to the catalog (#1075)
• (pagination) Add pagination to remaining places (#1106)
• Add immutable option for project, domain, role (#1097)
• Generalize marker pagination for v3/v4 lists (#1086)
• (identity) Add trust create/delete and REST CRUD (#1079)
• (catalog) Expose /v3/regions REST API (#1078)
• (identity) Add PATCH to few resources (#1076)
• (ldap) Add LDAP identity driver (#1047)
• (test) Add tempest identity compatibility (#998)
• (adr0028) Add local-quorum-bypass emergency rotation (#1032)
• Add catalog CRUD API and bootstrap support (#1029)
• (adr0026) Add RFC 8628 Device Authorization Grant (#1023)
• (adr0026) Phase 6a (#1017)
• (adr0026) Add Phase 5 offline token verification (#1016)
• (adr0026) Add authorization code flow with PKCE (#1015)
• (adr0026) Add client_credentials token endpoint (#1014)
• (adr0026) Phase 2 client registration & OIDC discovery (#1013)
• (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
• (adr0026) Phase 0 token abstraction and JWS driver (#1010)
• (identity) Add per-user auth rate limiting (#996)
• (adr0025) Complete imlpementation (#969)
• (api) Add global IP rate limiting framework (ADR-0022 phase 1) (#846)
• (adr0025) Phase 1 (1.1+1.2) (#952)
• (security) Wrap secrets with secrecy crate (#369) (#912)
• (scim) ADR 0024 - Phase 4 (protocol surface completion) (#929)
• (scim) ADR 0024 - Phase 3 (#928)
• (scim) ADR 0024 - Phase 1+2 (#925)
• (credential) Implement Phase 3 of ADR 0019 (#909)
• (credential) Implement ADR 0019 phases 1-2 (#897)
• Implement stateless SCIM ingress auth (ADR 0021) (#891)
• Audit framework (ADR-0023) phase 3 (#880)
• (audit) Implement CADF audit framework Phase 2 (#872)
• Migrate federation to new mapping engine (#839)
• Add access rule CRD to appcred provider (#806)
• ADR-0020 mapping phase 4 (#818)
• (mapping) ADR-0020 (mapping engine) phase 1 (#794)
• Add endpoint CRUD to catalog provider (#785)
• Add inter-provider event notification system (#784)
• Add service CRUD to the catalog provider (#773)
• Validate password for compliance conformity (#774)
• Return 401 on roleless scoped contexts (#742)
• Add region CRUD to catalog SQL driver (#761)
• Add role-imply rest api (#750)
• Add role imply API (#749)
• Add user update functionality (#747)
• Add spiffe binding API (#740)
• Add Admin interface over the UDS (#735)
• Add spiffe provider (#733)
• Expand role info in expand_implied_roles (#730)
• Introduce SecurityContext (#710)
• Improve the code (#686)
• Add k8s-auth raft driver (#676)
• Introduce the keystone-manage cli managing raft (#656)

Fixed

• Use proper token issued_at time (#1194)
• Register UserType in OpenAPI components schema (#1151)
• Fix ID sanitizer and capture client IP in audit (#1126)
• (api) Default enabled/domain_id on create (#1073)
• (security) Address security review findings (#1049)
• (federation) Allow long external unique_id values (#1033)
• Unify ApiClient scope validation, fix nextest filter (#947)
• Finalize ADR 0021 work (#906)
• Resolve raft replication state races (#884)
• (k8s_auth) Flatten k8s.aud claim from JWT TokenReview (#834)
• Align "extra" property handling (#787)

Other

• (api) Harden v3 authorization and authentication coverage (#1166)
• (identity) Remove service account API methods (#1152)
• Extend workspace unsafe/unwrap/expect lints (#1120)
• Revise documentation layout (#1069)
• (security) Close mutation-testing gaps in auth/policy (#1056)
• Move jsonwebtoken to keystone crate (#820)
• mapping engine phase 3 - migrate SPIFFE (#811)
• Rename identity_mapping to idmapping (#788)
• Make resolve_implied_roles optional (#764)
• Redesign SecurityContext with two-phase validation (#717)
• Unify state initialization in test (#642)
• Small optimization of the derives (#638)
• Split the core-types crate (#640)

openstack-keystone-api-types

0.1.1 - 2026-09-04

Added

• (assignment) Add OpenFGA assignment driver (#1206)
• (domain-config) Dispatch identity ops per domain (#1202)
• (domain-config) Add configuration API (#1201)
• Add vendor data JWT API for SPIRE integration (#1192)
• (api) Log response body for all 4xx/5xx errors (#1171)
• (api) Log error details in IntoResponse (#1169)
• (policy) Implement legacy Policy API (/v3/policies) (#1127)
• Filter user listing by type (#813)
• (loadtest) Add more auth tests (#1119)
• (pagination) Add pagination to remaining places (#1106)
• Add immutable option for project, domain, role (#1097)
• Generalize marker pagination for v3/v4 lists (#1086)
• (identity) Add trust create/delete and REST CRUD (#1079)
• (catalog) Expose /v3/regions REST API (#1078)
• (identity) Add PATCH to few resources (#1076)
• (ldap) Add LDAP identity driver (#1047)
• (test) Add tempest identity compatibility (#998)
• (adr0028) Add local-quorum-bypass emergency rotation (#1032)
• Add catalog CRUD API and bootstrap support (#1029)
• (adr0026) Extend keystone-manage oauth2 CLI (#1020)
• (adr0026) Phase 6a (#1017)
• (adr0026) Add client_credentials token endpoint (#1014)
• (adr0026) Phase 2 client registration & OIDC discovery (#1013)
• (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
• (identity) Add per-user auth rate limiting (#996)
• (adr0025) Complete imlpementation (#969)
• (identity) Implement user password change endpoint (#970)
• (api) Add global IP rate limiting framework (ADR-0022 phase 1) (#846)
• (adr0025) Phase 1 (1.1+1.2) (#952)
• (security) Wrap secrets with secrecy crate (#369) (#912)
• (scim) ADR 0024 - Phase 5 (#951)
• (scim) ADR 0024 - Phase 1+2 (#925)
• (credential) Implement Phase 3 of ADR 0019 (#909)
• ADR 0021 admin surface, simulate-access, and janitor (#896)
• Implement stateless SCIM ingress auth (ADR 0021) (#891)
• Migrate federation to new mapping engine (#839)
• ADR-0020 mapping phase 4 (#818)
• (mapping) ADR-0020 phase 2 (#807)
• (mapping) ADR-0020 (mapping engine) phase 1 (#794)
• Validate password for compliance conformity (#774)
• Add system-user-role assignments API (#762)
• Add role-imply rest api (#750)
• Add user update functionality (#747)
• Add api to list user roles on project (#639)
• Add domain CRUD operations (#743)
• Add spiffe binding API (#740)
• Add spiffe provider (#733)
• Introduce SecurityContext (#710)
• Add skeleton for the spiffe mTLS integration (#695)
• Improve the code (#686)

Fixed

• (types) Remove invalid PartialEq from AppCred wrappers (#1191)
• (logging) Surface 5xx causes at error level (#1172)
• Register UserType in OpenAPI components schema (#1151)
• Map raft-not-available to proper HTTP status codes (#1149)
• (api) Fix pagination limit, filters, and rows (#1115)
• Address multiple tempest failures (#1083)
• (api) Default enabled/domain_id on create (#1073)
• (security) Address security review findings (#1049)
• (federation) Allow long external unique_id values (#1033)
• Unify ApiClient scope validation, fix nextest filter (#947)
• Finalize ADR 0021 work (#906)

Other

• (api) Harden v3 authorization and authentication coverage (#1166)
• (identity) Remove service account API methods (#1152)
• Feature/expose app credential (#948)
• (api) Expand v3 coverage and enforce EC2 token restrictions (#1084)
• Extend workspace unsafe/unwrap/expect lints (#1120)
• (test) Improve testing of the oauth2 OP (#1024)
• Move jsonwebtoken to keystone crate (#820)
• (tests) Reorganize integration_api tests (#815)
• mapping engine phase 3 - migrate SPIFFE (#811)
• Rename identity_mapping to idmapping (#788)
• Further align workspace features (#772)
• Make resolve_implied_roles optional (#764)
• Redesign SecurityContext with two-phase validation (#717)
• Small optimization of the derives (#638)
• Split the core-types crate (#640)
• Introduce features in api-types crate (#624)
• Slim down api-types crate (#622)

openstack-keystone-audit

0.1.0 - 2026-09-04

Added

• (audit) Complete ADR-0023 audit implementation (#887)
• Audit framework (ADR-0023) phase 3 (#880)
• (audit) Implement CADF audit framework Phase 2 (#872)

Fixed

• Fix ID sanitizer and capture client IP in audit (#1126)

Other

• Extend workspace unsafe/unwrap/expect lints (#1120)

openstack-keystone-auth-plugin-core

0.1.0 - 2026-09-04

Other

• Split extism out of core's dependency tree (#1148)

openstack-keystone-key-repository

0.1.0 - 2026-09-04

Added

• (adr0026) Add previous-key and JTI-revocation janitor (#1021)
• (adr0026) Add Phase 5 offline token verification (#1016)
• (adr0026) Add client_credentials token endpoint (#1014)
• (adr0026) Phase 0 token abstraction and JWS driver (#1010)
• (scim) ADR 0024 - Phase 1+2 (#925)
• (fernet) Unify credential/token key repositories (#915)

Fixed

• Widen Fernet key index from i8 to u32 (#1080)
• Support macOS dev builds and fs watcher shutdown (#1009)

Other

• (deps) bump pem from 3.0.6 to 4.0.0 (#1162)
• (deps) bump pkcs8 from 0.10.2 to 0.11.0 (#1061)

openstack-keystone-local-emergency-store

0.1.0 - 2026-09-04

Added

• (test) Add tempest identity compatibility (#998)
• (adr0028) Add local-quorum-bypass emergency rotation (#1032)

Other

• Extend workspace unsafe/unwrap/expect lints (#1120)

openstack-keystone-metrics

0.1.0 - 2026-09-04

Added

• (metrics) Add shared Prometheus primitives crate (#1186)

openstack-keystone-storage-api

0.1.0 - 2026-09-04

Added

• (storage) Add ephemeral state machine records (#1198)
• (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
• (storage) Cert validity and SVID TTL enforcement (#886)
• (storage) SPIFFE checks, RBAC, rate limiting, auto-join (#861)
• (storage) Complete ADR-0016-v2 (#844)
• (storage) implement ADR 0016-v2 Phases 1-4 — encrypted storage with quarantine (#840)

Fixed

• (webauthn) Rotate raft ceremony-state keyspaces (#890)

Other

• Extend workspace unsafe/unwrap/expect lints (#1120)
• (storage) Decouple core from storage (#832)

openstack-keystone-core

0.1.2 - 2026-09-04

Added

• (assignment) Add OpenFGA assignment driver (#1206)
• (idmapping) Add id-mapping write paths (#1205)
• (domain-config) Dispatch identity ops per domain (#1202)
• (domain-config) Add configuration API (#1201)
• (domain-config) Add resolution layer (#1199)
• (spiffe) Derive spiffe claims (#1193)
• Add vendor data JWT API for SPIRE integration (#1192)
• (core) Reconnect database connection on new config (#1188)
• (metrics) Add shared Prometheus primitives crate (#1186)
• Add domain config SQL driver (#1139)
• (policy) Implement legacy Policy API (/v3/policies) (#1127)
• Add domain config types and backend trait (#1138)
• Add SCIM scenarios; Fix findings (#1136)
• Add cargo-fuzz targets (#1130)
• Add SPIFFE SVID health check to readiness probe (#1121)
• Add OS-EP-FILTER provider CRUD to the catalog (#1075)
• Add per-request cache framework (ADR 0030) (#1114)
• Auto-register backend drivers via inventory (#1105)
• Add immutable option for project, domain, role (#1097)
• (config) Revoke Vault token on shutdown (#1088)
• (identity) Add trust create/delete and REST CRUD (#1079)
• (identity) Add PATCH to few resources (#1076)
• (tempest) Improve tempest testing (#1046)
• (test) Add tempest identity compatibility (#998)
• (adr0028) Add local-quorum-bypass emergency rotation (#1032)
• (adr0026) Add RFC 8628 Device Authorization Grant (#1023)
• (adr0026) Add previous-key and JTI-revocation janitor (#1021)
• (adr0026) Phase 6a (#1017)
• (adr0026) Add Phase 5 offline token verification (#1016)
• (adr0026) Add authorization code flow with PKCE (#1015)
• (adr0026) Add client_credentials token endpoint (#1014)
• (adr0026) Phase 2 client registration & OIDC discovery (#1013)
• (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
• (adr0026) Phase 0 token abstraction and JWS driver (#1010)
• (api) capture client IP via proxy headers & SPIFFE (Start capturing client information in the request processing #358 follow-up) (#908)
• (identity) Add per-user auth rate limiting (#996)
• (adr0025) Complete imlpementation (#969)
• (api) Add global IP rate limiting framework (ADR-0022 phase 1) (#846)
• (adr0025) Phase 1 (1.1+1.2) (#952)
• (security) Wrap secrets with secrecy crate (#369) (#912)
• (scim) ADR 0024 - Phase 5 (#951)
• (scim) ADR 0024 - Phase 4 (protocol surface completion) (#929)
• (scim) ADR 0024 - Phase 3 (#928)
• (scim) ADR 0024 - Phase 1+2 (#925)
• (credential) Implement Phase 3 of ADR 0019 (#909)
• (credential) Implement ADR 0019 phases 1-2 (#897)
• ADR 0021 admin surface, simulate-access, and janitor (#896)
• Implement stateless SCIM ingress auth (ADR 0021) (#891)
• (audit) Complete ADR-0023 audit implementation (#887)
• (storage) Cert validity and SVID TTL enforcement (#886)
• Audit framework (ADR-0023) phase 3 (#880)
• (auth) Password hashing parity with Python Keystone (#859)
• (audit) Implement CADF audit framework Phase 2 (#872)
• Migrate federation to new mapping engine (#839)
• Add access rule CRD to appcred provider (#806)
• ADR-0020 mapping phase 4 (#818)
• Add bootstrap cli command (#809)
• (mapping) ADR-0020 (mapping engine) phase 1 (#794)
• Add endpoint CRUD to catalog provider (#785)
• Add inter-provider event notification system (#784)
• Add service CRUD to the catalog provider (#773)
• Validate password for compliance conformity (#774)
• Return 401 on roleless scoped contexts (#742)
• Add region CRUD to catalog SQL driver (#761)
• Add timing attack protection and failed auth tracking (#758)
• Add role-imply rest api (#750)
• Add role imply API (#749)
• Add user update functionality (#747)
• Add domain CRUD operations (#743)
• Add spiffe binding API (#740)
• Normalize the policy enforcer structure (#741)
• Make drivers more dynamic (#737)
• Add Admin interface over the UDS (#735)
• Add spiffe provider (#733)
• Expand role info in expand_implied_roles (#730)
• Introduce SecurityContext (#710)
• Talk to OPA over unix socket (#701)
• Add skeleton for the spiffe mTLS integration (#695)
• Implement ConfigManager for config watching (#691)
• Improve the code (#686)
• Add k8s-auth raft driver (#676)
• Add basic healthcheck endpoint (#671)
• Make raft storage available through state (#657)

