feat(domain-config): Add configuration API - #1201
Merged
Merged
Conversation
Implement issue #954 phase 4 (#959): the REST surface for per-domain identity/LDAP configuration under /v3/domains/{domain_id}/config. Handlers cover the whole configuration, a single group, and a single option (show / set / merge / delete), plus the read-only default views /config/default, /config/{group}/default and /config/{group}/{option}/default. DomainConfigApi is the provider trait behind the handlers; DomainConfigService passes straight through to the "sql" backend, since python-keystone's config API always targets the database regardless of domain_configurations_from_database and the "fs" driver is operator managed. api-types gains the DomainConfigRequest / DomainConfigResponse envelope models and their conversions. Read responses serialize the core DomainConfig, whose Serialize already drops sensitive options, so ldap.password and friends are never echoed; policy input is masked the same way and option-level input never carries the value. OPA policy files for create / show / update / delete / get_default: admin, is_admin, or a manager acting on the target domain; show also admits a system-scoped reader. No identity-driver dispatch and no PUT registration lock yet; both are issue #960. Assisted-By: Claude <noreply@anthropic.com> Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
|
🦢 Load Test Results Goose Attack ReportPlan Overview
Request Metrics
Response Time Metrics
Status Code Metrics
Transaction Metrics
Scenario Metrics
Error Metrics
|
|
🧪 Tempest Identity Compatibility Results (advisory, non-blocking) rust Failed test IDs |
|
Bencher Report| Project | keystone |
| Branch | feat/domain-config-api |
| Testbed | ubuntu-latest |
Click to view all benchmark results
| Benchmark | Latency | Benchmark Result nanoseconds (ns) (Result Δ%) | Upper Boundary nanoseconds (ns) (Limit %) |
|---|---|---|---|
| Command_Serde/apply/remove | 📈 view plot 🚷 view threshold | 89,093.00 ns(-66.80%)Baseline: 268,352.53 ns | 1,350,346.09 ns (6.60%) |
| Command_Serde/apply/set | 📈 view plot 🚷 view threshold | 94,623.00 ns(-78.33%)Baseline: 436,571.30 ns | 3,262,840.58 ns (2.90%) |
| Command_Serde/pack/delete | 📈 view plot 🚷 view threshold | 127.79 ns(+7.91%)Baseline: 118.43 ns | 155.45 ns (82.21%) |
| Command_Serde/pack/delete_index | 📈 view plot 🚷 view threshold | 114.19 ns(+7.99%)Baseline: 105.74 ns | 138.70 ns (82.33%) |
| Command_Serde/pack/set | 📈 view plot 🚷 view threshold | 201.06 ns(+5.90%)Baseline: 189.85 ns | 244.41 ns (82.26%) |
| Command_Serde/pack/set_index | 📈 view plot 🚷 view threshold | 115.07 ns(+8.90%)Baseline: 105.66 ns | 139.30 ns (82.61%) |
| Command_Serde/unpack/delete | 📈 view plot 🚷 view threshold | 224.27 ns(+19.22%)Baseline: 188.11 ns | 268.22 ns (83.61%) |
| Command_Serde/unpack/delete_index | 📈 view plot 🚷 view threshold | 177.85 ns(+13.56%)Baseline: 156.61 ns | 217.48 ns (81.78%) |
| Command_Serde/unpack/set | 📈 view plot 🚷 view threshold | 295.08 ns(+13.02%)Baseline: 261.08 ns | 353.78 ns (83.41%) |
| Command_Serde/unpack/set_index | 📈 view plot 🚷 view threshold | 175.67 ns(+14.02%)Baseline: 154.06 ns | 211.70 ns (82.98%) |
| Payload_encryption/pack/remove_cmd | 📈 view plot 🚷 view threshold | 121.11 ns(+7.06%)Baseline: 113.13 ns | 149.76 ns (80.87%) |
| Payload_encryption/pack/set_cmd | 📈 view plot 🚷 view threshold | 195.29 ns(-1.11%)Baseline: 197.47 ns | 262.54 ns (74.38%) |
| Payload_encryption/unpack/remove_cmd | 📈 view plot 🚷 view threshold | 221.20 ns(+12.29%)Baseline: 196.99 ns | 282.50 ns (78.30%) |
| Payload_encryption/unpack/set_cmd | 📈 view plot 🚷 view threshold | 312.22 ns(+15.04%)Baseline: 271.40 ns | 373.68 ns (83.55%) |
| Raft_1Node_Latency/prefix/1node | 📈 view plot 🚷 view threshold | 4,798,600.00 ns(+56.47%)Baseline: 3,066,708.73 ns | 7,977,292.54 ns (60.15%) |
| Raft_1Node_Latency/read/1node | 📈 view plot 🚷 view threshold | 33,798.00 ns(-9.28%)Baseline: 37,253.94 ns | 51,526.25 ns (65.59%) |
| Raft_1Node_Latency/remove/1node | 📈 view plot 🚷 view threshold | 255,820.00 ns(-78.97%)Baseline: 1,216,530.31 ns | 11,598,037.20 ns (2.21%) |
| Raft_1Node_Latency/write/1node | 📈 view plot 🚷 view threshold | 270,270.00 ns(-72.70%)Baseline: 989,874.69 ns | 7,583,997.06 ns (3.56%) |
| build_snapshot/default | 📈 view plot 🚷 view threshold | 103,500.00 ns(-17.19%)Baseline: 124,988.02 ns | 276,794.62 ns (37.39%) |
| fernet token/project | 📈 view plot 🚷 view threshold | 1,567.10 ns(+9.53%)Baseline: 1,430.74 ns | 1,800.76 ns (87.02%) |
| get_data_keyspace | 📈 view plot 🚷 view threshold | 0.35 ns(+11.34%)Baseline: 0.32 ns | 0.39 ns (90.63%) |
| get_db | 📈 view plot 🚷 view threshold | 0.35 ns(+11.33%)Baseline: 0.32 ns | 0.39 ns (90.77%) |
| get_fernet_token_timestamp/project | 📈 view plot 🚷 view threshold | 149.56 ns(+6.80%)Baseline: 140.03 ns | 179.41 ns (83.36%) |
| get_keyspace | 📈 view plot 🚷 view threshold | 4.74 ns(-18.14%)Baseline: 5.79 ns | 13.46 ns (35.19%) |
Open
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Issue #954 phase 4 (#959): the REST surface for per-domain identity/LDAP
configuration under
/v3/domains/{domain_id}/config.(
show/ set /merge/delete), plus the read-only default views/config/default,/config/{group}/defaultand/config/{group}/{option}/default.DomainConfigApiis the trait behind the handlers;DomainConfigServicepasses straight through to the"sql"backend,since python-keystone's config API always targets the database
regardless of
domain_configurations_from_databaseand the"fs"driver is operator-managed. Mockable via
MockDomainConfigProvider.DomainConfigRequest/DomainConfigResponseenvelopemodels and conversions. Read responses serialize the core
DomainConfig, whoseSerializealready drops sensitive options, soldap.passwordand friends are never echoed; policy input is maskedthe same way and option-level policy input never carries the value.
create/show/update/delete/get_default: admin,is_admin, or a manager acting on the targetdomain;
showalso admits a system-scoped reader.opa test policy/domain_config→ 15/15.Out of scope (issue #960)
No identity-driver dispatch and no PUT registration lock.
Tests
cargo test -p openstack-keystone domain_config— 37 handler tests(each handler: valid auth + positive/negative policy + invalid auth).
cargo test -p openstack-keystone-api-types --features conv,openapi domain_config— 3 conversion tests (masking, envelope shape).cargo fmt --all -- --check,opa test policy/383/383.🤖 Generated with Claude Code