Skip to content

chore: release#754

Open
openstack-experimental-release-plz[bot] wants to merge 1 commit into
mainfrom
release-plz-2026-06-05T09-00-15Z
Open

chore: release#754
openstack-experimental-release-plz[bot] wants to merge 1 commit into
mainfrom
release-plz-2026-06-05T09-00-15Z

Conversation

@openstack-experimental-release-plz

@openstack-experimental-release-plz openstack-experimental-release-plz Bot commented Jun 5, 2026

Copy link
Copy Markdown
Contributor

🤖 New release

  • openstack-keystone-config: 0.1.0
  • openstack-keystone-core-types: 0.1.1
  • openstack-keystone-api-types: 0.1.0 -> 0.1.1 (✓ API compatible changes)
  • openstack-keystone-audit: 0.1.0
  • openstack-keystone-storage-api: 0.1.0
  • openstack-keystone-core: 0.1.1 -> 0.1.2 (✓ API compatible changes)
  • openstack-keystone-storage-crypto: 0.1.0
  • openstack-keystone-storage-crypto-pkcs11: 0.1.0
  • openstack-keystone-storage-crypto-tpm: 0.1.0
  • openstack-keystone-distributed-storage: 0.1.0 -> 0.1.1 (✓ API compatible changes)
  • openstack-keystone-api-key-driver-raft: 0.1.0
  • openstack-keystone-appcred-driver-sql: 0.1.0
  • openstack-keystone-assignment-driver-sql: 0.1.0
  • openstack-keystone-catalog-driver-sql: 0.1.0
  • openstack-keystone-key-repository: 0.1.0
  • openstack-keystone-credential-driver-sql: 0.1.0
  • openstack-keystone-dynamic-plugin-runtime: 0.1.0
  • openstack-keystone-federation-driver-sql: 0.1.0
  • openstack-keystone-identity-driver-sql: 0.1.0
  • openstack-keystone-idmapping-driver-sql: 0.1.0
  • openstack-keystone-k8s-auth-driver-raft: 0.1.0
  • openstack-keystone-k8s-auth-driver-sql: 0.1.0
  • openstack-keystone-mapping-driver-raft: 0.1.0
  • openstack-keystone-resource-driver-sql: 0.1.0
  • openstack-keystone-revoke-driver-sql: 0.1.0
  • openstack-keystone-role-driver-sql: 0.1.0
  • openstack-keystone-scim-driver-raft: 0.1.0
  • openstack-keystone-token-driver-fernet: 0.1.1
  • openstack-keystone-token-restriction-driver-sql: 0.1.0
  • openstack-keystone-trust-driver-sql: 0.1.0
  • openstack-keystone-webauthn: 0.1.0
  • openstack-keystone: 0.1.1 -> 0.1.2 (✓ API compatible changes)
  • openstack-keystone-cli-manage: 0.1.0
Changelog

openstack-keystone-config

0.1.0 - 2026-07-08

Added

  • (scim) ADR 0024 - Phase 1+2 (#925)
  • (fernet) Unify credential/token key repositories (#915)
  • Start ADR 0025 immplementation (#911)
  • (credential) Implement Phase 3 of ADR 0019 (#909)
  • Prepare PKCS#11/TPM KEK support in storage (#907)
  • (credential) Implement ADR 0019 phases 1-2 (#897)
  • Implement stateless SCIM ingress auth (ADR 0021) (#891)
  • (auth) Password hashing parity with Python Keystone (#859)
  • (audit) Implement CADF audit framework Phase 2 (#872)
  • (storage) SPIFFE checks, RBAC, rate limiting, auto-join (#861)
  • (storage) Harden preflight and erase dev KEK (#860)
  • Add bootstrap cli command (#809)
  • (mapping) ADR-0020 (mapping engine) phase 1 (#794)
  • Add inter-provider event notification system (#784)
  • Add SO_PEERCRED peer credential validation (#775)
  • Validate password for compliance conformity (#774)
  • Enforce minimum range boundaries for security
  • Add role-imply rest api (#750)
  • Add user update functionality (#747)
  • Make drivers more dynamic (#737)
  • Add keystone container with opa and policies (#738)
  • Add Admin interface over the UDS (#735)
  • Add spiffe provider (#733)
  • Introduce SecurityContext (#710)
  • Add skeleton for the spiffe mTLS integration (#695)
  • Implement ConfigManager for config watching (#691)
  • Improve the code (#686)
  • Add k8s-auth raft driver (#676)
  • Add raft support under skaffold (#667)
  • Introduce raft backend for webauthn (#658)
  • Introduce the keystone-manage cli managing raft (#656)

Fixed

  • (passkey) Prevent user enumeration (#905)

Other

  • Move jsonwebtoken to keystone crate (#820)
  • mapping engine phase 3 - migrate SPIFFE (#811)
  • Rename identity_mapping to idmapping (#788)
  • Replace Regex with str::find for db connection (#760)
  • Redesign SecurityContext with two-phase validation (#717)
  • Split out remaining sql drivers (#633)
  • Split config into standalone crate (#628)

openstack-keystone-core-types

0.1.1 - 2026-07-08

Added

  • (scim) ADR 0024 - Phase 4 (protocol surface completion) (#929)
  • (scim) ADR 0024 - Phase 3 (#928)
  • (scim) ADR 0024 - Phase 1+2 (#925)
  • (credential) Implement Phase 3 of ADR 0019 (#909)
  • (credential) Implement ADR 0019 phases 1-2 (#897)
  • Implement stateless SCIM ingress auth (ADR 0021) (#891)
  • Audit framework (ADR-0023) phase 3 (#880)
  • (audit) Implement CADF audit framework Phase 2 (#872)
  • Migrate federation to new mapping engine (#839)
  • Add access rule CRD to appcred provider (#806)
  • ADR-0020 mapping phase 4 (#818)
  • (mapping) ADR-0020 (mapping engine) phase 1 (#794)
  • Add endpoint CRUD to catalog provider (#785)
  • Add inter-provider event notification system (#784)
  • Add service CRUD to the catalog provider (#773)
  • Validate password for compliance conformity (#774)
  • Return 401 on roleless scoped contexts (#742)
  • Add region CRUD to catalog SQL driver (#761)
  • Add role-imply rest api (#750)
  • Add role imply API (#749)
  • Add user update functionality (#747)
  • Add spiffe binding API (#740)
  • Add Admin interface over the UDS (#735)
  • Add spiffe provider (#733)
  • Expand role info in expand_implied_roles (#730)
  • Introduce SecurityContext (#710)
  • Improve the code (#686)
  • Add k8s-auth raft driver (#676)
  • Introduce the keystone-manage cli managing raft (#656)

Fixed

  • Unify ApiClient scope validation, fix nextest filter (#947)
  • Finalize ADR 0021 work (#906)
  • Resolve raft replication state races (#884)
  • (k8s_auth) Flatten k8s.aud claim from JWT TokenReview (#834)
  • Align "extra" property handling (#787)

Other

  • Move jsonwebtoken to keystone crate (#820)
  • mapping engine phase 3 - migrate SPIFFE (#811)
  • Rename identity_mapping to idmapping (#788)
  • Make resolve_implied_roles optional (#764)
  • Redesign SecurityContext with two-phase validation (#717)
  • Unify state initialization in test (#642)
  • Small optimization of the derives (#638)
  • Split the core-types crate (#640)

openstack-keystone-api-types

0.1.1 - 2026-07-08

Added

  • (scim) ADR 0024 - Phase 1+2 (#925)
  • (credential) Implement Phase 3 of ADR 0019 (#909)
  • ADR 0021 admin surface, simulate-access, and janitor (#896)
  • Implement stateless SCIM ingress auth (ADR 0021) (#891)
  • Migrate federation to new mapping engine (#839)
  • ADR-0020 mapping phase 4 (#818)
  • (mapping) ADR-0020 phase 2 (#807)
  • (mapping) ADR-0020 (mapping engine) phase 1 (#794)
  • Validate password for compliance conformity (#774)
  • Add system-user-role assignments API (#762)
  • Add role-imply rest api (#750)
  • Add user update functionality (#747)
  • Add api to list user roles on project (#639)
  • Add domain CRUD operations (#743)
  • Add spiffe binding API (#740)
  • Add spiffe provider (#733)
  • Introduce SecurityContext (#710)
  • Add skeleton for the spiffe mTLS integration (#695)
  • Improve the code (#686)

Fixed

  • Unify ApiClient scope validation, fix nextest filter (#947)
  • Finalize ADR 0021 work (#906)

Other

  • Move jsonwebtoken to keystone crate (#820)
  • (tests) Reorganize integration_api tests (#815)
  • mapping engine phase 3 - migrate SPIFFE (#811)
  • Rename identity_mapping to idmapping (#788)
  • Further align workspace features (#772)
  • Make resolve_implied_roles optional (#764)
  • Redesign SecurityContext with two-phase validation (#717)
  • Small optimization of the derives (#638)
  • Split the core-types crate (#640)
  • Introduce features in api-types crate (#624)
  • Slim down api-types crate (#622)

openstack-keystone-audit

0.1.0 - 2026-07-08

Added

  • (audit) Complete ADR-0023 audit implementation (#887)
  • Audit framework (ADR-0023) phase 3 (#880)
  • (audit) Implement CADF audit framework Phase 2 (#872)

openstack-keystone-storage-api

0.1.0 - 2026-07-08

Added

  • (storage) Cert validity and SVID TTL enforcement (#886)
  • (storage) SPIFFE checks, RBAC, rate limiting, auto-join (#861)
  • (storage) Complete ADR-0016-v2 (#844)
  • (storage) implement ADR 0016-v2 Phases 1-4 — encrypted storage with quarantine (#840)

Fixed

  • (webauthn) Rotate raft ceremony-state keyspaces (#890)

Other

  • (storage) Decouple core from storage (#832)

openstack-keystone-core

0.1.2 - 2026-07-08

Added

  • (scim) ADR 0024 - Phase 4 (protocol surface completion) (#929)
  • (scim) ADR 0024 - Phase 3 (#928)
  • (scim) ADR 0024 - Phase 1+2 (#925)
  • (credential) Implement Phase 3 of ADR 0019 (#909)
  • (credential) Implement ADR 0019 phases 1-2 (#897)
  • ADR 0021 admin surface, simulate-access, and janitor (#896)
  • Implement stateless SCIM ingress auth (ADR 0021) (#891)
  • (audit) Complete ADR-0023 audit implementation (#887)
  • (storage) Cert validity and SVID TTL enforcement (#886)
  • Audit framework (ADR-0023) phase 3 (#880)
  • (auth) Password hashing parity with Python Keystone (#859)
  • (audit) Implement CADF audit framework Phase 2 (#872)
  • Migrate federation to new mapping engine (#839)
  • Add access rule CRD to appcred provider (#806)
  • ADR-0020 mapping phase 4 (#818)
  • Add bootstrap cli command (#809)
  • (mapping) ADR-0020 (mapping engine) phase 1 (#794)
  • Add endpoint CRUD to catalog provider (#785)
  • Add inter-provider event notification system (#784)
  • Add service CRUD to the catalog provider (#773)
  • Validate password for compliance conformity (#774)
  • Return 401 on roleless scoped contexts (#742)
  • Add region CRUD to catalog SQL driver (#761)
  • Add timing attack protection and failed auth tracking (#758)
  • Add role-imply rest api (#750)
  • Add role imply API (#749)
  • Add user update functionality (#747)
  • Add domain CRUD operations (#743)
  • Add spiffe binding API (#740)
  • Normalize the policy enforcer structure (#741)
  • Make drivers more dynamic (#737)
  • Add Admin interface over the UDS (#735)
  • Add spiffe provider (#733)
  • Expand role info in expand_implied_roles (#730)
  • Introduce SecurityContext (#710)
  • Talk to OPA over unix socket (#701)
  • Add skeleton for the spiffe mTLS integration (#695)
  • Implement ConfigManager for config watching (#691)
  • Improve the code (#686)
  • Add k8s-auth raft driver (#676)
  • Add basic healthcheck endpoint (#671)
  • Make raft storage available through state (#657)

Fixed

  • Unify ApiClient scope validation, fix nextest filter (#947)
  • Finalize ADR 0021 work (#906)
  • (ci) Prepare workflows for merge queue (#902)
  • Resolve raft replication state races (#884)
  • (core) Eliminate mapping race condition (#876)
  • (k8s_auth) Flatten k8s.aud claim from JWT TokenReview (#834)
  • (auth) Close admin SVID impersonation gap (#833)

Other

  • (deps) bump scrypt from 0.11.0 to 0.12.0 (#923)
  • Reorganize dockerfile and deps (#857)
  • (core) Remove spiffe crate dependency (#858)
  • Wrap ServiceState under ExecutionContext (#856)
  • (storage) Decouple core from storage (#832)
  • (core) Eliminate XxxProvider enums (#830)
  • Move jsonwebtoken to keystone crate (#820)
  • mapping engine phase 3 - migrate SPIFFE (#811)
  • (deps) bump hmac from 0.12.1 to 0.13.0 (#801)
  • Rename identity_mapping to idmapping (#788)
  • Consolidate password update flows (#778)
  • Further align workspace features (#772)
  • Make resolve_implied_roles optional (#764)
  • Redesign SecurityContext with two-phase validation (#717)
  • (deps) bump jsonwebtoken from 10.3.0 to 10.4.0 (#707)
  • Introduce dynamic plugins (#643)
  • Small optimization of the derives (#638)
  • Split the core-types crate (#640)
  • Split out remaining sql drivers (#633)
  • Split more drivers to separate crates (#632)
  • Drop unnecessary derives to help compilation (#631)
  • Drop unnecessary tracing directives (#627)
  • Split config into standalone crate (#628)
  • Rework http client pool (#629)
  • Make assignment sql driver a standalone crate (#626)
  • Move assignment parameters resolution to driver (#625)
  • Introduce features in api-types crate (#624)
  • Slim down api-types crate (#622)
  • Split out webauthn into crate (#621)
  • Split out token-fernet driver (#620)
  • Prepare slit out of the FernetTokenProvider (#619)
  • Move benchmark into the proper crate (#614)

openstack-keystone-storage-crypto

0.1.0 - 2026-07-08

Added

  • (scim) ADR 0024 - Phase 3 (#928)
  • (storage) Add PKCS#11 KEK provider crate (#917)
  • (storage) Cert validity and SVID TTL enforcement (#886)
  • (audit) Implement CADF audit framework Phase 2 (#872)
  • (storage) SPIFFE checks, RBAC, rate limiting, auto-join (#861)
  • (storage) Harden preflight and erase dev KEK (#860)
  • (storage) Complete ADR-0016-v2 (#844)
  • (storage) implement ADR 0016-v2 Phases 1-4 — encrypted storage with quarantine (#840)

Other

  • (deps) Batch update dependencies (#875)

openstack-keystone-storage-crypto-pkcs11

0.1.0 - 2026-07-08

Added

  • (storage) Add PKCS#11 KEK provider crate (#917)

openstack-keystone-storage-crypto-tpm

0.1.0 - 2026-07-08

Added

  • (storage) Add PKCS#11 KEK provider crate (#917)

openstack-keystone-distributed-storage

0.1.1 - 2026-07-08

Added

  • (storage) Add PKCS#11 KEK provider crate (#917)
  • Prepare PKCS#11/TPM KEK support in storage (#907)
  • Implement background DEK re-encryption pipeline (#898)
  • ADR 0021 admin surface, simulate-access, and janitor (#896)
  • (storage) Cert validity and SVID TTL enforcement (#886)
  • (storage) SPIFFE checks, RBAC, rate limiting, auto-join (#861)
  • (storage) Harden preflight and erase dev KEK (#860)
  • (storage) Add SPIFFE mTLS support to Raft gRPC (#852)
  • (cli) Add cli storage subcommands per ADR 0016-v2 (#850)
  • (storage) Complete ADR-0016-v2 (#844)
  • (storage) implement ADR 0016-v2 Phases 1-4 — encrypted storage with quarantine (#840)
  • (mapping) ADR-0020 phase 2 (#807)
  • (adr) Add updated revision of the DS ADR (#795)
  • (mapping) ADR-0020 (mapping engine) phase 1 (#794)
  • Add skeleton for the spiffe mTLS integration (#695)
  • Implement ConfigManager for config watching (#691)
  • Improve the code (#686)
  • Add k8s-auth raft driver (#676)
  • Add SetIndex/RemoveIndex storage commands (#675)
  • Add basic healthcheck endpoint (#671)
  • Add metadata for raft data (#670)
  • Add transaction support for Raft storage (#669)
  • Add initial benchmarks for the storage (#668)
  • Add raft support under skaffold (#667)
  • Introduce raft backend for webauthn (#658)
  • Prepare raft storage promotion (#659)
  • Make raft storage available through state (#657)
  • Introduce the keystone-manage cli managing raft (#656)

Fixed

  • Finalize ADR 0021 work (#906)
  • (ci) Prepare workflows for merge queue (#902)
  • Further polish storage crate (#892)
  • (webauthn) Rotate raft ceremony-state keyspaces (#890)
  • Resolve raft replication state races (#884)

Other

  • (deps) Batch update dependencies (#875)
  • (core) Remove spiffe crate dependency (#858)
  • Add SpiFFE Raft integration test by skaffold (#854)
  • Wrap ServiceState under ExecutionContext (#856)
  • (storage) Decouple core from storage (#832)
  • Update raft drivers mocking (#791)
  • Add mock raft storage for unittest (#790)
  • Make core crates a workspace dependency (#736)
  • Redesign SecurityContext with two-phase validation (#717)
  • (deps) Bump openraft to alpha17 (#641)

openstack-keystone-api-key-driver-raft

0.1.0 - 2026-07-08

Added

  • ADR 0021 admin surface, simulate-access, and janitor (#896)
  • Implement stateless SCIM ingress auth (ADR 0021) (#891)

openstack-keystone-appcred-driver-sql

0.1.0 - 2026-07-08

Added

  • Add access rule CRD to appcred provider (#806)
  • Make drivers more dynamic (#737)

Other

  • (core) Eliminate XxxProvider enums (#830)
  • Move jsonwebtoken to keystone crate (#820)
  • Further align workspace features (#772)

openstack-keystone-assignment-driver-sql

0.1.0 - 2026-07-08

Added

  • (audit) Implement CADF audit framework Phase 2 (#872)
  • Add role-imply rest api (#750)
  • Make drivers more dynamic (#737)

Fixed

  • (ci) Prepare workflows for merge queue (#902)

Other

  • Wrap ServiceState under ExecutionContext (#856)
  • (storage) Decouple core from storage (#832)
  • Move jsonwebtoken to keystone crate (#820)
  • Further align workspace features (#772)
  • Make resolve_implied_roles optional (#764)

openstack-keystone-catalog-driver-sql

0.1.0 - 2026-07-08

Added

  • (mapping) ADR-0020 (mapping engine) phase 1 (#794)
  • Add endpoint CRUD to catalog provider (#785)
  • Add inter-provider event notification system (#784)
  • Add service CRUD to the catalog provider (#773)
  • Add region CRUD to catalog SQL driver (#761)
  • Make drivers more dynamic (#737)

Fixed

  • Align "extra" property handling (#787)

Other

  • Move jsonwebtoken to keystone crate (#820)
  • Further align workspace features (#772)

openstack-keystone-key-repository

0.1.0 - 2026-07-08

Added

  • (scim) ADR 0024 - Phase 1+2 (#925)
  • (fernet) Unify credential/token key repositories (#915)

openstack-keystone-credential-driver-sql

0.1.0 - 2026-07-08

Added

  • (fernet) Unify credential/token key repositories (#915)
  • (credential) Enforce Null Key check at startup (#913)
  • (credential) Implement Phase 3 of ADR 0019 (#909)
  • (credential) Implement ADR 0019 phases 1-2 (#897)

openstack-keystone-dynamic-plugin-runtime

0.1.0 - 2026-07-08

Added

  • Start ADR 0025 immplementation (#911)

openstack-keystone-federation-driver-sql

0.1.0 - 2026-07-08

Added

  • Migrate federation to new mapping engine (#839)
  • Make drivers more dynamic (#737)

Other

  • Move jsonwebtoken to keystone crate (#820)
  • Further align workspace features (#772)

openstack-keystone-identity-driver-sql

0.1.0 - 2026-07-08

Added

  • (scim) ADR 0024 - Phase 3 (#928)
  • (scim) ADR 0024 - Phase 1+2 (#925)
  • (auth) Password hashing parity with Python Keystone (#859)
  • (mapping) ADR-0020 (mapping engine) phase 1 (#794)
  • Add inter-provider event notification system (#784)
  • Add timing attack protection and failed auth tracking (#758)
  • Add role-imply rest api (#750)
  • Add user update functionality (#747)
  • Make drivers more dynamic (#737)

Fixed

  • Validate password complexity before storing password (#845)
  • Align "extra" property handling (#787)

Other

  • Move jsonwebtoken to keystone crate (#820)
  • Consolidate password update flows (#778)
  • Further align workspace features (#772)

openstack-keystone-idmapping-driver-sql

0.1.0 - 2026-07-08

Added

  • Make drivers more dynamic (#737)

Fixed

  • (ci) Prepare workflows for merge queue (#902)

Other

  • Move jsonwebtoken to keystone crate (#820)
  • Rename identity_mapping to idmapping (#788)

openstack-keystone-k8s-auth-driver-raft

0.1.0 - 2026-07-08

Added

  • ADR-0020 mapping phase 4 (#818)
  • (mapping) ADR-0020 (mapping engine) phase 1 (#794)
  • Add user update functionality (#747)
  • Make drivers more dynamic (#737)

Other

  • (storage) Decouple core from storage (#832)
  • Update raft drivers mocking (#791)
  • Add mock raft storage for unittest (#790)

openstack-keystone-k8s-auth-driver-sql

0.1.0 - 2026-07-08

Added

  • ADR-0020 mapping phase 4 (#818)
  • Make drivers more dynamic (#737)

Other

  • Wrap ServiceState under ExecutionContext (#856)
  • Move jsonwebtoken to keystone crate (#820)

openstack-keystone-mapping-driver-raft

0.1.0 - 2026-07-08

Added

  • (mapping) ADR-0020 phase 2 (#807)
  • (mapping) ADR-0020 (mapping engine) phase 1 (#794)

Other

  • (storage) Decouple core from storage (#832)

openstack-keystone-resource-driver-sql

0.1.0 - 2026-07-08

Added

  • Add bootstrap cli command (#809)
  • Make drivers more dynamic (#737)

Fixed

  • (ci) Prepare workflows for merge queue (#902)

Other

  • Wrap ServiceState under ExecutionContext (#856)
  • Move jsonwebtoken to keystone crate (#820)

openstack-keystone-revoke-driver-sql

0.1.0 - 2026-07-08

Added

  • Make drivers more dynamic (#737)

Fixed

  • Finalize ADR 0021 work (#906)

Other

  • Move jsonwebtoken to keystone crate (#820)

openstack-keystone-role-driver-sql

0.1.0 - 2026-07-08

Added

  • Add role-imply rest api (#750)
  • Add role imply API (#749)
  • Make drivers more dynamic (#737)

Other

  • Move jsonwebtoken to keystone crate (#820)

openstack-keystone-scim-driver-raft

0.1.0 - 2026-07-08

Added

  • (scim) ADR 0024 - Phase 4 (protocol surface completion) (#929)
  • (scim) ADR 0024 - Phase 1+2 (#925)

openstack-keystone-token-driver-fernet

0.1.1 - 2026-07-08

Added

  • (fernet) Unify credential/token key repositories (#915)
  • Add user update functionality (#747)
  • Make drivers more dynamic (#737)

Fixed

  • Fix msgpack decode and auth-method encoding bugs (#895)

openstack-keystone-token-restriction-driver-sql

0.1.0 - 2026-07-08

Added

  • Make drivers more dynamic (#737)

Other

  • Move jsonwebtoken to keystone crate (#820)

openstack-keystone-trust-driver-sql

0.1.0 - 2026-07-08

Added

  • Make drivers more dynamic (#737)

Other

  • Move jsonwebtoken to keystone crate (#820)

openstack-keystone-webauthn

0.1.0 - 2026-07-08

Added

  • Prepare PKCS#11/TPM KEK support in storage (#907)
  • (audit) Implement CADF audit framework Phase 2 (#872)
  • (storage) SPIFFE checks, RBAC, rate limiting, auto-join (#861)
  • (storage) Harden preflight and erase dev KEK (#860)
  • Security improvements in the webauthn crate (#838)
  • Add inter-provider event notification system (#784)
  • Make drivers more dynamic (#737)
  • Introduce SecurityContext (#710)
  • Add skeleton for the spiffe mTLS integration (#695)
  • Implement ConfigManager for config watching (#691)
  • Improve the code (#686)
  • Add k8s-auth raft driver (#676)
  • Add metadata for raft data (#670)
  • Add raft support under skaffold (#667)
  • Introduce raft backend for webauthn (#658)

Fixed

  • (passkey) Prevent user enumeration (#905)
  • (ci) Prepare workflows for merge queue (#902)
  • (webauthn) Rotate raft ceremony-state keyspaces (#890)

Other

  • (deps) Batch update dependencies (#875)
  • Wrap ServiceState under ExecutionContext (#856)
  • (storage) Decouple core from storage (#832)
  • Update raft drivers mocking (#791)
  • Add mock raft storage for unittest (#790)
  • Make core crates a workspace dependency (#736)
  • Redesign SecurityContext with two-phase validation (#717)
  • Split the core-types crate (#640)
  • Move assignment parameters resolution to driver (#625)
  • Introduce features in api-types crate (#624)
  • Split out webauthn into crate (#621)

openstack-keystone

0.1.2 - 2026-07-08

Added

  • (scim) ADR 0024 - Phase 4 (protocol surface completion) (#929)
  • (scim) ADR 0024 - Phase 3 (#928)
  • (scim) ADR 0024 - Phase 1+2 (#925)
  • (fernet) Unify credential/token key repositories (#915)
  • (credential) Enforce Null Key check at startup (#913)
  • (credential) Implement Phase 3 of ADR 0019 (#909)
  • (credential) Implement ADR 0019 phases 1-2 (#897)
  • ADR 0021 admin surface, simulate-access, and janitor (#896)
  • Implement stateless SCIM ingress auth (ADR 0021) (#891)
  • (audit) Complete ADR-0023 audit implementation (#887)
  • (storage) Cert validity and SVID TTL enforcement (#886)
  • Audit framework (ADR-0023) phase 3 (#880)
  • (auth) Password hashing parity with Python Keystone (#859)
  • (audit) Implement CADF audit framework Phase 2 (#872)
  • (storage) SPIFFE checks, RBAC, rate limiting, auto-join (#861)
  • (storage) Add SPIFFE mTLS support to Raft gRPC (#852)
  • Migrate federation to new mapping engine (#839)
  • (api) Capture client IP via ConnectInfo (#842)
  • (api) Normalize trailing slashes in paths (#841)
  • ADR-0020 mapping phase 4 (#818)
  • Add bootstrap cli command (#809)
  • (mapping) ADR-0020 phase 2 (#807)
  • (mapping) ADR-0020 (mapping engine) phase 1 (#794)
  • Add inter-provider event notification system (#784)
  • Add service CRUD to the catalog provider (#773)
  • Add SO_PEERCRED peer credential validation (#775)
  • Return 401 on roleless scoped contexts (#742)
  • Add system-user-role assignments API (#762)
  • Add role-imply rest api (#750)
  • Add user update functionality (#747)
  • Add api to list user roles on project (#639)
  • Add domain CRUD operations (#743)
  • Add spiffe binding API (#740)
  • Normalize the policy enforcer structure (#741)
  • Make drivers more dynamic (#737)
  • Add keystone container with opa and policies (#738)
  • Add Admin interface over the UDS (#735)
  • Add spiffe provider (#733)
  • Introduce SecurityContext (#710)
  • Talk to OPA over unix socket (#701)
  • Add skeleton for the spiffe mTLS integration (#695)
  • Implement ConfigManager for config watching (#691)
  • Improve the code (#686)
  • Add k8s-auth raft driver (#676)
  • Add basic healthcheck endpoint (#671)
  • Add raft support under skaffold (#667)
  • Introduce raft backend for webauthn (#658)
  • Make raft storage available through state (#657)
  • Introduce the keystone-manage cli managing raft (#656)

Fixed

  • Pass resolved token to OPA policy checks (#927)
  • Finalize ADR 0021 work (#906)
  • (ci) Prepare workflows for merge queue (#902)
  • Stop swagger-ui redirect loop, split main() (#899)
  • Resolve raft replication state races (#884)
  • ADR-0002 compliance for policy enforcement (#882)
  • (k8s_auth) Flatten k8s.aud claim from JWT TokenReview (#834)
  • (auth) Fix token-from-token auth bounds (#810)

Other

  • (ci) Rework skaffold setup (#871)
  • Reorganize dockerfile and deps (#857)
  • (core) Remove spiffe crate dependency (#858)
  • Add SpiFFE Raft integration test by skaffold (#854)
  • Wrap ServiceState under ExecutionContext (#856)
  • (federation) Drop openidconnect dependency (#849)
  • (storage) Decouple core from storage (#832)
  • Move jsonwebtoken to keystone crate (#820)
  • (tests) Reorganize integration_api tests (#815)
  • mapping engine phase 3 - migrate SPIFFE (#811)
  • Upgrade spiffe dependencies (#805)
  • Rename identity_mapping to idmapping (#788)
  • Unify sea-orm features (#769)
  • Make resolve_implied_roles optional (#764)
  • Make core crates a workspace dependency (#736)
  • Redesign SecurityContext with two-phase validation (#717)
  • (deps) bump spiffe (#709)
  • (deps) bump spiffe-rustls-tokio from 0.2.0 to 0.3.0 (#706)
  • Add policy enforcement into group.v3 handler (#685)
  • Split api.v3.group handlers (#679)
  • Small optimization of the derives (#638)
  • Split the core-types crate (#640)
  • Split out remaining sql drivers (#633)
  • Split more drivers to separate crates (#632)
  • Split config into standalone crate (#628)
  • Make assignment sql driver a standalone crate (#626)
  • Move assignment parameters resolution to driver (#625)
  • Introduce features in api-types crate (#624)
  • Slim down api-types crate (#622)
  • Split out webauthn into crate (#621)
  • Split out token-fernet driver (#620)
  • Prepare slit out of the FernetTokenProvider (#619)
  • Move benchmark into the proper crate (#614)

openstack-keystone-cli-manage

0.1.0 - 2026-07-08

Added

  • (fernet) Unify credential/token key repositories (#915)
  • (credential) Implement Phase 3 of ADR 0019 (#909)
  • (storage) SPIFFE checks, RBAC, rate limiting, auto-join (#861)
  • (storage) Add SPIFFE mTLS support to Raft gRPC (#852)
  • (cli) Add cli storage subcommands per ADR 0016-v2 (#850)
  • (storage) implement ADR 0016-v2 Phases 1-4 — encrypted storage with quarantine (#840)
  • Add bootstrap cli command (#809)
  • Make drivers more dynamic (#737)
  • Introduce SecurityContext (#710)
  • Add skeleton for the spiffe mTLS integration (#695)
  • Implement ConfigManager for config watching (#691)
  • Add raft support under skaffold (#667)
  • Introduce the keystone-manage cli managing raft (#656)

Fixed

  • (ci) Prepare workflows for merge queue (#902)

Other

  • Move jsonwebtoken to keystone crate (#820)
  • Unify sea-orm features (#769)


This PR was generated with release-plz.

@github-actions

github-actions Bot commented Jun 5, 2026

Copy link
Copy Markdown

🦢 Load Test Results

Goose Attack Report

Plan Overview

Action Started Stopped Elapsed Users
Increasing 26-07-08 08:55:07 26-07-08 08:55:23 00:00:16 0 → 30
Maintaining 26-07-08 08:55:23 26-07-08 08:55:53 00:00:30 30
Decreasing 26-07-08 08:55:53 26-07-08 08:55:53 00:00:00 0 ← 30

Request Metrics

Method Name # Requests # Fails Average (ms) Min (ms) Max (ms) RPS Failures/s
DELETE DELETE /v3/auth/tokens 500 0 109.33 15 139 16.67 0.00
DELETE DELETE /v3/projects/:id (teardown) 2 0 51.00 46 56 0.07 0.00
DELETE DELETE /v3/users/:id (teardown) 3 0 44.00 24 76 0.10 0.00
GET 4566 0 102.93 67 200 152.20 0.00
GET GET /v3/auth/tokens (validate new) 497 0 109.79 67 139 16.57 0.00
GET GET /v3/projects/:id 713 0 84.02 73 111 23.77 0.00
GET GET /v3/projects/:id (catalog) 707 0 84.29 72 112 23.57 0.00
GET GET /v3/users/:id 995 0 90.43 78 117 33.17 0.00
GET GET /v3/users/:id (catalog) 784 0 90.03 76 118 26.13 0.00
POST POST /v3/auth/tokens 495 0 82.44 71 105 16.50 0.00
Aggregated 9262 0 97.20 15 200 308.73 0.00

Response Time Metrics

Method Name 50%ile (ms) 60%ile (ms) 70%ile (ms) 80%ile (ms) 90%ile (ms) 95%ile (ms) 99%ile (ms) 100%ile (ms)
DELETE DELETE /v3/auth/tokens 110 110 110 110 120 120 130 139
DELETE DELETE /v3/projects/:id (teardown) 46 46 46 56 56 56 56 56
DELETE DELETE /v3/users/:id (teardown) 32 32 32 32 76 76 76 76
GET 94 99 100 110 160 160 170 200
GET GET /v3/auth/tokens (validate new) 110 110 110 110 120 120 130 139
GET GET /v3/projects/:id 84 85 86 88 90 91 100 110
GET GET /v3/projects/:id (catalog) 84 85 86 88 90 92 100 110
GET GET /v3/users/:id 90 91 93 94 96 99 110 117
GET GET /v3/users/:id (catalog) 90 91 92 94 96 99 110 118
POST POST /v3/auth/tokens 82 83 85 86 88 90 100 105
Aggregated 90 94 100 110 120 160 170 200

Status Code Metrics

Method Name Status Codes
DELETE DELETE /v3/auth/tokens 500 [204]
DELETE DELETE /v3/projects/:id (teardown) 2 [204]
DELETE DELETE /v3/users/:id (teardown) 3 [204]
GET 4,566 [200]
GET GET /v3/auth/tokens (validate new) 497 [200]
GET GET /v3/projects/:id 713 [200]
GET GET /v3/projects/:id (catalog) 707 [200]
GET GET /v3/users/:id 995 [200]
GET GET /v3/users/:id (catalog) 784 [200]
POST POST /v3/auth/tokens 495 [200]
Aggregated 505 [204], 8,757 [200]

Transaction Metrics

Transaction # Times Run # Fails Average (ms) Min (ms) Max (ms) RPS Failures/s
ReadHeavy
0.0 1 0 17.00 17 17 0.03 0.00
0.1 775 0 101.61 89 129 25.83 0.00
0.2 775 0 85.09 72 110 25.83 0.00
0.3 772 0 84.49 70 117 25.73 0.00
TokenLifecycle
1.0 0 0 0.00 0 0 0.00 0.00
1.1 500 0 302.58 166 344 16.67 0.00
ValidateToken
2.0 0 0 0.00 0 0 0.00 0.00
2.1 753 0 159.89 90 201 25.10 0.00
UserCRUD
3.0 0 0 0.00 0 0 0.00 0.00
3.1 0 0 0.00 0 0 0.00 0.00
3.2 995 0 90.47 78 117 33.17 0.00
3.3 3 0 44.00 24 76 0.10 0.00
ProjectCRUD
4.0 0 0 0.00 0 0 0.00 0.00
4.1 0 0 0.00 0 0 0.00 0.00
4.2 713 0 84.07 73 111 23.77 0.00
4.3 2 0 51.00 46 56 0.07 0.00
UserRead
5.0 0 0 0.00 0 0 0.00 0.00
5.1 783 0 101.60 88 130 26.10 0.00
5.2 784 0 90.06 76 118 26.13 0.00
ProjectRead
6.0 0 0 0.00 0 0 0.00 0.00
6.1 708 0 85.14 67 116 23.60 0.00
6.2 707 0 84.33 72 112 23.57 0.00
Aggregated 8271 0 108.85 17 344 275.70 0.00

Scenario Metrics

Transaction # Users # Times Run Average (ms) Min (ms) Max (ms) Scenarios/s Iterations
ReadHeavy 7 770 272.21 252 308 25.67 110.00
TokenLifecycle 5 495 303.02 277 344 16.50 99.00
ValidateToken 4 749 160.02 141 201 24.97 187.25
UserCRUD 3 992 90.49 78 117 33.07 330.67
ProjectCRUD 2 711 84.06 73 111 23.70 355.50
UserRead 5 780 192.20 173 230 26.00 156.00
ProjectRead 4 707 169.95 151 206 23.57 176.75
Aggregated 30 5204 172.76 73 344 173.47 1415.17

View full report

@github-actions

github-actions Bot commented Jun 5, 2026

Copy link
Copy Markdown

🐰 Bencher Report

Branchrelease-plz-2026-06-05T09-00-15Z
Testbedubuntu-latest
Click to view all benchmark results
BenchmarkLatencyBenchmark Result
nanoseconds (ns)
(Result Δ%)
Upper Boundary
nanoseconds (ns)
(Limit %)
Command_Serde/apply/remove📈 view plot
🚷 view threshold
158,420.00 ns
(-34.94%)Baseline: 243,505.66 ns
1,490,490.84 ns
(10.63%)
Command_Serde/apply/set📈 view plot
🚷 view threshold
190,920.00 ns
(-8.83%)Baseline: 209,413.83 ns
782,544.32 ns
(24.40%)
Command_Serde/pack/delete📈 view plot
🚷 view threshold
122.71 ns
(-0.22%)Baseline: 122.98 ns
143.51 ns
(85.51%)
Command_Serde/pack/delete_index📈 view plot
🚷 view threshold
111.72 ns
(+0.43%)Baseline: 111.24 ns
129.68 ns
(86.15%)
Command_Serde/pack/set📈 view plot
🚷 view threshold
206.92 ns
(+4.33%)Baseline: 198.33 ns
234.82 ns
(88.12%)
Command_Serde/pack/set_index📈 view plot
🚷 view threshold
112.11 ns
(+0.98%)Baseline: 111.02 ns
128.90 ns
(86.97%)
Command_Serde/unpack/delete📈 view plot
🚷 view threshold
189.26 ns
(-2.36%)Baseline: 193.83 ns
236.68 ns
(79.97%)
Command_Serde/unpack/delete_index📈 view plot
🚷 view threshold
159.92 ns
(-1.05%)Baseline: 161.61 ns
201.10 ns
(79.52%)
Command_Serde/unpack/set📈 view plot
🚷 view threshold
268.22 ns
(-1.83%)Baseline: 273.22 ns
325.56 ns
(82.39%)
Command_Serde/unpack/set_index📈 view plot
🚷 view threshold
160.53 ns
(+0.23%)Baseline: 160.16 ns
197.29 ns
(81.37%)
Payload_encryption/pack/remove_cmd📈 view plot
🚷 view threshold
116.46 ns
(-0.47%)Baseline: 117.01 ns
139.37 ns
(83.56%)
Payload_encryption/pack/set_cmd📈 view plot
🚷 view threshold
256.90 ns
(+24.27%)Baseline: 206.73 ns
261.56 ns
(98.22%)
Payload_encryption/unpack/remove_cmd📈 view plot
🚷 view threshold
204.54 ns
(-0.91%)Baseline: 206.42 ns
258.09 ns
(79.25%)
Payload_encryption/unpack/set_cmd📈 view plot
🚷 view threshold
308.16 ns
(+7.90%)Baseline: 285.59 ns
350.89 ns
(87.82%)
Raft_1Node_Latency/prefix/1node📈 view plot
🚷 view threshold
2,510,400.00 ns
(-12.01%)Baseline: 2,852,938.12 ns
6,237,792.49 ns
(40.25%)
Raft_1Node_Latency/read/1node📈 view plot
🚷 view threshold
37,632.00 ns
(+41.71%)Baseline: 26,555.75 ns
73,261.58 ns
(51.37%)
Raft_1Node_Latency/remove/1node📈 view plot
🚷 view threshold
484,180.00 ns
(+2.28%)Baseline: 473,398.28 ns
1,314,279.25 ns
(36.84%)
Raft_1Node_Latency/write/1node📈 view plot
🚷 view threshold
486,370.00 ns
(-8.56%)Baseline: 531,891.09 ns
1,793,047.40 ns
(27.13%)
build_snapshot/default📈 view plot
🚷 view threshold
108,310.00 ns
(-1.26%)Baseline: 109,690.39 ns
130,716.40 ns
(82.86%)
fernet token/project📈 view plot
🚷 view threshold
1,445.70 ns
(+3.23%)Baseline: 1,400.47 ns
1,619.54 ns
(89.27%)
get_data_keyspace📈 view plot
🚷 view threshold
0.31 ns
(-1.19%)Baseline: 0.32 ns
0.36 ns
(85.81%)
get_db📈 view plot
🚷 view threshold
0.31 ns
(-1.14%)Baseline: 0.32 ns
0.36 ns
(85.85%)
get_fernet_token_timestamp/project📈 view plot
🚷 view threshold
144.64 ns
(+0.49%)Baseline: 143.94 ns
177.50 ns
(81.49%)
get_keyspace📈 view plot
🚷 view threshold
4.38 ns
(-13.00%)Baseline: 5.03 ns
10.66 ns
(41.03%)
🐰 View full continuous benchmarking report in Bencher

@openstack-experimental-release-plz openstack-experimental-release-plz Bot force-pushed the release-plz-2026-06-05T09-00-15Z branch 22 times, most recently from d04a4df to 7fe2614 Compare June 12, 2026 09:11
@openstack-experimental-release-plz openstack-experimental-release-plz Bot force-pushed the release-plz-2026-06-05T09-00-15Z branch 6 times, most recently from 3966098 to 805ed8e Compare June 15, 2026 10:08
@openstack-experimental-release-plz openstack-experimental-release-plz Bot force-pushed the release-plz-2026-06-05T09-00-15Z branch 28 times, most recently from fd83531 to fd0af7c Compare June 26, 2026 17:15
@openstack-experimental-release-plz openstack-experimental-release-plz Bot force-pushed the release-plz-2026-06-05T09-00-15Z branch from fd0af7c to 53568cd Compare June 26, 2026 20:00
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants