)]}'
{"id":"openstack%2Fkeystonemiddleware~1005601","triplet_id":"openstack%2Fkeystonemiddleware~master~I6bef9323ea4ff012d6679b04e371139b7faf93bc","project":"openstack/keystonemiddleware","branch":"master","hashtags":[],"change_id":"I6bef9323ea4ff012d6679b04e371139b7faf93bc","subject":"WIP: add SPIFFE mTLS transport option","status":"NEW","created":"2026-09-14 16:09:31.000000000","updated":"2026-09-16 10:22:10.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":0,"unresolved_comment_count":0,"work_in_progress":true,"has_review_started":true,"meta_rev_id":"6f06a1824f1f8c4a7376e850fd38656d6a44e66e","_number":1005601,"virtual_id_number":1005601,"owner":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:check","value":1,"date":"2026-09-16 10:22:10.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"reviewer_updates":[{"updated":"2026-09-14 17:50:40.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"81b5310a9d0a58b7dceec6a5976c8af90e69d6e0","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-09-14 16:09:31.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"9ea4e6cc572e7cce617ca24e6d1f0a64d545fa44","tag":"autogenerated:gerrit:setWorkInProgress","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-09-14 16:09:53.000000000","message":"Set Work In Progress","accounts_in_message":[],"_revision_number":1},{"id":"04cf60bc95b19287bef29bde68cdb02f1a392226","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-14 17:50:40.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/2e4e6489c1ba42e296b9ae31631336c8\n\n- test-release-openstack https://zuul.opendev.org/t/openstack/build/c60afcceb4284af38dc852b75cc27df4 : SUCCESS in 2m 36s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/4adc1285d91b42da83f1d23d3b5ba70c : SUCCESS in 3m 24s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/1f294698094c4289b917c8413425df5d : SUCCESS in 2m 53s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/74654815365d4b39ad5c34a7ed53b7f7 : SUCCESS in 3m 18s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/99192cbe99194814972cb18fc1c2a66e : SUCCESS in 3m 11s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/61064b2898834016b18b5de4b3ecf07c : SUCCESS in 3m 27s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/16ee077af55145458b0edd2a7d80a65f : SUCCESS in 6m 36s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/e88b51d745e74035898b2c7871e701c5 : SUCCESS in 1h 34m 14s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/1ff3795c7b4f46deb87a4a543a357750 : SUCCESS in 4m 10s","accounts_in_message":[],"_revision_number":1},{"id":"a1b529e399e7c9bed4b477b28168baa6f25bde54","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-09-15 11:48:58.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"28b202679c6074e2b736920e1ce5d75fe1738309","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-15 12:53:41.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/563a699a839b4d2b890ac99fbc9bb852\n\n- test-release-openstack https://zuul.opendev.org/t/openstack/build/7fac871fdce3422c9794e5b4597caecc : SUCCESS in 2m 47s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/680aaef00f1448c9aeef7125e55409bd : SUCCESS in 3m 39s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/886ba25b5f6d4f71a4147d7918fdb148 : SUCCESS in 3m 05s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/4921031fcdb44ceeb5692b33947a938d : SUCCESS in 3m 18s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/d520fce0c2da4aeebf30a9c75398ce01 : SUCCESS in 3m 28s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/008f1e904a9e4ff6961126d021c851b8 : SUCCESS in 5m 44s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/8c60d3a2151c4c8c84e4da6871a6101b : SUCCESS in 6m 47s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/32dc74afa8c3461c8bbfbe7c6afcbec3 : SUCCESS in 1h 02m 48s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/eef54488603d4a14b30c110975011f9f : SUCCESS in 3m 57s","accounts_in_message":[],"_revision_number":2},{"id":"c273e16256ecaaf08e6539339c5f84425d9d9440","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-09-16 08:48:03.000000000","message":"Uploaded patch set 3.\n\nOutdated Votes:\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":3},{"id":"6f06a1824f1f8c4a7376e850fd38656d6a44e66e","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-16 10:22:10.000000000","message":"Patch Set 3: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/d1f56492aad0473f8c06d6a91619e995\n\n- test-release-openstack https://zuul.opendev.org/t/openstack/build/fea11530952f4618a0ac51eedb9cda38 : SUCCESS in 2m 09s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/f6a9a9f0aad74f62bee22aac7b08d756 : SUCCESS in 3m 04s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/b89dde74b45043739c96a9db10488c7e : SUCCESS in 4m 56s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/3a9761181a8a40cbbfe29100bbbf5de1 : SUCCESS in 3m 09s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/702def5918c04f0b83c10042dffe61fa : SUCCESS in 3m 31s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/d88f321f94e64110be22b5b59fc22b2e : SUCCESS in 6m 11s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/7a6c862d5a7f43209ceb30dff9858ee2 : SUCCESS in 8m 26s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/4bbbc650dc674d74afaa032da53e85bb : SUCCESS in 1h 28m 27s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/c4d8bc3356c94405b82cb426d0350785 : SUCCESS in 4m 32s","accounts_in_message":[],"_revision_number":3}],"current_revision_number":3,"current_revision":"834a643e25dcb09ffd5515f0506614d5d925a4ee","revisions":{"0c50c134bb231c2983c589cc8443ff2cc23c48aa":{"kind":"REWORK","_number":1,"created":"2026-09-14 16:09:31.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/01/1005601/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystonemiddleware","ref":"refs/changes/01/1005601/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/01/1005601/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/01/1005601/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/01/1005601/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystonemiddleware refs/changes/01/1005601/1"}}},"commit":{"parents":[{"commit":"40379eb763e1e861e388bd874821ec2e27e19987","subject":"Adopt pre-commit","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/40379eb763e1e861e388bd874821ec2e27e19987"}]}],"author":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-09-14 16:06:36.000000000","tz":120},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-09-14 16:06:36.000000000","tz":120},"subject":"WIP: add SPIFFE mTLS transport option","message":"WIP: add SPIFFE mTLS transport option\n\nKeystone-rs with SPIRE workload identity allows auth_token to\nauthenticate its back-channel to the identity server with a SPIRE-issued\nX.509 SVID instead of static certfile/keyfile. The same can be\nalso configured with a python keystone, albeit with hacks, so the change\nis not introducing something only relevant to keystone-rs.\n\nAdd spiffe_agent_socket config option: when set, fetches a workload\nSVID from the local SPIRE agent\u0027s Workload API socket and uses it as\nclient cert, refreshing on rotation. Takes precedence over\ncertfile/keyfile/cafile/insecure when both are configured.\n\nNew optional dependency gated behind the `spiffe` extra.\n\nThe change is a POC demonstrating integration in devstack.\n\nChange-Id: I6bef9323ea4ff012d6679b04e371139b7faf93bc\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/0c50c134bb231c2983c589cc8443ff2cc23c48aa"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/0c50c134bb231c2983c589cc8443ff2cc23c48aa"}]},"branch":"refs/heads/master"},"551eb6c5f50e426e752d1ee6c57a9c6f73b856e0":{"kind":"REWORK","_number":2,"created":"2026-09-15 11:48:58.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/01/1005601/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystonemiddleware","ref":"refs/changes/01/1005601/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/01/1005601/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/01/1005601/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/01/1005601/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystonemiddleware refs/changes/01/1005601/2"}}},"commit":{"parents":[{"commit":"40379eb763e1e861e388bd874821ec2e27e19987","subject":"Adopt pre-commit","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/40379eb763e1e861e388bd874821ec2e27e19987"}]}],"author":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-09-14 16:06:36.000000000","tz":120},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-09-15 11:48:42.000000000","tz":120},"subject":"WIP: add SPIFFE mTLS transport option","message":"WIP: add SPIFFE mTLS transport option\n\nKeystone-rs with SPIRE workload identity allows auth_token to\nauthenticate its back-channel to the identity server with a SPIRE-issued\nX.509 SVID instead of static certfile/keyfile. The same can be\nalso configured with a python keystone, albeit with hacks, so the change\nis not introducing something only relevant to keystone-rs.\n\nAdd spiffe_agent_socket config option: when set, fetches a workload\nSVID from the local SPIRE agent\u0027s Workload API socket and uses it as\nclient cert, refreshing on rotation. Takes precedence over\ncertfile/keyfile/cafile/insecure when both are configured.\n\nNew optional dependency gated behind the `spiffe` extra.\n\nThe change is a POC demonstrating integration in devstack.\n\nChange-Id: I6bef9323ea4ff012d6679b04e371139b7faf93bc\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/551eb6c5f50e426e752d1ee6c57a9c6f73b856e0"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/551eb6c5f50e426e752d1ee6c57a9c6f73b856e0"}]},"branch":"refs/heads/master"},"834a643e25dcb09ffd5515f0506614d5d925a4ee":{"kind":"REWORK","_number":3,"created":"2026-09-16 08:48:03.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/01/1005601/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystonemiddleware","ref":"refs/changes/01/1005601/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/01/1005601/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/01/1005601/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/01/1005601/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystonemiddleware refs/changes/01/1005601/3"}}},"commit":{"parents":[{"commit":"40379eb763e1e861e388bd874821ec2e27e19987","subject":"Adopt pre-commit","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/40379eb763e1e861e388bd874821ec2e27e19987"}]}],"author":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-09-14 16:06:36.000000000","tz":120},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-09-16 08:47:49.000000000","tz":120},"subject":"WIP: add SPIFFE mTLS transport option","message":"WIP: add SPIFFE mTLS transport option\n\nKeystone-rs with SPIRE workload identity allows auth_token to\nauthenticate its back-channel to the identity server with a SPIRE-issued\nX.509 SVID instead of static certfile/keyfile. The same can be\nalso configured with a python keystone, albeit with hacks, so the change\nis not introducing something only relevant to keystone-rs.\n\nAdd spiffe_agent_socket config option: when set, fetches a workload\nSVID from the local SPIRE agent\u0027s Workload API socket and uses it as\nclient cert, refreshing on rotation. Takes precedence over\ncertfile/keyfile/cafile/insecure when both are configured.\n\nThe identity server\u0027s SVID is verified against the trust bundle\nfetched from the same agent; the hostname/IP assertion is disabled,\nas a SPIFFE SVID carries its identity in a URI SAN and can never\nmatch a hostname or IP.\n\nNew optional dependency gated behind the \u0027spiffe\u0027 extra.\n\nThe change is a POC demonstrating integration in devstack.\n\nChange-Id: I6bef9323ea4ff012d6679b04e371139b7faf93bc\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/834a643e25dcb09ffd5515f0506614d5d925a4ee"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/834a643e25dcb09ffd5515f0506614d5d925a4ee"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY"},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}