Skip to content

chore: release - #1570

Open
openstack-experimental-release-plz[bot] wants to merge 1 commit into
mainfrom
release-plz-2026-10-20T11-27-55Z
Open

chore: release#1570
openstack-experimental-release-plz[bot] wants to merge 1 commit into
mainfrom
release-plz-2026-10-20T11-27-55Z

Conversation

@openstack-experimental-release-plz

@openstack-experimental-release-plz openstack-experimental-release-plz Bot commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

🤖 New release

  • openstack-keystone-tls-provider: 0.1.0
  • oslo-config: 0.1.0
  • openstack-keystone-telemetry: 0.1.0
  • cadf: 0.1.0
  • openstack-keystone-common: 0.1.0
  • openstack-keystone-config: 0.1.0
  • openstack-keystone-core-types: 0.1.1
  • openstack-keystone-api-types: 0.1.0 -> 0.1.1 (✓ API compatible changes)
  • openstack-keystone-auth-plugin-core: 0.1.0
  • openstack-keystone-auth-plugin-runtime: 0.1.0
  • openstack-keystone-jwt-crypto: 0.1.0
  • openstack-keystone-key-repository: 0.1.0
  • openstack-keystone-local-emergency-store: 0.1.0
  • openstack-keystone-storage-api: 0.1.0
  • openstack-keystone-core: 0.1.1 -> 0.1.2 (✓ API compatible changes)
  • openstack-keystone-storage-crypto: 0.1.0
  • openstack-keystone-storage-crypto-pkcs11: 0.1.0
  • openstack-keystone-storage-crypto-tpm: 0.1.0
  • openstack-keystone-distributed-storage: 0.1.0 -> 0.1.1 (✓ API compatible changes)
  • openstack-keystone-api-key-driver-raft: 0.1.0
  • openstack-keystone-password-hashing: 0.1.0
  • openstack-keystone-appcred-driver-sql: 0.1.0
  • openstack-keystone-assignment-driver-sql: 0.1.0
  • openstack-keystone-assignment-driver-openfga: 0.1.0
  • openstack-keystone-catalog-driver-sql: 0.1.0
  • openstack-keystone-credential-driver-sql: 0.1.0
  • openstack-keystone-auth-plugin-identity-driver-raft: 0.1.0
  • openstack-keystone-domain-config-driver-fs: 0.1.0
  • openstack-keystone-domain-config-driver-sql: 0.1.0
  • openstack-keystone-federation-driver-sql: 0.1.0
  • openstack-keystone-identity-driver-ldap: 0.1.0
  • openstack-keystone-identity-driver-sql: 0.1.0
  • openstack-keystone-idmapping-driver-sql: 0.1.0
  • openstack-keystone-k8s-auth-driver-raft: 0.1.0
  • openstack-keystone-k8s-auth-driver-sql: 0.1.0
  • openstack-keystone-limit-driver-sql: 0.1.0
  • openstack-keystone-mapping-driver-raft: 0.1.0
  • openstack-keystone-oauth2-client-driver-raft: 0.1.0
  • openstack-keystone-oauth2-key-driver-raft: 0.1.0
  • openstack-keystone-oauth2-session-driver-raft: 0.1.0
  • openstack-keystone-policy-regorus: 0.1.0
  • openstack-keystone-policy-store-driver-sql: 0.1.0
  • openstack-keystone-resource-driver-sql: 0.1.0
  • openstack-keystone-revoke-driver-sql: 0.1.0
  • openstack-keystone-role-driver-sql: 0.1.0
  • openstack-keystone-scim-driver-raft: 0.1.0
  • openstack-keystone-service-grant-driver-raft: 0.1.0
  • openstack-keystone-token-driver-fernet: 0.1.1
  • openstack-keystone-token-driver-jws: 0.1.0
  • openstack-keystone-token-restriction-driver-sql: 0.1.0
  • openstack-keystone-trust-driver-sql: 0.1.0
  • openstack-keystone-webauthn: 0.1.0
  • openstack-keystone: 0.1.1 -> 0.1.2 (✓ API compatible changes)
  • openstack-keystone-cli-manage: 0.1.0
Changelog

openstack-keystone-tls-provider

0.1.0 - 2026-11-14

Added

  • (oauth2) Add delegatable service grants (#1550)
  • (fips) Further improve fips support (#1544)
  • Make TLS and storage crypto provider selectable (#1543)

oslo-config

0.1.0 - 2026-11-14

Added

  • Make TLS and storage crypto provider selectable (#1543)
  • Enable OpenTelemetry metrics and traces support (#1456)
  • (oslo.config) Generalize oslo-config crate (#1429)

Other

  • (deps) Reorg few more dependencies (#1558)

openstack-keystone-telemetry

0.1.0 - 2026-11-14

Added

  • Make TLS and storage crypto provider selectable (#1543)
  • Enable OpenTelemetry metrics and traces support (#1456)

Fixed

  • (telemetry) Use native roots for OTLP gRPC TLS (#1604)

cadf

0.1.0 - 2026-11-14

Added

  • Start implementation of on-behalf-of exchange (#1578)
  • (oauth2) Add delegatable service grants (#1550)
  • (fips) Further improve fips support (#1544)
  • Make TLS and storage crypto provider selectable (#1543)
  • Enable OpenTelemetry metrics and traces support (#1456)
  • (cadf) Use DSP0262 names on the wire (#1419)
  • (audit) Add opt-in per-request perimeter record (#1415)

Fixed

  • (oauth2) Check client on device grant redeem (#1435)
  • (audit) Polish the CADF crate (#1424)

Other

  • (audit) Assert live audit spool records (#1422)
  • (audit) Cover startup seal, quarantine, hooks (#1410)
  • (cadf) Move audit startup into runtime (#1406)
  • (cadf) Own the audit configuration (#1405)
  • (cadf) Parameterize the service identity (#1400)
  • (audit) Rename audit crate to cadf (#1399)

openstack-keystone-common

0.1.0 - 2026-11-14

Fixed

  • Address soak test findings (#1553)

openstack-keystone-config

0.1.0 - 2026-11-14

Added

  • Initiate work on SingleUseStore (#1641)
  • (policy) Add in-process regorus enforcer (#1630)
  • (catalog) Add TTL cache for get_catalog (#1607)
  • (identity) Isolate password hashing pool (#1606)
  • Add CRA/NIS2 coverage (#1595)
  • (oauth2) Add per-domain DPoP settings (#1579)
  • (oauth2) Add DPoP binding data model (#1576)
  • (oauth2) Add DPoP configuration (#1572)
  • (oauth2) Add delegatable service grants (#1550)
  • (oauth2) Add enabled switch and domain filter (#1537)
  • (oauth2) Add user_code backoff on /device (#1514)
  • (oauth2) back-channel/front-channel logout and upstream IdP logout (#1505)
  • (oauth2) Harden SSO sessions (#1490)
  • (oauth2) Add SSO session and RP logout (#1475)
  • (oauth2) Add TOTP second factor to OP login (#1473)
  • (oauth2) Add client display metadata (#1472)
  • (oauth2) Brand and localize the login pages (#1471)
  • (oauth2) Add operator login page templates (#1470)
  • (oslo.config) Generalize oslo-config crate (#1429)
  • (limit) Add unified limits (#1407)
  • (audit) Add HMAC key rotation and node checks (#1382)
  • (audit) Add an RFC 5424 syslog sink (#1381)
  • (audit) Make channel and spool limits configurable (#1380)
  • (audit) Add an enabled switch (#1379)
  • (audit) Ship sealed spool segments to a sink (#1374)
  • (oauth2) Cap refresh families and revalidate user (#1360)
  • (oauth2-session) Add expired record janitor (#1359)
  • (raft) Add backup restore (#1352)
  • (devstack) Pilot ksm SPIFFE mTLS transport (#1239)
  • Hot-reload fs per-domain config files (#1225)
  • (adr0034) Route assignment ops per domain (#1219)
  • (adr0034) Add per-domain driver config surface (#1216)
  • (assignment) Add OpenFGA assignment driver (#1206)
  • (domain-config) Add resolution layer (#1199)
  • (domain-config) Add filesystem driver (#1197)
  • (spiffe) Derive spiffe claims (#1193)
  • Add vendor data JWT API for SPIRE integration (#1192)
  • (core) Reconnect database connection on new config (#1188)
  • (policy) Implement legacy Policy API (/v3/policies) (#1127)
  • Add domain config types and backend trait (#1138)
  • (adr0031) Add HTTP request metrics (#1134)
  • (config) Support configurable log file rotation (#1128)
  • Add connection_debug to tune SQL query logging (#1109)
  • (pagination) Add pagination to remaining places (#1106)
  • (config) Revoke Vault token on shutdown (#1088)
  • Generalize marker pagination for v3/v4 lists (#1086)
  • (config) Add Vault-backed configuration (#1051)
  • (logging) Add native journald log writer (#1081)
  • (identity) Add PATCH to few resources (#1076)
  • (ldap) Add LDAP identity driver (#1047)
  • (adr0028) Add local-quorum-bypass emergency rotation (#1032)
  • Add catalog CRUD API and bootstrap support (#1029)
  • (adr0026) Add RFC 8628 Device Authorization Grant (#1023)
  • (adr0026) Add authorization code flow with PKCE (#1015)
  • (adr0026) Add client_credentials token endpoint (#1014)
  • (adr0026) Phase 2 client registration & OIDC discovery (#1013)
  • (adr0026) Phase 0 token abstraction and JWS driver (#1010)
  • (api) capture client IP via proxy headers & SPIFFE (Start capturing client information in the request processing #358 follow-up) (#908)
  • (identity) Add per-user auth rate limiting (#996)
  • (adr0025) Complete imlpementation (#969)
  • (api) Add global IP rate limiting framework (ADR-0022 phase 1) (#846)
  • (scim) Harden RFC 7644 compliance, add docs (#968)
  • (adr0025) Phase 1 (1.1+1.2) (#952)
  • (security) Wrap secrets with secrecy crate (#369) (#912)
  • (scim) ADR 0024 - Phase 5 (#951)
  • (scim) ADR 0024 - Phase 1+2 (#925)
  • (fernet) Unify credential/token key repositories (#915)
  • Start ADR 0025 immplementation (#911)
  • (credential) Implement Phase 3 of ADR 0019 (#909)
  • Prepare PKCS#11/TPM KEK support in storage (#907)
  • (credential) Implement ADR 0019 phases 1-2 (#897)
  • Implement stateless SCIM ingress auth (ADR 0021) (#891)
  • (auth) Password hashing parity with Python Keystone (#859)
  • (audit) Implement CADF audit framework Phase 2 (#872)
  • (storage) SPIFFE checks, RBAC, rate limiting, auto-join (#861)
  • (storage) Harden preflight and erase dev KEK (#860)
  • Add bootstrap cli command (#809)
  • (mapping) ADR-0020 (mapping engine) phase 1 (#794)
  • Add inter-provider event notification system (#784)
  • Add SO_PEERCRED peer credential validation (#775)
  • Validate password for compliance conformity (#774)
  • Enforce minimum range boundaries for security
  • Add role-imply rest api (#750)
  • Add user update functionality (#747)
  • Make drivers more dynamic (#737)
  • Add keystone container with opa and policies (#738)
  • Add Admin interface over the UDS (#735)
  • Add spiffe provider (#733)
  • Introduce SecurityContext (#710)
  • Add skeleton for the spiffe mTLS integration (#695)
  • Implement ConfigManager for config watching (#691)
  • Improve the code (#686)
  • Add k8s-auth raft driver (#676)
  • Add raft support under skaffold (#667)
  • Introduce raft backend for webauthn (#658)
  • Introduce the keystone-manage cli managing raft (#656)

Fixed

  • Address loadtest findings (#1620)
  • (auth-plugins) Raise default invocation rate limits (#1437)
  • (oauth2) Pin issuer to public_endpoint (#1436)
  • (oauth2) Rate limit device_code token grant (#1434)
  • (storage) Authorize Raft and Storage gRPC callers (#1418)
  • (raft) Rotate audit key per DEK epoch (#1362)
  • (audit) Stop spool replay from looping into itself (#1350)
  • (raft) Fail closed on stale ReadIndex reads (#1341)
  • Next round of security review fixes (#1241)
  • (adr0034) Post implementation fixes (#1223)
  • Avoid blocking notify's event thread in watch_loop (#1125)
  • Fix flaky test (#1110)
  • (security) Address security review findings (#1049)
  • (passkey) Prevent user enumeration (#905)

Other

  • (identity-driver-ldap) Add config parity, filter and live tests (#1332)
  • Adapt perf comparison with regorus (#1632)
  • (config) Pin reload and overlay behaviour (#1421)
  • (cadf) Own the audit configuration (#1405)
  • (audit) Cover spool, rotation and hook paths (#1391)
  • Fix clippy lints across workspace (#1361)
  • (config) Fix flaky notify watcher tests (#1112)
  • Revise documentation layout (#1069)
  • Moves health and metrics endpoints to dedicated listener on separate port (#910)
  • Move jsonwebtoken to keystone crate (#820)
  • mapping engine phase 3 - migrate SPIFFE (#811)
  • Rename identity_mapping to idmapping (#788)
  • Replace Regex with str::find for db connection (#760)
  • Redesign SecurityContext with two-phase validation (#717)
  • Split out remaining sql drivers (#633)
  • Split config into standalone crate (#628)

openstack-keystone-core-types

0.1.1 - 2026-11-14

Added

  • (federation) Add IdP lookup by issuer (#1637)
  • (mapping) Add token exchange identity source (#1622)
  • (identity) Isolate password hashing pool (#1606)
  • (resource) Add project tags support (#1602)
  • Add CRA/NIS2 coverage (#1595)
  • (identity) Add group membership endpoints (#1594)
  • Support DPoP in /token endpoint (#1581)
  • Start implementation of on-behalf-of exchange (#1578)
  • (oauth2) Add per-domain DPoP settings (#1579)
  • (oauth2) Add DPoP binding data model (#1576)
  • (service_grant) Expand test coverage (#1552)
  • (oauth2) Add delegatable service grants (#1550)
  • (oauth2) back-channel/front-channel logout and upstream IdP logout (#1505)
  • (oauth2) Use control-plane aud for tokens (#1498)
  • (oauth2) Add back-channel logout (#1493)
  • (oauth2) Add federated sign-in to device page (#1491)
  • (oauth2) Harden SSO sessions (#1490)
  • (oauth2) Remember consent per client (#1476)
  • (oauth2) Add SSO session and RP logout (#1475)
  • (oauth2) Add federated sign-in to OP login (#1474)
  • (oauth2) Add TOTP second factor to OP login (#1473)
  • (oauth2) Add client display metadata (#1472)
  • (resource) Add enabled filter to project list (#1453)
  • (identity) Add enabled filter to user list (#1451)
  • (oauth2) Rotate signing keys automatically (#1440)
  • Implement authc by app credential (#1187)
  • (limit) Add unified limits (#1407)
  • (oauth2) Populate id_token profile claims (#1408)
  • (oauth2) Revoke refresh families on lifecycle (#1404)
  • (audit) Fix initiator and outcome fidelity (#1387)
  • (audit) Audit remaining provider mutations (#1386)
  • (oauth2) Add RFC 7009 token revocation endpoint (#1369)
  • (oauth2) Cap refresh families and revalidate user (#1360)
  • (oauth2-session) Add expired record janitor (#1359)
  • Hot-reload fs per-domain config files (#1225)
  • (adr0034) Route assignment ops per domain (#1219)
  • (adr0034) Build per-instance assignment backends (#1218)
  • (adr0034) Add per-domain driver config surface (#1216)
  • Resolve local/public ids for non-default backends (#1207)
  • (assignment) Add OpenFGA assignment driver (#1206)
  • (idmapping) Add id-mapping write paths (#1205)
  • (domain-config) Dispatch identity ops per domain (#1202)
  • (domain-config) Add resolution layer (#1199)
  • (domain-config) Add filesystem driver (#1197)
  • Add vendor data JWT API for SPIRE integration (#1192)
  • Add domain config SQL driver (#1139)
  • (policy) Implement legacy Policy API (/v3/policies) (#1127)
  • Add domain config types and backend trait (#1138)
  • Add cargo-fuzz targets (#1130)
  • Add OS-EP-FILTER provider CRUD to the catalog (#1075)
  • (pagination) Add pagination to remaining places (#1106)
  • Add immutable option for project, domain, role (#1097)
  • Generalize marker pagination for v3/v4 lists (#1086)
  • (identity) Add trust create/delete and REST CRUD (#1079)
  • (catalog) Expose /v3/regions REST API (#1078)
  • (identity) Add PATCH to few resources (#1076)
  • (ldap) Add LDAP identity driver (#1047)
  • (test) Add tempest identity compatibility (#998)
  • (adr0028) Add local-quorum-bypass emergency rotation (#1032)
  • Add catalog CRUD API and bootstrap support (#1029)
  • (adr0026) Add RFC 8628 Device Authorization Grant (#1023)
  • (adr0026) Phase 6a (#1017)
  • (adr0026) Add Phase 5 offline token verification (#1016)
  • (adr0026) Add authorization code flow with PKCE (#1015)
  • (adr0026) Add client_credentials token endpoint (#1014)
  • (adr0026) Phase 2 client registration & OIDC discovery (#1013)
  • (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
  • (adr0026) Phase 0 token abstraction and JWS driver (#1010)
  • (identity) Add per-user auth rate limiting (#996)
  • (adr0025) Complete imlpementation (#969)
  • (api) Add global IP rate limiting framework (ADR-0022 phase 1) (#846)
  • (adr0025) Phase 1 (1.1+1.2) (#952)
  • (security) Wrap secrets with secrecy crate (#369) (#912)
  • (scim) ADR 0024 - Phase 4 (protocol surface completion) (#929)
  • (scim) ADR 0024 - Phase 3 (#928)
  • (scim) ADR 0024 - Phase 1+2 (#925)
  • (credential) Implement Phase 3 of ADR 0019 (#909)
  • (credential) Implement ADR 0019 phases 1-2 (#897)
  • Implement stateless SCIM ingress auth (ADR 0021) (#891)
  • Audit framework (ADR-0023) phase 3 (#880)
  • (audit) Implement CADF audit framework Phase 2 (#872)
  • Migrate federation to new mapping engine (#839)
  • Add access rule CRD to appcred provider (#806)
  • ADR-0020 mapping phase 4 (#818)
  • (mapping) ADR-0020 (mapping engine) phase 1 (#794)
  • Add endpoint CRUD to catalog provider (#785)
  • Add inter-provider event notification system (#784)
  • Add service CRUD to the catalog provider (#773)
  • Validate password for compliance conformity (#774)
  • Return 401 on roleless scoped contexts (#742)
  • Add region CRUD to catalog SQL driver (#761)
  • Add role-imply rest api (#750)
  • Add role imply API (#749)
  • Add user update functionality (#747)
  • Add spiffe binding API (#740)
  • Add Admin interface over the UDS (#735)
  • Add spiffe provider (#733)
  • Expand role info in expand_implied_roles (#730)
  • Introduce SecurityContext (#710)
  • Improve the code (#686)
  • Add k8s-auth raft driver (#676)
  • Introduce the keystone-manage cli managing raft (#656)

Fixed

  • Add missing event hooks (#1633)
  • (identity) Cascade group deletion memberships (#1631)
  • Address loadtest findings (#1620)
  • (service_grant) Harden on-behalf-of implementation (#1586)
  • (oauth2) Address second DPoP review round (#1585)
  • (notification) Rework notification implementation (#1506)
  • (application_credential) Accept tempest create payloads (#1446)
  • (oauth2) Revoke refresh families on client delete/disable (#1363)
  • (oauth2-session) Tombstone revoked refresh families (#1358)
  • Next round of security review fixes (#1241)
  • Use proper token issued_at time (#1194)
  • Register UserType in OpenAPI components schema (#1151)
  • Fix ID sanitizer and capture client IP in audit (#1126)
  • (api) Default enabled/domain_id on create (#1073)
  • (security) Address security review findings (#1049)
  • (federation) Allow long external unique_id values (#1033)
  • Unify ApiClient scope validation, fix nextest filter (#947)
  • Finalize ADR 0021 work (#906)
  • Resolve raft replication state races (#884)
  • (k8s_auth) Flatten k8s.aud claim from JWT TokenReview (#834)
  • Align "extra" property handling (#787)

Other

  • Feature/system assignment group (#796)
  • Fix clippy lints across workspace (#1361)
  • (api) Harden v3 authorization and authentication coverage (#1166)
  • (identity) Remove service account API methods (#1152)
  • Extend workspace unsafe/unwrap/expect lints (#1120)
  • Revise documentation layout (#1069)
  • (security) Close mutation-testing gaps in auth/policy (#1056)
  • Move jsonwebtoken to keystone crate (#820)
  • mapping engine phase 3 - migrate SPIFFE (#811)
  • Rename identity_mapping to idmapping (#788)
  • Make resolve_implied_roles optional (#764)
  • Redesign SecurityContext with two-phase validation (#717)
  • Unify state initialization in test (#642)
  • Small optimization of the derives (#638)
  • Split the core-types crate (#640)

openstack-keystone-api-types

0.1.1 - 2026-11-14

Added

  • (federation) Add IdP lookup by issuer (#1637)
  • (mapping) Add token exchange identity source (#1622)
  • (project) Add project hierarchy to show API (#1603)
  • (identity) Isolate password hashing pool (#1606)
  • (resource) Add project tags support (#1602)
  • Add CRA/NIS2 coverage (#1595)
  • Complete OAuth2 DPoP implementation (#1583)
  • (oauth2) Add DPoP binding data model (#1576)
  • (soak_test) Expand soak test (#1551)
  • (service_grant) Expand test coverage (#1552)
  • (oauth2) Add delegatable service grants (#1550)
  • (oauth2) Add bulk session revocation (#1539)
  • (oauth2) back-channel/front-channel logout and upstream IdP logout (#1505)
  • (oauth2) Use control-plane aud for tokens (#1498)
  • (oauth2) Add back-channel logout (#1493)
  • (oauth2) Remember consent per client (#1476)
  • (oauth2) Add SSO session and RP logout (#1475)
  • (oauth2) Add client display metadata (#1472)
  • (resource) Add enabled filter to project list (#1453)
  • (identity) Add enabled filter to user list (#1451)
  • Implement authc by app credential (#1187)
  • (limit) Add unified limits (#1407)
  • (devstack) Pilot ksm SPIFFE mTLS transport (#1239)
  • (assignment) Add OpenFGA assignment driver (#1206)
  • (domain-config) Dispatch identity ops per domain (#1202)
  • (domain-config) Add configuration API (#1201)
  • Add vendor data JWT API for SPIRE integration (#1192)
  • (api) Log response body for all 4xx/5xx errors (#1171)
  • (api) Log error details in IntoResponse (#1169)
  • (policy) Implement legacy Policy API (/v3/policies) (#1127)
  • Filter user listing by type (#813)
  • (loadtest) Add more auth tests (#1119)
  • (pagination) Add pagination to remaining places (#1106)
  • Add immutable option for project, domain, role (#1097)
  • Generalize marker pagination for v3/v4 lists (#1086)
  • (identity) Add trust create/delete and REST CRUD (#1079)
  • (catalog) Expose /v3/regions REST API (#1078)
  • (identity) Add PATCH to few resources (#1076)
  • (ldap) Add LDAP identity driver (#1047)
  • (test) Add tempest identity compatibility (#998)
  • (adr0028) Add local-quorum-bypass emergency rotation (#1032)
  • Add catalog CRUD API and bootstrap support (#1029)
  • (adr0026) Extend keystone-manage oauth2 CLI (#1020)
  • (adr0026) Phase 6a (#1017)
  • (adr0026) Add client_credentials token endpoint (#1014)
  • (adr0026) Phase 2 client registration & OIDC discovery (#1013)
  • (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
  • (identity) Add per-user auth rate limiting (#996)
  • (adr0025) Complete imlpementation (#969)
  • (identity) Implement user password change endpoint (#970)
  • (api) Add global IP rate limiting framework (ADR-0022 phase 1) (#846)
  • (adr0025) Phase 1 (1.1+1.2) (#952)
  • (security) Wrap secrets with secrecy crate (#369) (#912)
  • (scim) ADR 0024 - Phase 5 (#951)
  • (scim) ADR 0024 - Phase 1+2 (#925)
  • (credential) Implement Phase 3 of ADR 0019 (#909)
  • ADR 0021 admin surface, simulate-access, and janitor (#896)
  • Implement stateless SCIM ingress auth (ADR 0021) (#891)
  • Migrate federation to new mapping engine (#839)
  • ADR-0020 mapping phase 4 (#818)
  • (mapping) ADR-0020 phase 2 (#807)
  • (mapping) ADR-0020 (mapping engine) phase 1 (#794)
  • Validate password for compliance conformity (#774)
  • Add system-user-role assignments API (#762)
  • Add role-imply rest api (#750)
  • Add user update functionality (#747)
  • Add api to list user roles on project (#639)
  • Add domain CRUD operations (#743)
  • Add spiffe binding API (#740)
  • Add spiffe provider (#733)
  • Introduce SecurityContext (#710)
  • Add skeleton for the spiffe mTLS integration (#695)
  • Improve the code (#686)

Fixed

  • Add missing event hooks (#1633)
  • Address loadtest findings (#1620)
  • (oauth2) Address second DPoP review round (#1585)
  • Address soak test findings (#1553)
  • (notification) Rework notification implementation (#1506)
  • (resource) Reject project names over 64 chars (#1455)
  • (resource) Align domain and project response shape (#1454)
  • (application_credential) Accept tempest create payloads (#1446)
  • Next round of security review fixes (#1241)
  • (api-types) Allow empty domain description (#1237)
  • (types) Remove invalid PartialEq from AppCred wrappers (#1191)
  • (logging) Surface 5xx causes at error level (#1172)
  • Register UserType in OpenAPI components schema (#1151)
  • Map raft-not-available to proper HTTP status codes (#1149)
  • (api) Fix pagination limit, filters, and rows (#1115)
  • Address multiple tempest failures (#1083)
  • (api) Default enabled/domain_id on create (#1073)
  • (security) Address security review findings (#1049)
  • (federation) Allow long external unique_id values (#1033)
  • Unify ApiClient scope validation, fix nextest filter (#947)
  • Finalize ADR 0021 work (#906)

Other

  • Feature/system assignment group (#796)
  • Fix clippy lints across workspace (#1361)
  • (api) Harden v3 authorization and authentication coverage (#1166)
  • (identity) Remove service account API methods (#1152)
  • Feature/expose app credential (#948)
  • (api) Expand v3 coverage and enforce EC2 token restrictions (#1084)
  • Extend workspace unsafe/unwrap/expect lints (#1120)
  • (test) Improve testing of the oauth2 OP (#1024)
  • Move jsonwebtoken to keystone crate (#820)
  • (tests) Reorganize integration_api tests (#815)
  • mapping engine phase 3 - migrate SPIFFE (#811)
  • Rename identity_mapping to idmapping (#788)
  • Further align workspace features (#772)
  • Make resolve_implied_roles optional (#764)
  • Redesign SecurityContext with two-phase validation (#717)
  • Small optimization of the derives (#638)
  • Split the core-types crate (#640)
  • Introduce features in api-types crate (#624)
  • Slim down api-types crate (#622)

openstack-keystone-auth-plugin-core

0.1.0 - 2026-11-14

Other

  • Split extism out of core's dependency tree (#1148)

openstack-keystone-auth-plugin-runtime

0.1.0 - 2026-11-14

Added

  • (fips) Further improve fips support (#1544)
  • (adr0025) Complete imlpementation (#969)

Fixed

  • Match real app-cred id field in route plugin (#1242)

Other

  • (deps) Exclude wasm runtime from defaults (#1545)
  • Split extism out of core's dependency tree (#1148)

openstack-keystone-jwt-crypto

0.1.0 - 2026-11-14

Added

  • Introduce jwt-crypto crate for ring backend (#1629)

Fixed

  • Add missing event hooks (#1633)

openstack-keystone-key-repository

0.1.0 - 2026-11-14

Added

  • Introduce jwt-crypto crate for ring backend (#1629)
  • (fips) Further improve fips support (#1544)
  • (adr0026) Add previous-key and JTI-revocation janitor (#1021)
  • (adr0026) Add Phase 5 offline token verification (#1016)
  • (adr0026) Add client_credentials token endpoint (#1014)
  • (adr0026) Phase 0 token abstraction and JWS driver (#1010)
  • (scim) ADR 0024 - Phase 1+2 (#925)
  • (fernet) Unify credential/token key repositories (#915)

Fixed

  • (deps) Bump p256 to 0.14, unpin rand_core (#1247)
  • Widen Fernet key index from i8 to u32 (#1080)
  • Support macOS dev builds and fs watcher shutdown (#1009)

Other

  • (deps) Reorg few more dependencies (#1558)
  • Fix clippy lints across workspace (#1361)
  • (deps) bump pem from 3.0.6 to 4.0.0 (#1162)
  • (deps) bump pkcs8 from 0.10.2 to 0.11.0 (#1061)

openstack-keystone-local-emergency-store

0.1.0 - 2026-11-14

Added

  • (test) Add tempest identity compatibility (#998)
  • (adr0028) Add local-quorum-bypass emergency rotation (#1032)

Other

  • Extend workspace unsafe/unwrap/expect lints (#1120)

openstack-keystone-storage-api

0.1.0 - 2026-11-14

Added

  • (storage) Add replicated keyspace drop (#1643)
  • (oauth2) Add delegatable service grants (#1550)
  • (storage) Add opt-in stale local reads (#1532)
  • Enable OpenTelemetry metrics and traces support (#1456)
  • (storage) Gate readiness on Raft health (#1450)
  • (storage) Add ephemeral state machine records (#1198)
  • (adr0026) Phase 1 crypto engine & JWKS endpoint (#1011)
  • (storage) Cert validity and SVID TTL enforcement (#886)
  • (storage) SPIFFE checks, RBAC, rate limiting, auto-join (#861)
  • (storage) Complete ADR-0016-v2 (#844)
  • (storage) implement ADR 0016-v2 Phases 1-4 — encrypted storage with quarantine (#840)

Fixed

  • Address soak test findings (#1553)
  • (raft) Fail closed on stale ReadIndex reads (#1341)
  • (webauthn) Rotate raft ceremony-state keyspaces (#890)

Other

  • (storage) Split large modules and tests (#1466)
  • Extend workspace unsafe/unwrap/expect lints (#1120)
  • (storage) Decouple core from storage (#832)

openstack-keystone-core

0.1.2 - 2026-11-14

Added

  • Initiate work on SingleUseStore (#1641)
  • (oauth2) Add allowed algorithms to profile (#1639)
  • (federation) Add IdP lookup by issuer (#1637)
  • (oauth2) Add shared OAuth2 subject-token validation (#1560)
  • Introduce jwt-crypto crate for ring backend (#1629)
  • (project) Add project hierarchy to show API (#1603)
  • (catalog) Add TTL cache for get_catalog (#1607)
  • (identity) Isolate password hashing pool (#1606)
  • (resource) Add project tags support (#1602)
  • Add CRA/NIS2 coverage (#1595)
  • (identity) Add group membership endpoints (#1594)
  • Complete OAuth2 DPoP implementation (#1583)
  • Support SVID + JWT used by service delegation (#1582)
  • Support DPoP in /token endpoint (#1581)
  • Start implementation of on-behalf-of exchange (#1578)
  • (oauth2) Add per-domain DPoP settings (#1579)
  • (oauth2) Add DPoP binding data model (#1576)
  • (oauth2) Add DPoP replay cache and nonces (#1565)
  • (oauth2) Add DPoP proof verifier (#1559)
  • (soak_test) Expand soak test (#1551)
  • (service_grant) Expand test coverage (#1552)
  • (oauth2) Add delegatable service grants (#1550)
  • (fips) Further improve fips support (#1544)
  • (oauth2) Add Prometheus metrics (#1540)
  • (oauth2) Add enabled switch and domain filter (#1537)
  • (deps) Make extism an optional feature (#1536)
  • (oauth2) Add user_code backoff on /device (#1514)
  • (oauth2) back-channel/front-channel logout and upstream IdP logout (#1505)
  • (oauth2) Use control-plane aud for tokens (#1498)
  • (oauth2) Add back-channel logout (#1493)
  • (oauth2) Add federated sign-in to device page (#1491)
  • (oauth2) Harden SSO sessions (#1490)
  • (oauth2) Remember consent per client (#1476)
  • (oauth2) Add SSO session and RP logout (#1475)
  • (oauth2) Add federated sign-in to OP login (#1474)
  • (oauth2) Add TOTP second factor to OP login (#1473)
  • (oauth2) Add client display metadata (#1472)
  • Enable OpenTelemetry metrics and traces support (#1456)
  • (oauth2) Add OIDC userinfo endpoint (#1442)
  • (oauth2) Rotate signing keys automatically (#1440)
  • (oauth2) Add RFC 7662 token introspection (#1439)
  • Implement authc by app credential (#1187)
  • (oslo.config) Generalize oslo-config crate (#1429)
  • (cadf) Use DSP0262 names on the wire (#1419)
  • (limit) Add unified limits (#1407)
  • (oauth2) Populate id_token profile claims (#1408)
  • (oauth2) Revoke refresh families on lifecycle (#1404)
  • (audit) Align audit schema and vectors (#1389)
  • (audit) Add perimeter completion record (#1388)
  • (audit) Fix initiator and outcome fidelity (#1387)
  • (audit) Audit remaining provider mutations (#1386)
  • (oauth2) Add RFC 7009 token revocation endpoint (#1369)
  • (oauth2) Cap refresh families and revalidate user (#1360)
  • (oauth2-session) Add expired record janitor (#1359)
  • (oauth2) Add secondary indexes to raft driver (#1327)
  • Hot-reload fs per-domain config files (#1225)
  • (adr0034) Reload assignment bundle on config change (#1220)
  • (adr0034) Route assignment ops per domain (#1219)
  • (adr0034) Build per-instance assignment backends (#1218)
  • (adr0034) Gate sources on domain_config (#1217)
  • Resolve local/public ids for non-default backends (#1207)
  • (assignment) Add OpenFGA assignment driver (#1206)
  • (idmapping) Add id-mapping write paths (#1205)
  • (domain-config) Dispatch identity ops per domain (#1202)
  • (domain-config) Add configuration API (#1201)
  • (domain-config) Add resolution layer (#1199)
  • (spiffe) Derive spiffe claims (#1193)
  • Add vendor data JWT API for SPIRE integration (#1192)
  • (core) Reconnect database connection on new config ([#1188](https://github.

@github-actions

github-actions Bot commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown

🐰 Bencher Report

Projectkeystone
Branchrelease-plz-2026-10-20T11-27-55Z
Testbedubuntu-latest
Click to view all benchmark results
BenchmarkLatencyBenchmark Result
nanoseconds (ns)
(Result Δ%)		Upper Boundary
nanoseconds (ns)
(Limit %)
Command_Serde/apply/remove📈 view plot
🚷 view threshold		118,260.00 ns
(-3.89%)Baseline: 123,047.72 ns
201,116.48 ns
(58.80%)
Command_Serde/apply/set📈 view plot
🚷 view threshold		132,200.00 ns
(+1.86%)Baseline: 129,790.41 ns
202,414.71 ns
(65.31%)
Command_Serde/pack/delete📈 view plot
🚷 view threshold		131.42 ns
(+14.30%)Baseline: 114.98 ns
165.26 ns
(79.52%)
Command_Serde/pack/delete_index📈 view plot
🚷 view threshold		117.26 ns
(+13.72%)Baseline: 103.12 ns
144.82 ns
(80.97%)
Command_Serde/pack/set📈 view plot
🚷 view threshold		207.37 ns
(+10.00%)Baseline: 188.52 ns
274.53 ns
(75.54%)
Command_Serde/pack/set_index📈 view plot
🚷 view threshold		116.57 ns
(+13.11%)Baseline: 103.06 ns
144.74 ns
(80.54%)
Command_Serde/unpack/delete📈 view plot
🚷 view threshold		168.83 ns
(+17.94%)Baseline: 143.14 ns
216.58 ns
(77.95%)
Command_Serde/unpack/delete_index📈 view plot
🚷 view threshold		142.96 ns
(+17.86%)Baseline: 121.29 ns
181.56 ns
(78.74%)
Command_Serde/unpack/set📈 view plot
🚷 view threshold		278.33 ns
(+25.19%)Baseline: 222.32 ns
341.50 ns
(81.50%)
Command_Serde/unpack/set_index📈 view plot
🚷 view threshold		140.95 ns
(+16.94%)Baseline: 120.54 ns
178.56 ns
(78.94%)
Payload_encryption/pack/remove_cmd📈 view plot
🚷 view threshold		134.32 ns
(+25.67%)Baseline: 106.88 ns
159.74 ns
(84.09%)
Payload_encryption/pack/set_cmd📈 view plot
🚷 view threshold		235.91 ns
(+22.02%)Baseline: 193.34 ns
295.85 ns
(79.74%)
Payload_encryption/unpack/remove_cmd📈 view plot
🚷 view threshold		167.66 ns
(+15.45%)Baseline: 145.22 ns
217.60 ns
(77.05%)
Payload_encryption/unpack/set_cmd📈 view plot
🚷 view threshold		268.47 ns
(+18.50%)Baseline: 226.56 ns
347.73 ns
(77.21%)
Raft_1Node_Latency/prefix/1node📈 view plot
🚷 view threshold		3,452,300.00 ns
(-7.64%)Baseline: 3,737,796.88 ns
7,894,996.46 ns
(43.73%)
Raft_1Node_Latency/read/1node📈 view plot
🚷 view threshold		33,599.00 ns
(+4.42%)Baseline: 32,178.27 ns
50,986.52 ns
(65.90%)
Raft_1Node_Latency/remove/1node📈 view plot
🚷 view threshold		332,400.00 ns
(-3.37%)Baseline: 343,975.00 ns
627,563.37 ns
(52.97%)
Raft_1Node_Latency/write/1node📈 view plot
🚷 view threshold		353,570.00 ns
(-0.72%)Baseline: 356,133.28 ns
583,910.55 ns
(60.55%)
build_snapshot/default📈 view plot
🚷 view threshold		2,144.00 ns
(+2.13%)Baseline: 2,099.29 ns
2,828.85 ns
(75.79%)
evaluate allow (identity/role/show)📈 view plot
🚷 view threshold		96,425.00 ns
(+9.52%)Baseline: 88,042.90 ns
125,005.31 ns
(77.14%)
evaluate deny (identity/role/show)📈 view plot
🚷 view threshold		12,000.00 ns
(+4.28%)Baseline: 11,507.91 ns
15,336.72 ns
(78.24%)
fernet token/project📈 view plot
🚷 view threshold		1,467.00 ns
(+16.64%)Baseline: 1,257.72 ns
1,747.65 ns
(83.94%)
get_data_keyspace📈 view plot
🚷 view threshold		0.32 ns
(+8.39%)Baseline: 0.29 ns
0.37 ns
(85.26%)
get_db📈 view plot
🚷 view threshold		0.31 ns
(+7.01%)Baseline: 0.29 ns
0.37 ns
(84.38%)
get_fernet_token_timestamp/project📈 view plot
🚷 view threshold		149.08 ns
(+14.20%)Baseline: 130.54 ns
180.08 ns
(82.79%)
get_keyspace📈 view plot
🚷 view threshold		4.06 ns
(-42.71%)Baseline: 7.08 ns
16.43 ns
(24.70%)
load all policies📈 view plot
🚷 view threshold		438,000,000.00 ns
(+4.46%)Baseline: 419,282,000.00 ns
530,954,373.18 ns
(82.49%)
🐰 View full continuous benchmarking report in Bencher

🔗 Link this project to GitHub

@github-actions

github-actions Bot commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown

🧪 Tempest Identity Compatibility Results (advisory, non-blocking)

rust

Totals
======
Ran: 133 tests in 41.7208 sec.
 - Passed: 89
 - Skipped: 4
 - Expected Fail: 0
 - Unexpected Success: 0
 - Failed: 40
Sum of execute time for each test: 31.4741 sec.
Failed test IDs 
===== FAILED TESTS (target=rust) =====
tempest.api.identity.admin.v3.test_domains_negative.DomainsNegativeTestJSON.test_delete_active_domain[gate,id-1f3fbff5-4e44-400d-9ca1-d953f05f609b,negative]
tempest.api.identity.admin.v3.test_credentials.CredentialsTestJSON.test_credentials_create_get_update_delete[id-7cd59bf9-bda4-4c72-9467-d21cab278355,smoke]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_create_domain_config_and_show_config_groups_and_options[id-9e3ff13c-f597-4f01-9377-d6c06c2a1477]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_create_update_and_delete_domain_config_groups_and_opts[id-c7510fa2-6661-4170-9c6b-4783a80651e9]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_show_default_group_config_and_options[id-11a02bf0-6f94-4380-b3b0-c8dc18fc0d22]
tempest.api.identity.admin.v3.test_default_project_id.TestDefaultProjectId.test_default_project_id[id-d6110661-6a71-49a7-a453-b5e26640ff6d]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_create_and_show_consumer[id-c8307ea6-a86c-47fd-ae7b-5b3b2caca76d]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_delete_consumer[id-fdfa1b7f-2a31-4354-b2c7-f6ae20554f93]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_list_consumers[id-09ca50de-78f2-4ffb-ac71-f2254036b2b8]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_update_consumer[id-080a9b1a-c009-47c0-9979-5305bf72e3dc]
setUpClass (tempest.api.identity.admin.v3.test_endpoint_groups.EndPointGroupsTest)
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_check_revoke_roles_on_projects_group[id-26021436-d5a4-4256-943c-ded01e0d4b45]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_check_revoke_roles_on_projects_user[id-18b70e45-7687-4b72-8277-b8f1a47d7591]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_check_revoke_roles_on_domains_group[id-c7a8dda2-be50-4fb4-9a9c-e830771078b1]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_check_revoke_roles_on_domains_user[id-4e6f0366-97c8-423c-b2be-41eae6ac91c8]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_revoke_user_roles_on_domain[id-3acf666e-5354-42ac-8e17-8b68893bcd36]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_revoke_user_roles_on_project_tree[id-9f02ccd9-9b57-46b4-8f77-dd5a736f3a06]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_assignments_for_domain_roles[id-3859df7e-5b78-4e4d-b10e-214c8953842a]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_assignments_for_implied_roles_create_delete[id-c8828027-df48-4021-95df-b65b92c7429e]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_implied_domain_roles[id-eb1e1c24-1bc4-4d47-9748-e127a1852c82]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_implied_roles_create_check_show_delete[id-c90c316c-d706-4728-bcba-eb1912081b69]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_role_create_update_show_list[id-18afc6c0-46cf-4911-824e-9989cc056c3a,smoke]
tempest.api.identity.admin.v3.test_list_projects.ListProjectsTestJSON.test_list_projects_with_parent[id-6edc66f5-2941-4a17-9526-4073311c1fac]
tempest.api.identity.admin.v3.test_projects.ProjectsTestJSON.test_create_is_domain_project[id-a7eb9416-6f9b-4dbb-b71b-7f73aaef59d5]
tempest.api.identity.admin.v3.test_projects.ProjectsTestJSON.test_project_create_with_parent[id-1854f9c0-70bc-4d11-a08a-1c789d339e3d]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_get_trusts_all[id-4773ebd5-ecbf-4255-b8d8-b63e6f72b65d,smoke]
tempest.api.identity.v3.test_tokens.TokensV3Test.test_validate_token[id-a9512ac3-3909-48a4-b395-11f438e16260]
tempest.api.identity.admin.v3.test_tokens.TokensV3TestJSON.test_get_available_domain_scopes[id-ec5ecb05-af64-4c04-ac86-4d9f6f12f185]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_get_trusts_query[id-6268b345-87ca-47c0-9ce3-37792b43403a]
tempest.api.identity.admin.v3.test_tokens.TokensV3TestJSON.test_rescope_token[id-565fa210-1da1-4563-999b-f7b5b67cf112]
tempest.api.identity.admin.v3.test_users_negative.UsersNegativeTest.test_create_user_for_non_existent_domain[id-e75f006c-89cc-477b-874d-588e4eab4b17,negative]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_expire[id-0ed14b66-cefd-4b5c-a964-65759453e292]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_create_application_credential_expires[id-852daf0c-42b5-4239-8466-d193d0543ed3]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_impersonate[id-5a0a91a4-baef-4a14-baba-59bf4d7fcace]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_noimpersonate[id-ed2a8779-a7ac-49dc-afd7-30f32f936ed2]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_api_media_types[id-657c1970-4722-4189-8831-7325f3bc4265,smoke]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_api_version_resources[id-b9232f5e-d9e5-4d97-b96c-28d3db4de1bd,smoke]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_identity_v3_existence[id-79aec9ae-710f-4c54-a4fc-3aa25b4feac3]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_list_api_versions[id-721f480f-35b6-46c7-846e-047e6acea0dc,smoke]
tempest.api.identity.v3.test_catalog.IdentityCatalogTest.test_catalog_standardization[id-56b57ced-22b8-4127-9b8a-565dfb0207e2]
===== END FAILED TESTS (target=rust) =====

View full run

@github-actions

github-actions Bot commented Oct 20, 2026 •
edited
Loading

Copy link
Copy Markdown

🦢 Load Test Results

Goose Attack Report

Plan Overview

Action Started Stopped Elapsed Users
Increasing 26-11-14 23:57:16 26-11-14 23:57:38 00:00:22 0 → 45
Maintaining 26-11-14 23:57:38 26-11-14 23:58:08 00:00:30 45
Decreasing 26-11-14 23:58:08 26-11-14 23:58:10 00:00:02 0 ← 45

Request Metrics

Method Name # Requests # Fails Average (ms) Min (ms) Max (ms) RPS Failures/s
DELETE DELETE /SCIM/v2/:domain_id/Users/:id (sync offboard) 1 0 185 185 185 0.03 0.00
DELETE DELETE /v3/OS-TRUST/trusts/:id 20 0 243 6.19 361 0.67 0.00
DELETE DELETE /v3/auth/tokens 81 0 213 133 331 2.70 0.00
DELETE DELETE /v3/auth/tokens (churn) 21 0 237 6.62 317 0.70 0.00
DELETE DELETE /v3/credentials/:id 20 0 191 9.62 312 0.67 0.00
DELETE DELETE /v3/endpoints/:id 32 0 160 32 244 1.07 0.00
DELETE DELETE /v3/groups/:id 35 0 234 11 409 1.17 0.00
DELETE DELETE /v3/groups/:id/users/:id 35 0 272 13 360 1.17 0.00
DELETE DELETE /v3/projects/:id (churn) 21 0 311 7.89 390 0.70 0.00
DELETE DELETE /v3/projects/:id (teardown) 1 0 62 62 62 0.03 0.00
DELETE DELETE /v3/projects/:id/users/:id/roles/:id (churn) 21 0 217 7.98 353 0.70 0.00
DELETE DELETE /v3/regions/:id 32 0 163 18 266 1.07 0.00
DELETE DELETE /v3/roles/:id (teardown) 1 0 84 84 84 0.03 0.00
DELETE DELETE /v3/services/:id 32 0 162 36 271 1.07 0.00
DELETE DELETE /v3/users/:id (churn) 40 0 307 8.37 480 1.33 0.00
DELETE DELETE /v3/users/:id (teardown) 2 0 79 70 88 0.07 0.00
DELETE DELETE /v4/mappings/rulesets/:mapping_id (cc teardown) 1 0 11 11 11 0.03 0.00
DELETE DELETE /v4/mappings/rulesets/:mapping_id (teardown) 1 0 98 98 98 0.03 0.00
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (cc teardown) 1 0 8.34 8.34 8.34 0.03 0.00
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown) 1 0 114 114 114 0.03 0.00
GET 96 0 184 110 296 3.20 0.00
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 15 0 413 2.38 563 0.50 0.00
└─ 200 (93.3%) 14 442 341 563
└─ 429 (6.7%) 1 2.38 2.38 2.38
GET GET /SCIM/v2/:domain_id/Users/:id (sync reconcile show) 15 0 56 1.35 704 0.50 0.00
└─ 200 (6.7%) 1 704 704 704
└─ 429 (93.3%) 14 10 1.35 64
GET GET /v3/OS-TRUST/trusts (by trustor) 20 0 182 4.99 294 0.67 0.00
GET GET /v3/OS-TRUST/trusts/:id 20 0 173 5.28 276 0.67 0.00
GET GET /v3/auth/tokens (churn validate) 20 0 244 6.8 352 0.67 0.00
GET GET /v3/auth/tokens (trustor) 20 0 242 174 334 0.67 0.00
GET GET /v3/auth/tokens (validate new) 81 0 192 128 290 2.70 0.00
GET GET /v3/auth/tokens (validate revoked) 81 0 174 115 340 2.70 0.00
GET GET /v3/auth/tokens (validate token) 253 0 233 148 423 8.43 0.00
GET GET /v3/credentials (by user) 20 0 157 9.74 308 0.67 0.00
GET GET /v3/credentials/:id 20 0 147 80 230 0.67 0.00
GET GET /v3/endpoints (by service) 30 0 171 98 306 1.00 0.00
GET GET /v3/endpoints/:id 30 0 159 114 257 1.00 0.00
GET GET /v3/groups 34 0 158 24 252 1.13 0.00
GET GET /v3/groups/:id 34 0 149 23 276 1.13 0.00
GET GET /v3/groups/:id/users 33 0 225 90 370 1.10 0.00
GET GET /v3/projects/:id 185 0 159 95 270 6.17 0.00
GET GET /v3/projects/:id (catalog) 167 0 159 101 315 5.57 0.00
GET GET /v3/projects?domain_id 264 0 202 133 383 8.80 0.00
GET GET /v3/regions/:id 30 0 164 100 229 1.00 0.00
GET GET /v3/role_assignments 92 0 177 110 342 3.07 0.00
GET GET /v3/role_assignments?role.id 93 0 158 108 262 3.10 0.00
GET GET /v3/role_assignments?scope.domain.id 93 0 152 97 233 3.10 0.00
GET GET /v3/role_assignments?user.id 93 0 167 104 311 3.10 0.00
GET GET /v3/roles 337 0 179 104 316 11.23 0.00
GET GET /v3/roles/:id 227 0 131 80 280 7.57 0.00
GET GET /v3/services 31 0 153 108 238 1.03 0.00
GET GET /v3/services/:id 30 0 156 107 302 1.00 0.00
GET GET /v3/users/:id 356 0 159 97 303 11.87 0.00
GET GET /v3/users/:id (catalog) 164 0 158 97 304 5.47 0.00
GET GET /v3/users?domain_id 262 0 212 131 382 8.73 0.00
GET GET /v4/api-keys 110 0 139 84 292 3.67 0.00
GET GET /v4/api-keys/:client_id 111 0 135 83 243 3.70 0.00
GET GET /v4/mappings/rulesets 109 0 143 90 280 3.63 0.00
GET GET /v4/mappings/rulesets/:mapping_id 109 0 134 83 272 3.63 0.00
GET GET /v4/oauth2/:domain_id/.well-known/openid-configuration 3017 0 10 1.89 103 100.57 0.00
GET GET /v4/oauth2/:domain_id/clients 109 0 139 89 244 3.63 0.00
GET GET /v4/oauth2/:domain_id/clients/:provider_id 109 0 138 84 223 3.63 0.00
GET GET /v4/oauth2/:domain_id/jwks 3019 0 9.81 1.9 95 100.63 0.00
GET GET /v4/scim_realms 71 0 145 88 262 2.37 0.00
GET GET /v4/scim_realms/:domain_id/:provider_id 70 0 137 81 273 2.33 0.00
HEAD HEAD /v3/groups/:id/users/:id 33 0 212 122 324 1.10 0.00
PATCH PATCH /SCIM/v2/:domain_id/Users/:id (sync attribute drift) 15 0 531 417 681 0.50 0.00
PATCH PATCH /v3/credentials/:id 20 0 244 96 353 0.67 0.00
PATCH PATCH /v3/groups/:id 34 0 197 37 307 1.13 0.00
PATCH PATCH /v3/services/:id 31 0 195 136 301 1.03 0.00
POST POST /v3/OS-TRUST/trusts 20 0 268 7.51 453 0.67 0.00
POST POST /v3/auth/tokens 81 0 145 87 280 2.70 0.00
POST POST /v3/auth/tokens (churn user) 20 0 1814 982 2832 0.67 0.00
POST POST /v3/auth/tokens (password, invalid) 17 0 1831 1331 2726 0.57 0.00
POST POST /v3/auth/tokens (password, project-scoped) 17 0 1808 1371 2974 0.57 0.00
POST POST /v3/auth/tokens (password, unscoped) 19 0 1836 1336 3096 0.63 0.00
POST POST /v3/auth/tokens (rescope to system) 334 0 181 110 340 11.13 0.00
POST POST /v3/auth/tokens (rescope, invalid project) 189 0 160 100 327 6.30 0.00
POST POST /v3/auth/tokens (system-scoped, bootstrap admin) 33 0 1928 1437 2915 1.10 0.00
POST POST /v3/credentials 20 0 153 102 216 0.67 0.00
POST POST /v3/endpoints 30 0 179 135 240 1.00 0.00
POST POST /v3/groups 33 0 147 109 250 1.10 0.00
POST POST /v3/projects (churn) 19 0 177 106 264 0.63 0.00
POST POST /v3/projects (setup) 1 0 144 144 144 0.03 0.00
POST POST /v3/regions 30 0 163 114 267 1.00 0.00
POST POST /v3/roles (setup) 1 0 240 240 240 0.03 0.00
POST POST /v3/services 30 0 162 103 259 1.00 0.00
POST POST /v3/users (churn) 40 0 1855 1149 3043 1.33 0.00
POST POST /v3/users (setup) 1 0 2557 2557 2557 0.03 0.00
POST POST /v4/api-keys/:client_id/revoke (teardown) 1 0 121 121 121 0.03 0.00
POST POST /v4/oauth2/:domain_id/device_authorization 1293 0 23 7.56 120 43.10 0.00
POST POST /v4/oauth2/:domain_id/token (client_credentials) 17 0 426 345 565 0.57 0.00
PUT PUT /v3/groups/:id/users/:id 33 0 209 139 319 1.10 0.00
PUT PUT /v3/projects/:id/users/:id/roles/:id (churn) 20 0 189 116 317 0.67 0.00
PUT PUT /v4/scim_realms/:domain_id/:provider_id 70 0 148 104 226 2.33 0.00
Aggregated 12981 0 103 1.35 3096 432.70 0.00

Response Time Metrics

Method Name 50%ile (ms) 60%ile (ms) 70%ile (ms) 80%ile (ms) 90%ile (ms) 95%ile (ms) 99%ile (ms) 100%ile (ms)
DELETE DELETE /SCIM/v2/:domain_id/Users/:id (sync offboard) 185 185 185 185 185 185 185 185
DELETE DELETE /v3/OS-TRUST/trusts/:id 257 272 281 301 334 338 361 361
DELETE DELETE /v3/auth/tokens 204 214 241 259 272 289 322 331
DELETE DELETE /v3/auth/tokens (churn) 243 247 259 285 293 313 317 317
DELETE DELETE /v3/credentials/:id 196 216 224 230 239 245 312 312
DELETE DELETE /v3/endpoints/:id 155 159 167 185 218 218 244 244
DELETE DELETE /v3/groups/:id 237 241 272 281 309 313 409 409
DELETE DELETE /v3/groups/:id/users/:id 276 297 313 317 342 354 360 360
DELETE DELETE /v3/projects/:id (churn) 322 334 342 371 379 387 390 390
DELETE DELETE /v3/projects/:id (teardown) 62 62 62 62 62 62 62 62
DELETE DELETE /v3/projects/:id/users/:id/roles/:id (churn) 218 228 255 255 259 268 353 353
DELETE DELETE /v3/regions/:id 171 177 181 194 202 212 266 266
DELETE DELETE /v3/roles/:id (teardown) 84 84 84 84 84 84 84 84
DELETE DELETE /v3/services/:id 161 169 173 187 204 241 271 271
DELETE DELETE /v3/users/:id (churn) 322 350 367 403 416 436 480 480
DELETE DELETE /v3/users/:id (teardown) 70 70 70 88 88 88 88 88
DELETE DELETE /v4/mappings/rulesets/:mapping_id (cc teardown) 11 11 11 11 11 11 11 11
DELETE DELETE /v4/mappings/rulesets/:mapping_id (teardown) 98 98 98 98 98 98 98 98
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (cc teardown) 8.34 8.34 8.34 8.34 8.34 8.34 8.34 8.34
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown) 114 114 114 114 114 114 114 114
GET 171 191 200 220 237 261 289 296
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 457 457 473 481 506 506 563 563
GET GET /SCIM/v2/:domain_id/Users/:id (sync reconcile show) 6.5 6.56 9.15 9.54 64 64 704 704
GET GET /v3/OS-TRUST/trusts (by trustor) 187 191 200 237 251 255 294 294
GET GET /v3/OS-TRUST/trusts/:id 177 183 196 200 210 276 276 276
GET GET /v3/auth/tokens (churn validate) 239 259 272 293 305 317 352 352
GET GET /v3/auth/tokens (trustor) 228 237 272 289 305 313 334 334
GET GET /v3/auth/tokens (validate new) 183 194 206 222 245 264 281 290
GET GET /v3/auth/tokens (validate revoked) 171 179 185 196 210 247 289 340
GET GET /v3/auth/tokens (validate token) 230 241 253 272 301 317 358 423
GET GET /v3/credentials (by user) 151 163 173 177 185 261 308 308
GET GET /v3/credentials/:id 144 153 157 177 183 185 230 230
GET GET /v3/endpoints (by service) 157 183 191 206 224 285 306 306
GET GET /v3/endpoints/:id 151 159 167 179 196 222 257 257
GET GET /v3/groups 151 169 175 183 210 247 252 252
GET GET /v3/groups/:id 140 151 161 171 216 216 276 276
GET GET /v3/groups/:id/users 224 232 241 255 276 301 370 370
GET GET /v3/projects/:id 151 161 173 189 214 230 259 270
GET GET /v3/projects/:id (catalog) 153 163 173 185 202 232 281 315
GET GET /v3/projects?domain_id 191 204 220 237 264 289 326 383
GET GET /v3/regions/:id 161 171 187 200 220 224 229 229
GET GET /v3/role_assignments 167 177 189 208 228 268 313 342
GET GET /v3/role_assignments?role.id 153 159 167 179 202 212 251 262
GET GET /v3/role_assignments?scope.domain.id 144 153 171 181 200 214 228 233
GET GET /v3/role_assignments?user.id 157 171 181 202 234 245 276 311
GET GET /v3/roles 173 183 196 210 234 253 301 316
GET GET /v3/roles/:id 122 131 142 157 173 196 220 280
GET GET /v3/services 136 151 163 173 202 204 238 238
GET GET /v3/services/:id 151 161 163 173 191 210 302 302
GET GET /v3/users/:id 153 165 173 187 206 226 257 303
GET GET /v3/users/:id (catalog) 151 161 171 183 210 234 255 304
GET GET /v3/users?domain_id 208 218 232 249 276 301 317 382
GET GET /v4/api-keys 132 138 148 167 183 198 243 292
GET GET /v4/api-keys/:client_id 126 134 155 165 179 198 214 243
GET GET /v4/mappings/rulesets 134 144 159 171 191 212 259 280
GET GET /v4/mappings/rulesets/:mapping_id 126 131 138 157 181 204 247 272
GET GET /v4/oauth2/:domain_id/.well-known/openid-configuration 8.51 9.54 11 13 16 20 34 103
GET GET /v4/oauth2/:domain_id/clients 124 142 148 169 189 208 228 244
GET GET /v4/oauth2/:domain_id/clients/:provider_id 134 140 153 167 181 185 214 223
GET GET /v4/oauth2/:domain_id/jwks 8.38 9.41 11 13 16 21 31 95
GET GET /v4/scim_realms 136 144 163 179 196 204 239 262
GET GET /v4/scim_realms/:domain_id/:provider_id 130 134 142 151 181 247 264 273
HEAD HEAD /v3/groups/:id/users/:id 208 214 226 245 276 276 324 324
PATCH PATCH /SCIM/v2/:domain_id/Users/:id (sync attribute drift) 528 528 553 586 659 659 681 681
PATCH PATCH /v3/credentials/:id 253 253 272 281 309 322 353 353
PATCH PATCH /v3/groups/:id 194 196 208 234 261 272 307 307
PATCH PATCH /v3/services/:id 175 202 230 237 268 272 301 301
POST POST /v3/OS-TRUST/trusts 281 293 313 322 362 375 453 453
POST POST /v3/auth/tokens 144 148 159 173 191 204 272 280
POST POST /v3/auth/tokens (churn user) 1,712 1,745 1,843 1,942 2,507 2,802 2,832 2,832
POST POST /v3/auth/tokens (password, invalid) 1,794 1,794 1,876 2,089 2,212 2,343 2,726 2,726
POST POST /v3/auth/tokens (password, project-scoped) 1,745 1,745 1,810 1,958 2,073 2,089 2,974 2,974
POST POST /v3/auth/tokens (password, unscoped) 1,679 1,761 1,843 2,089 2,245 2,540 3,096 3,096
POST POST /v3/auth/tokens (rescope to system) 175 185 196 208 234 264 305 340
POST POST /v3/auth/tokens (rescope, invalid project) 155 161 173 185 206 232 264 327
POST POST /v3/auth/tokens (system-scoped, bootstrap admin) 1,860 1,925 2,040 2,089 2,179 2,703 2,915 2,915
POST POST /v3/credentials 142 144 177 191 202 204 216 216
POST POST /v3/endpoints 175 185 191 200 216 240 240 240
POST POST /v3/groups 142 148 159 163 177 187 250 250
POST POST /v3/projects (churn) 171 175 200 210 216 228 264 264
POST POST /v3/projects (setup) 144 144 144 144 144 144 144 144
POST POST /v3/regions 146 163 179 189 212 228 267 267
POST POST /v3/roles (setup) 240 240 240 240 240 240 240 240
POST POST /v3/services 161 179 185 189 206 212 259 259
POST POST /v3/users (churn) 1,778 1,794 1,892 1,974 2,114 2,802 3,043 3,043
POST POST /v3/users (setup) 2,557 2,557 2,557 2,557 2,557 2,557 2,557 2,557
POST POST /v4/api-keys/:client_id/revoke (teardown) 121 121 121 121 121 121 121 121
POST POST /v4/oauth2/:domain_id/device_authorization 21 23 26 29 36 44 66 120
POST POST /v4/oauth2/:domain_id/token (client_credentials) 412 420 440 481 502 561 565 565
PUT PUT /v3/groups/:id/users/:id 200 208 237 247 276 281 319 319
PUT PUT /v3/projects/:id/users/:id/roles/:id (churn) 175 198 208 224 264 264 317 317
PUT PUT /v4/scim_realms/:domain_id/:provider_id 148 157 161 165 183 202 222 226
Aggregated 21 112 144 173 212 257 1,516 3,096

Status Code Metrics

Method Name Status Codes
DELETE DELETE /SCIM/v2/:domain_id/Users/:id (sync offboard) 1 [204]
DELETE DELETE /v3/OS-TRUST/trusts/:id 20 [204]
DELETE DELETE /v3/auth/tokens 81 [204]
DELETE DELETE /v3/auth/tokens (churn) 21 [204]
DELETE DELETE /v3/credentials/:id 20 [204]
DELETE DELETE /v3/endpoints/:id 32 [204]
DELETE DELETE /v3/groups/:id 35 [204]
DELETE DELETE /v3/groups/:id/users/:id 35 [204]
DELETE DELETE /v3/projects/:id (churn) 21 [204]
DELETE DELETE /v3/projects/:id (teardown) 1 [204]
DELETE DELETE /v3/projects/:id/users/:id/roles/:id (churn) 21 [204]
DELETE DELETE /v3/regions/:id 32 [204]
DELETE DELETE /v3/roles/:id (teardown) 1 [204]
DELETE DELETE /v3/services/:id 32 [204]
DELETE DELETE /v3/users/:id (churn) 40 [204]
DELETE DELETE /v3/users/:id (teardown) 2 [204]
DELETE DELETE /v4/mappings/rulesets/:mapping_id (cc teardown) 1 [204]
DELETE DELETE /v4/mappings/rulesets/:mapping_id (teardown) 1 [204]
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (cc teardown) 1 [204]
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown) 1 [204]
GET 96 [200]
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 14 [200], 1 [429]
GET GET /SCIM/v2/:domain_id/Users/:id (sync reconcile show) 1 [200], 14 [429]
GET GET /v3/OS-TRUST/trusts (by trustor) 20 [200]
GET GET /v3/OS-TRUST/trusts/:id 20 [200]
GET GET /v3/auth/tokens (churn validate) 20 [200]
GET GET /v3/auth/tokens (trustor) 20 [200]
GET GET /v3/auth/tokens (validate new) 81 [200]
GET GET /v3/auth/tokens (validate revoked) 81 [404]
GET GET /v3/auth/tokens (validate token) 253 [200]
GET GET /v3/credentials (by user) 20 [200]
GET GET /v3/credentials/:id 20 [200]
GET GET /v3/endpoints (by service) 30 [200]
GET GET /v3/endpoints/:id 30 [200]
GET GET /v3/groups 34 [200]
GET GET /v3/groups/:id 34 [200]
GET GET /v3/groups/:id/users 33 [200]
GET GET /v3/projects/:id 185 [200]
GET GET /v3/projects/:id (catalog) 167 [200]
GET GET /v3/projects?domain_id 264 [200]
GET GET /v3/regions/:id 30 [200]
GET GET /v3/role_assignments 92 [200]
GET GET /v3/role_assignments?role.id 93 [200]
GET GET /v3/role_assignments?scope.domain.id 93 [200]
GET GET /v3/role_assignments?user.id 93 [200]
GET GET /v3/roles 337 [200]
GET GET /v3/roles/:id 227 [200]
GET GET /v3/services 31 [200]
GET GET /v3/services/:id 30 [200]
GET GET /v3/users/:id 356 [200]
GET GET /v3/users/:id (catalog) 164 [200]
GET GET /v3/users?domain_id 262 [200]
GET GET /v4/api-keys 110 [200]
GET GET /v4/api-keys/:client_id 111 [200]
GET GET /v4/mappings/rulesets 109 [200]
GET GET /v4/mappings/rulesets/:mapping_id 109 [200]
GET GET /v4/oauth2/:domain_id/.well-known/openid-configuration 3,017 [200]
GET GET /v4/oauth2/:domain_id/clients 109 [200]
GET GET /v4/oauth2/:domain_id/clients/:provider_id 109 [200]
GET GET /v4/oauth2/:domain_id/jwks 3,019 [200]
GET GET /v4/scim_realms 71 [200]
GET GET /v4/scim_realms/:domain_id/:provider_id 70 [200]
HEAD HEAD /v3/groups/:id/users/:id 33 [204]
PATCH PATCH /SCIM/v2/:domain_id/Users/:id (sync attribute drift) 15 [200]
PATCH PATCH /v3/credentials/:id 20 [200]
PATCH PATCH /v3/groups/:id 34 [200]
PATCH PATCH /v3/services/:id 31 [200]
POST POST /v3/OS-TRUST/trusts 20 [201]
POST POST /v3/auth/tokens 81 [201]
POST POST /v3/auth/tokens (churn user) 20 [201]
POST POST /v3/auth/tokens (password, invalid) 17 [401]
POST POST /v3/auth/tokens (password, project-scoped) 17 [201]
POST POST /v3/auth/tokens (password, unscoped) 19 [201]
POST POST /v3/auth/tokens (rescope to system) 334 [201]
POST POST /v3/auth/tokens (rescope, invalid project) 189 [401]
POST POST /v3/auth/tokens (system-scoped, bootstrap admin) 33 [201]
POST POST /v3/credentials 20 [201]
POST POST /v3/endpoints 30 [201]
POST POST /v3/groups 33 [201]
POST POST /v3/projects (churn) 19 [201]
POST POST /v3/projects (setup) 1 [201]
POST POST /v3/regions 30 [201]
POST POST /v3/roles (setup) 1 [201]
POST POST /v3/services 30 [201]
POST POST /v3/users (churn) 40 [201]
POST POST /v3/users (setup) 1 [201]
POST POST /v4/api-keys/:client_id/revoke (teardown) 1 [200]
POST POST /v4/oauth2/:domain_id/device_authorization 1,293 [200]
POST POST /v4/oauth2/:domain_id/token (client_credentials) 17 [200]
PUT PUT /v3/groups/:id/users/:id 33 [204]
PUT PUT /v3/projects/:id/users/:id/roles/:id (churn) 20 [204]
PUT PUT /v4/scim_realms/:domain_id/:provider_id 70 [200]
Aggregated 81 [404], 729 [201], 206 [401], 15 [429], 11,465 [200], 485 [204]

Transaction Metrics

Transaction # Times Run # Fails Average (ms) Min (ms) Max (ms) RPS Failures/s
ReadHeavy
0.0 1 0 3036 3036 3036 0.03 0.00
0.1 96 0 218 139 340 3.20 0.00
0.2 96 0 200 133 383 3.20 0.00
0.3 96 0 184 111 296 3.20 0.00
TokenLifecycle
1.0 1 0 2852 2852 2852 0.03 0.00
1.1 81 0 724 518 945 2.70 0.00
ValidateToken
2.0 1 0 2907 2907 2907 0.03 0.00
2.1 253 0 233 148 423 8.43 0.00
UserCRUD
3.0 1 0 3039 3039 3039 0.03 0.00
3.1 1 0 2558 2558 2558 0.03 0.00
3.2 356 0 159 97 303 11.87 0.00
3.3 2 0 79 70 88 0.07 0.00
ProjectCRUD
4.0 1 0 3096 3096 3096 0.03 0.00
4.1 1 0 144 144 144 0.03 0.00
4.2 185 0 159 95 270 6.17 0.00
4.3 1 0 62 62 62 0.03 0.00
RoleCRUD
5.0 1 0 3177 3177 3177 0.03 0.00
5.1 1 0 240 240 240 0.03 0.00
5.2 227 0 131 80 280 7.57 0.00
5.3 1 0 84 84 84 0.03 0.00
RoleList
6.0 0 0 0 0 0 0.00 0.00
6.1 337 0 179 104 316 11.23 0.00
RoleAssignmentList
7.0 0 0 0 0 0 0.00 0.00
7.1 92 0 177 110 342 3.07 0.00
7.2 91 0 168 105 311 3.03 0.00
7.3 93 0 152 97 233 3.10 0.00
7.4 93 0 158 108 263 3.10 0.00
UserRead
8.0 0 0 0 0 0 0.00 0.00
8.1 165 0 209 137 382 5.50 0.00
8.2 164 0 158 97 304 5.47 0.00
ProjectRead
9.0 0 0 0 0 0 0.00 0.00
9.1 166 0 204 134 329 5.53 0.00
9.2 167 0 159 101 315 5.57 0.00
PasswordAuth
10.0 18 0 1797 1336 3096 0.60 0.00
10.1 17 0 1808 1371 2974 0.57 0.00
PasswordAuthNegative
11.0 17 0 1831 1331 2726 0.57 0.00
Rescope
12.0 0 0 0 0 0 0.00 0.00
12.1 334 0 181 110 340 11.13 0.00
RescopeNegative
13.0 0 0 0 0 0 0.00 0.00
13.1 189 0 160 100 327 6.30 0.00
SystemScopeAuth
14.0 33 0 1928 1437 2915 1.10 0.00
GroupChurn
15.0 0 0 0 0 0 0.00 0.00
15.1 35 0 1798 721 2276 1.17 0.00
CatalogChurn
16.0 0 0 0 0 0 0.00 0.00
16.1 32 0 1972 1588 2237 1.07 0.00
CredentialChurn
17.0 0 0 0 0 0 0.00 0.00
17.1 20 0 3091 2141 4207 0.67 0.00
TrustChurn
18.0 0 0 0 0 0 0.00 0.00
18.1 20 0 3233 1393 4333 0.67 0.00
IdentityChurn
19.0 0 0 0 0 0 0.00 0.00
19.1 21 0 3217 1260 4018 0.70 0.00
ApiKeyCRUD
20.0 0 0 0 0 0 0.00 0.00
20.1 0 0 0 0 0 0.00 0.00
20.2 110 0 135 83 243 3.67 0.00
20.3 110 0 139 84 292 3.67 0.00
20.4 1 0 121 121 121 0.03 0.00
MappingCRUD
21.0 0 0 0 0 0 0.00 0.00
21.1 0 0 0 0 0 0.00 0.00
21.2 108 0 134 83 272 3.60 0.00
21.3 109 0 143 90 280 3.63 0.00
21.4 1 0 98 98 98 0.03 0.00
OAuth2ClientCRUD
22.0 0 0 0 0 0 0.00 0.00
22.1 0 0 0 0 0 0.00 0.00
22.2 109 0 138 84 223 3.63 0.00
22.3 109 0 139 89 244 3.63 0.00
22.4 1 0 114 114 114 0.03 0.00
OAuth2ClientCredentials
23.0 0 0 0 0 0 0.00 0.00
23.1 0 0 0 0 0 0.00 0.00
23.2 17 0 426 345 566 0.57 0.00
23.3 1 0 19 19 19 0.03 0.00
OAuth2DeviceAuthorization
24.0 1293 0 23 7.57 120 43.10 0.00
OAuth2Discovery
25.0 3018 0 9.83 1.91 95 100.60 0.00
25.1 3017 0 10 1.9 103 100.57 0.00
ScimRealmRead
26.0 0 0 0 0 0 0.00 0.00
26.1 70 0 138 81 273 2.33 0.00
26.2 70 0 146 88 262 2.33 0.00
26.3 70 0 148 104 226 2.33 0.00
ScimSync
27.0 0 0 0 0 0 0.00 0.00
27.1 0 0 0 0 0 0.00 0.00
27.2 0 0 0 0 0 0.00 0.00
27.3 15 0 480 341 1004 0.50 0.00
27.4 16 0 992 705 1065 0.53 0.00
27.5 15 0 531 417 681 0.50 0.00
27.6 1 0 185 185 185 0.03 0.00
Aggregated 11768 0 117 1.9 4333 392.27 0.00

Scenario Metrics

Scenario # Users # Times Run Average (ms) Min (ms) Max (ms) Scenarios/s Iterations
ReadHeavy 2 95 602 398 809 3.17 47.50
TokenLifecycle 2 79 726 518 945 2.63 39.50
ValidateToken 2 251 233 148 423 8.37 125.50
UserCRUD 2 354 160 97 303 11.80 177.00
ProjectCRUD 1 184 159 95 270 6.13 184.00
RoleCRUD 1 226 131 80 280 7.53 226.00
RoleList 2 335 179 104 316 11.17 167.50
RoleAssignmentList 2 92 653 456 827 3.07 46.00
UserRead 2 164 367 253 525 5.47 82.00
ProjectRead 2 165 363 249 532 5.50 82.50
PasswordAuth 2 17 3692 2840 5520 0.57 8.50
PasswordAuthNegative 1 16 1818 1331 2726 0.53 16.00
Rescope 2 332 181 110 340 11.07 166.00
RescopeNegative 1 188 160 100 327 6.27 188.00
SystemScopeAuth 2 31 1941 1437 2915 1.03 15.50
GroupChurn 2 33 1832 1608 2276 1.10 16.50
CatalogChurn 2 30 1991 1728 2237 1.00 15.00
CredentialChurn 2 18 3179 2778 4207 0.60 9.00
TrustChurn 2 18 3414 2910 4333 0.60 9.00
IdentityChurn 2 19 3333 2925 4018 0.63 9.50
ApiKeyCRUD 1 110 274 183 407 3.67 110.00
MappingCRUD 1 108 278 178 491 3.60 108.00
OAuth2ClientCRUD 1 108 277 188 427 3.60 108.00
OAuth2ClientCredentials 1 16 1835 1400 2356 0.53 16.00
OAuth2DeviceAuthorization 1 1292 23 7.58 120 43.07 1292.00
OAuth2Discovery 2 3017 20 5.19 126 100.57 1508.50
ScimRealmRead 1 70 431 308 649 2.33 70.00
ScimSync 1 15 2006 1827 2181 0.50 15.00
Aggregated 45 7383 182 5.19 5520 246.10 164.07

Error Metrics

Method Name # Error
POST POST /v3/auth/tokens (password, invalid) 34 401 Unauthorized: POST /v3/auth/tokens (password, invalid)
POST POST /v3/auth/tokens (rescope, invalid project) 378 401 Unauthorized: POST /v3/auth/tokens (rescope, invalid project)
GET GET /v3/auth/tokens (validate revoked) 162 404 Not Found: GET /v3/auth/tokens (validate revoked)
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 2 429 Too Many Requests: GET /SCIM/v2/:domain_id/Users (sync reconcile list)
GET GET /SCIM/v2/:domain_id/Users/:id (sync reconcile show) 28 429 Too Many Requests: GET /SCIM/v2/:domain_id/Users/:id (sync reconcile show)

View full report

@openstack-experimental-release-plz
openstack-experimental-release-plz Bot force-pushed the release-plz-2026-10-20T11-27-55Z branch 23 times, most recently from 402508f to 33f3e94 Compare October 27, 2026 11:32
@openstack-experimental-release-plz
openstack-experimental-release-plz Bot force-pushed the release-plz-2026-10-20T11-27-55Z branch 4 times, most recently from a9a461e to 873b7df Compare October 28, 2026 17:37
@openstack-experimental-release-plz
openstack-experimental-release-plz Bot force-pushed the release-plz-2026-10-20T11-27-55Z branch 13 times, most recently from d79d0aa to bb4e9c4 Compare November 6, 2026 13:02
@openstack-experimental-release-plz
openstack-experimental-release-plz Bot force-pushed the release-plz-2026-10-20T11-27-55Z branch 14 times, most recently from 8224bd4 to b7c5d4f Compare November 13, 2026 14:28

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

0 participants