Fixed

• Use proper token issued_at time (#1194)
• (logging) Surface 5xx causes at error level (#1172)
• Register UserType in OpenAPI components schema (#1151)
• (api) Fix pagination limit, filters, and rows (#1115)
• Fix ID sanitizer and capture client IP in audit (#1126)
• (api) Default enabled/domain_id on create (#1073)
• (security) Do not allow ec2cred token to do anything (#1071)
• (security) Address security review findings (#1049)
• (adr0026) Bind Token Exchange grant to the issuing domain (#1019)
• Unify ApiClient scope validation, fix nextest filter (#947)
• Finalize ADR 0021 work (#906)
• (ci) Prepare workflows for merge queue (#902)
• Resolve raft replication state races (#884)
• (core) Eliminate mapping race condition (#876)
• (k8s_auth) Flatten k8s.aud claim from JWT TokenReview (#834)
• (auth) Close admin SVID impersonation gap (#833)

Other

• (deps) Bump argon2 from 0.5.3 to 0.6.0 (#1184)
• (identity) Remove service account API methods (#1152)
• Feature/expose app credential (#948)
• (api) Expand v3 coverage and enforce EC2 token restrictions (#1084)
• Split extism out of core's dependency tree (#1148)
• Add SECURITY note to important method (#1132)
• Extend workspace unsafe/unwrap/expect lints (#1120)
• (db) 3 optimizations for DB queries (#1111)
• (deps) Bump sea-orm and sea-orm-migration to 2.0 (#1089)
• Revise documentation layout (#1069)
• (security) Close mutation-testing gaps in auth/policy (#1056)
• Extract password hashing into own crate (#1055)
• (test) Improve testing of the oauth2 OP (#1024)
• (deps) bump scrypt from 0.11.0 to 0.12.0 (#923)
• Reorganize dockerfile and deps (#857)
• (core) Remove spiffe crate dependency (#858)
• Wrap ServiceState under ExecutionContext (#856)
• (storage) Decouple core from storage (#832)
• (core) Eliminate XxxProvider enums (#830)
• Move jsonwebtoken to keystone crate (#820)
• mapping engine phase 3 - migrate SPIFFE (#811)
• (deps) bump hmac from 0.12.1 to 0.13.0 (#801)
• Rename identity_mapping to idmapping (#788)
• Consolidate password update flows (#778)
• Further align workspace features (#772)
• Make resolve_implied_roles optional (#764)
• Redesign SecurityContext with two-phase validation (#717)
• (deps) bump jsonwebtoken from 10.3.0 to 10.4.0 (#707)
• Introduce dynamic plugins (#643)
• Small optimization of the derives (#638)
• Split the core-types crate (#640)
• Split out remaining sql drivers (#633)
• Split more drivers to separate crates (#632)
• Drop unnecessary derives to help compilation (#631)
• Drop unnecessary tracing directives (#627)
• Split config into standalone crate (#628)
• Rework http client pool (#629)
• Make assignment sql driver a standalone crate (#626)
• Move assignment parameters resolution to driver (#625)
• Introduce features in api-types crate (#624)
• Slim down api-types crate (#622)
• Split out webauthn into crate (#621)
• Split out token-fernet driver (#620)
• Prepare slit out of the FernetTokenProvider (#619)
• Move benchmark into the proper crate (#614)

openstack-keystone-storage-crypto

0.1.0 - 2026-09-04

Added

• (scim) ADR 0024 - Phase 3 (#928)
• (storage) Add PKCS#11 KEK provider crate (#917)
• (storage) Cert validity and SVID TTL enforcement (#886)
• (audit) Implement CADF audit framework Phase 2 (#872)
• (storage) SPIFFE checks, RBAC, rate limiting, auto-join (#861)
• (storage) Harden preflight and erase dev KEK (#860)
• (storage) Complete ADR-0016-v2 (#844)
• (storage) implement ADR 0016-v2 Phases 1-4 — encrypted storage with quarantine (#840)

Other

• Bump deps and whitelist rustsec advisory (#1140)
• (deps) Batch update dependencies (#875)

openstack-keystone-storage-crypto-pkcs11

0.1.0 - 2026-09-04

Added

• (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
• (storage) Add PKCS#11 KEK provider crate (#917)

Other

• Extend workspace unsafe/unwrap/expect lints (#1120)

openstack-keystone-storage-crypto-tpm

0.1.0 - 2026-09-04

Added

• (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
• (storage) Add PKCS#11 KEK provider crate (#917)

Other

• Extend workspace unsafe/unwrap/expect lints (#1120)

openstack-keystone-distributed-storage

0.1.1 - 2026-09-04

Added

• (storage) Add ephemeral state machine records (#1198)
• (metrics) Add shared Prometheus primitives crate (#1186)
• Add SCIM scenarios; Fix findings (#1136)
• (test) Add tempest identity compatibility (#998)
• (adr0028) Add local-quorum-bypass emergency rotation (#1032)
• (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
• (storage) Add PKCS#11 KEK provider crate (#917)
• Prepare PKCS#11/TPM KEK support in storage (#907)
• Implement background DEK re-encryption pipeline (#898)
• ADR 0021 admin surface, simulate-access, and janitor (#896)
• (storage) Cert validity and SVID TTL enforcement (#886)
• (storage) SPIFFE checks, RBAC, rate limiting, auto-join (#861)
• (storage) Harden preflight and erase dev KEK (#860)
• (storage) Add SPIFFE mTLS support to Raft gRPC (#852)
• (cli) Add cli storage subcommands per ADR 0016-v2 (#850)
• (storage) Complete ADR-0016-v2 (#844)
• (storage) implement ADR 0016-v2 Phases 1-4 — encrypted storage with quarantine (#840)
• (mapping) ADR-0020 phase 2 (#807)
• (adr) Add updated revision of the DS ADR (#795)
• (mapping) ADR-0020 (mapping engine) phase 1 (#794)
• Add skeleton for the spiffe mTLS integration (#695)
• Implement ConfigManager for config watching (#691)
• Improve the code (#686)
• Add k8s-auth raft driver (#676)
• Add SetIndex/RemoveIndex storage commands (#675)
• Add basic healthcheck endpoint (#671)
• Add metadata for raft data (#670)
• Add transaction support for Raft storage (#669)
• Add initial benchmarks for the storage (#668)
• Add raft support under skaffold (#667)
• Introduce raft backend for webauthn (#658)
• Prepare raft storage promotion (#659)
• Make raft storage available through state (#657)
• Introduce the keystone-manage cli managing raft (#656)

Fixed

• Support macOS dev builds and fs watcher shutdown (#1009)
• Finalize ADR 0021 work (#906)
• (ci) Prepare workflows for merge queue (#902)
• Further polish storage crate (#892)
• (webauthn) Rotate raft ceremony-state keyspaces (#890)
• Resolve raft replication state races (#884)

Other

• Bump openraft version to 0.10.0.a31 (#1137)
• Silence some clippy warnings (#1030)
• (deps) Batch update dependencies (#875)
• (core) Remove spiffe crate dependency (#858)
• Add SpiFFE Raft integration test by skaffold (#854)
• Wrap ServiceState under ExecutionContext (#856)
• (storage) Decouple core from storage (#832)
• Update raft drivers mocking (#791)
• Add mock raft storage for unittest (#790)
• Make core crates a workspace dependency (#736)
• Redesign SecurityContext with two-phase validation (#717)
• (deps) Bump openraft to alpha17 (#641)

openstack-keystone-api-key-driver-raft

0.1.0 - 2026-09-04

Added

• Auto-register backend drivers via inventory (#1105)
• Generalize marker pagination for v3/v4 lists (#1086)
• ADR 0021 admin surface, simulate-access, and janitor (#896)
• Implement stateless SCIM ingress auth (ADR 0021) (#891)

openstack-keystone-auth-plugin-runtime

0.1.0 - 2026-09-04

Added

• (adr0025) Complete imlpementation (#969)

Other

• Split extism out of core's dependency tree (#1148)

openstack-keystone-password-hashing

0.1.0 - 2026-09-04

Other

• Extract password hashing into own crate (#1055)

openstack-keystone-appcred-driver-sql

0.1.0 - 2026-09-04

Added

• (core) Reconnect database connection on new config (#1188)
• Auto-register backend drivers via inventory (#1105)
• (security) Wrap secrets with secrecy crate (#369) (#912)
• Add access rule CRD to appcred provider (#806)
• Make drivers more dynamic (#737)

Fixed

• Ensure appcred are unique over name+user_id (#1150)

Other

• Feature/expose app credential (#948)
• (deps) Bump sea-orm and sea-orm-migration to 2.0 (#1089)
• Extract password hashing into own crate (#1055)
• (core) Eliminate XxxProvider enums (#830)
• Move jsonwebtoken to keystone crate (#820)
• Further align workspace features (#772)

openstack-keystone-assignment-driver-sql

0.1.0 - 2026-09-04

Added

• (core) Reconnect database connection on new config (#1188)
• (pagination) Add pagination to remaining places (#1106)
• Auto-register backend drivers via inventory (#1105)
• (audit) Implement CADF audit framework Phase 2 (#872)
• Add role-imply rest api (#750)
• Make drivers more dynamic (#737)

Fixed

• Respect group_id param in assignment list (#953)
• (ci) Prepare workfl

[github-actions]

🦢 Load Test Results

Goose Attack Report

Plan Overview

Action	Started	Stopped	Elapsed	Users
Increasing	26-09-04 16:06:00	26-09-04 16:06:23	00:00:23	0 → 45
Maintaining	26-09-04 16:06:23	26-09-04 16:06:53	00:00:30	45
Decreasing	26-09-04 16:06:53	26-09-04 16:06:54	00:00:01	0 ← 45

Request Metrics

Method	Name	# Requests	# Fails	Average (ms)	Min (ms)	Max (ms)	RPS	Failures/s
DELETE	DELETE /v3/auth/tokens	45	0	549.71	73	683	1.50	0.00
DELETE	DELETE /v3/projects/:id (teardown)	1	0	132.00	132	132	0.03	0.00
DELETE	DELETE /v3/roles/:id (teardown)	1	0	175.00	175	175	0.03	0.00
DELETE	DELETE /v3/users/:id (teardown)	2	0	122.00	117	127	0.07	0.00
DELETE	DELETE /v4/mappings/rulesets/:mapping_id (teardown)	1	0	259.00	259	259	0.03	0.00
DELETE	DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown)	1	0	281.00	281	281	0.03	0.00
GET		598	0	584.70	276	907	19.93	0.00
GET	GET /SCIM/v2/:domain_id/Users (sync reconcile list)	1946	1946	14.93	1	953	64.87	64.87
GET	GET /v3/auth/tokens (validate new)	44	0	545.41	391	741	1.47	0.00
GET	GET /v3/auth/tokens (validate revoked)	45	0	473.91	20	617	1.50	0.00
GET	GET /v3/projects/:id	56	0	546.29	378	717	1.87	0.00
GET	GET /v3/projects/:id (catalog)	82	0	555.87	330	744	2.73	0.00
GET	GET /v3/role_assignments	42	0	556.10	367	711	1.40	0.00
GET	GET /v3/role_assignments?role.id	42	0	554.83	384	759	1.40	0.00
GET	GET /v3/role_assignments?scope.domain.id	42	0	540.31	382	737	1.40	0.00
GET	GET /v3/role_assignments?user.id	43	0	517.09	350	678	1.43	0.00
GET	GET /v3/roles	111	0	550.41	358	830	3.70	0.00
GET	GET /v3/roles/:id	55	0	553.91	328	800	1.83	0.00
GET	GET /v3/users/:id	106	0	573.81	341	842	3.53	0.00
GET	GET /v3/users/:id (catalog)	104	0	583.03	292	783	3.47	0.00
GET	GET /v4/api-keys	26	0	542.96	410	730	0.87	0.00
GET	GET /v4/api-keys/:client_id	27	0	601.89	405	768	0.90	0.00
GET	GET /v4/mappings/rulesets	28	0	544.57	403	716	0.93	0.00
GET	GET /v4/mappings/rulesets/:mapping_id	28	0	543.96	339	676	0.93	0.00
GET	GET /v4/oauth2/:domain_id/.well-known/openid-configuration	858	0	52.21	8	162	28.60	0.00
GET	GET /v4/oauth2/:domain_id/clients	28	0	566.29	404	728	0.93	0.00
GET	GET /v4/oauth2/:domain_id/clients/:provider_id	28	0	525.04	429	637	0.93	0.00
GET	GET /v4/oauth2/:domain_id/jwks	860	0	52.01	8	160	28.67	0.00
GET	GET /v4/scim_realms	18	0	528.78	367	647	0.60	0.00
GET	GET /v4/scim_realms/:domain_id/:provider_id	18	0	548.89	383	649	0.60	0.00
POST	POST /v3/auth/tokens	42	0	526.10	296	744	1.40	0.00
POST	POST /v3/auth/tokens (password, invalid)	31	0	1014.26	541	1703	1.03	0.00
POST	POST /v3/auth/tokens (password, project-scoped)	53	0	1303.38	670	1830	1.77	0.00
POST	POST /v3/auth/tokens (password, unscoped)	54	0	1032.13	656	1588	1.80	0.00
POST	POST /v3/auth/tokens (rescope to system)	98	0	621.91	389	849	3.27	0.00
POST	POST /v3/auth/tokens (rescope, invalid project)	60	0	508.70	313	688	2.00	0.00
POST	POST /v3/auth/tokens (system-scoped, bootstrap admin)	47	0	1310.85	818	1869	1.57	0.00
POST	POST /v4/api-keys/:client_id/revoke (teardown)	1	0	262.00	262	262	0.03	0.00
PUT	PUT /v4/scim_realms/:domain_id/:provider_id	18	0	619.78	398	876	0.60	0.00
	Aggregated	5690	1946	241.44	1	1869	189.67	64.87

Response Time Metrics

Method	Name	50%ile (ms)	60%ile (ms)	70%ile (ms)	80%ile (ms)	90%ile (ms)	95%ile (ms)	99%ile (ms)	100%ile (ms)
DELETE	DELETE /v3/auth/tokens	600	600	600	600	683	683	683	683
DELETE	DELETE /v3/projects/:id (teardown)	132	132	132	132	132	132	132	132
DELETE	DELETE /v3/roles/:id (teardown)	175	175	175	175	175	175	175	175
DELETE	DELETE /v3/users/:id (teardown)	120	120	120	127	127	127	127	127
DELETE	DELETE /v4/mappings/rulesets/:mapping_id (teardown)	259	259	259	259	259	259	259	259
DELETE	DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown)	281	281	281	281	281	281	281	281
GET		600	600	600	700	700	700	800	900
GET	GET /SCIM/v2/:domain_id/Users (sync reconcile list)	6	8	9	12	15	21	420	953
GET	GET /v3/auth/tokens (validate new)	600	600	600	600	700	700	700	700
GET	GET /v3/auth/tokens (validate revoked)	500	500	600	600	600	600	600	600
GET	GET /v3/projects/:id	500	600	600	600	700	700	700	700
GET	GET /v3/projects/:id (catalog)	600	600	600	600	700	700	700	700
GET	GET /v3/role_assignments	600	600	600	600	600	700	700	700
GET	GET /v3/role_assignments?role.id	500	600	600	600	700	700	759	759
GET	GET /v3/role_assignments?scope.domain.id	500	500	600	600	700	700	700	700
GET	GET /v3/role_assignments?user.id	500	500	600	600	600	678	678	678
GET	GET /v3/roles	500	600	600	600	700	700	700	800
GET	GET /v3/roles/:id	500	600	600	600	700	700	700	800
GET	GET /v3/users/:id	600	600	600	600	700	700	800	800
GET	GET /v3/users/:id (catalog)	600	600	600	600	700	700	700	783
GET	GET /v4/api-keys	500	600	600	600	600	700	700	700
GET	GET /v4/api-keys/:client_id	600	600	600	700	700	700	768	768
GET	GET /v4/mappings/rulesets	500	500	600	600	600	600	700	700
GET	GET /v4/mappings/rulesets/:mapping_id	600	600	600	600	600	676	676	676
GET	GET /v4/oauth2/:domain_id/.well-known/openid-configuration	48	55	62	71	84	96	130	160
GET	GET /v4/oauth2/:domain_id/clients	600	600	600	600	600	700	700	700
GET	GET /v4/oauth2/:domain_id/clients/:provider_id	500	500	500	500	600	600	600	600
GET	GET /v4/oauth2/:domain_id/jwks	47	53	61	72	84	100	130	160
GET	GET /v4/scim_realms	500	600	600	600	600	600	600	600
GET	GET /v4/scim_realms/:domain_id/:provider_id	500	600	600	600	600	600	600	600
POST	POST /v3/auth/tokens	500	500	600	600	600	700	700	700
POST	POST /v3/auth/tokens (password, invalid)	1,000	1,000	1,000	1,000	1,000	1,703	1,703	1,703
POST	POST /v3/auth/tokens (password, project-scoped)	1,000	1,000	1,000	1,830	1,830	1,830	1,830	1,830
POST	POST /v3/auth/tokens (password, unscoped)	1,000	1,000	1,000	1,000	1,000	1,000	1,588	1,588
POST	POST /v3/auth/tokens (rescope to system)	600	600	700	700	700	800	800	800
POST	POST /v3/auth/tokens (rescope, invalid project)	500	500	600	600	600	600	600	688
POST	POST /v3/auth/tokens (system-scoped, bootstrap admin)	1,000	1,000	1,000	1,000	1,869	1,869	1,869	1,869
POST	POST /v4/api-keys/:client_id/revoke (teardown)	262	262	262	262	262	262	262	262
PUT	PUT /v4/scim_realms/:domain_id/:provider_id	600	700	700	700	800	800	876	876
	Aggregated	50	80	490	600	600	700	1,000	1,869

Status Code Metrics

Method	Name	Status Codes
DELETE	DELETE /v3/auth/tokens	45 [204]
DELETE	DELETE /v3/projects/:id (teardown)	1 [204]
DELETE	DELETE /v3/roles/:id (teardown)	1 [204]
DELETE	DELETE /v3/users/:id (teardown)	2 [204]
DELETE	DELETE /v4/mappings/rulesets/:mapping_id (teardown)	1 [204]
DELETE	DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown)	1 [204]
GET		598 [200]
GET	GET /SCIM/v2/:domain_id/Users (sync reconcile list)	1,916 [429], 30 [401]
GET	GET /v3/auth/tokens (validate new)	44 [200]
GET	GET /v3/auth/tokens (validate revoked)	45 [404]
GET	GET /v3/projects/:id	56 [200]
GET	GET /v3/projects/:id (catalog)	82 [200]
GET	GET /v3/role_assignments	42 [200]
GET	GET /v3/role_assignments?role.id	42 [200]
GET	GET /v3/role_assignments?scope.domain.id	42 [200]
GET	GET /v3/role_assignments?user.id	43 [200]
GET	GET /v3/roles	111 [200]
GET	GET /v3/roles/:id	55 [200]
GET	GET /v3/users/:id	106 [200]
GET	GET /v3/users/:id (catalog)	104 [200]
GET	GET /v4/api-keys	26 [200]
GET	GET /v4/api-keys/:client_id	27 [200]
GET	GET /v4/mappings/rulesets	28 [200]
GET	GET /v4/mappings/rulesets/:mapping_id	28 [200]
GET	GET /v4/oauth2/:domain_id/.well-known/openid-configuration	858 [200]
GET	GET /v4/oauth2/:domain_id/clients	28 [200]
GET	GET /v4/oauth2/:domain_id/clients/:provider_id	28 [200]
GET	GET /v4/oauth2/:domain_id/jwks	860 [200]
GET	GET /v4/scim_realms	18 [200]
GET	GET /v4/scim_realms/:domain_id/:provider_id	18 [200]
POST	POST /v3/auth/tokens	42 [201]
POST	POST /v3/auth/tokens (password, invalid)	31 [401]
POST	POST /v3/auth/tokens (password, project-scoped)	53 [201]
POST	POST /v3/auth/tokens (password, unscoped)	54 [201]
POST	POST /v3/auth/tokens (rescope to system)	98 [201]
POST	POST /v3/auth/tokens (rescope, invalid project)	60 [401]
POST	POST /v3/auth/tokens (system-scoped, bootstrap admin)	47 [201]
POST	POST /v4/api-keys/:client_id/revoke (teardown)	1 [200]
PUT	PUT /v4/scim_realms/:domain_id/:provider_id	18 [200]
	Aggregated	51 [204], 294 [201], 3,263 [200], 121 [401], 45 [404], 1,916 [429]

Transaction Metrics

Transaction	# Times Run	# Fails	Average (ms)	Min (ms)	Max (ms)	RPS	Failures/s
ReadHeavy
0.0	0	0	0.00	0	0	0.00	0.00
0.1	107	0	600.37	393	866	3.57	0.00
0.2	108	0	545.79	276	746	3.60	0.00
0.3	105	0	564.36	356	839	3.50	0.00
TokenLifecycle
1.0	0	0	0.00	0	0	0.00	0.00
1.1	45	0	2094.04	1106	2510	1.50	0.00
ValidateToken
2.0	0	0	0.00	0	0	0.00	0.00
2.1	92	0	657.47	445	907	3.07	0.00
UserCRUD
3.0	0	0	0.00	0	0	0.00	0.00
3.1	0	0	0.00	0	0	0.00	0.00
3.2	106	0	573.83	341	842	3.53	0.00
3.3	2	0	122.00	117	127	0.07	0.00
ProjectCRUD
4.0	0	0	0.00	0	0	0.00	0.00
4.1	0	0	0.00	0	0	0.00	0.00
4.2	56	0	546.34	378	717	1.87	0.00
4.3	1	0	132.00	132	132	0.03	0.00
RoleCRUD
5.0	0	0	0.00	0	0	0.00	0.00
5.1	0	0	0.00	0	0	0.00	0.00
5.2	55	0	553.96	328	800	1.83	0.00
5.3	1	0	175.00	175	175	0.03	0.00
RoleList
6.0	0	0	0.00	0	0	0.00	0.00
6.1	111	0	550.44	358	830	3.70	0.00
RoleAssignmentList
7.0	0	0	0.00	0	0	0.00	0.00
7.1	42	0	556.21	367	712	1.40	0.00
7.2	43	0	517.12	350	678	1.43	0.00
7.3	42	0	540.31	382	737	1.40	0.00
7.4	42	0	554.86	384	759	1.40	0.00
UserRead
8.0	0	0	0.00	0	0	0.00	0.00
8.1	104	0	588.70	336	772	3.47	0.00
8.2	104	0	583.06	292	783	3.47	0.00
ProjectRead
9.0	0	0	0.00	0	0	0.00	0.00
9.1	82	0	555.11	318	752	2.73	0.00
9.2	82	0	555.89	330	744	2.73	0.00
PasswordAuth
10.0	54	0	1032.20	656	1588	1.80	0.00
10.1	53	0	1303.43	671	1830	1.77	0.00
PasswordAuthNegative
11.0	31	0	1014.29	541	1703	1.03	0.00
Rescope
12.0	0	0	0.00	0	0	0.00	0.00
12.1	98	0	621.91	389	849	3.27	0.00
RescopeNegative
13.0	0	0	0.00	0	0	0.00	0.00
13.1	60	0	508.73	313	688	2.00	0.00
SystemScopeAuth
14.0	47	0	1310.98	818	1869	1.57	0.00
ApiKeyCRUD
15.0	0	0	0.00	0	0	0.00	0.00
15.1	0	0	0.00	0	0	0.00	0.00
15.2	27	0	601.93	405	768	0.90	0.00
15.3	26	0	543.08	410	731	0.87	0.00
15.4	1	0	262.00	262	262	0.03	0.00
MappingCRUD
16.0	0	0	0.00	0	0	0.00	0.00
16.1	0	0	0.00	0	0	0.00	0.00
16.2	28	0	544.00	339	676	0.93	0.00
16.3	28	0	544.57	403	716	0.93	0.00
16.4	1	0	259.00	259	259	0.03	0.00
OAuth2ClientCRUD
17.0	0	0	0.00	0	0	0.00	0.00
17.1	0	0	0.00	0	0	0.00	0.00
17.2	28	0	525.11	429	637	0.93	0.00
17.3	28	0	566.32	404	728	0.93	0.00
17.4	1	0	281.00	281	281	0.03	0.00
OAuth2Discovery
18.0	860	0	52.04	8	160	28.67	0.00
18.1	858	0	52.23	8	162	28.60	0.00
ScimRealmRead
19.0	0	0	0.00	0	0	0.00	0.00
19.1	18	0	548.89	383	649	0.60	0.00
19.2	18	0	528.78	367	647	0.60	0.00
19.3	18	0	619.78	398	876	0.60	0.00
ScimSync
20.0	0	0	0.00	0	0	0.00	0.00
20.1	0	0	0.00	0	0	0.00	0.00
20.2	0	0	0.00	0	0	0.00	0.00
20.3	1946	0	14.95	1	953	64.87	0.00
20.4	1945	0	0.00	0	0	64.83	0.00
20.5	1945	0	0.00	0	0	64.83	0.00
20.6	1	0	0.00	0	0	0.03	0.00
Aggregated	9450	0	145.38	1	2510	315.00	0.00

Scenario Metrics

Transaction	# Users	# Times Run	Average (ms)	Min (ms)	Max (ms)	Scenarios/s	Iterations
ReadHeavy	6	103	1708.74	1335	2117	3.43	17.17
TokenLifecycle	3	42	2135.83	1846	2510	1.40	14.00
ValidateToken	2	90	655.79	445	907	3.00	45.00
UserCRUD	2	104	574.16	341	842	3.47	52.00
ProjectCRUD	1	55	545.73	378	717	1.83	55.00
RoleCRUD	1	54	551.72	328	800	1.80	54.00
RoleList	2	109	550.95	358	830	3.63	54.50
RoleAssignmentList	3	42	2156.10	1853	2514	1.40	14.00
UserRead	4	100	1175.34	906	1352	3.33	25.00
ProjectRead	3	81	1106.91	840	1393	2.70	27.00
PasswordAuth	4	52	2366.52	1816	3143	1.73	13.00
PasswordAuthNegative	1	30	1027.13	541	1703	1.00	30.00
Rescope	2	96	621.27	389	849	3.20	48.00
RescopeNegative	1	59	507.88	313	688	1.97	59.00
SystemScopeAuth	2	45	1324.58	818	1869	1.50	22.50
ApiKeyCRUD	1	26	1142.88	815	1332	0.87	26.00
MappingCRUD	1	28	1084.39	857	1382	0.93	28.00
OAuth2ClientCRUD	1	27	1086.93	834	1259	0.90	27.00
OAuth2Discovery	3	857	104.75	24	268	28.57	285.67
ScimRealmRead	1	18	1698.72	1353	1970	0.60	18.00
ScimSync	1	1945	14.97	1	953	64.83	1945.00
Aggregated	45	3963	339.14	1	3143	132.10	2859.83

Error Metrics

Method	Name	#	Error
GET	GET /SCIM/v2/:domain_id/Users (sync reconcile list)	48	401 Unauthorized: GET /SCIM/v2/:domain_id/Users (sync reconcile list)
POST	POST /SCIM/v2/:domain_id/Users (sync provision)	1	401 Unauthorized: POST /SCIM/v2/:domain_id/Users (sync provision)
POST	POST /v3/auth/tokens (password, invalid)	72	401 Unauthorized: POST /v3/auth/tokens (password, invalid)
POST	POST /v3/auth/tokens (rescope, invalid project)	154	401 Unauthorized: POST /v3/auth/tokens (rescope, invalid project)
GET	GET /v3/auth/tokens (validate revoked)	154	404 Not Found: GET /v3/auth/tokens (validate revoked)
GET	GET /SCIM/v2/:domain_id/Users (sync reconcile list)	2019	429 Too Many Requests: GET /SCIM/v2/:domain_id/Users (sync reconcile list)

View full report

[github-actions]

Bencher Report

Project	keystone
Branch	release-plz-2026-06-05T09-00-15Z
Testbed	ubuntu-latest

Click to view all benchmark results

Benchmark	Latency	Benchmark Result nanoseconds (ns) (Result Δ%)	Upper Boundary nanoseconds (ns) (Limit %)
Command_Serde/apply/remove	📈 view plot 🚷 view threshold	84,200.00 ns (-69.17%) Baseline: 273,076.45 ns	1,352,565.88 ns (6.23%)
Command_Serde/apply/set	📈 view plot 🚷 view threshold	87,108.00 ns (-80.31%) Baseline: 442,332.34 ns	3,265,766.51 ns (2.67%)
Command_Serde/pack/delete	📈 view plot 🚷 view threshold	126.12 ns (+7.04%) Baseline: 117.82 ns	155.36 ns (81.18%)
Command_Serde/pack/delete_index	📈 view plot 🚷 view threshold	115.51 ns (+9.91%) Baseline: 105.10 ns	138.45 ns (83.43%)
Command_Serde/pack/set	📈 view plot 🚷 view threshold	199.73 ns (+5.28%) Baseline: 189.72 ns	245.14 ns (81.48%)
Command_Serde/pack/set_index	📈 view plot 🚷 view threshold	116.32 ns (+10.74%) Baseline: 105.04 ns	139.00 ns (83.68%)
Command_Serde/unpack/delete	📈 view plot 🚷 view threshold	232.72 ns (+25.06%) Baseline: 186.09 ns	267.37 ns (87.04%)
Command_Serde/unpack/delete_index	📈 view plot 🚷 view threshold	179.35 ns (+15.72%) Baseline: 154.99 ns	216.25 ns (82.94%)
Command_Serde/unpack/set	📈 view plot 🚷 view threshold	295.32 ns (+13.34%) Baseline: 260.55 ns	355.47 ns (83.08%)
Command_Serde/unpack/set_index	📈 view plot 🚷 view threshold	178.94 ns (+17.37%) Baseline: 152.46 ns	210.54 ns (84.99%)
Payload_encryption/pack/remove_cmd	📈 view plot 🚷 view threshold	118.67 ns (+5.42%) Baseline: 112.57 ns	149.98 ns (79.12%)
Payload_encryption/pack/set_cmd	📈 view plot 🚷 view threshold	197.29 ns (+0.06%) Baseline: 197.18 ns	263.18 ns (74.96%)
Payload_encryption/unpack/remove_cmd	📈 view plot 🚷 view threshold	221.99 ns (+13.65%) Baseline: 195.33 ns	283.21 ns (78.38%)
Payload_encryption/unpack/set_cmd	📈 view plot 🚷 view threshold	330.98 ns (+22.29%) Baseline: 270.65 ns	375.05 ns (88.25%)
Raft_1Node_Latency/prefix/1node	📈 view plot 🚷 view threshold	4,726,900.00 ns (+59.21%) Baseline: 2,968,944.67 ns	7,777,574.56 ns (60.78%)
Raft_1Node_Latency/read/1node	📈 view plot 🚷 view threshold	33,822.00 ns (-9.37%) Baseline: 37,318.91 ns	51,652.80 ns (65.48%)
Raft_1Node_Latency/remove/1node	📈 view plot 🚷 view threshold	245,760.00 ns (-79.94%) Baseline: 1,225,240.47 ns	11,602,622.84 ns (2.12%)
Raft_1Node_Latency/write/1node	📈 view plot 🚷 view threshold	267,500.00 ns (-73.26%) Baseline: 1,000,391.25 ns	7,589,559.30 ns (3.52%)
build_snapshot/default	📈 view plot 🚷 view threshold	105,870.00 ns (-15.42%) Baseline: 125,177.23 ns	277,033.80 ns (38.22%)
fernet token/project	📈 view plot 🚷 view threshold	1,583.60 ns (+11.39%) Baseline: 1,421.63 ns	1,791.61 ns (88.39%)
get_data_keyspace	📈 view plot 🚷 view threshold	0.35 ns (+11.63%) Baseline: 0.32 ns	0.39 ns (91.00%)
get_db	📈 view plot 🚷 view threshold	0.35 ns (+11.74%) Baseline: 0.32 ns	0.39 ns (91.22%)
get_fernet_token_timestamp/project	📈 view plot 🚷 view threshold	137.00 ns (-1.88%) Baseline: 139.63 ns	179.37 ns (76.38%)
get_keyspace	📈 view plot 🚷 view threshold	4.74 ns (-19.58%) Baseline: 5.89 ns	13.79 ns (34.36%)

🐰 View full continuous benchmarking report in Bencher

[github-actions]

🧪 Tempest Identity Compatibility Results (advisory, non-blocking)

rust

Totals
======
Ran: 133 tests in 31.4518 sec.
 - Passed: 66
 - Skipped: 4
 - Expected Fail: 0
 - Unexpected Success: 0
 - Failed: 63
Sum of execute time for each test: 25.0455 sec.

