Keystone has always been the cornerstone of trust in an OpenStack deployment — but „trust“ in the traditional Keystone architecture often relies heavily on network topology: services within the perimeter are assumed to be secure, tokens are validated locally, and a compromised node quietly gains more authority than it should.
Rebuilding Keystone from scratch in Rust (keystone-rs) forced us to confront that assumption head-on. This talk explores what „zero-trust“ actually means once you stop treating the network as a trust boundary: how service-to-service authentication needs to change, what a management API and CLI need to enforce rather than assume, and where a distributed, Raft-based identity backend makes some zero-trust properties easier — and others harder — to achieve.
Rather than a deep dive into cryptography, this talk focuses on architectural decisions: which assumptions had to be discarded, what replaced them, the cost in terms of complexity, and what advice we would give to another project attempting the same rebuild. Expect practical insights from an ongoing rewrite, not a white paper — including a few instances where „proper“ zero-trust ran up against the practical limitations of an internal-only cluster with fewer than 100 nodes.
Target audience: Operators and engineers working with OpenStack or open infrastructure in general — no specialist knowledge of security is assumed.
Key takeaways:
