keystone — Async processing

Processing triggered outside the API — keystone — branch stable/2026.2

Branch stable/2026.2 @ e6dc5ae079e6 — repository https://opendev.org/openstack/keystone — analysed on 2026-10-28

Finding: no bus consumer, no periodic task

So the "background" work of Keystone is of two kinds: cascades run inside the request that triggered them, and operator commands (keystone-manage) that must be scheduled outside (cron, Kubernetes jobs).

1. In-process callbacks (cascades)

notify_event_callbacks (keystone/notifications.py:466-485) calls every function registered for (event, resource type), in the request thread and in its transaction context. An exception in a callback propagates to the request [inferred: no try/except around the call].

Project deletion itself also cleans its assignments, credentials, trusts and limits, directly and without an event (keystone/resource/core.py:521-539).

Operational consequences:

• Deleting a domain or a large project is one long request that does all the cleanup. There is no queue: a timeout on the HTTP proxy side can interrupt the response while the work goes on, or leave it half done if the WSGI worker is killed [inferred].
• Revocation events are written in the request, so a token is invalid on every node as soon as the commit is done, within the token cache: each node keeps its tokens cache, unless the cache is shared and invalidated by region (see 03 § 4).

2. Notifications sent (to the outside)

Every create, update, delete or disable operation, every role assignment and every authentication (success excluded by default) publishes an identity.* event (see interactions § 5). It is fire-and-forget: a bus failure is logged and does not fail the request (keystone/notifications.py:582-636). Consumers outside Keystone include Ceilometer, Designate and the audit middleware [inferred: outside this repository].

3. Work at API process startup

Unlike Placement, Keystone writes nothing to the database at startup: no standard data is copied. Default roles, the admin user and the catalog come from keystone-manage bootstrap.

4. Operator commands (keystone-manage, keystone/cmd/cli.py)

What nobody purges automatically:

• expired trusts: trust_flush is needed;
• users inactive beyond [security_compliance]/disable_user_account_days_inactive: no task disables them. The enabled property is computed on read from last_active_at, or created_at if never active (keystone/identity/backends/sql_model.py:217-238), so such a user simply reads as disabled. Accounts with the ignore_user_inactivity option are exempt;
• revocation events: purged at each new revocation (see 03 § 3).

Source: reverse-spec-keystone/05-async-processing_stable-2026.2.md. The _rewrite/ and _inventory/ files are not published on the site.