keystone-tempest-plugin — Change history

Change history — keystone-tempest-plugin — branch master

Branch master @ 41e16f7f319c — range 0.22.0..master (requested), 2 non-merge commits — target: none — analysed on 2026-10-28 Keystone reference: keystone: = Keystone repository (stable/2026.2 checked out; master commits read with git)

Raw facts: _inventory/history_master.md and _inventory/history_master.json. The script classified both commits as maintenance; one of them changes test behaviour. It is reclassified here as a change of the expected behaviour.

#	Commit	Date	Category	Change	Impact
1	`d5dcf00f4f69`	2026-06-18	behaviour (tests), reclassified	removal of the assertions that expected 204 for the grant of a domain-specific role on another domain	`keystone_tempest_plugin/tests/rbac/v3/test_grant.py` (−200 lines)
2	`0266d55ff82e`	2026-09-17	maintenance	`stable/2026.2` job in the gate	`.zuul.yaml`

1. Cross-domain grants of domain-specific roles: assertions removed

Before: the RBAC tests expected PUT /v3/domains/{d}/users|groups/{a}/roles/{r} to succeed (204) even when the role r belongs to another domain than d.
After: these assertions are removed. A follow-up patch will add them back expecting 403.
Why: Keystone now refuses these grants, the same way it already refused them for projects (DomainSpecificRoleMismatch). That fix is keystone:fa43c4b3d "Enforce domain scope for domain-targeted role grants", which is **only on Keystone master**: stable/2026.2 does not contain it.
Consequence for OpenKeel:
- Keystone stable/2026.2 still accepts these grants (204);
- the plugin no longer tests either behaviour;
- a rewrite should refuse them (403), like master, and consider backporting fa43c4b3d to stable/2026.2.

Carry-over plan

Nothing to carry over to the plugin. On the Keystone side, consider backporting keystone:fa43c4b3d (security hardening) to stable/2026.2.

Source: reverse-spec-keystone-tempest-plugin/06-change-history_master.md. The _rewrite/ and _inventory/ files are not published on the site.