)]}'
{"id":"openstack%2Fkeystone~985804","triplet_id":"openstack%2Fkeystone~master~I7c10c8a52e57e63cb9c66d03d69540abefe5425c","project":"openstack/keystone","branch":"master","topic":"clean-stack","attention_set":{},"removed_from_attention_set":{"7973":{"account":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"last_update":"2026-04-23 01:59:34.000000000","reason":"Change was submitted"},"7414":{"account":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"last_update":"2026-04-23 01:59:34.000000000","reason":"Change was submitted"},"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-04-22 22:11:14.000000000","reason":"\u003cGERRIT_ACCOUNT_14250\u003e replied on the change","reason_account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}}},"hashtags":[],"change_id":"I7c10c8a52e57e63cb9c66d03d69540abefe5425c","subject":"Enforce app cred project boundary on EC2 credential paths","status":"MERGED","created":"2026-04-22 11:25:27.000000000","updated":"2026-04-23 02:03:02.000000000","submitted":"2026-04-23 01:59:34.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"985804-clean-stack","meta_rev_id":"f5da286ffb5da3822b5c2cbd2a24b1baeb92c444","_number":985804,"virtual_id_number":985804,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},{"value":0,"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-04-23 01:59:34.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":0,"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},{"value":0,"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":2,"date":"2026-04-22 22:11:32.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":0,"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},{"value":0,"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":1,"date":"2026-04-22 22:11:14.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-04-22 19:01:38.000000000","updated_by":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"reviewer":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"state":"REVIEWER"},{"updated":"2026-04-22 19:41:19.000000000","updated_by":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"reviewer":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"state":"REVIEWER"},{"updated":"2026-04-22 21:02:31.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"ab8063b049191f32d5bafd0f73ac0ba950fa43d3","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-04-22 11:25:27.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"c70c7181dc8b836ff42ad7e23086d9fe3d956bd4","tag":"autogenerated:gerrit:abandon","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-04-22 11:49:58.000000000","message":"Abandoned","accounts_in_message":[],"_revision_number":1},{"id":"54d169aacc5dc1ab20f10e68787a9c80c27fe6ee","tag":"autogenerated:gerrit:restore","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-04-22 18:45:38.000000000","message":"Restored","accounts_in_message":[],"_revision_number":1},{"id":"2dc5c4b40393d0fbe6d83d1a0323fa97da61d8bc","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-04-22 18:46:15.000000000","message":"Uploaded patch set 2.","accounts_in_message":[],"_revision_number":2},{"id":"ad02e6f38a1f086ea74d4fa0af6e8db3df7d319d","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-04-22 18:46:39.000000000","message":"Patch Set 2:\n\nThis change is ready for review.","accounts_in_message":[],"_revision_number":2},{"id":"41bcf21df4a9a19c64f2a589ecae4610ffadb86a","author":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"date":"2026-04-22 19:01:38.000000000","message":"Patch Set 2: Code-Review+2","accounts_in_message":[],"_revision_number":2},{"id":"0db8b2632352eea298672df26be8d8392feae0ba","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-04-22 19:05:06.000000000","message":"Uploaded patch set 3.\n\nOutdated Votes:\n* Code-Review+2 (copy condition: \"changekind:TRIVIAL_REBASE OR is:MIN\")\n","accounts_in_message":[],"_revision_number":3},{"id":"7ca19e93bd24f16ae46761769f4809ba623f5fa0","author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"date":"2026-04-22 19:41:19.000000000","message":"Patch Set 3: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":3},{"id":"b3aca49c67204fba245c9436e6be8d90cecc05be","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-22 21:02:31.000000000","message":"Patch Set 3: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/48d2494b867a494786170d7936bdc001\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/94d051e52d3047b9bc5b83654a7b6688 : SUCCESS in 19m 17s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/4c212ee26c39462298d22055cf0429df : FAILURE in 5m 08s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/e27f786d8f174a62a1e934e92dce6dce : SUCCESS in 11m 24s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/217c8add28da4127ac9dd5e25f3b0a9d : SUCCESS in 9m 26s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/2ef1fe369e0e45fa9461bc4850730dc8 : SUCCESS in 12m 02s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/bf8879c6cefd4b90b7cd74549d73bffe : SUCCESS in 13m 55s\n- grenade https://zuul.opendev.org/t/openstack/build/acfbc81b610c4baea2f6d8f356700061 : SUCCESS in 48m 55s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/6a590d6495c84833880d274d720b6850 : SUCCESS in 1h 44m 07s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/ca08b44af2184e279df12fa46f09bc21 : SUCCESS in 16m 51s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/3a7fce3ba4734a7889b78f4ebf3a2814 : SUCCESS in 29m 48s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/081fa18389d74e159a3ee099b40d428e : FAILURE in 20m 16s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/29252215a6124529af1920d475441208 : FAILURE in 28m 43s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/6df47633549547c08cef9e1a51ebce33 : SUCCESS in 32m 52s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/db76da898dda43bb9101ac8deec6444f : SUCCESS in 33m 39s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/feb00a6d345b4df9b5aa2c77c65751a9 : SUCCESS in 35m 30s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/a1af4dffe40743cc9e1a5aa1a5850548 : SUCCESS in 45m 56s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/3833b26a7d9e4465bcbf5afe8ab06548 : FAILURE in 43m 43s (non-voting)\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/571009d66dfc48e6a501cd3d0ce22d93 : SUCCESS in 6m 49s (non-voting)","accounts_in_message":[],"_revision_number":3},{"id":"28b185bd07dd50f1719d5d80c97e01e44b1fa383","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-04-22 22:09:29.000000000","message":"Uploaded patch set 4.\n\nOutdated Votes:\n* Code-Review+2 (copy condition: \"changekind:TRIVIAL_REBASE OR is:MIN\")\n* Verified-1 (copy condition: \"NEVER\")\n* Workflow+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":4},{"id":"f47f73641b6d5aadb523b27ae42535a589ae4a93","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-04-22 22:11:14.000000000","message":"Patch Set 4: Workflow+1\n\n(1 comment)","accounts_in_message":[],"_revision_number":4},{"id":"b29af1b786bc271b14dcb75fddab5148c6de400b","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-04-22 22:11:32.000000000","message":"Patch Set 4: Code-Review+2","accounts_in_message":[],"_revision_number":4},{"id":"d088b44ceb11ea8491095d6e033eb3b6b7a453cc","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-23 00:16:05.000000000","message":"Patch Set 4: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/3a2d31806cc2497fb146bf30eb9928d4\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/b485d4bc8f404fcc84c501beb3fe97bd : SUCCESS in 17m 17s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/e4394997440945319f6b73bb1de6a908 : SUCCESS in 5m 19s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/ce2fb931e55244b4a29f3f42f2c62ce9 : SUCCESS in 9m 33s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/265a4ee193b54dc599277e66579cbced : SUCCESS in 10m 47s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/d912ecb6fc354d26b3dd45d8a0560e91 : SUCCESS in 8m 33s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/5e1e840a03c24f8e9d2695dfc4451d0c : SUCCESS in 6m 27s\n- grenade https://zuul.opendev.org/t/openstack/build/9c9af562ed884669ac7c39c1ee218544 : SUCCESS in 1h 04m 29s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/45ee4927581145f89e8dea97bf7b00d6 : SUCCESS in 2h 01m 04s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/4be879f6270949a0a9b1cb7349b95909 : SUCCESS in 9m 05s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/90921bf82a384ca898ba1b70d97f82cc : SUCCESS in 15m 13s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/f8ffc75c3837473185ae9dce0d15a3d7 : FAILURE in 9m 19s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/0654a7a399fc42cfa02d1384e019c568 : FAILURE in 14m 12s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/6d16070f53094cb7984c8f958f5c20ad : SUCCESS in 30m 19s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/3d3471adf2cb4534bc2e8c5f45df087f : SUCCESS in 16m 10s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/dc217d264d2a4569a44c6dbdca176375 : SUCCESS in 47m 11s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/ca6735732f13413897ac5053e2c031a0 : SUCCESS in 1h 02m 49s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/a6ebc9f6ee8a423c8b27cd9a0484fbb6 : FAILURE in 33m 34s (non-voting)\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/8f5bc5b6ff2948db859ae2fd5599d2ce : SUCCESS in 6m 47s (non-voting)","accounts_in_message":[],"_revision_number":4},{"id":"a04bbbe46767141d4fbc3a34252839c22ffc4aad","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-23 00:16:33.000000000","message":"Patch Set 4: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":4},{"id":"e7f65943e9953dcaba9bd20b19a37a8bddba531e","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-23 01:59:34.000000000","message":"Patch Set 4: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/17760dce2a034792a2d36cb0ec7a74b1\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/442d9700f94f452dba3fe02b10ea3992 : SUCCESS in 3m 16s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/aa07a9ea987e4b42b560973eea608a60 : SUCCESS in 7m 51s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/561bb0cb7b7a41dabca5294b0ab7a0f3 : SUCCESS in 6m 43s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/451faa1e353f4148b7a4702f40aea575 : SUCCESS in 7m 19s\n- grenade https://zuul.opendev.org/t/openstack/build/4ce2940a647a4110ab461346b8bc9d3d : SUCCESS in 47m 22s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/4574f68ae2a1439a9258435cdf53e4df : SUCCESS in 1h 41m 45s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/3e221c98c68f423a8b7e6517d51cce8e : SUCCESS in 21m 21s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/5dd512823e6042a8ba3c2c1d7691cd4d : SUCCESS in 17m 24s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/41ce7d5204ab4e9f80ba47bc9358dd80 : SUCCESS in 35m 24s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/1fbb031096454ecf917c668931ecd301 : FAILURE in 42m 42s (non-voting)","accounts_in_message":[],"_revision_number":4},{"id":"7dcb83071bb13c12aea545076c70e397a1c8570c","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-23 01:59:34.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":4},{"id":"585f9123dbab534e87f323dd7cc0f95e246f8329","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-23 02:00:39.000000000","message":"Patch Set 4:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/f7cac821728c423791b57847f445dea8\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/ac4780768c574c72b36fb1ab29ead0aa : SUCCESS in 55s","accounts_in_message":[],"_revision_number":4},{"id":"f5da286ffb5da3822b5c2cbd2a24b1baeb92c444","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-23 02:03:02.000000000","message":"Patch Set 4:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/16cafb1933b54a7d8d7628024cf6e2c3\n\n- openstack-tox-py310-arm64 https://zuul.opendev.org/t/openstack/build/38975a83923c4f6ea901fdea62f24922 : SUCCESS in 24m 45s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/2f4d271dfe7a476ca361680ca2cd516a : SUCCESS in 13m 55s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/b7c787fa8cd04a7e9968f1d9c5f853ba : SUCCESS in 19m 05s (non-voting)","accounts_in_message":[],"_revision_number":4}],"current_revision_number":4,"current_revision":"b6fd80996b882890a51f3e2aab41d952d7ff68ae","revisions":{"cfe2dce7c5be71d27452f6b50575cef957b8bb4d":{"kind":"REWORK","_number":1,"created":"2026-04-22 11:25:27.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/04/985804/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/04/985804/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/04/985804/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/04/985804/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/04/985804/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/04/985804/1"}}},"commit":{"parents":[{"commit":"b42547956017d5c04b62c77cbc1b8395986299a3","subject":"Add Kubernetes token auth middleware for OCP federation","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/b42547956017d5c04b62c77cbc1b8395986299a3"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-04-22 11:23:44.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-04-22 11:23:44.000000000","tz":120},"subject":"Enforce app cred project boundary on EC2 credential paths","message":"Enforce app cred project boundary on EC2 credential paths\n\nPOST /v3/credentials did not validate that the caller-supplied\nproject_id for an EC2-type credential matched the project of the\nauthenticating application credential. This allowed an attacker\nholding an unrestricted application credential for project A to\ncreate an EC2 credential targeting project B; a subsequent\n/v3/ec2tokens exchange would then issue a Keystone token scoped to\nproject B while still carrying the original app_cred_id, enabling\ncross-project lateral movement within the credential owner\u0027s role\nfootprint.\n\nTwo fixes:\n\n1. credentials.py: after extracting app_cred_id from the token,\n   check that credential[\u0027project_id\u0027] \u003d\u003d app_cred[\u0027project_id\u0027]\n   for EC2-type credentials and raise ForbiddenAction otherwise.\n\n2. EC2_S3_Resource.py: in handle_authenticate(), assert that the\n   stored EC2 credential project_id matches the application\n   credential\u0027s project before issuing the token.\n\nThis issue is orthogonal to CVE-2026-33551 (LP#2142138 / Gerrit\n983655), which blocks restricted application credentials from\ncreating EC2 credentials at all. The project-boundary check is\nabsent regardless of the restricted flag and requires separate\ntreatment.\n\nRelated-Bug: #OSPRH-29345\nAssisted-by: claude-sonnet-4-6 \u003cnoreply@anthropic.com\u003e\nChange-Id: I7c10c8a52e57e63cb9c66d03d69540abefe5425c\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/cfe2dce7c5be71d27452f6b50575cef957b8bb4d"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/cfe2dce7c5be71d27452f6b50575cef957b8bb4d"}]},"branch":"refs/heads/master"},"9d3cb831e9a40a8c78cf37e5932ea2b2164eb9d0":{"kind":"REWORK","_number":2,"created":"2026-04-22 18:46:15.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/04/985804/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/04/985804/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/04/985804/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/04/985804/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/04/985804/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/04/985804/2"}}},"commit":{"parents":[{"commit":"80d5b7bf50448073223723cf1f6001a367695e80","subject":"Merge \"Fix pagination next link duplicating URL prefix\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/80d5b7bf50448073223723cf1f6001a367695e80"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-04-22 11:23:44.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-04-22 18:43:09.000000000","tz":120},"subject":"Enforce app cred project boundary on EC2 credential paths","message":"Enforce app cred project boundary on EC2 credential paths\n\nPOST /v3/credentials did not validate that the caller-supplied\nproject_id for an EC2-type credential matched the project of the\nauthenticating application credential. This allowed an attacker\nholding an unrestricted application credential for project A to\ncreate an EC2 credential targeting project B; a subsequent\n/v3/ec2tokens exchange would then issue a Keystone token scoped to\nproject B while still carrying the original app_cred_id, enabling\ncross-project lateral movement within the credential owner\u0027s role\nfootprint.\n\nTwo fixes:\n\n1. credentials.py: after extracting app_cred_id from the token,\n   check that credential[\u0027project_id\u0027] \u003d\u003d app_cred[\u0027project_id\u0027]\n   for EC2-type credentials and raise ForbiddenAction otherwise.\n\n2. EC2_S3_Resource.py: in handle_authenticate(), assert that the\n   stored EC2 credential project_id matches the application\n   credential\u0027s project before issuing the token.\n\nThis issue is orthogonal to CVE-2026-33551 (LP#2142138 / Gerrit\n983655), which blocks restricted application credentials from\ncreating EC2 credentials at all. The project-boundary check is\nabsent regardless of the restricted flag and requires separate\ntreatment.\n\nCloses-Bug: #2149775\nRelated-Bug: #OSPRH-29345\nAssisted-by: claude-sonnet-4-6 \u003cnoreply@anthropic.com\u003e\nChange-Id: I7c10c8a52e57e63cb9c66d03d69540abefe5425c\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/9d3cb831e9a40a8c78cf37e5932ea2b2164eb9d0"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/9d3cb831e9a40a8c78cf37e5932ea2b2164eb9d0"}]},"branch":"refs/heads/master"},"9232dda3270585a7bd340243119957ec65414277":{"kind":"REWORK","_number":3,"created":"2026-04-22 19:05:06.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/04/985804/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/04/985804/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/04/985804/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/04/985804/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/04/985804/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/04/985804/3"}}},"commit":{"parents":[{"commit":"29246c5fd8d1dafbe6cc8cec4c57faf5590cd44e","subject":"Block app cred tokens from authorizing OAuth1 requests","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/29246c5fd8d1dafbe6cc8cec4c57faf5590cd44e"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-04-22 11:23:44.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-04-22 19:04:59.000000000","tz":120},"subject":"Enforce app cred project boundary on EC2 credential paths","message":"Enforce app cred project boundary on EC2 credential paths\n\nPOST /v3/credentials did not validate that the caller-supplied\nproject_id for an EC2-type credential matched the project of the\nauthenticating application credential. This allowed an attacker\nholding an unrestricted application credential for project A to\ncreate an EC2 credential targeting project B; a subsequent\n/v3/ec2tokens exchange would then issue a Keystone token scoped to\nproject B while still carrying the original app_cred_id, enabling\ncross-project lateral movement within the credential owner\u0027s role\nfootprint.\n\nTwo fixes:\n\n1. credentials.py: after extracting app_cred_id from the token,\n   check that credential[\u0027project_id\u0027] \u003d\u003d app_cred[\u0027project_id\u0027]\n   for EC2-type credentials and raise ForbiddenAction otherwise.\n\n2. EC2_S3_Resource.py: in handle_authenticate(), assert that the\n   stored EC2 credential project_id matches the application\n   credential\u0027s project before issuing the token.\n\nThis issue is orthogonal to CVE-2026-33551 (LP#2142138 / Gerrit\n983655), which blocks restricted application credentials from\ncreating EC2 credentials at all. The project-boundary check is\nabsent regardless of the restricted flag and requires separate\ntreatment.\n\nCloses-Bug: #2149775\nRelated-Bug: #OSPRH-29345\nAssisted-by: claude-sonnet-4-6 \u003cnoreply@anthropic.com\u003e\nChange-Id: I7c10c8a52e57e63cb9c66d03d69540abefe5425c\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/9232dda3270585a7bd340243119957ec65414277"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/9232dda3270585a7bd340243119957ec65414277"}]},"branch":"refs/heads/master"},"b6fd80996b882890a51f3e2aab41d952d7ff68ae":{"kind":"REWORK","_number":4,"created":"2026-04-22 22:09:29.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/04/985804/4","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/04/985804/4","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/04/985804/4 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/04/985804/4 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/04/985804/4 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/04/985804/4"}}},"commit":{"parents":[{"commit":"29246c5fd8d1dafbe6cc8cec4c57faf5590cd44e","subject":"Block app cred tokens from authorizing OAuth1 requests","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/29246c5fd8d1dafbe6cc8cec4c57faf5590cd44e"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-04-22 11:23:44.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-04-22 22:08:11.000000000","tz":120},"subject":"Enforce app cred project boundary on EC2 credential paths","message":"Enforce app cred project boundary on EC2 credential paths\n\nPOST /v3/credentials did not validate that the caller-supplied\nproject_id for an EC2-type credential matched the project of the\nauthenticating application credential. This allowed an attacker\nholding an unrestricted application credential for project A to\ncreate an EC2 credential targeting project B; a subsequent\n/v3/ec2tokens exchange would then issue a Keystone token scoped to\nproject B while still carrying the original app_cred_id, enabling\ncross-project lateral movement within the credential owner\u0027s role\nfootprint.\n\nTwo fixes:\n\n1. credentials.py: after extracting app_cred_id from the token,\n   check that credential[\u0027project_id\u0027] \u003d\u003d app_cred[\u0027project_id\u0027]\n   for EC2-type credentials and raise ForbiddenAction otherwise.\n\n2. EC2_S3_Resource.py: in handle_authenticate(), assert that the\n   stored EC2 credential project_id matches the application\n   credential\u0027s project before issuing the token.\n\nThis issue is orthogonal to CVE-2026-33551 (LP#2142138 / Gerrit\n983655), which blocks restricted application credentials from\ncreating EC2 credentials at all. The project-boundary check is\nabsent regardless of the restricted flag and requires separate\ntreatment.\n\nCloses-Bug: #2149775\nRelated-Bug: #OSPRH-29345\nAssisted-by: claude-sonnet-4-6 \u003cnoreply@anthropic.com\u003e\nChange-Id: I7c10c8a52e57e63cb9c66d03d69540abefe5425c\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/b6fd80996b882890a51f3e2aab41d952d7ff68ae"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/b6fd80996b882890a51f3e2aab41d952d7ff68ae"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}