feat: add keystoneauth_kubeservicetoken authentication plugin

.github/workflows/containers-openstack.yaml

@@ -36,6 +36,7 @@ jobs:
           - cinder
           - glance
           - horizon
+          - neutron
           - octavia
           - openstack-client
           - skyline
@@ -44,51 +45,5 @@ jobs:
     with:
       container_name: ${{ matrix.project }}
       dockerfile_path: containers/${{ matrix.project }}/Dockerfile
-      build_args: OPENSTACK_VERSION=2025.2
-      latest_name: "2025.2"
-
-  placement:
-    uses: ./.github/workflows/build-container-reuse.yaml
-    secrets: inherit
-    with:
-      container_name: placement
-      dockerfile_path: containers/placement/Dockerfile
-      build_args: OPENSTACK_VERSION=2026.1
-      latest_name: "2026.1"
-
-  nova:
-    uses: ./.github/workflows/build-container-reuse.yaml
-    secrets: inherit
-    with:
-      container_name: nova
-      dockerfile_path: containers/nova/Dockerfile
-      build_args: OPENSTACK_VERSION=2026.1
-      latest_name: "2026.1"
-
-  neutron:
-    uses: ./.github/workflows/build-container-reuse.yaml
-    secrets: inherit
-    with:
-      container_name: neutron
-      dockerfile_path: containers/neutron/Dockerfile
-      build_args: OPENSTACK_VERSION=2026.1
-      latest_name: "2026.1"
-
-  ironic:
-    uses: ./.github/workflows/build-container-reuse.yaml
-    secrets: inherit
-    with:
-      container_name: ironic
-      dockerfile_path: containers/ironic/Dockerfile
-      build_args: OPENSTACK_VERSION=2026.1
-      latest_name: "2026.1"
-      target: final
-
-  keystone:
-    uses: ./.github/workflows/build-container-reuse.yaml
-    secrets: inherit
-    with:
-      container_name: keystone
-      dockerfile_path: containers/keystone/Dockerfile
       build_args: OPENSTACK_VERSION=2026.1
       latest_name: "2026.1"

ansible/roles/keystone_bootstrap/defaults/main.yml

@@ -68,3 +68,32 @@ keystone_bootstrap_groups:
     #     role: member
     #   - project: shared-services
     #     role: reader
+
+# domain in which k8s service account groups are created
+keystone_bootstrap_k8s_group_domain: service
+
+# k8s identity providers; override with your cluster issuers
+keystone_k8s_identity:
+  providers: []
+
+# k8s service account groups and their project role assignments
+# Each group can have project_roles with an optional domain to scope the project lookup
+keystone_bootstrap_k8s_groups:
+  - name: k8s-serviceaccounts
+    desc: 'Kubernetes Service Accounts'
+    project_roles:
+      - project: service
+        domain: service
+        role: admin
+      - project: service
+        domain: service
+        role: service
+      - project: baremetal
+        domain: infra
+        role: admin
+      - project: baremetal
+        domain: infra
+        role: service
+      - project: admin
+        domain: Default
+        role: admin

ansible/roles/keystone_bootstrap/tasks/k8s.yml

@@ -0,0 +1,54 @@
+---
+# Copyright (c) 2026 Rackspace Technology, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+- name: Create k8s mapping
+  openstack.cloud.federation_mapping:
+    name: k8s-mapping
+    rules:
+      - local:
+          - user:
+              name: '{0}'
+            group:
+              domain:
+                name: service
+              name: k8s-serviceaccounts
+        remote:
+          - type: HTTP_OIDC_SUB
+
+- name: Create k8s identity providers
+  openstack.cloud.federation_idp:
+    name: "{{ item.name }}"
+    is_enabled: true
+    remote_ids:
+      - "{{ item.issuer }}"
+  loop: "{{ keystone_k8s_identity.providers }}"
+
+- name: Create k8s openid protocols
+  openstack.cloud.keystone_federation_protocol:
+    name: openid
+    idp: "{{ item.name }}"
+    mapping: k8s-mapping
+  loop: "{{ keystone_k8s_identity.providers }}"
+
+- name: Get k8s group domain info
+  openstack.cloud.identity_domain_info:
+    name: "{{ keystone_bootstrap_k8s_group_domain }}"
+  register: _k8s_group_domain
+
+- name: Create k8s service account group mappings
+  ansible.builtin.include_tasks: k8s_group.yml
+  loop: "{{ keystone_bootstrap_k8s_groups }}"
+  loop_control:
+    loop_var: group_item

