chore: release

[openstack-experimental-release-plz]

🤖 New release

• openstack-keystone-config: 0.1.0
• openstack-keystone-core-types: 0.1.1
• openstack-keystone-api-types: 0.1.0 -> 0.1.1 (✓ API compatible changes)
• openstack-keystone-audit: 0.1.0
• openstack-keystone-auth-plugin-core: 0.1.0
• openstack-keystone-key-repository: 0.1.0
• openstack-keystone-local-emergency-store: 0.1.0
• openstack-keystone-storage-api: 0.1.0
• openstack-keystone-core: 0.1.1 -> 0.1.2 (✓ API compatible changes)
• openstack-keystone-storage-crypto: 0.1.0
• openstack-keystone-storage-crypto-pkcs11: 0.1.0
• openstack-keystone-storage-crypto-tpm: 0.1.0
• openstack-keystone-distributed-storage: 0.1.0 -> 0.1.1 (✓ API compatible changes)
• openstack-keystone-api-key-driver-raft: 0.1.0
• openstack-keystone-auth-plugin-runtime: 0.1.0
• openstack-keystone-password-hashing: 0.1.0
• openstack-keystone-appcred-driver-sql: 0.1.0
• openstack-keystone-assignment-driver-sql: 0.1.0
• openstack-keystone-catalog-driver-sql: 0.1.0
• openstack-keystone-credential-driver-sql: 0.1.0
• openstack-keystone-auth-plugin-identity-driver-raft: 0.1.0
• openstack-keystone-federation-driver-sql: 0.1.0
• openstack-keystone-identity-driver-ldap: 0.1.0
• openstack-keystone-identity-driver-sql: 0.1.0
• openstack-keystone-idmapping-driver-sql: 0.1.0
• openstack-keystone-k8s-auth-driver-raft: 0.1.0
• openstack-keystone-k8s-auth-driver-sql: 0.1.0
• openstack-keystone-mapping-driver-raft: 0.1.0
• openstack-keystone-oauth2-client-driver-raft: 0.1.0
• openstack-keystone-oauth2-key-driver-raft: 0.1.0
• openstack-keystone-oauth2-session-driver-raft: 0.1.0
• openstack-keystone-policy-store-driver-sql: 0.1.0
• openstack-keystone-resource-driver-sql: 0.1.0
• openstack-keystone-revoke-driver-sql: 0.1.0
• openstack-keystone-role-driver-sql: 0.1.0
• openstack-keystone-scim-driver-raft: 0.1.0
• openstack-keystone-token-driver-fernet: 0.1.1
• openstack-keystone-token-driver-jws: 0.1.0
• openstack-keystone-token-restriction-driver-sql: 0.1.0
• openstack-keystone-trust-driver-sql: 0.1.0
• openstack-keystone-webauthn: 0.1.0
• openstack-keystone: 0.1.1 -> 0.1.2 (✓ API compatible changes)
• openstack-keystone-cli-manage: 0.1.0

Changelog

openstack-keystone-config

0.1.0 - 2026-08-05

Added

• (policy) Implement legacy Policy API (/v3/policies) (#1127)
• Add domain config types and backend trait (#1138)
• (adr0031) Add HTTP request metrics (#1134)
• (config) Support configurable log file rotation (#1128)
• Add connection_debug to tune SQL query logging (#1109)
• (pagination) Add pagination to remaining places (#1106)
• (config) Revoke Vault token on shutdown (#1088)
• Generalize marker pagination for v3/v4 lists (#1086)
• (config) Add Vault-backed configuration (#1051)
• (logging) Add native journald log writer (#1081)
• (identity) Add PATCH to few resources (#1076)
• (ldap) Add LDAP identity driver (#1047)
• (adr0028) Add local-quorum-bypass emergency rotation (#1032)
• Add catalog CRUD API and bootstrap support (#1029)
• (adr0026) Add RFC 8628 Device Authorization Grant (#1023)
• (adr0026) Add authorization code flow with PKCE (#1015)
• (adr0026) Add client_credentials token endpoint (#1014)
• (adr0026) Phase 2 client registration & OIDC discovery (#1013)
• (adr0026) Phase 0 token abstraction and JWS driver (#1010)
• (api) capture client IP via proxy headers & SPIFFE (Start capturing client information in the request processing #358 follow-up) (#908)
• (identity) Add per-user auth rate limiting (#996)
• (adr0025) Complete imlpementation (#969)
• (api) Add global IP rate limiting framework (ADR-0022 phase 1) (#846)
• (scim) Harden RFC 7644 compliance, add docs (#968)
• (adr0025) Phase 1 (1.1+1.2) (#952)
• (security) Wrap secrets with secrecy crate (#369) (#912)
• (scim) ADR 0024 - Phase 5 (#951)
• (scim) ADR 0024 - Phase 1+2 (#925)
• (fernet) Unify credential/token key repositories (#915)
• Start ADR 0025 immplementation (#911)
• (credential) Implement Phase 3 of ADR 0019 (#909)
• Prepare PKCS#11/TPM KEK support in storage (#907)
• (credential) Implement ADR 0019 phases 1-2 (#897)
• Implement stateless SCIM ingress auth (ADR 0021) (#891)
• (auth) Password hashing parity with Python Keystone (#859)
• (audit) Implement CADF audit framework Phase 2 (#872)
• (storage) SPIFFE checks, RBAC, rate limiting, auto-join (#861)
• (storage) Harden preflight and erase dev KEK (#860)
• Add bootstrap cli command (#809)
• (mapping) ADR-0020 (mapping engine) phase 1 (#794)
• Add inter-provider event notification system (#784)
• Add SO_PEERCRED peer credential validation (#775)
• Validate password for compliance conformity (#774)
• Enforce minimum range boundaries for security
• Add role-imply rest api (#750)
• Add user update functionality (#747)
• Make drivers more dynamic (#737)
• Add keystone container with opa and policies (#738)
• Add Admin interface over the UDS (#735)
• Add spiffe provider (#733)
• Introduce SecurityContext (#710)
• Add skeleton for the spiffe mTLS integration (#695)
• Implement ConfigManager for config watching (#691)
• Improve the code (#686)
• Add k8s-auth raft driver (#676)
• Add raft support under skaffold (#667)
• Introduce raft backend for webauthn (#658)
• Introduce the keystone-manage cli managing raft (#656)

Fixed

• Avoid blocking notify's event thread in watch_loop (#1125)
• Fix flaky test (#1110)
• (security) Address security review findings (#1049)
• (passkey) Prevent user enumeration (#905)

Other

• (config) Fix flaky notify watcher tests (#1112)
• Revise documentation layout (#1069)
• Moves health and metrics endpoints to dedicated listener on separate port (#910)
• Move jsonwebtoken to keystone crate (#820)
• mapping engine phase 3 - migrate SPIFFE (#811)
• Rename identity_mapping to idmapping (#788)
• Replace Regex with str::find for db connection (#760)
• Redesign SecurityContext with two-phase validation (#717)
• Split out remaining sql drivers (#633)
• Split config into standalone crate (#628)

openstack-keystone-core-types

0.1.1 - 2026-08-05

Added

• (policy) Implement legacy Policy API (/v3/policies) (#1127)
• Add domain config types and backend trait (#1138)
• Add cargo-fuzz targets (#1130)
• Add OS-EP-FILTER provider CRUD to the catalog (#1075)
• (pagination) Add pagination to remaining places (#1106)
• Add immutable option for project, domain, role (#1097)
• Generalize marker pagination for v3/v4 lists (#1086)
• (identity) Add trust create/delete and REST CRUD (#1079)
• (catalog) Expose /v3/regions REST API (#1078)
• (identity) Add PATCH to few resources (#1076)
• (ldap) Add LDAP identity driver (#1047)
• (test) Add tempest identity compatibility (#998)
• (adr0028) Add local-quorum-bypass emergency rotation (#1032)
• Add catalog CRUD API and bootstrap support (#1029)
• (adr0026) Add RFC 8628 Device Authorization Grant (#1023)
• (adr0026) Phase 6a (#1017)
• (adr0026) Add Phase 5 offline token verification (#1016)
• (adr0026) Add authorization code flow with PKCE (#1015)
• (adr0026) Add client_credentials token endpoint (#1014)
• (adr0026) Phase 2 client registration & OIDC discovery (#1013)
• (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
• (adr0026) Phase 0 token abstraction and JWS driver (#1010)
• (identity) Add per-user auth rate limiting (#996)
• (adr0025) Complete imlpementation (#969)
• (api) Add global IP rate limiting framework (ADR-0022 phase 1) (#846)
• (adr0025) Phase 1 (1.1+1.2) (#952)
• (security) Wrap secrets with secrecy crate (#369) (#912)
• (scim) ADR 0024 - Phase 4 (protocol surface completion) (#929)
• (scim) ADR 0024 - Phase 3 (#928)
• (scim) ADR 0024 - Phase 1+2 (#925)
• (credential) Implement Phase 3 of ADR 0019 (#909)
• (credential) Implement ADR 0019 phases 1-2 (#897)
• Implement stateless SCIM ingress auth (ADR 0021) (#891)
• Audit framework (ADR-0023) phase 3 (#880)
• (audit) Implement CADF audit framework Phase 2 (#872)
• Migrate federation to new mapping engine (#839)
• Add access rule CRD to appcred provider (#806)
• ADR-0020 mapping phase 4 (#818)
• (mapping) ADR-0020 (mapping engine) phase 1 (#794)
• Add endpoint CRUD to catalog provider (#785)
• Add inter-provider event notification system (#784)
• Add service CRUD to the catalog provider (#773)
• Validate password for compliance conformity (#774)
• Return 401 on roleless scoped contexts (#742)
• Add region CRUD to catalog SQL driver (#761)
• Add role-imply rest api (#750)
• Add role imply API (#749)
• Add user update functionality (#747)
• Add spiffe binding API (#740)
• Add Admin interface over the UDS (#735)
• Add spiffe provider (#733)
• Expand role info in expand_implied_roles (#730)
• Introduce SecurityContext (#710)
• Improve the code (#686)
• Add k8s-auth raft driver (#676)
• Introduce the keystone-manage cli managing raft (#656)

Fixed

• Register UserType in OpenAPI components schema (#1151)
• Fix ID sanitizer and capture client IP in audit (#1126)
• (api) Default enabled/domain_id on create (#1073)
• (security) Address security review findings (#1049)
• (federation) Allow long external unique_id values (#1033)
• Unify ApiClient scope validation, fix nextest filter (#947)
• Finalize ADR 0021 work (#906)
• Resolve raft replication state races (#884)
• (k8s_auth) Flatten k8s.aud claim from JWT TokenReview (#834)
• Align "extra" property handling (#787)

Other

• (identity) Remove service account API methods (#1152)
• Extend workspace unsafe/unwrap/expect lints (#1120)
• Revise documentation layout (#1069)
• (security) Close mutation-testing gaps in auth/policy (#1056)
• Move jsonwebtoken to keystone crate (#820)
• mapping engine phase 3 - migrate SPIFFE (#811)
• Rename identity_mapping to idmapping (#788)
• Make resolve_implied_roles optional (#764)
• Redesign SecurityContext with two-phase validation (#717)
• Unify state initialization in test (#642)
• Small optimization of the derives (#638)
• Split the core-types crate (#640)

openstack-keystone-api-types

0.1.1 - 2026-08-05

Added

• (policy) Implement legacy Policy API (/v3/policies) (#1127)
• Filter user listing by type (#813)
• (loadtest) Add more auth tests (#1119)
• (pagination) Add pagination to remaining places (#1106)
• Add immutable option for project, domain, role (#1097)
• Generalize marker pagination for v3/v4 lists (#1086)
• (identity) Add trust create/delete and REST CRUD (#1079)
• (catalog) Expose /v3/regions REST API (#1078)
• (identity) Add PATCH to few resources (#1076)
• (ldap) Add LDAP identity driver (#1047)
• (test) Add tempest identity compatibility (#998)
• (adr0028) Add local-quorum-bypass emergency rotation (#1032)
• Add catalog CRUD API and bootstrap support (#1029)
• (adr0026) Extend keystone-manage oauth2 CLI (#1020)
• (adr0026) Phase 6a (#1017)
• (adr0026) Add client_credentials token endpoint (#1014)
• (adr0026) Phase 2 client registration & OIDC discovery (#1013)
• (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
• (identity) Add per-user auth rate limiting (#996)
• (adr0025) Complete imlpementation (#969)
• (identity) Implement user password change endpoint (#970)
• (api) Add global IP rate limiting framework (ADR-0022 phase 1) (#846)
• (adr0025) Phase 1 (1.1+1.2) (#952)
• (security) Wrap secrets with secrecy crate (#369) (#912)
• (scim) ADR 0024 - Phase 5 (#951)
• (scim) ADR 0024 - Phase 1+2 (#925)
• (credential) Implement Phase 3 of ADR 0019 (#909)
• ADR 0021 admin surface, simulate-access, and janitor (#896)
• Implement stateless SCIM ingress auth (ADR 0021) (#891)
• Migrate federation to new mapping engine (#839)
• ADR-0020 mapping phase 4 (#818)
• (mapping) ADR-0020 phase 2 (#807)
• (mapping) ADR-0020 (mapping engine) phase 1 (#794)
• Validate password for compliance conformity (#774)
• Add system-user-role assignments API (#762)
• Add role-imply rest api (#750)
• Add user update functionality (#747)
• Add api to list user roles on project (#639)
• Add domain CRUD operations (#743)
• Add spiffe binding API (#740)
• Add spiffe provider (#733)
• Introduce SecurityContext (#710)
• Add skeleton for the spiffe mTLS integration (#695)
• Improve the code (#686)

Fixed

• Register UserType in OpenAPI components schema (#1151)
• Map raft-not-available to proper HTTP status codes (#1149)
• (api) Fix pagination limit, filters, and rows (#1115)
• Address multiple tempest failures (#1083)
• (api) Default enabled/domain_id on create (#1073)
• (security) Address security review findings (#1049)
• (federation) Allow long external unique_id values (#1033)
• Unify ApiClient scope validation, fix nextest filter (#947)
• Finalize ADR 0021 work (#906)

Other

• (identity) Remove service account API methods (#1152)
• Feature/expose app credential (#948)
• (api) Expand v3 coverage and enforce EC2 token restrictions (#1084)
• Extend workspace unsafe/unwrap/expect lints (#1120)
• (test) Improve testing of the oauth2 OP (#1024)
• Move jsonwebtoken to keystone crate (#820)
• (tests) Reorganize integration_api tests (#815)
• mapping engine phase 3 - migrate SPIFFE (#811)
• Rename identity_mapping to idmapping (#788)
• Further align workspace features (#772)
• Make resolve_implied_roles optional (#764)
• Redesign SecurityContext with two-phase validation (#717)
• Small optimization of the derives (#638)
• Split the core-types crate (#640)
• Introduce features in api-types crate (#624)
• Slim down api-types crate (#622)

openstack-keystone-audit

0.1.0 - 2026-08-05

Added

• (audit) Complete ADR-0023 audit implementation (#887)
• Audit framework (ADR-0023) phase 3 (#880)
• (audit) Implement CADF audit framework Phase 2 (#872)

Fixed

• Fix ID sanitizer and capture client IP in audit (#1126)

Other

• Extend workspace unsafe/unwrap/expect lints (#1120)

openstack-keystone-auth-plugin-core

0.1.0 - 2026-08-05

Other

• Split extism out of core's dependency tree (#1148)

openstack-keystone-key-repository

0.1.0 - 2026-08-05

Added

• (adr0026) Add previous-key and JTI-revocation janitor (#1021)
• (adr0026) Add Phase 5 offline token verification (#1016)
• (adr0026) Add client_credentials token endpoint (#1014)
• (adr0026) Phase 0 token abstraction and JWS driver (#1010)
• (scim) ADR 0024 - Phase 1+2 (#925)
• (fernet) Unify credential/token key repositories (#915)

Fixed

• Widen Fernet key index from i8 to u32 (#1080)
• Support macOS dev builds and fs watcher shutdown (#1009)

Other

• (deps) bump pkcs8 from 0.10.2 to 0.11.0 (#1061)

openstack-keystone-local-emergency-store

0.1.0 - 2026-08-05

Added

• (test) Add tempest identity compatibility (#998)
• (adr0028) Add local-quorum-bypass emergency rotation (#1032)

Other

• Extend workspace unsafe/unwrap/expect lints (#1120)

openstack-keystone-storage-api

0.1.0 - 2026-08-05

Added

• (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
• (storage) Cert validity and SVID TTL enforcement (#886)
• (storage) SPIFFE checks, RBAC, rate limiting, auto-join (#861)
• (storage) Complete ADR-0016-v2 (#844)
• (storage) implement ADR 0016-v2 Phases 1-4 — encrypted storage with quarantine (#840)

Fixed

• (webauthn) Rotate raft ceremony-state keyspaces (#890)

Other

• Extend workspace unsafe/unwrap/expect lints (#1120)
• (storage) Decouple core from storage (#832)

openstack-keystone-core

0.1.2 - 2026-08-05

Added

• (policy) Implement legacy Policy API (/v3/policies) (#1127)
• Add domain config types and backend trait (#1138)
• Add SCIM scenarios; Fix findings (#1136)
• Add cargo-fuzz targets (#1130)
• Add SPIFFE SVID health check to readiness probe (#1121)
• Add OS-EP-FILTER provider CRUD to the catalog (#1075)
• Add per-request cache framework (ADR 0030) (#1114)
• Auto-register backend drivers via inventory (#1105)
• Add immutable option for project, domain, role (#1097)
• (config) Revoke Vault token on shutdown (#1088)
• (identity) Add trust create/delete and REST CRUD (#1079)
• (identity) Add PATCH to few resources (#1076)
• (tempest) Improve tempest testing (#1046)
• (test) Add tempest identity compatibility (#998)
• (adr0028) Add local-quorum-bypass emergency rotation (#1032)
• (adr0026) Add RFC 8628 Device Authorization Grant (#1023)
• (adr0026) Add previous-key and JTI-revocation janitor (#1021)
• (adr0026) Phase 6a (#1017)
• (adr0026) Add Phase 5 offline token verification (#1016)
• (adr0026) Add authorization code flow with PKCE (#1015)
• (adr0026) Add client_credentials token endpoint (#1014)
• (adr0026) Phase 2 client registration & OIDC discovery (#1013)
• (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
• (adr0026) Phase 0 token abstraction and JWS driver (#1010)
• (api) capture client IP via proxy headers & SPIFFE (Start capturing client information in the request processing #358 follow-up) (#908)
• (identity) Add per-user auth rate limiting (#996)
• (adr0025) Complete imlpementation (#969)
• (api) Add global IP rate limiting framework (ADR-0022 phase 1) (#846)
• (adr0025) Phase 1 (1.1+1.2) (#952)
• (security) Wrap secrets with secrecy crate (#369) (#912)
• (scim) ADR 0024 - Phase 5 (#951)
• (scim) ADR 0024 - Phase 4 (protocol surface completion) (#929)
• (scim) ADR 0024 - Phase 3 (#928)
• (scim) ADR 0024 - Phase 1+2 (#925)
• (credential) Implement Phase 3 of ADR 0019 (#909)
• (credential) Implement ADR 0019 phases 1-2 (#897)
• ADR 0021 admin surface, simulate-access, and janitor (#896)
• Implement stateless SCIM ingress auth (ADR 0021) (#891)
• (audit) Complete ADR-0023 audit implementation (#887)
• (storage) Cert validity and SVID TTL enforcement (#886)
• Audit framework (ADR-0023) phase 3 (#880)
• (auth) Password hashing parity with Python Keystone (#859)
• (audit) Implement CADF audit framework Phase 2 (#872)
• Migrate federation to new mapping engine (#839)
• Add access rule CRD to appcred provider (#806)
• ADR-0020 mapping phase 4 (#818)
• Add bootstrap cli command (#809)
• (mapping) ADR-0020 (mapping engine) phase 1 (#794)
• Add endpoint CRUD to catalog provider (#785)
• Add inter-provider event notification system (#784)
• Add service CRUD to the catalog provider (#773)
• Validate password for compliance conformity (#774)
• Return 401 on roleless scoped contexts (#742)
• Add region CRUD to catalog SQL driver (#761)
• Add timing attack protection and failed auth tracking (#758)
• Add role-imply rest api (#750)
• Add role imply API (#749)
• Add user update functionality (#747)
• Add domain CRUD operations (#743)
• Add spiffe binding API (#740)
• Normalize the policy enforcer structure (#741)
• Make drivers more dynamic (#737)
• Add Admin interface over the UDS (#735)
• Add spiffe provider (#733)
• Expand role info in expand_implied_roles (#730)
• Introduce SecurityContext (#710)
• Talk to OPA over unix socket (#701)
• Add skeleton for the spiffe mTLS integration (#695)
• Implement ConfigManager for config watching (#691)
• Improve the code (#686)
• Add k8s-auth raft driver (#676)
• Add basic healthcheck endpoint (#671)
• Make raft storage available through state (#657)

Fixed

• Register UserType in OpenAPI components schema (#1151)
• (api) Fix pagination limit, filters, and rows (#1115)
• Fix ID sanitizer and capture client IP in audit (#1126)
• (api) Default enabled/domain_id on create (#1073)
• (security) Do not allow ec2cred token to do anything (#1071)
• (security) Address security review findings (#1049)
• (adr0026) Bind Token Exchange grant to the issuing domain (#1019)
• Unify ApiClient scope validation, fix nextest filter (#947)
• Finalize ADR 0021 work (#906)
• (ci) Prepare workflows for merge queue (#902)
• Resolve raft replication state races (#884)
• (core) Eliminate mapping race condition (#876)
• (k8s_auth) Flatten k8s.aud claim from JWT TokenReview (#834)
• (auth) Close admin SVID impersonation gap (#833)

Other

• (identity) Remove service account API methods (#1152)
• Feature/expose app credential (#948)
• (api) Expand v3 coverage and enforce EC2 token restrictions (#1084)
• Split extism out of core's dependency tree (#1148)
• Add SECURITY note to important method (#1132)
• Extend workspace unsafe/unwrap/expect lints (#1120)
• (db) 3 optimizations for DB queries (#1111)
• (deps) Bump sea-orm and sea-orm-migration to 2.0 (#1089)
• Revise documentation layout (#1069)
• (security) Close mutation-testing gaps in auth/policy (#1056)
• Extract password hashing into own crate (#1055)
• (test) Improve testing of the oauth2 OP (#1024)
• (deps) bump scrypt from 0.11.0 to 0.12.0 (#923)
• Reorganize dockerfile and deps (#857)
• (core) Remove spiffe crate dependency (#858)
• Wrap ServiceState under ExecutionContext (#856)
• (storage) Decouple core from storage (#832)
• (core) Eliminate XxxProvider enums (#830)
• Move jsonwebtoken to keystone crate (#820)
• mapping engine phase 3 - migrate SPIFFE (#811)
• (deps) bump hmac from 0.12.1 to 0.13.0 (#801)
• Rename identity_mapping to idmapping (#788)
• Consolidate password update flows (#778)
• Further align workspace features (#772)
• Make resolve_implied_roles optional (#764)
• Redesign SecurityContext with two-phase validation (#717)
• (deps) bump jsonwebtoken from 10.3.0 to 10.4.0 (#707)
• Introduce dynamic plugins (#643)
• Small optimization of the derives (#638)
• Split the core-types crate (#640)
• Split out remaining sql drivers (#633)
• Split more drivers to separate crates (#632)
• Drop unnecessary derives to help compilation (#631)
• Drop unnecessary tracing directives (#627)
• Split config into standalone crate (#628)
• Rework http client pool (#629)
• Make assignment sql driver a standalone crate (#626)
• Move assignment parameters resolution to driver (#625)
• Introduce features in api-types crate (#624)
• Slim down api-types crate (#622)
• Split out webauthn into crate (#621)
• Split out token-fernet driver (#620)
• Prepare slit out of the FernetTokenProvider (#619)
• Move benchmark into the proper crate (#614)

openstack-keystone-storage-crypto

0.1.0 - 2026-08-05

Added

• (scim) ADR 0024 - Phase 3 (#928)
• (storage) Add PKCS#11 KEK provider crate (#917)
• (storage) Cert validity and SVID TTL enforcement (#886)
• (audit) Implement CADF audit framework Phase 2 (#872)
• (storage) SPIFFE checks, RBAC, rate limiting, auto-join (#861)
• (storage) Harden preflight and erase dev KEK (#860)
• (storage) Complete ADR-0016-v2 (#844)
• (storage) implement ADR 0016-v2 Phases 1-4 — encrypted storage with quarantine (#840)

Other

• Bump deps and whitelist rustsec advisory (#1140)
• (deps) Batch update dependencies (#875)

openstack-keystone-storage-crypto-pkcs11

0.1.0 - 2026-08-05

Added

• (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
• (storage) Add PKCS#11 KEK provider crate (#917)

Other

• Extend workspace unsafe/unwrap/expect lints (#1120)

openstack-keystone-storage-crypto-tpm

0.1.0 - 2026-08-05

Added

• (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
• (storage) Add PKCS#11 KEK provider crate (#917)

Other

• Extend workspace unsafe/unwrap/expect lints (#1120)

openstack-keystone-distributed-storage

0.1.1 - 2026-08-05

Added

• Add SCIM scenarios; Fix findings (#1136)
• (test) Add tempest identity compatibility (#998)
• (adr0028) Add local-quorum-bypass emergency rotation (#1032)
• (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
• (storage) Add PKCS#11 KEK provider crate (#917)
• Prepare PKCS#11/TPM KEK support in storage (#907)
• Implement background DEK re-encryption pipeline (#898)
• ADR 0021 admin surface, simulate-access, and janitor (#896)
• (storage) Cert validity and SVID TTL enforcement (#886)
• (storage) SPIFFE checks, RBAC, rate limiting, auto-join (#861)
• (storage) Harden preflight and erase dev KEK (#860)
• (storage) Add SPIFFE mTLS support to Raft gRPC (#852)
• (cli) Add cli storage subcommands per ADR 0016-v2 (#850)
• (storage) Complete ADR-0016-v2 (#844)
• (storage) implement ADR 0016-v2 Phases 1-4 — encrypted storage with quarantine (#840)
• (mapping) ADR-0020 phase 2 (#807)
• (adr) Add updated revision of the DS ADR (#795)
• (mapping) ADR-0020 (mapping engine) phase 1 (#794)
• Add skeleton for the spiffe mTLS integration (#695)
• Implement ConfigManager for config watching (#691)
• Improve the code (#686)
• Add k8s-auth raft driver (#676)
• Add SetIndex/RemoveIndex storage commands (#675)
• Add basic healthcheck endpoint (#671)
• Add metadata for raft data (#670)
• Add transaction support for Raft storage (#669)
• Add initial benchmarks for the storage (#668)
• Add raft support under skaffold (#667)
• Introduce raft backend for webauthn (#658)
• Prepare raft storage promotion (#659)
• Make raft storage available through state (#657)
• Introduce the keystone-manage cli managing raft (#656)

Fixed

• Support macOS dev builds and fs watcher shutdown (#1009)
• Finalize ADR 0021 work (#906)
• (ci) Prepare workflows for merge queue (#902)
• Further polish storage crate (#892)
• (webauthn) Rotate raft ceremony-state keyspaces (#890)
• Resolve raft replication state races (#884)

Other

• Bump openraft version to 0.10.0.a31 (#1137)
• Silence some clippy warnings (#1030)
• (deps) Batch update dependencies (#875)
• (core) Remove spiffe crate dependency (#858)
• Add SpiFFE Raft integration test by skaffold (#854)
• Wrap ServiceState under ExecutionContext (#856)
• (storage) Decouple core from storage (#832)
• Update raft drivers mocking (#791)
• Add mock raft storage for unittest (#790)
• Make core crates a workspace dependency (#736)
• Redesign SecurityContext with two-phase validation (#717)
• (deps) Bump openraft to alpha17 (#641)

openstack-keystone-api-key-driver-raft

0.1.0 - 2026-08-05

Added

• Auto-register backend drivers via inventory (#1105)
• Generalize marker pagination for v3/v4 lists (#1086)
• ADR 0021 admin surface, simulate-access, and janitor (#896)
• Implement stateless SCIM ingress auth (ADR 0021) (#891)

openstack-keystone-auth-plugin-runtime

0.1.0 - 2026-08-05

Added

• (adr0025) Complete imlpementation (#969)

Other

• Split extism out of core's dependency tree (#1148)

openstack-keystone-password-hashing

0.1.0 - 2026-08-05

Other

• Extract password hashing into own crate (#1055)

openstack-keystone-appcred-driver-sql

0.1.0 - 2026-08-05

Added

• Auto-register backend drivers via inventory (#1105)
• (security) Wrap secrets with secrecy crate (#369) (#912)
• Add access rule CRD to appcred provider (#806)
• Make drivers more dynamic (#737)

Fixed

• Ensure appcred are unique over name+user_id (#1150)

Other

• Feature/expose app credential (#948)
• (deps) Bump sea-orm and sea-orm-migration to 2.0 (#1089)
• Extract password hashing into own crate (#1055)
• (core) Eliminate XxxProvider enums (#830)
• Move jsonwebtoken to keystone crate (#820)
• Further align workspace features (#772)

openstack-keystone-assignment-driver-sql

0.1.0 - 2026-08-05

Added

• (pagination) Add pagination to remaining places (#1106)
• Auto-register backend drivers via inventory (#1105)
• (audit) Implement CADF audit framework Phase 2 (#872)
• Add role-imply rest api (#750)
• Make drivers more dynamic (#737)

Fixed

• Respect group_id param in assignment list (#953)
• (ci) Prepare workflows for merge queue (#902)

Other

• Extend workspace unsafe/unwrap/expect lints (#1120)
• (db) 3 optimizations for DB queries (#1111)
• Wrap ServiceState under ExecutionContext (#856)
• (storage) Decouple core from storage (#832)
• Move jsonwebtoken to keystone crate (#820)
• Further align workspace features (#772)
• Make resolve_implied_roles optional (#764)

openstack-keystone-catalog-driver-sql

0.1.0 - 2026-08-05

Added

• Add OS-EP-FILTER provider CRUD to the catalog (#1075)
• Auto-register backend drivers via inventory (#1105)
• Generalize marker pagination for v3/v4 lists (#1086)
• (mapping) ADR-0020 (mapping engine) phase 1 (#794)
• Add endpoint CRUD to catalog provider (#785)
• Add inter-provider event notification system (#784)
• Add service CRUD to the catalog provider (#773)
• Add region CRUD to catalog SQL driver (#761)
• Make drivers more dynamic (#737)

Fixed

• Align "extra" property handling (#787)

Other

• (deps) Bump sea-orm and sea-orm-migration to 2.0 (#1089)
• Move jsonwebtoken to keystone crate (#820)
• Further align workspace features (#772)

openstack-keystone-credential-driver-sql

0.1.0 - 2026-08-05

Added

• Auto-register backend drivers via inventory (#1105)
• Generalize marker pagination for v3/v4 lists (#1086)
• (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
• (adr0026) Phase 0 token abstraction and JWS driver (#1010)
• (fernet) Unify credential/token key repositories (#915)
• (credential) Enforce Null Key check at startup (#913)
• (credential) Implement Phase 3 of ADR 0019 (#909)
• (credential) Implement ADR 0019 phases 1-2 (#897)

Fixed

• Widen Fernet key index from i8 to u32 (#1080)

Other

• (deps) Bump sea-orm and sea-orm-migration to 2.0 (#1089)

openstack-keystone-auth-plugin-identity-driver-raft

0.1.0 - 2026-08-05

Added

• Auto-register backend drivers via inventory (#1105)
• (adr0025) Complete imlpementation (#969)

openstack-keystone-federation-driver-sql

0.1.0 - 2026-08-05

Added

• Auto-register backend drivers via inventory (#1105)
• Generalize marker pagination for v3/v4 lists (#1086)
• (security) Wrap secrets with secrecy crate (#369) (#912)
• (scim) ADR 0024 - Phase 5 (#951)
• Migrate federation to new mapping engine (#839)
• Make drivers more dynamic (#737)

Other

• (deps) Bump sea-orm and sea-orm-migration to 2.0 (#1089)
• Move json

[github-actions]

🦢 Load Test Results

Goose Attack Report

Plan Overview

Action	Started	Stopped	Elapsed	Users
Increasing	26-08-05 16:12:06	26-08-05 16:12:29	00:00:23	0 → 45
Maintaining	26-08-05 16:12:29	26-08-05 16:12:59	00:00:30	45
Decreasing	26-08-05 16:12:59	26-08-05 16:12:59	00:00:00	0 ← 45

Request Metrics

Method	Name	# Requests	# Fails	Average (ms)	Min (ms)	Max (ms)	RPS	Failures/s
DELETE	DELETE /v3/auth/tokens	42	0	560.14	262	787	1.40	0.00
DELETE	DELETE /v3/projects/:id (teardown)	1	0	159.00	159	159	0.03	0.00
DELETE	DELETE /v3/roles/:id (teardown)	1	0	233.00	233	233	0.03	0.00
DELETE	DELETE /v3/users/:id (teardown)	2	0	86.50	67	106	0.07	0.00
DELETE	DELETE /v4/mappings/rulesets/:mapping_id (teardown)	1	0	160.00	160	160	0.03	0.00
DELETE	DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown)	1	0	196.00	196	196	0.03	0.00
GET		582	0	609.53	361	965	19.40	0.00
GET	GET /SCIM/v2/:domain_id/Users (sync reconcile list)	1497	1497	19.88	1	1100	49.90	49.90
GET	GET /v3/auth/tokens (validate new)	42	0	591.57	404	839	1.40	0.00
GET	GET /v3/auth/tokens (validate revoked)	42	0	521.55	79	785	1.40	0.00
GET	GET /v3/projects/:id	54	0	565.04	374	765	1.80	0.00
GET	GET /v3/projects/:id (catalog)	79	0	562.58	351	702	2.63	0.00
GET	GET /v3/role_assignments	42	0	575.50	447	773	1.40	0.00
GET	GET /v3/role_assignments?role.id	41	0	575.51	383	776	1.37	0.00
GET	GET /v3/role_assignments?scope.domain.id	41	0	526.61	389	800	1.37	0.00
GET	GET /v3/role_assignments?user.id	42	0	542.60	392	829	1.40	0.00
GET	GET /v3/roles	108	0	568.06	380	822	3.60	0.00
GET	GET /v3/roles/:id	53	0	575.26	404	819	1.77	0.00
GET	GET /v3/users/:id	104	0	592.61	367	901	3.47	0.00
GET	GET /v3/users/:id (catalog)	102	0	597.76	380	846	3.40	0.00
GET	GET /v4/api-keys	26	0	552.12	410	715	0.87	0.00
GET	GET /v4/api-keys/:client_id	27	0	616.70	430	892	0.90	0.00
GET	GET /v4/mappings/rulesets	26	0	577.46	425	780	0.87	0.00
GET	GET /v4/mappings/rulesets/:mapping_id	27	0	571.26	423	856	0.90	0.00
GET	GET /v4/oauth2/:domain_id/.well-known/openid-configuration	754	0	59.73	12	216	25.13	0.00
GET	GET /v4/oauth2/:domain_id/clients	26	0	601.62	471	794	0.87	0.00
GET	GET /v4/oauth2/:domain_id/clients/:provider_id	27	0	559.52	384	806	0.90	0.00
GET	GET /v4/oauth2/:domain_id/jwks	754	0	59.15	10	278	25.13	0.00
GET	GET /v4/scim_realms	17	0	559.71	397	733	0.57	0.00
GET	GET /v4/scim_realms/:domain_id/:provider_id	17	0	571.00	389	778	0.57	0.00
POST	POST /v3/auth/tokens	40	0	543.05	397	766	1.33	0.00
POST	POST /v3/auth/tokens (password, invalid)	28	0	1107.25	688	1843	0.93	0.00
POST	POST /v3/auth/tokens (password, project-scoped)	51	0	1375.33	764	2131	1.70	0.00
POST	POST /v3/auth/tokens (password, unscoped)	48	0	1158.04	752	2687	1.60	0.00
POST	POST /v3/auth/tokens (rescope to system)	95	0	643.64	362	991	3.17	0.00
POST	POST /v3/auth/tokens (rescope, invalid project)	58	0	532.21	311	730	1.93	0.00
POST	POST /v3/auth/tokens (system-scoped, bootstrap admin)	46	0	1353.09	833	2194	1.53	0.00
POST	POST /v4/api-keys/:client_id/revoke (teardown)	1	0	181.00	181	181	0.03	0.00
PUT	PUT /v4/scim_realms/:domain_id/:provider_id	18	0	654.78	468	903	0.60	0.00
	Aggregated	4963	1497	278.66	1	2687	165.43	49.90

Response Time Metrics

Method	Name	50%ile (ms)	60%ile (ms)	70%ile (ms)	80%ile (ms)	90%ile (ms)	95%ile (ms)	99%ile (ms)	100%ile (ms)
DELETE	DELETE /v3/auth/tokens	600	600	600	600	600	700	787	787
DELETE	DELETE /v3/projects/:id (teardown)	159	159	159	159	159	159	159	159
DELETE	DELETE /v3/roles/:id (teardown)	233	233	233	233	233	233	233	233
DELETE	DELETE /v3/users/:id (teardown)	67	67	67	106	106	106	106	106
DELETE	DELETE /v4/mappings/rulesets/:mapping_id (teardown)	160	160	160	160	160	160	160	160
DELETE	DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown)	196	196	196	196	196	196	196	196
GET		600	600	700	700	700	800	900	965
GET	GET /SCIM/v2/:domain_id/Users (sync reconcile list)	8	10	11	15	21	28	480	1,000
GET	GET /v3/auth/tokens (validate new)	600	600	600	700	700	800	800	800
GET	GET /v3/auth/tokens (validate revoked)	500	500	500	600	600	700	785	785
GET	GET /v3/projects/:id	600	600	600	600	700	700	765	765
GET	GET /v3/projects/:id (catalog)	600	600	600	600	700	700	700	700
GET	GET /v3/role_assignments	600	600	600	600	700	700	773	773
GET	GET /v3/role_assignments?role.id	600	600	600	600	700	700	776	776
GET	GET /v3/role_assignments?scope.domain.id	500	500	600	600	600	600	800	800
GET	GET /v3/role_assignments?user.id	500	500	600	600	700	700	800	800
GET	GET /v3/roles	600	600	600	600	700	700	800	800
GET	GET /v3/roles/:id	600	600	600	600	700	800	800	800
GET	GET /v3/users/:id	600	600	600	700	700	800	800	900
GET	GET /v3/users/:id (catalog)	600	600	600	700	700	700	800	800
GET	GET /v4/api-keys	500	600	600	600	600	700	700	700
GET	GET /v4/api-keys/:client_id	600	600	700	700	700	800	892	892
GET	GET /v4/mappings/rulesets	600	600	600	600	700	780	780	780
GET	GET /v4/mappings/rulesets/:mapping_id	500	600	600	600	700	800	856	856
GET	GET /v4/oauth2/:domain_id/.well-known/openid-configuration	50	61	71	86	100	130	160	216
GET	GET /v4/oauth2/:domain_id/clients	600	600	600	700	700	794	794	794
GET	GET /v4/oauth2/:domain_id/clients/:provider_id	600	600	600	600	700	800	800	800
GET	GET /v4/oauth2/:domain_id/jwks	52	61	71	83	110	120	170	278
GET	GET /v4/scim_realms	600	600	600	600	600	600	700	700
GET	GET /v4/scim_realms/:domain_id/:provider_id	600	600	600	700	700	700	778	778
POST	POST /v3/auth/tokens	500	600	600	600	600	700	766	766
POST	POST /v3/auth/tokens (password, invalid)	1,000	1,000	1,000	1,000	1,000	1,000	1,843	1,843
POST	POST /v3/auth/tokens (password, project-scoped)	1,000	1,000	1,000	2,000	2,000	2,000	2,000	2,000
POST	POST /v3/auth/tokens (password, unscoped)	1,000	1,000	1,000	1,000	1,000	2,000	2,687	2,687
POST	POST /v3/auth/tokens (rescope to system)	600	700	700	700	800	800	900	991
POST	POST /v3/auth/tokens (rescope, invalid project)	500	500	600	600	600	700	700	700
POST	POST /v3/auth/tokens (system-scoped, bootstrap admin)	1,000	1,000	1,000	2,000	2,000	2,000	2,000	2,000
POST	POST /v4/api-keys/:client_id/revoke (teardown)	181	181	181	181	181	181	181	181
PUT	PUT /v4/scim_realms/:domain_id/:provider_id	600	700	700	700	800	800	900	900
	Aggregated	68	210	500	600	700	800	1,000	2,687

Status Code Metrics

Method	Name	Status Codes
DELETE	DELETE /v3/auth/tokens	42 [204]
DELETE	DELETE /v3/projects/:id (teardown)	1 [204]
DELETE	DELETE /v3/roles/:id (teardown)	1 [204]
DELETE	DELETE /v3/users/:id (teardown)	2 [204]
DELETE	DELETE /v4/mappings/rulesets/:mapping_id (teardown)	1 [204]
DELETE	DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown)	1 [204]
GET		582 [200]
GET	GET /SCIM/v2/:domain_id/Users (sync reconcile list)	31 [401], 1,466 [429]
GET	GET /v3/auth/tokens (validate new)	42 [200]
GET	GET /v3/auth/tokens (validate revoked)	42 [404]
GET	GET /v3/projects/:id	54 [200]
GET	GET /v3/projects/:id (catalog)	79 [200]
GET	GET /v3/role_assignments	42 [200]
GET	GET /v3/role_assignments?role.id	41 [200]
GET	GET /v3/role_assignments?scope.domain.id	41 [200]
GET	GET /v3/role_assignments?user.id	42 [200]
GET	GET /v3/roles	108 [200]
GET	GET /v3/roles/:id	53 [200]
GET	GET /v3/users/:id	104 [200]
GET	GET /v3/users/:id (catalog)	102 [200]
GET	GET /v4/api-keys	26 [200]
GET	GET /v4/api-keys/:client_id	27 [200]
GET	GET /v4/mappings/rulesets	26 [200]
GET	GET /v4/mappings/rulesets/:mapping_id	27 [200]
GET	GET /v4/oauth2/:domain_id/.well-known/openid-configuration	754 [200]
GET	GET /v4/oauth2/:domain_id/clients	26 [200]
GET	GET /v4/oauth2/:domain_id/clients/:provider_id	27 [200]
GET	GET /v4/oauth2/:domain_id/jwks	754 [200]
GET	GET /v4/scim_realms	17 [200]
GET	GET /v4/scim_realms/:domain_id/:provider_id	17 [200]
POST	POST /v3/auth/tokens	40 [201]
POST	POST /v3/auth/tokens (password, invalid)	28 [401]
POST	POST /v3/auth/tokens (password, project-scoped)	51 [201]
POST	POST /v3/auth/tokens (password, unscoped)	48 [201]
POST	POST /v3/auth/tokens (rescope to system)	95 [201]
POST	POST /v3/auth/tokens (rescope, invalid project)	58 [401]
POST	POST /v3/auth/tokens (system-scoped, bootstrap admin)	46 [201]
POST	POST /v4/api-keys/:client_id/revoke (teardown)	1 [200]
PUT	PUT /v4/scim_realms/:domain_id/:provider_id	18 [200]
	Aggregated	280 [201], 48 [204], 117 [401], 1,466 [429], 42 [404], 3,010 [200]

Transaction Metrics

Transaction	# Times Run	# Fails	Average (ms)	Min (ms)	Max (ms)	RPS	Failures/s
ReadHeavy
0.0	0	0	0.00	0	0	0.00	0.00
0.1	106	0	618.65	396	959	3.53	0.00
0.2	103	0	584.22	401	835	3.43	0.00
0.3	103	0	572.99	361	862	3.43	0.00
TokenLifecycle
1.0	0	0	0.00	0	0	0.00	0.00
1.1	42	0	2216.86	1330	2708	1.40	0.00
ValidateToken
2.0	0	0	0.00	0	0	0.00	0.00
2.1	89	0	687.70	539	965	2.97	0.00
UserCRUD
3.0	0	0	0.00	0	0	0.00	0.00
3.1	0	0	0.00	0	0	0.00	0.00
3.2	104	0	592.66	367	901	3.47	0.00
3.3	2	0	86.50	67	106	0.07	0.00
ProjectCRUD
4.0	0	0	0.00	0	0	0.00	0.00
4.1	0	0	0.00	0	0	0.00	0.00
4.2	54	0	565.07	374	765	1.80	0.00
4.3	1	0	159.00	159	159	0.03	0.00
RoleCRUD
5.0	0	0	0.00	0	0	0.00	0.00
5.1	0	0	0.00	0	0	0.00	0.00
5.2	53	0	575.30	404	819	1.77	0.00
5.3	1	0	233.00	233	233	0.03	0.00
RoleList
6.0	0	0	0.00	0	0	0.00	0.00
6.1	108	0	568.07	380	822	3.60	0.00
RoleAssignmentList
7.0	0	0	0.00	0	0	0.00	0.00
7.1	42	0	575.52	447	773	1.40	0.00
7.2	42	0	542.62	392	829	1.40	0.00
7.3	41	0	526.63	389	800	1.37	0.00
7.4	41	0	575.56	384	776	1.37	0.00
UserRead
8.0	0	0	0.00	0	0	0.00	0.00
8.1	101	0	611.80	440	907	3.37	0.00
8.2	102	0	597.77	380	846	3.40	0.00
ProjectRead
9.0	0	0	0.00	0	0	0.00	0.00
9.1	80	0	587.50	400	838	2.67	0.00
9.2	79	0	562.59	351	702	2.63	0.00
PasswordAuth
10.0	48	0	1158.08	752	2687	1.60	0.00
10.1	51	0	1375.35	764	2131	1.70	0.00
PasswordAuthNegative
11.0	28	0	1107.32	688	1843	0.93	0.00
Rescope
12.0	0	0	0.00	0	0	0.00	0.00
12.1	95	0	643.69	362	991	3.17	0.00
RescopeNegative
13.0	0	0	0.00	0	0	0.00	0.00
13.1	58	0	532.22	311	730	1.93	0.00
SystemScopeAuth
14.0	46	0	1353.17	833	2194	1.53	0.00
ApiKeyCRUD
15.0	0	0	0.00	0	0	0.00	0.00
15.1	0	0	0.00	0	0	0.00	0.00
15.2	27	0	616.70	430	892	0.90	0.00
15.3	26	0	552.15	411	715	0.87	0.00
15.4	1	0	181.00	181	181	0.03	0.00
MappingCRUD
16.0	0	0	0.00	0	0	0.00	0.00
16.1	0	0	0.00	0	0	0.00	0.00
16.2	27	0	571.26	423	856	0.90	0.00
16.3	26	0	577.46	425	780	0.87	0.00
16.4	1	0	160.00	160	160	0.03	0.00
OAuth2ClientCRUD
17.0	0	0	0.00	0	0	0.00	0.00
17.1	0	0	0.00	0	0	0.00	0.00
17.2	27	0	559.56	384	806	0.90	0.00
17.3	26	0	601.69	471	794	0.87	0.00
17.4	1	0	196.00	196	196	0.03	0.00
OAuth2Discovery
18.0	754	0	59.17	10	278	25.13	0.00
18.1	754	0	59.75	12	216	25.13	0.00
ScimRealmRead
19.0	0	0	0.00	0	0	0.00	0.00
19.1	17	0	571.00	389	778	0.57	0.00
19.2	17	0	559.71	397	733	0.57	0.00
19.3	18	0	654.83	468	903	0.60	0.00
ScimSync
20.0	0	0	0.00	0	0	0.00	0.00
20.1	0	0	0.00	0	0	0.00	0.00
20.2	0	0	0.00	0	0	0.00	0.00
20.3	1497	0	19.91	1	1100	49.90	0.00
20.4	1496	0	0.00	0	0	49.87	0.00
20.5	1496	0	0.00	0	0	49.87	0.00
20.6	1	0	0.00	0	0	0.03	0.00
Aggregated	7832	0	176.58	1	2708	261.07	0.00

Scenario Metrics

Transaction	# Users	# Times Run	Average (ms)	Min (ms)	Max (ms)	Scenarios/s	Iterations
ReadHeavy	6	101	1788.32	1496	2217	3.37	16.83
TokenLifecycle	3	39	2257.23	1887	2708	1.30	13.00
ValidateToken	2	87	690.56	539	965	2.90	43.50
UserCRUD	2	102	594.70	367	901	3.40	51.00
ProjectCRUD	1	53	566.77	374	765	1.77	53.00
RoleCRUD	1	52	577.10	404	819	1.73	52.00
RoleList	2	106	570.55	380	822	3.53	53.00
RoleAssignmentList	3	41	2231.20	1962	2747	1.37	13.67
UserRead	4	99	1215.72	970	1753	3.30	24.75
ProjectRead	3	78	1156.03	975	1436	2.60	26.00
PasswordAuth	4	47	2569.26	1753	3997	1.57	11.75
PasswordAuthNegative	1	27	1112.33	688	1843	0.90	27.00
Rescope	2	93	646.08	362	991	3.10	46.50
RescopeNegative	1	57	534.82	311	730	1.90	57.00
SystemScopeAuth	2	44	1368.86	833	2194	1.47	22.00
ApiKeyCRUD	1	26	1175.88	959	1495	0.87	26.00
MappingCRUD	1	26	1151.81	954	1636	0.87	26.00
OAuth2ClientCRUD	1	26	1168.54	997	1600	0.87	26.00
OAuth2Discovery	3	752	119.27	34	324	25.07	250.67
ScimRealmRead	1	17	1794.00	1495	2222	0.57	17.00
ScimSync	1	1496	19.57	1	1100	49.87	1496.00
Aggregated	45	3369	401.86	1	3997	112.30	2352.67

Error Metrics

Method	Name	#	Error
GET	GET /SCIM/v2/:domain_id/Users (sync reconcile list)	49	401 Unauthorized: GET /SCIM/v2/:domain_id/Users (sync reconcile list)
POST	POST /SCIM/v2/:domain_id/Users (sync provision)	1	401 Unauthorized: POST /SCIM/v2/:domain_id/Users (sync provision)
POST	POST /v3/auth/tokens (password, invalid)	68	401 Unauthorized: POST /v3/auth/tokens (password, invalid)
POST	POST /v3/auth/tokens (rescope, invalid project)	150	401 Unauthorized: POST /v3/auth/tokens (rescope, invalid project)
GET	GET /v3/auth/tokens (validate revoked)	152	404 Not Found: GET /v3/auth/tokens (validate revoked)
GET	GET /SCIM/v2/:domain_id/Users (sync reconcile list)	1519	429 Too Many Requests: GET /SCIM/v2/:domain_id/Users (sync reconcile list)

View full report

[github-actions]

Bencher Report

Project	keystone
Branch	release-plz-2026-06-05T09-00-15Z
Testbed	ubuntu-latest

🚨 1 Alert

Benchmark	Measure Units	View	Benchmark Result (Result Δ%)	Upper Boundary (Limit %)
Command_Serde/apply/set	Latency milliseconds (ms)	📈 plot 🚷 threshold 🚨 alert (🔔)	1.93 ms (+540.11%) Baseline: 0.30 ms	1.34 ms (143.64%)

Click to view all benchmark results

Benchmark	Latency	Benchmark Result nanoseconds (ns) (Result Δ%)	Upper Boundary nanoseconds (ns) (Limit %)
Command_Serde/apply/remove	📈 view plot 🚷 view threshold	1,297,400.00 ns (+326.29%) Baseline: 304,345.23 ns	1,601,862.44 ns (80.99%)
Command_Serde/apply/set	📈 view plot 🚷 view threshold 🚨 view alert (🔔)	1,927,000.00 ns (+540.11%) Baseline: 301,040.14 ns	1,341,576.44 ns (143.64%)
Command_Serde/pack/delete	📈 view plot 🚷 view threshold	102.09 ns (-14.49%) Baseline: 119.39 ns	156.64 ns (65.17%)
Command_Serde/pack/delete_index	📈 view plot 🚷 view threshold	89.82 ns (-15.28%) Baseline: 106.01 ns	138.83 ns (64.70%)
Command_Serde/pack/set	📈 view plot 🚷 view threshold	169.13 ns (-11.51%) Baseline: 191.14 ns	247.26 ns (68.40%)
Command_Serde/pack/set_index	📈 view plot 🚷 view threshold	92.14 ns (-13.15%) Baseline: 106.08 ns	139.17 ns (66.20%)
Command_Serde/unpack/delete	📈 view plot 🚷 view threshold	138.29 ns (-25.46%) Baseline: 185.53 ns	265.28 ns (52.13%)
Command_Serde/unpack/delete_index	📈 view plot 🚷 view threshold	114.98 ns (-25.95%) Baseline: 155.27 ns	215.39 ns (53.38%)
Command_Serde/unpack/set	📈 view plot 🚷 view threshold	198.30 ns (-23.54%) Baseline: 259.37 ns	348.56 ns (56.89%)
Command_Serde/unpack/set_index	📈 view plot 🚷 view threshold	110.35 ns (-27.36%) Baseline: 151.91 ns	208.89 ns (52.83%)
Payload_encryption/pack/remove_cmd	📈 view plot 🚷 view threshold	89.19 ns (-21.56%) Baseline: 113.71 ns	147.04 ns (60.66%)
Payload_encryption/pack/set_cmd	📈 view plot 🚷 view threshold	167.20 ns (-15.36%) Baseline: 197.55 ns	262.89 ns (63.60%)
Payload_encryption/unpack/remove_cmd	📈 view plot 🚷 view threshold	125.68 ns (-35.49%) Baseline: 194.82 ns	281.38 ns (44.67%)
Payload_encryption/unpack/set_cmd	📈 view plot 🚷 view threshold	198.36 ns (-27.55%) Baseline: 273.81 ns	373.92 ns (53.05%)
Raft_1Node_Latency/prefix/1node	📈 view plot 🚷 view threshold	443,750.00 ns (-83.98%) Baseline: 2,769,650.31 ns	6,640,780.60 ns (6.68%)
Raft_1Node_Latency/read/1node	📈 view plot 🚷 view threshold	32,908.00 ns (-14.08%) Baseline: 38,300.56 ns	52,657.88 ns (62.49%)
Raft_1Node_Latency/remove/1node	📈 view plot 🚷 view threshold	2,583,400.00 ns (+250.00%) Baseline: 738,115.00 ns	3,695,449.49 ns (69.91%)
Raft_1Node_Latency/write/1node	📈 view plot 🚷 view threshold	4,514,900.00 ns (+428.67%) Baseline: 854,003.59 ns	4,894,007.17 ns (92.25%)
build_snapshot/default	📈 view plot 🚷 view threshold	172,140.00 ns (+40.09%) Baseline: 122,881.02 ns	213,810.82 ns (80.51%)
fernet token/project	📈 view plot 🚷 view threshold	1,281.50 ns (-10.56%) Baseline: 1,432.78 ns	1,792.61 ns (71.49%)
get_data_keyspace	📈 view plot 🚷 view threshold	0.31 ns (-2.93%) Baseline: 0.32 ns	0.38 ns (80.18%)
get_db	📈 view plot 🚷 view threshold	0.30 ns (-6.24%) Baseline: 0.32 ns	0.38 ns (77.52%)
get_fernet_token_timestamp/project	📈 view plot 🚷 view threshold	131.60 ns (-7.41%) Baseline: 142.13 ns	179.44 ns (73.34%)
get_keyspace	📈 view plot 🚷 view threshold	13.09 ns (+115.89%) Baseline: 6.06 ns	14.37 ns (91.09%)

🐰 View full continuous benchmarking report in Bencher

[github-actions]

🧪 Tempest Identity Compatibility Results (advisory, non-blocking)

rust

Totals
======
Ran: 133 tests in 37.1877 sec.
 - Passed: 65
 - Skipped: 4
 - Expected Fail: 0
 - Unexpected Success: 0
 - Failed: 64
Sum of execute time for each test: 24.3781 sec.

Failed test IDs

===== FAILED TESTS (target=rust) =====
tempest.api.identity.admin.v3.test_domains_negative.DomainsNegativeTestJSON.test_create_domain_with_name_length_over_64[id-37b1bbf2-d664-4785-9a11-333438586eae,negative]
tempest.api.identity.admin.v3.test_domains_negative.DomainsNegativeTestJSON.test_delete_active_domain[gate,id-1f3fbff5-4e44-400d-9ca1-d953f05f609b,negative]
tempest.api.identity.admin.v3.test_credentials.CredentialsTestJSON.test_credentials_create_get_update_delete[id-7cd59bf9-bda4-4c72-9467-d21cab278355,smoke]
tempest.api.identity.admin.v3.test_application_credentials.ApplicationCredentialsV3AdminTest.test_create_application_credential_with_roles[id-3b3dd48f-3388-406a-a9e6-4d078a552d0e]
setUpClass (tempest.api.identity.admin.v3.test_endpoint_groups.EndPointGroupsTest)
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_check_revoke_roles_on_projects_group[id-26021436-d5a4-4256-943c-ded01e0d4b45]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_check_revoke_roles_on_projects_user[id-18b70e45-7687-4b72-8277-b8f1a47d7591]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_check_revoke_roles_on_domains_group[id-c7a8dda2-be50-4fb4-9a9c-e830771078b1]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_check_revoke_roles_on_domains_user[id-4e6f0366-97c8-423c-b2be-41eae6ac91c8]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_revoke_user_roles_on_domain[id-3acf666e-5354-42ac-8e17-8b68893bcd36]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_revoke_user_roles_on_project_tree[id-9f02ccd9-9b57-46b4-8f77-dd5a736f3a06]
tempest.api.identity.admin.v3.test_domains.DomainsTestJSON.test_create_domain_without_description[id-2abf8764-309a-4fa9-bc58-201b799817ad]
tempest.api.identity.admin.v3.test_domains.DomainsTestJSON.test_create_update_delete_domain[id-f2f5b44a-82e8-4dad-8084-0661ea3b18cf,smoke]
tempest.api.identity.admin.v3.test_default_project_id.TestDefaultProjectId.test_default_project_id[id-d6110661-6a71-49a7-a453-b5e26640ff6d]
tempest.api.identity.admin.v3.test_domains.DomainsTestJSON.test_domain_delete_cascades_content[id-d8d318b7-d1b3-4c37-94c5-3c5ba0b121ea]
tempest.api.identity.admin.v3.test_domains.DomainsTestJSON.test_list_domains_filter_by_enabled[id-3fd19840-65c1-43f8-b48c-51bdd066dff9]
tempest.api.identity.admin.v3.test_project_tags.IdentityV3ProjectTagsTest.test_list_update_delete_project_tags[id-7c123aac-999d-416a-a0fb-84b915ab10de]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_create_domain_config_and_show_config_groups_and_options[id-9e3ff13c-f597-4f01-9377-d6c06c2a1477]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_create_update_and_delete_domain_config[id-7161023e-5dd0-4612-9da0-1bac6ac30b63]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_create_update_and_delete_domain_config_groups_and_opts[id-c7510fa2-6661-4170-9c6b-4783a80651e9]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_show_default_group_config_and_options[id-11a02bf0-6f94-4380-b3b0-c8dc18fc0d22]
tempest.api.identity.admin.v3.test_groups.GroupsV3TestJSON.test_group_users_add_list_delete[id-1598521a-2f36-4606-8df9-30772bd51339,smoke]
tempest.api.identity.admin.v3.test_groups.GroupsV3TestJSON.test_list_user_groups[id-64573281-d26a-4a52-b899-503cb0f4e4ec]
tempest.api.identity.admin.v3.test_list_projects.ListProjectsStaticTestJSON.test_list_projects[id-1d830662-22ad-427c-8c3e-4ec854b0af44]
tempest.api.identity.admin.v3.test_list_users.UsersV3TestJSON.test_list_users_with_not_enabled[id-bff8bf2f-9408-4ef5-b63a-753c8c2124eb]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_create_and_show_consumer[id-c8307ea6-a86c-47fd-ae7b-5b3b2caca76d]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_delete_consumer[id-fdfa1b7f-2a31-4354-b2c7-f6ae20554f93]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_list_consumers[id-09ca50de-78f2-4ffb-ac71-f2254036b2b8]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_update_consumer[id-080a9b1a-c009-47c0-9979-5305bf72e3dc]
tempest.api.identity.admin.v3.test_list_projects.ListProjectsTestJSON.test_list_projects_with_enabled[id-0fe7a334-675a-4509-b00e-1c4b95d5dae8]
tempest.api.identity.admin.v3.test_list_projects.ListProjectsTestJSON.test_list_projects_with_parent[id-6edc66f5-2941-4a17-9526-4073311c1fac]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_assignments_for_domain_roles[id-3859df7e-5b78-4e4d-b10e-214c8953842a]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_assignments_for_implied_roles_create_delete[id-c8828027-df48-4021-95df-b65b92c7429e]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_group_on_domain[id-4bf8a70b-e785-413a-ad53-9f91ce02faa7]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_group_on_project[id-cbf11737-1904-4690-9613-97bcbb3df1c4]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_group_on_system[id-c888fe4f-8018-48db-b959-542225c1b4b6]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_user_on_domain[id-6c9a2940-3625-43a3-ac02-5dcec62ef3bd]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_implied_domain_roles[id-eb1e1c24-1bc4-4d47-9748-e127a1852c82]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_implied_roles_create_check_show_delete[id-c90c316c-d706-4728-bcba-eb1912081b69]
tempest.api.identity.admin.v3.test_projects_negative.ProjectsNegativeStaticTestJSON.test_create_projects_name_length_over_64[id-502b6ceb-b0c8-4422-bf53-f08fdb21e2f0,negative]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_role_create_update_show_list[id-18afc6c0-46cf-4911-824e-9989cc056c3a,smoke]
tempest.api.identity.admin.v3.test_projects.ProjectsTestJSON.test_create_is_domain_project[id-a7eb9416-6f9b-4dbb-b71b-7f73aaef59d5]
tempest.api.identity.admin.v3.test_projects.ProjectsTestJSON.test_project_create_with_parent[id-1854f9c0-70bc-4d11-a08a-1c789d339e3d]
tempest.api.identity.admin.v3.test_projects.ProjectsTestJSON.test_project_get_equals_list[id-d1db68b6-aebe-4fa0-b79d-d724d2e21162]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_get_trusts_all[id-4773ebd5-ecbf-4255-b8d8-b63e6f72b65d,smoke]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_create_application_credential[id-8080c75c-eddc-4786-941a-c2da7039ae61]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_create_application_credential_expires[id-852daf0c-42b5-4239-8466-d193d0543ed3]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_list_application_credentials[id-ff0cd457-6224-46e7-b79e-0ada4964a8a6]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_query_application_credentials[id-9bb5e5cc-5250-493a-8869-8b665f6aa5f6]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_get_trusts_query[id-6268b345-87ca-47c0-9ce3-37792b43403a]
tempest.api.identity.v3.test_catalog.IdentityCatalogTest.test_catalog_standardization[id-56b57ced-22b8-4127-9b8a-565dfb0207e2]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_expire[id-0ed14b66-cefd-4b5c-a964-65759453e292]
tempest.api.identity.v3.test_projects.IdentityV3ProjectsTest.test_list_projects_returns_only_authorized_projects[id-86128d46-e170-4644-866a-cc487f699e1d]
tempest.api.identity.admin.v3.test_tokens.TokensV3TestJSON.test_get_available_domain_scopes[id-ec5ecb05-af64-4c04-ac86-4d9f6f12f185]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_impersonate[id-5a0a91a4-baef-4a14-baba-59bf4d7fcace]
tempest.api.identity.admin.v3.test_tokens.TokensV3TestJSON.test_rescope_token[id-565fa210-1da1-4563-999b-f7b5b67cf112]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_noimpersonate[id-ed2a8779-a7ac-49dc-afd7-30f32f936ed2]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_api_media_types[id-657c1970-4722-4189-8831-7325f3bc4265,smoke]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_api_version_resources[id-b9232f5e-d9e5-4d97-b96c-28d3db4de1bd,smoke]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_identity_v3_existence[id-79aec9ae-710f-4c54-a4fc-3aa25b4feac3]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_list_api_versions[id-721f480f-35b6-46c7-846e-047e6acea0dc,smoke]
tempest.api.identity.admin.v3.test_users.UsersV3TestJSON.test_list_user_projects[id-a831e70c-e35b-430b-92ed-81ebbc5437b8]
tempest.api.identity.admin.v3.test_users_negative.UsersNegativeTest.test_create_user_for_non_existent_domain[id-e75f006c-89cc-477b-874d-588e4eab4b17,negative]
tempest.api.identity.v3.test_tokens.TokensV3Test.test_validate_token[id-a9512ac3-3909-48a4-b395-11f438e16260]
===== END FAILED TESTS (target=rust) =====

View full run