Failed test IDs

===== FAILED TESTS (target=rust) =====
tempest.api.identity.admin.v3.test_credentials.CredentialsTestJSON.test_credentials_create_get_update_delete[id-7cd59bf9-bda4-4c72-9467-d21cab278355,smoke]
tempest.api.identity.admin.v3.test_application_credentials.ApplicationCredentialsV3AdminTest.test_create_application_credential_with_roles[id-3b3dd48f-3388-406a-a9e6-4d078a552d0e]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_create_domain_config_and_show_config_groups_and_options[id-9e3ff13c-f597-4f01-9377-d6c06c2a1477]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_create_update_and_delete_domain_config_groups_and_opts[id-c7510fa2-6661-4170-9c6b-4783a80651e9]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_show_default_group_config_and_options[id-11a02bf0-6f94-4380-b3b0-c8dc18fc0d22]
tempest.api.identity.admin.v3.test_groups.GroupsV3TestJSON.test_group_users_add_list_delete[id-1598521a-2f36-4606-8df9-30772bd51339,smoke]
tempest.api.identity.admin.v3.test_groups.GroupsV3TestJSON.test_list_user_groups[id-64573281-d26a-4a52-b899-503cb0f4e4ec]
tempest.api.identity.admin.v3.test_domains_negative.DomainsNegativeTestJSON.test_create_domain_with_name_length_over_64[id-37b1bbf2-d664-4785-9a11-333438586eae,negative]
tempest.api.identity.admin.v3.test_domains_negative.DomainsNegativeTestJSON.test_delete_active_domain[gate,id-1f3fbff5-4e44-400d-9ca1-d953f05f609b,negative]
tempest.api.identity.admin.v3.test_default_project_id.TestDefaultProjectId.test_default_project_id[id-d6110661-6a71-49a7-a453-b5e26640ff6d]
tempest.api.identity.admin.v3.test_domains.DomainsTestJSON.test_create_domain_without_description[id-2abf8764-309a-4fa9-bc58-201b799817ad]
tempest.api.identity.admin.v3.test_domains.DomainsTestJSON.test_create_update_delete_domain[id-f2f5b44a-82e8-4dad-8084-0661ea3b18cf,smoke]
tempest.api.identity.admin.v3.test_domains.DomainsTestJSON.test_domain_delete_cascades_content[id-d8d318b7-d1b3-4c37-94c5-3c5ba0b121ea]
tempest.api.identity.admin.v3.test_domains.DomainsTestJSON.test_list_domains_filter_by_enabled[id-3fd19840-65c1-43f8-b48c-51bdd066dff9]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_check_revoke_roles_on_projects_group[id-26021436-d5a4-4256-943c-ded01e0d4b45]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_check_revoke_roles_on_projects_user[id-18b70e45-7687-4b72-8277-b8f1a47d7591]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_check_revoke_roles_on_domains_group[id-c7a8dda2-be50-4fb4-9a9c-e830771078b1]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_check_revoke_roles_on_domains_user[id-4e6f0366-97c8-423c-b2be-41eae6ac91c8]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_revoke_user_roles_on_domain[id-3acf666e-5354-42ac-8e17-8b68893bcd36]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_revoke_user_roles_on_project_tree[id-9f02ccd9-9b57-46b4-8f77-dd5a736f3a06]
tempest.api.identity.admin.v3.test_list_users.UsersV3TestJSON.test_list_users_with_not_enabled[id-bff8bf2f-9408-4ef5-b63a-753c8c2124eb]
setUpClass (tempest.api.identity.admin.v3.test_endpoint_groups.EndPointGroupsTest)
tempest.api.identity.admin.v3.test_list_projects.ListProjectsStaticTestJSON.test_list_projects[id-1d830662-22ad-427c-8c3e-4ec854b0af44]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_create_and_show_consumer[id-c8307ea6-a86c-47fd-ae7b-5b3b2caca76d]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_delete_consumer[id-fdfa1b7f-2a31-4354-b2c7-f6ae20554f93]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_list_consumers[id-09ca50de-78f2-4ffb-ac71-f2254036b2b8]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_update_consumer[id-080a9b1a-c009-47c0-9979-5305bf72e3dc]
tempest.api.identity.admin.v3.test_list_projects.ListProjectsTestJSON.test_list_projects_with_enabled[id-0fe7a334-675a-4509-b00e-1c4b95d5dae8]
tempest.api.identity.admin.v3.test_list_projects.ListProjectsTestJSON.test_list_projects_with_parent[id-6edc66f5-2941-4a17-9526-4073311c1fac]
tempest.api.identity.admin.v3.test_projects.ProjectsTestJSON.test_create_is_domain_project[id-a7eb9416-6f9b-4dbb-b71b-7f73aaef59d5]
tempest.api.identity.admin.v3.test_projects.ProjectsTestJSON.test_project_create_with_parent[id-1854f9c0-70bc-4d11-a08a-1c789d339e3d]
tempest.api.identity.admin.v3.test_projects.ProjectsTestJSON.test_project_get_equals_list[id-d1db68b6-aebe-4fa0-b79d-d724d2e21162]
tempest.api.identity.admin.v3.test_project_tags.IdentityV3ProjectTagsTest.test_list_update_delete_project_tags[id-7c123aac-999d-416a-a0fb-84b915ab10de]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_assignments_for_domain_roles[id-3859df7e-5b78-4e4d-b10e-214c8953842a]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_assignments_for_implied_roles_create_delete[id-c8828027-df48-4021-95df-b65b92c7429e]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_group_on_domain[id-4bf8a70b-e785-413a-ad53-9f91ce02faa7]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_group_on_project[id-cbf11737-1904-4690-9613-97bcbb3df1c4]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_group_on_system[id-c888fe4f-8018-48db-b959-542225c1b4b6]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_user_on_domain[id-6c9a2940-3625-43a3-ac02-5dcec62ef3bd]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_implied_domain_roles[id-eb1e1c24-1bc4-4d47-9748-e127a1852c82]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_implied_roles_create_check_show_delete[id-c90c316c-d706-4728-bcba-eb1912081b69]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_role_create_update_show_list[id-18afc6c0-46cf-4911-824e-9989cc056c3a,smoke]
tempest.api.identity.admin.v3.test_tokens.TokensV3TestJSON.test_get_available_domain_scopes[id-ec5ecb05-af64-4c04-ac86-4d9f6f12f185]
tempest.api.identity.admin.v3.test_projects_negative.ProjectsNegativeStaticTestJSON.test_create_projects_name_length_over_64[id-502b6ceb-b0c8-4422-bf53-f08fdb21e2f0,negative]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_get_trusts_all[id-4773ebd5-ecbf-4255-b8d8-b63e6f72b65d,smoke]
tempest.api.identity.admin.v3.test_tokens.TokensV3TestJSON.test_rescope_token[id-565fa210-1da1-4563-999b-f7b5b67cf112]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_get_trusts_query[id-6268b345-87ca-47c0-9ce3-37792b43403a]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_api_media_types[id-657c1970-4722-4189-8831-7325f3bc4265,smoke]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_api_version_resources[id-b9232f5e-d9e5-4d97-b96c-28d3db4de1bd,smoke]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_identity_v3_existence[id-79aec9ae-710f-4c54-a4fc-3aa25b4feac3]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_list_api_versions[id-721f480f-35b6-46c7-846e-047e6acea0dc,smoke]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_expire[id-0ed14b66-cefd-4b5c-a964-65759453e292]
tempest.api.identity.admin.v3.test_users.UsersV3TestJSON.test_list_user_projects[id-a831e70c-e35b-430b-92ed-81ebbc5437b8]
tempest.api.identity.v3.test_catalog.IdentityCatalogTest.test_catalog_standardization[id-56b57ced-22b8-4127-9b8a-565dfb0207e2]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_impersonate[id-5a0a91a4-baef-4a14-baba-59bf4d7fcace]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_noimpersonate[id-ed2a8779-a7ac-49dc-afd7-30f32f936ed2]
tempest.api.identity.admin.v3.test_users_negative.UsersNegativeTest.test_create_user_for_non_existent_domain[id-e75f006c-89cc-477b-874d-588e4eab4b17,negative]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_create_application_credential[id-8080c75c-eddc-4786-941a-c2da7039ae61]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_create_application_credential_expires[id-852daf0c-42b5-4239-8466-d193d0543ed3]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_list_application_credentials[id-ff0cd457-6224-46e7-b79e-0ada4964a8a6]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_query_application_credentials[id-9bb5e5cc-5250-493a-8869-8b665f6aa5f6]
tempest.api.identity.v3.test_projects.IdentityV3ProjectsTest.test_list_projects_returns_only_authorized_projects[id-86128d46-e170-4644-866a-cc487f699e1d]
tempest.api.identity.v3.test_tokens.TokensV3Test.test_validate_token[id-a9512ac3-3909-48a4-b395-11f438e16260]
===== END FAILED TESTS (target=rust) =====

View full run