ansible/roles/keystone_bootstrap/tasks/k8s_group.yml

@@ -0,0 +1,34 @@
+---
+# Copyright (c) 2026 Rackspace Technology, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+- name: Create k8s group
+  openstack.cloud.identity_group:
+    name: "{{ group_item.name }}"
+    domain_id: "{{ _k8s_group_domain.domains[0].id }}"
+    description: "{{ group_item.desc }}"
+    state: present
+  register: _k8s_group
+
+- name: Assign role to k8s group for project
+  openstack.cloud.role_assignment:
+    group: "{{ _k8s_group.group.id }}"
+    project: "{{ role_item.project }}"
+    project_domain: "{{ role_item.domain | default(omit) }}"
+    role: "{{ role_item.role }}"
+    state: present
+  loop: "{{ group_item.project_roles | default([]) }}"
+  loop_control:
+    loop_var: role_item
+  when: dont_set_roles is not defined

ansible/roles/keystone_bootstrap/tasks/main.yml

@@ -10,5 +10,8 @@
 - name: Define SSO
   ansible.builtin.include_tasks: sso.yml
 
+- name: Define k8s service account groups
+  ansible.builtin.include_tasks: k8s.yml
+
 - name: Define misc keystone
   ansible.builtin.include_tasks: misc.yml

charts/argocd-understack/templates/application-oidc-rbac.yaml

@@ -0,0 +1,30 @@
+{{- if or (eq (include "understack.isEnabled" (list $.Values.global "oidc_rbac")) "true") (eq (include "understack.isEnabled" (list $.Values.site "oidc_rbac")) "true") }}
+---
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: {{ printf "%s-%s" $.Release.Name "oidc-rbac" }}
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/compare-options: ServerSideDiff=true,IncludeMutationWebhook=true
+{{- include "understack.appLabelsBlock" $ | nindent 2 }}
+spec:
+  destination:
+    namespace: kube-system
+    server: {{ $.Values.cluster_server }}
+  project: understack-infra
+  sources:
+  - path: components/oidc-rbac
+    ref: understack
+    repoURL: {{ include "understack.understack_url" $ }}
+    targetRevision: {{ include "understack.understack_ref" $ }}
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+    - ServerSideApply=true
+    - RespectIgnoreDifferences=true
+    - ApplyOutOfSyncOnly=true
+{{- end }}

charts/argocd-understack/values.yaml

@@ -146,7 +146,7 @@
     enabled: false
     # -- config file to use for Nautobot scoped to either $understack or $deploy repo
     # @default -- $understack/components/nautobot/nautobot_config.py
-    nautobot_config: '$understack/components/nautobot/nautobot_config.py'
+    nautobot_config: "$understack/components/nautobot/nautobot_config.py"
 
   # -- Nautobot API token generation jobs
   nautobot_api_tokens:
@@ -169,6 +169,12 @@
     # @default -- 0.0.3
     chartVersion: 0.0.3
 
+  # -- OIDC RBAC (ClusterRoleBindings for OIDC service account issuer discovery)
+  oidc_rbac:
+    # -- Enable/disable deploying OIDC RBAC
+    # @default -- false
+    enabled: false
+
   # -- OpenEBS
   openebs:
     # -- Enable/disable deploying OpenEBS
@@ -229,7 +235,6 @@
     # @default -- false
     enabled: false
 
-
 # -- This block is for setting up the UnderStack site specific ArgoCD Applications
 site:
   # -- Enable/disable deploying the site specific applications
@@ -341,9 +346,8 @@
     wave: 1
     # -- Chart version for Keystone
     # renovate: datasource=helm depName=keystone registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
-    chartVersion: 2026.1.5+a2a343968
+    chartVersion: 2026.1.10+a659ab8a2 # -- Glance (Image Service)
 
-  # -- Glance (Image Service)
   glance:
     # -- Enable/disable deploying Glance
     # @default -- false
@@ -353,7 +357,7 @@
     wave: 2
     # -- Chart version for Glance
     # renovate: datasource=helm depName=glance registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
-    chartVersion: 2026.1.5+bad57716b
+    chartVersion: 2026.1.11+a659ab8a2
 
   # -- Cinder (Block Storage Service)
   cinder:
@@ -365,8 +369,7 @@
     wave: 2
     # -- Chart version for Cinder
     # renovate: datasource=helm depName=cinder registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
-    chartVersion: 2025.1.3+abd55b4a7
-
+    chartVersion: 2026.1.14+a659ab8a2
   # -- Ironic (Bare Metal Service)
   ironic:
     # -- Enable/disable deploying Ironic
@@ -377,8 +380,7 @@
     wave: 2
     # -- Chart version for Ironic
     # renovate: datasource=helm depName=ironic registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
-    chartVersion: 2025.2.23+ea0d1ecda
-
+    chartVersion: 2026.1.10+a659ab8a2
   # -- Neutron (Networking Service)
   neutron:
     # -- Enable/disable deploying Neutron
@@ -389,7 +391,7 @@
     wave: 2
     # -- Chart version for Neutron
     # renovate: datasource=helm depName=neutron registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
-    chartVersion: 2026.1.8+872fd69e7
+    chartVersion: 2026.1.15+a659ab8a2
 
   # -- Placement (Placement Service)
   placement:
@@ -401,7 +403,7 @@
     wave: 2
     # -- Chart version for Placement
     # renovate: datasource=helm depName=placement registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
-    chartVersion: 2026.1.4+a2a343968
+    chartVersion: 2026.1.7+a659ab8a2
 
   # -- Nova (Compute Service)
   nova:
@@ -413,7 +415,7 @@
     wave: 3
     # -- Chart version for Nova
     # renovate: datasource=helm depName=nova registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
-    chartVersion: 2026.1.8+a2a343968
+    chartVersion: 2026.1.13+a659ab8a2
 
   # -- Octavia (Load Balancer Service)
   octavia:
@@ -425,7 +427,7 @@
     wave: 3
     # -- Chart version for Octavia
     # renovate: datasource=helm depName=octavia registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
-    chartVersion: 2025.2.8+01c93d867
+    chartVersion: 2026.1.7+a659ab8a2
 
   # -- Horizon (Dashboard)
   horizon:
@@ -437,7 +439,7 @@
     wave: 4
     # -- Chart version for Horizon
     # renovate: datasource=helm depName=horizon registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
-    chartVersion: 2025.2.4+01c93d867
+    chartVersion: 2026.1.8+a659ab8a2
 
   # -- Skyline (Dashboard)
   skyline:
@@ -449,7 +451,7 @@
     wave: 4
     # -- Chart version for Skyline
     # renovate: datasource=helm depName=skyline registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
-    chartVersion: 2025.2.5+01c93d867
+    chartVersion: 2026.1.3+a659ab8a2
 
   # -- Open vSwitch (Networking)
   openvswitch:
@@ -508,6 +510,12 @@
     # @default -- false
     enabled: false
 
+  # -- OIDC RBAC (ClusterRoleBindings for OIDC service account issuer discovery)
+  oidc_rbac:
+    # -- Enable/disable deploying OIDC RBAC
+    # @default -- false
+    enabled: false
+
   # -- OpenEBS
   openebs:
     # -- Enable/disable deploying OpenEBS
@@ -575,7 +583,7 @@
     enabled: false
     # -- config file to use for Nautobot scoped to either $understack or $deploy repo
     # @default -- $understack/components/nautobot/nautobot_config.py
-    nautobot_config: '$understack/components/nautobot/nautobot_config.py'
+    nautobot_config: "$understack/components/nautobot/nautobot_config.py"
 
   # -- Ironic hardware exporter for bare-metal hardware metrics via RabbitMQ
   ironic_hardware_exporter: