Keystone has always been the trust anchor of an OpenStack deployment — but „trust“ in the classical Keystone architecture often leans heavily on network topology: services inside the perimeter are assumed safe, tokens are validated locally, and a compromised node quietly inherits more authority than it should.
Rebuilding Keystone from scratch in Rust (keystone-rs) forced us to confront that assumption directly. This talk walks through what „zero-trust“ actually means once you stop treating the network as a trust boundary: how service-to-service authentication has to change, what a management API and CLI need to enforce instead of assume, and where a distributed, Raft-based identity backend makes some zero-trust properties easier — and others harder — to achieve.
Rather than a cryptography deep-dive, this is a talk about architectural decisions: which assumptions had to go, what replaced them, what it cost us in complexity, and what we’d tell another project attempting the same rebuild. Expect concrete lessons from an active rewrite, not a whitepaper — including a few places where „proper“ zero-trust ran into the practical limits of an internal-only, sub-100-node cluster.
Target audience: Operators and engineers working with OpenStack or open infrastructure in general — no specialist knowledge of security is assumed.
Key takeaways:
