openstack-experimental · openstack-experimental-release-plz · Jul 4, 2026
diff --git a/Cargo.lock b/Cargo.lock
diff --git a/Cargo.toml b/Cargo.toml
@@ -106,10 +106,10 @@ openstack-keystone-appcred-driver-sql = { version = "0.1", path = "crates/appcre
 openstack-keystone-assignment-driver-sql = { version = "0.1", path = "crates/assignment-driver-sql/" }
 openstack-keystone-catalog-driver-sql = { version = "0.1", path = "crates/catalog-driver-sql/" }
 openstack-keystone-config = { version = "0.1.0", path = "crates/config"}
-openstack-keystone-core = { version = "0.1.0", path = "crates/core" }
-openstack-keystone-core-types = { version = "0.1.0", path = "crates/core-types" }
+openstack-keystone-core = { version = "0.1.2", path = "crates/core" }
+openstack-keystone-core-types = { version = "0.1.1", path = "crates/core-types" }
 openstack-keystone-credential-driver-sql = { version = "0.1", path = "crates/credential-driver-sql/" }
-openstack-keystone-distributed-storage = { version = "0.1.0", path = "crates/storage"}
+openstack-keystone-distributed-storage = { version = "0.1.1", path = "crates/storage"}
 openstack-keystone-dynamic-plugin-runtime = { version = "0.1.0", path = "crates/dynamic-plugin-runtime" }
 openstack-keystone-storage-api = { version = "0.1.0", path = "crates/storage-api" }
 openstack-keystone-storage-crypto = { version = "0.1.0", path = "crates/storage-crypto" }
@@ -123,7 +123,7 @@ openstack-keystone-idmapping-driver-sql = { version = "0.1", path = "crates/idma
 openstack-keystone-resource-driver-sql = { version = "0.1", path = "crates/resource-driver-sql/" }
 openstack-keystone-revoke-driver-sql = { version = "0.1", path = "crates/revoke-driver-sql/" }
 openstack-keystone-role-driver-sql = { version = "0.1", path = "crates/role-driver-sql/" }
-openstack-keystone-token-driver-fernet = { version = "0.1.0", path = "crates/token-driver-fernet" }
+openstack-keystone-token-driver-fernet = { version = "0.1.1", path = "crates/token-driver-fernet" }
 openstack-keystone-token-restriction-driver-sql = { version = "0.1", path = "crates/token-restriction-driver-sql/" }
 openstack-keystone-trust-driver-sql = { version = "0.1", path = "crates/trust-driver-sql/" }
 openstack-keystone-webauthn = { version = "0.1", path = "crates/webauthn/"}

diff --git a/crates/api-key-driver-raft/CHANGELOG.md b/crates/api-key-driver-raft/CHANGELOG.md
@@ -0,0 +1,15 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-api-key-driver-raft-v0.1.0) - 2026-07-04
+
+### Added
+
+- ADR 0021 admin surface, simulate-access, and janitor ([#896](https://github.com/openstack-experimental/keystone/pull/896))
+- Implement stateless SCIM ingress auth (ADR 0021) ([#891](https://github.com/openstack-experimental/keystone/pull/891))
diff --git a/crates/api-types/CHANGELOG.md b/crates/api-types/CHANGELOG.md
@@ -0,0 +1,49 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.1](https://github.com/openstack-experimental/keystone/compare/openstack-keystone-api-types-v0.1.0...openstack-keystone-api-types-v0.1.1) - 2026-07-04
+
+### Added
+
+- *(credential)* Implement Phase 3 of ADR 0019 ([#909](https://github.com/openstack-experimental/keystone/pull/909))
+- ADR 0021 admin surface, simulate-access, and janitor ([#896](https://github.com/openstack-experimental/keystone/pull/896))
+- Implement stateless SCIM ingress auth (ADR 0021) ([#891](https://github.com/openstack-experimental/keystone/pull/891))
+- Migrate federation to new mapping engine ([#839](https://github.com/openstack-experimental/keystone/pull/839))
+- ADR-0020 mapping phase 4 ([#818](https://github.com/openstack-experimental/keystone/pull/818))
+- *(mapping)* ADR-0020 phase 2 ([#807](https://github.com/openstack-experimental/keystone/pull/807))
+- *(mapping)* ADR-0020 (mapping engine) phase 1 ([#794](https://github.com/openstack-experimental/keystone/pull/794))
+- Validate password for compliance conformity ([#774](https://github.com/openstack-experimental/keystone/pull/774))
+- Add system-user-role assignments API ([#762](https://github.com/openstack-experimental/keystone/pull/762))
+- Add role-imply rest api ([#750](https://github.com/openstack-experimental/keystone/pull/750))
+- Add user update functionality ([#747](https://github.com/openstack-experimental/keystone/pull/747))
+- Add api to list user roles on project ([#639](https://github.com/openstack-experimental/keystone/pull/639))
+- Add domain CRUD operations ([#743](https://github.com/openstack-experimental/keystone/pull/743))
+- Add spiffe binding API ([#740](https://github.com/openstack-experimental/keystone/pull/740))
+- Add spiffe provider ([#733](https://github.com/openstack-experimental/keystone/pull/733))
+- Introduce SecurityContext ([#710](https://github.com/openstack-experimental/keystone/pull/710))
+- Add skeleton for the spiffe mTLS integration ([#695](https://github.com/openstack-experimental/keystone/pull/695))
+- Improve the code ([#686](https://github.com/openstack-experimental/keystone/pull/686))
+
+### Fixed
+
+- Finalize ADR 0021 work ([#906](https://github.com/openstack-experimental/keystone/pull/906))
+
+### Other
+
+- Move jsonwebtoken to keystone crate ([#820](https://github.com/openstack-experimental/keystone/pull/820))
+- *(tests)* Reorganize integration_api tests ([#815](https://github.com/openstack-experimental/keystone/pull/815))
+- mapping engine phase 3 - migrate SPIFFE ([#811](https://github.com/openstack-experimental/keystone/pull/811))
+- Rename identity_mapping to idmapping ([#788](https://github.com/openstack-experimental/keystone/pull/788))
+- Further align workspace features ([#772](https://github.com/openstack-experimental/keystone/pull/772))
+- Make resolve_implied_roles optional ([#764](https://github.com/openstack-experimental/keystone/pull/764))
+- Redesign SecurityContext with two-phase validation ([#717](https://github.com/openstack-experimental/keystone/pull/717))
+- Small optimization of the derives ([#638](https://github.com/openstack-experimental/keystone/pull/638))
+- Split the core-types crate ([#640](https://github.com/openstack-experimental/keystone/pull/640))
+- Introduce features in api-types crate ([#624](https://github.com/openstack-experimental/keystone/pull/624))
+- Slim down api-types crate ([#622](https://github.com/openstack-experimental/keystone/pull/622))
diff --git a/crates/api-types/Cargo.toml b/crates/api-types/Cargo.toml
@@ -1,7 +1,7 @@
 [package]
 name = "openstack-keystone-api-types"
 description = "OpenStack Keystone API types"
-version = "0.1.0"
+version = "0.1.1"
 rust-version.workspace = true
 edition.workspace = true
 license.workspace = true

diff --git a/crates/appcred-driver-sql/CHANGELOG.md b/crates/appcred-driver-sql/CHANGELOG.md
@@ -0,0 +1,21 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-appcred-driver-sql-v0.1.0) - 2026-07-04
+
+### Added
+
+- Add access rule CRD to appcred provider ([#806](https://github.com/openstack-experimental/keystone/pull/806))
+- Make drivers more dynamic ([#737](https://github.com/openstack-experimental/keystone/pull/737))
+
+### Other
+
+- *(core)* Eliminate XxxProvider enums ([#830](https://github.com/openstack-experimental/keystone/pull/830))
+- Move jsonwebtoken to keystone crate ([#820](https://github.com/openstack-experimental/keystone/pull/820))
+- Further align workspace features ([#772](https://github.com/openstack-experimental/keystone/pull/772))
diff --git a/crates/assignment-driver-sql/CHANGELOG.md b/crates/assignment-driver-sql/CHANGELOG.md
@@ -0,0 +1,28 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-assignment-driver-sql-v0.1.0) - 2026-07-04
+
+### Added
+
+- *(audit)* Implement CADF audit framework Phase 2 ([#872](https://github.com/openstack-experimental/keystone/pull/872))
+- Add role-imply rest api ([#750](https://github.com/openstack-experimental/keystone/pull/750))
+- Make drivers more dynamic ([#737](https://github.com/openstack-experimental/keystone/pull/737))
+
+### Fixed
+
+- *(ci)* Prepare workflows for merge queue ([#902](https://github.com/openstack-experimental/keystone/pull/902))
+
+### Other
+
+- Wrap ServiceState under ExecutionContext ([#856](https://github.com/openstack-experimental/keystone/pull/856))
+- *(storage)* Decouple core from storage ([#832](https://github.com/openstack-experimental/keystone/pull/832))
+- Move jsonwebtoken to keystone crate ([#820](https://github.com/openstack-experimental/keystone/pull/820))
+- Further align workspace features ([#772](https://github.com/openstack-experimental/keystone/pull/772))
+- Make resolve_implied_roles optional ([#764](https://github.com/openstack-experimental/keystone/pull/764))
diff --git a/crates/audit/CHANGELOG.md b/crates/audit/CHANGELOG.md
@@ -0,0 +1,16 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-audit-v0.1.0) - 2026-07-04
+
+### Added
+
+- *(audit)* Complete ADR-0023 audit implementation ([#887](https://github.com/openstack-experimental/keystone/pull/887))
+- Audit framework (ADR-0023) phase 3 ([#880](https://github.com/openstack-experimental/keystone/pull/880))
+- *(audit)* Implement CADF audit framework Phase 2 ([#872](https://github.com/openstack-experimental/keystone/pull/872))
diff --git a/crates/catalog-driver-sql/CHANGELOG.md b/crates/catalog-driver-sql/CHANGELOG.md
@@ -0,0 +1,28 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-catalog-driver-sql-v0.1.0) - 2026-07-04
+
+### Added
+
+- *(mapping)* ADR-0020 (mapping engine) phase 1 ([#794](https://github.com/openstack-experimental/keystone/pull/794))
+- Add endpoint CRUD to catalog provider ([#785](https://github.com/openstack-experimental/keystone/pull/785))
+- Add inter-provider event notification system ([#784](https://github.com/openstack-experimental/keystone/pull/784))
+- Add service CRUD to the catalog provider ([#773](https://github.com/openstack-experimental/keystone/pull/773))
+- Add region CRUD to catalog SQL driver ([#761](https://github.com/openstack-experimental/keystone/pull/761))
+- Make drivers more dynamic ([#737](https://github.com/openstack-experimental/keystone/pull/737))
+
+### Fixed
+
+- Align "extra" property handling ([#787](https://github.com/openstack-experimental/keystone/pull/787))
+
+### Other
+
+- Move jsonwebtoken to keystone crate ([#820](https://github.com/openstack-experimental/keystone/pull/820))
+- Further align workspace features ([#772](https://github.com/openstack-experimental/keystone/pull/772))
diff --git a/crates/cli-manage/CHANGELOG.md b/crates/cli-manage/CHANGELOG.md
@@ -0,0 +1,35 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-cli-manage-v0.1.0) - 2026-07-04
+
+### Added
+
+- *(fernet)* Unify credential/token key repositories ([#915](https://github.com/openstack-experimental/keystone/pull/915))
+- *(credential)* Implement Phase 3 of ADR 0019 ([#909](https://github.com/openstack-experimental/keystone/pull/909))
+- *(storage)* SPIFFE checks, RBAC, rate limiting, auto-join ([#861](https://github.com/openstack-experimental/keystone/pull/861))
+- *(storage)* Add SPIFFE mTLS support to Raft gRPC ([#852](https://github.com/openstack-experimental/keystone/pull/852))
+- *(cli)* Add cli storage subcommands per ADR 0016-v2 ([#850](https://github.com/openstack-experimental/keystone/pull/850))
+- *(storage)* implement ADR 0016-v2 Phases 1-4 — encrypted storage with quarantine ([#840](https://github.com/openstack-experimental/keystone/pull/840))
+- Add bootstrap cli command ([#809](https://github.com/openstack-experimental/keystone/pull/809))
+- Make drivers more dynamic ([#737](https://github.com/openstack-experimental/keystone/pull/737))
+- Introduce SecurityContext ([#710](https://github.com/openstack-experimental/keystone/pull/710))
+- Add skeleton for the spiffe mTLS integration ([#695](https://github.com/openstack-experimental/keystone/pull/695))
+- Implement ConfigManager for config watching ([#691](https://github.com/openstack-experimental/keystone/pull/691))
+- Add raft support under skaffold ([#667](https://github.com/openstack-experimental/keystone/pull/667))
+- Introduce the keystone-manage cli managing raft ([#656](https://github.com/openstack-experimental/keystone/pull/656))
+
+### Fixed
+
+- *(ci)* Prepare workflows for merge queue ([#902](https://github.com/openstack-experimental/keystone/pull/902))
+
+### Other
+
+- Move jsonwebtoken to keystone crate ([#820](https://github.com/openstack-experimental/keystone/pull/820))
+- Unify sea-orm features ([#769](https://github.com/openstack-experimental/keystone/pull/769))
diff --git a/crates/config/CHANGELOG.md b/crates/config/CHANGELOG.md
@@ -0,0 +1,57 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [Unreleased]
+
+## [0.1.0](https://github.com/openstack-experimental/keystone/releases/tag/openstack-keystone-config-v0.1.0) - 2026-07-04
+
+### Added
+
+- *(fernet)* Unify credential/token key repositories ([#915](https://github.com/openstack-experimental/keystone/pull/915))
+- Start ADR 0025 immplementation ([#911](https://github.com/openstack-experimental/keystone/pull/911))
+- *(credential)* Implement Phase 3 of ADR 0019 ([#909](https://github.com/openstack-experimental/keystone/pull/909))
+- Prepare PKCS#11/TPM KEK support in storage ([#907](https://github.com/openstack-experimental/keystone/pull/907))
+- *(credential)* Implement ADR 0019 phases 1-2 ([#897](https://github.com/openstack-experimental/keystone/pull/897))
+- Implement stateless SCIM ingress auth (ADR 0021) ([#891](https://github.com/openstack-experimental/keystone/pull/891))
+- *(auth)* Password hashing parity with Python Keystone ([#859](https://github.com/openstack-experimental/keystone/pull/859))
+- *(audit)* Implement CADF audit framework Phase 2 ([#872](https://github.com/openstack-experimental/keystone/pull/872))
+- *(storage)* SPIFFE checks, RBAC, rate limiting, auto-join ([#861](https://github.com/openstack-experimental/keystone/pull/861))
+- *(storage)* Harden preflight and erase dev KEK ([#860](https://github.com/openstack-experimental/keystone/pull/860))
+- Add bootstrap cli command ([#809](https://github.com/openstack-experimental/keystone/pull/809))
+- *(mapping)* ADR-0020 (mapping engine) phase 1 ([#794](https://github.com/openstack-experimental/keystone/pull/794))
+- Add inter-provider event notification system ([#784](https://github.com/openstack-experimental/keystone/pull/784))
+- Add SO_PEERCRED peer credential validation ([#775](https://github.com/openstack-experimental/keystone/pull/775))
+- Validate password for compliance conformity ([#774](https://github.com/openstack-experimental/keystone/pull/774))
+- Enforce minimum range boundaries for security
+- Add role-imply rest api ([#750](https://github.com/openstack-experimental/keystone/pull/750))
+- Add user update functionality ([#747](https://github.com/openstack-experimental/keystone/pull/747))
+- Make drivers more dynamic ([#737](https://github.com/openstack-experimental/keystone/pull/737))
+- Add keystone container with opa and policies ([#738](https://github.com/openstack-experimental/keystone/pull/738))
+- Add Admin interface over the UDS ([#735](https://github.com/openstack-experimental/keystone/pull/735))
+- Add spiffe provider ([#733](https://github.com/openstack-experimental/keystone/pull/733))
+- Introduce SecurityContext ([#710](https://github.com/openstack-experimental/keystone/pull/710))
+- Add skeleton for the spiffe mTLS integration ([#695](https://github.com/openstack-experimental/keystone/pull/695))
+- Implement ConfigManager for config watching ([#691](https://github.com/openstack-experimental/keystone/pull/691))
+- Improve the code ([#686](https://github.com/openstack-experimental/keystone/pull/686))
+- Add k8s-auth raft driver ([#676](https://github.com/openstack-experimental/keystone/pull/676))
+- Add raft support under skaffold ([#667](https://github.com/openstack-experimental/keystone/pull/667))
+- Introduce raft backend for webauthn ([#658](https://github.com/openstack-experimental/keystone/pull/658))
+- Introduce the keystone-manage cli managing raft ([#656](https://github.com/openstack-experimental/keystone/pull/656))
+
+### Fixed
+
+- *(passkey)* Prevent user enumeration ([#905](https://github.com/openstack-experimental/keystone/pull/905))
+
+### Other
+
+- Move jsonwebtoken to keystone crate ([#820](https://github.com/openstack-experimental/keystone/pull/820))
+- mapping engine phase 3 - migrate SPIFFE ([#811](https://github.com/openstack-experimental/keystone/pull/811))
+- Rename identity_mapping to idmapping ([#788](https://github.com/openstack-experimental/keystone/pull/788))
+- Replace Regex with str::find for db connection ([#760](https://github.com/openstack-experimental/keystone/pull/760))
+- Redesign SecurityContext with two-phase validation ([#717](https://github.com/openstack-experimental/keystone/pull/717))
+- Split out remaining sql drivers ([#633](https://github.com/openstack-experimental/keystone/pull/633))
+- Split config into standalone crate ([#628](https://github.com/openstack-experimental/keystone/pull/628))