Merge branch 'main' into feat/one-year-certificate-scs-0004

Signed-off-by: Marvin Frommhold <depressiveRobot@users.noreply.github.com>

Author: depressiveRobot

.zuul.d/secure.yaml

@@ -457,3 +457,96 @@
           pmn42PxOsmXVXHYsRNlgHGQzrvTPSnC4zfQYr2fG3hh81+vbfQawpQ4eeyKNdcqTjubhF
           /Lt6+yMJMB7AUVpwXkI7cMmf+QXbDnnE6eX0UBosTM6MjdA/zhkjJ6PK9E0FnngW4HRDZ
           eAiVSQiN4CSa9bylrwLhvarAEhR+5avRv4yTurgAYe6I6Gh05pBPCgTXmCNxPU=
+      scaleup_api_server: !encrypted/pkcs1-oaep
+        - H4F/zi6Lp/CbkHPG4tEzhFVRprH6uxVqoOirUZNKOg1pDI33ilXG4K99O/CH9dCqbFiV0
+          GnI4p8b0Csho6S63DEuMikjXBLfNWsd2BncQ4gu4bGhHef3bkCjEmybk3AmEyA789vRNS
+          o6xjZUAJB0ZEQeuWudSo28fJDGxGOVcVW0Sda+OSk0K3qftucg047KZdJ5bWZmHTPvOha
+          4R2+nsbnecAQJtMDWVERPYTD62pF4CAHD6XVf9mUuZNnLYibl5uQz0t6JZQANu83pFYDZ
+          C5Z7T4/UJxKlyBpL2XtF/cHuKavEP41cheD/ihG1EI9Yf3InFCRllbIGzMj8fq8d4bZKV
+          tC1iui2RrL3s38GrOyyGE7odyHlvl08zbrJTkWb5UcI20jPxBCxHAvlqIWjl+9Ite7OuM
+          nXq62IgXUqVWWgrGWRINyJlvRgcQPxCVq7ty3OMB1Vp4R0ldDRWWR9+PozmK86fRXYatE
+          cgRi579JMBvKjbP9hKcZOkb12PVyZTTOLmyepfMAqZVpBULtpNza26ysCl5Wu14+0o3bh
+          d6Kst5qeZz4P8QjJe2UQU67B8JcX88zbpNYM1uxLhtXlAk0/8Hd8KWm+KiU/NfNzgr7jd
+          jxRhMEdHUuMOKHaSR/hwJs7kWp1RVR6l7L+SXv02VrYgzysGCiGqXhV9FwrEQw=
+      scaleup_ca_data: !encrypted/pkcs1-oaep
+        - CDar1TQ3Q4HrBXIDwVFvzL0FgPFy7r3K4joQmKnIbCJZ9pmbtrGGSD7xOsJnfIm5e89ZK
+          g4D654VfvK4+upredcVP5MRkfXY/SKfh9glR9okQMpsRS0T5l3kS+RpZOLPCuvvit3i1h
+          CJQ/yAO2RoXPdM/Y9SRcXDg+gliC6EdbDrz2OvamW2wpiqY3/l5JmwfTftbpTL0PpBLHo
+          NEolqEUlTr8jMB7Ai82DDmHmq3+68cK5JkelobO1TGx8t7gYErldF3Z06cLv1alRZQ/8Y
+          7CUFLQ/bmMr8GN1AIHJTApWZZbEiSdri997diJGYqcFVT7viXczAYp+pPS3Toobl0TIYh
+          5d0Y8V1eCNcudcyZoHwHNvBi7Pi3k3H0FW+jGe05sViA/gX37xf1Rqj9ekUyre+r3tcJa
+          UDNFspGxZ2bbl3yL6WJ/v+IJgdyyV/onLyt3eVRph8JbhOnRuRpt5+nr313K0vA46B9aX
+          15ERSqQ8DPXHhuRKcYOhtCy+5zjGKbOCwF6/xGaxXJ2YrU4RtlOBfLYNqTb9bNnZABsM1
+          ODt+BoZKzf7ZuEqbauUF3TgY7F+38MovXCNUDJKfrxG/or54ohlCQywKB6GQxBns1t+j0
+          UIyfwaZvGBaDJf+HrsMUemuud2a9JUUfsin5/1l8R7KOlZExlRpWptJvRssMsU=
+        - JAFfTl9ZgztYDCRjbD8hvcM12o+rf6TtFz/rAsaU3C+b5hzTVxCbbjD3t3JwO7xtEzloT
+          6jls48eHDSZAMqNBwKlxkt3smKQmc5cV8Csbhwgo1gmByd87hhYT6wTxFaJrRnznoQF53
+          BKE4dpiiNtipUlje8sXSL5qExytreewBTw5TZhVJ7u05wxGp6Zp62zTWfC/D+opDA6MY7
+          bufF8M4+zjNhTcJFzzmJc8Fkvs8rOamKY9qFYQIK/ae7J3GgJO6Ij75GtIZAuHUk7q/Iy
+          JHVssXxEp1Im3I6DgagInewOpjJpTPuC/FFu1jxdnLFyXgSGbIA5QIJvHH68gu9ZLhGYp
+          srfCl7ewxRAoJ2l9j7Ki9IrpDWQoRe8Exj9OdFdu8pPjl+HC9S16F/kMe+hr/A76PulEM
+          /aj+/87hKjHTlA8cVzGMELhxpnZjm5aA/2jhFKOpVmR438ivo0gALbQM8rLmlUADv03dr
+          b207Ra+Ek5R/11Rrujpr/kDufMUrg5cc5bHU2HCUsWhfjwCMKokNgeeF/qX7Z+qBw5p56
+          NW19E34eKXilZd0KPTXBkBNkXdBXAAXEXzha5xeB37uzA0iixlHK7Bc/F5ybECJqw9hfo
+          0zbzhrFG51A5DdwypFPwvGcQkoLCVWE2o5ioOkM8nvk2cuKqmQi5XgIxgmZdpo=
+        - izQi08x4r//MQPS1jRUSNgk/tYYe8e88/V1c5LbDq0cGFvNJAZkPBuF0Vc6IQkTPtml1U
+          ZE3Es/5WwgQ2gFRSU0x/z07BbJ3qPvzQkXorndncsqR3d/94CqT1+ZjdD3JZONbjYmHPq
+          QNZkspoW87uLCdj8Shw4cisUlIyyT6kNFK9VnbX282k4spJxFvZcgJSSpvoEUKwa3RMoA
+          R8KsqwlbWTuX9ZiZ33fIO73wLYDiqIeaZTK5xum4RlzSZ+0R01veKynjoulQTEJ5S7To1
+          hSwgFkjZxaea6LVHchrI+3eVEQsotQC+KTVvp8DKiUpaPFQeeJxiFfle505dZ6SWqijA0
+          L60UzbqIEk5Z7ZY7gjuOsxq0DHOpCRjTh+UcW3LhTkCdIBymcwEEF94A1/lDobUQNBxSA
+          cA63eQwAkIfWSCYWSN7PJAvUl/C6oT/hVdV53bnNHWyqssBAStdnI4AaclENp5L7qYhNQ
+          XDnRlt19fk9Po6nOyhpAvpI/74cu/lgjedobBwyMg+r4lS1rONAP/C9TrARlV5wjry07C
+          vV6F6O/d/Yj/5pvKV1uuqBwqzsy2UiyT+XV8CkCqhmfmhe2yjdVFch5rPCra2SNaLWe5N
+          wc6QghIMbbOUd4qu87Fir55h/+YdgeYOkfIeHt8dEacd9hG+poBcn1WsuS8f8E=
+        - PCMqg50GTZDWh2WUtS0n7RocyphbM8Q/7kqepmf+Ar7jyzik50rng1GFm2aRy4Cv9JkJX
+          6Tel6PpRVgGCsKBCSTnFJ+VfBxbd1uJ5vM/AY2pnvbXwEuxPXKLmR+UupY4HQXmwEq6MI
+          7D0JH921pwg35hNHV67Y0pMlC2bycmOtCvabgZ+I1a2oSK379/Yu2di8owM/1jnkhhee8
+          5vuftvc77j/78I8PBQ0SXoy6cGNIm8pWw98H20jbmOrB01aONn9z/DxLmuz5BCUoNjTrW
+          QJUj2VGbw1KZgjsLaiCjLfygSuZXsKZRln9yrpRZPWkymc6Vx7gc2HukR2mfv3jX6IUOg
+          tTJ/TdKqvlyzRMU92O1DouP8d+CBrCo/M41cKhqWTlL7ECRdKVimcsK2FQE2JFYocAIZ2
+          qIQXlWgwFV9LOBtRqseON9h2qqtqgDI+y55i5CkYtrHCBd70ufoCwuFr1h1utwowS1nE6
+          ZlxDhVctZ4kHgFip0KpPDxQh55rVZi6b/58A62ZNH/TpwxOMIkfo+83/Wn3se+28xf29B
+          CMxjfxUOO/KiCX6IZi/iBEPIg+AxrdReuoGaEoGZHokp3gnT8VZsRu9b4JGIaELuaLFYk
+          5PZh3WpcbXcFWR0dhLlfb03FzGW15QIBnn2W8rlRM77qo6GeJ8mI8RWS7gwhlw=
+        - l1bR11ctdhUGQY05Jh0qssC4wPSE36d0EjTCZVzDb4ViQBl2mGKz7qlzq4bAMb9ypiyOw
+          KzhI1Ara8bUR3/hti8OfHVDuAzsKeDXMq/5wxxYKLqGf8Lapf0xrOp8me3yaxuIVz+/Q4
+          YSIRMtR6+Rp4h68G5aHyXtbbpdSTbur+KxtHoyLDzxvuegy97Y/g1hC6MPnLiwwSsRX4j
+          iPZVQGx6deSSEmx4PjmguERPhMhH+0vpikCW4+GhJqOcFIdyvvH76pTD8fHAkiD+vdSXV
+          LytqolfR7QbM0UFTgaqpTl1EMDxfm2cDAYjhi/MOiXSFVMlSWgo4KvjH0bu47VwGgMrAO
+          w5mrqimbUTyNpJEYkdGksFpFtSRA0QIEKT7TKzybgYF7grMPW/MIrkgq0TddECmgk+iZ3
+          rl+XzxnQISMkoiVM7rboYy3pkrYru/CTFdve9YWsr2v/PX3FHqzfbZYEybqmce0sWAUMC
+          4uZOi7nzUZi35JreEJQjt5o/vIXp6fro6J0OKu2Lk7Y7kQrjWWJvTzInV5AtPjotFAvdC
+          tv1AhnfI12EXcT0pCWovwtJpyvE7ULtnC6mb4iB6hAPlHy4BiJTJa6KT8EwGc4zyXbn9x
+          O0j7veLRc1dht1Wt+eFa+aGjn2j4LzBiEtG/YXxjjeLrsp4NB8M8dtz7Go9dq4=
+      scaleup_token: !encrypted/pkcs1-oaep
+        - Zddiaw8Jx0Hqlx9I5vIBMeDAORMM5we9vTYa1p1n4nJM7Uxu5C3yLPjY0ubI1oFNkEWKz
+          2/V/ySJ3X1A1PV38G6C2EeZEq7dnuUuWNe6U/bOBvtbnyBQFMIXVVKsl0+gVvJQonF8r1
+          0vjFFTKgAcnqK5gp5rzDrD4odMs1H5sZ8ySLkXvwQeQOMHiF9bZChWFMXazTBLAarn9ZX
+          gznZsm7BZgmZIu2oBBww5ZPGpOrMM0OkquGQljiuiyeA0sED7V2RhQgm/hzaKc2CVAi5S
+          8nrc8lHZFHgqtzwk1bCVWqKM8p0zm1mRcUHBNxYRn7G0fdilQ9TIhG5W9xBTaP9AEjiPY
+          fwjqI0w86yWee9lzHm0fhh3EvhR7fhdir7rQDzXRXl2c6nU4vu5VDo8hM384Hg8wMGHWA
+          99lIEpJ03q3eu8XtbmLB4kGLu9iCWi3H3c9LEyHlfi1lMcrGpHWYNCxH7T2Sq4uVUDThF
+          eRbACDjg62MlgnQY1YVXKN+RyPFlhiw+gpOJgBRy9m/jJsMYsgkPE9UYAysTDR8S8GuWi
+          1ukg16qoDvlXH2ts0XM0UOMy4nrSCjq4Yj8hOi6Cno0jFWtV+1wKvHDNiBek7k38ixh1q
+          NrXhQWmgpHxFE6csPz8wzpaYxtlcmNM9QqZm1jdHO39cb53JZ+YFFV25kFEjB4=
+        - pekcvbpmLrxjtsqxk5deFM2vC9oSt7azBn3U5XUG40vNLg7tzQbU3SHgHvIOFpqjyGqhW
+          UxdyoMxwpVtcRokryaGGsRkaCB4yQf3e38E8uFMdpffTdTxVOATt+FEoTKea4tpYWIoyk
+          udABOASbQ4EiqUV1je28+xEONt6MtD3PkQ+8BtmDOC1G+IBCHTnMLz3UlH2d2lMCyDiOC
+          TiKuGc5bDzOWyQtuqmaMm3+gZkHsCd0CI+jeYmhVqwpdFUIbYUNNjv/xWagfhVvFcdAed
+          IB0DuWKChaKE4RhzxLeHPZwFN5wXp5RyplhmKEp7dLj3pbWwWiGBvH7G4zJVXKiH0eJT3
+          G0rU+Kt1Dh80LtRoJsPhzHybndbVbprk2Xi6RwpT0U8mR8KiHvfgedNAqAebJCbWdb6vC
+          RVKu67c6Q83uzLjgyebNQ+ZATfQNRk4E0JWU6N0/464mAxE/HDiUf8tuN5bA/ns6BlaCn
+          P2aJZl/hMvLHY+h6eyYzMcLOuMJy/1kRW5L/VmS1H5wmB73BjqPT9wJ7LhJ1Cvm5JO3UV
+          loIuZUX6COGXPovsDrMoAVMkFKmEyRhzkD/+B1Z8ZhQwKVgwMKCZaWrqiYL0IpkZETxDJ
+          J6AdjeDcDvkrRsHGh5ZiFGWoGbSb2bq9ZfkVuk2Yf5XecWnU3TGUzBk283Wv54=
+        - tcY9Nn1/N/+WoJSXduloZ9b4OL5nPh5UfXZWtnz6BfV6hfdqt2AwsBK2D89QSVYZt21LS
+          mPWO6+u2brMbOOBmP+I5OTejkoWZPozidbkDr8+QQ2ELw7k2oI5S0jx6lPKJQZUvN5pKS
+          vIv79bLdrdMWHc1z9F0POA1UTNzvfDLvnkO31OXYlH0dO8Jr+d0DMeTr+POFNm+QYAJ20
+          96MFwKgBoTlJbPskelg0Q0tQfTMI0PA7xl8PfojcvIE/dlzLvg3f5J0c0jOx8bQRguq5N
+          /jSUn9lmk0xl9c6/xrRrCj4q21p0o4KfDYUSIU7XHRN1yTLTjsI3sQCiivQIbYmmOi3mi
+          md6q/YNkwRmwGDuxB4l3Zq9PEN4UjLEUVeFLubryrw2m1bU5MlAIQqfAPIYcqK76CDoZS
+          teb56lXqOj3+NHPim/+nHfHuU+8qc//JdKLkklGbMMgqodKq+7AZrC3aPZl5ddp1yhKbj
+          E5livQmER4Tpzd4f566cFOqTB03g8aC77I+w4rlrCK/wVElQn5cVyWCcl3k4sSUbStS71
+          lEzcKtyRvZUM1NIvFNXk6+frB9o+lY2/gxz9DtARZWQREuF38DHKcHvZ201hKUMtyILAR
+          KNQUxVOw5pdkDRSuPV7IRrKWyqDRwWEKv5G/ReS03ldBw4nhJ27is4VSgq61EM=

CODEOWNERS

@@ -3,9 +3,3 @@
 /compliance-monitor/   @mbuechse @depressiveRobot
 
 /Tests/                @mbuechse @depressiveRobot
-
-# Members of the Project Board are the owners of the Community
-# Governance - see: 
-# https://docs.scs.community/community/governance/project-board
-/Community-Governance/ @SovereignCloudStack/project-board
-

Community-Governance/2024-12-project-board-nominees.md

@@ -119,7 +119,7 @@ three weeks in advance of happening and run for a week.
 
 Every person who is part of the Sovereign Cloud Stack GitHub organization can be
 nominated for the board. Likewise, one can nominate oneself.
-The nomination is done by adding the person with the required data to the file corresponding to the term in the "Community-Governance" folder in the [Standards](https://github.com/sovereignCloudStack/standards/) repository. Obviously, the person, that is to be nominated, should be asked before being added to the file.
+The nomination is done by adding the person with the required data to the file corresponding to the term in the [docs](https://github.com/SovereignCloudStack/docs/tree/main/community/governance) repository. Obviously, the person in question should be asked before being added to the file.
 
 ### Eligible for voting
 

Community-Governance/2025-01-project-board.md

@@ -39,7 +39,7 @@ As to remain backward compatibility with version 1 of this standard, the suffix
 
 ### General expectations
 
-The general expectation for certification is to provide proof of experience in setting up, operating and supporting SCS-compliant environments.
+The general expectation for certification is to provide proof of experience in setting up, operating and supporting SCS-compliant environments. This experience MUST remain in place for as long as the certification is valid.
 
 SCS is an open source community project with the goal of enabling digital sovereignty. As such, the commitment and support of this mission SHOULD be recognized and promoted beyond technical competence.
 

Community-Governance/2025-12-project-board-nominees.md

@@ -60,6 +60,7 @@ require an additional field:
   | `os_purpose` value | Intention                                                 |
   |--------------------|-----------------------------------------------------------|
   | `generic`          | A general purpose image, (mostly) vanilla from upstream   |
+  | `oldgeneric`       | A general purpose image, replaced by a newer one          |
   | `minimal`          | A much more barebones general purpose image               |
   | `k8snode`          | Node image built for k8s with CRI and kubelet             |
   | `gpu`              | Image with GPU drivers e.g. for HPC or AI                 |
@@ -70,8 +71,8 @@ require an additional field:
   of doubt. Talk to the SCS standardization bodies if you'd like to see this list extended which is
   likely the case if you fall back to `custom`.
 
-  The usage of standardized `os_distro`, `os_version`, `architecture`, and `os_purpose` help cloud users to create
-  automation that works across clouds without requiring image names to be standardized.
+  The usage of standardized `os_distro`, `os_version`, `architecture`, and `os_purpose` helps cloud users
+  to create automation that works across clouds without requiring image names to be standardized.
 
   _Uniqueness requirement_: For every assignment of values for `os_distro`, `os_version`,
   and `architecture`, there MUST be at most one public (`visibility=public`),
@@ -110,7 +111,9 @@ level).
 Technically, the thus updated image is a new image and will thus carry a new UUID.
 It is recommended that the old image gets renamed (e.g. build date or patch level attached)
 and hidden (`os_hidden=True`), but remains accessible via its (unchanged) UUID for some
-time.
+time. If an old image with `os_purpose` setting of `generic` is kept that way, we recommend
+to change `os_purpose` to `oldgeneric`. If it is not hidden, this is mandatory to meet
+the uniqueness requirement.
 
 The update handling by the provider is described via the properties `replace_frequency`,
 `uuid_validity`, `provided_until`, and `hotfix_hours`.
@@ -271,4 +274,4 @@ A boolean property that is not present is considered to be `false`.
   - Reference OpenStack image spec for standard values of `os_distro`, `architecture` and `hypervisor_type`.
   - Recommendation on `os_version` to be a version number (if such a value exists).
   - Recommended field `os_purpose`.
-- Version 2.0 (this one) makes the field `os_purpose` mandatory.
+- Version 2.0 makes the field `os_purpose` mandatory and adds a new value `oldgeneric`.

Community-Governance/2026-01-project-board.md

@@ -0,0 +1,71 @@
+---
+title: Mandatory and Supported IaaS Services
+type: Standard
+status: Draft
+track: IaaS
+---
+
+## Introduction
+
+To be SCS-compliant a Cloud Service Provider (CSP) has to fulfill all SCS standards.
+Some of those standards are broad and consider all APIs of all services on the IaaS-Layer like the consideration of a [role standard](https://github.com/SovereignCloudStack/issues/issues/396).
+There exist many services on that layer and for a first step they need to be limited to have a clear scope for the standards and the Cloud Service Providers following them.
+For this purpose, this standard will establish lists for mandatory services whose APIs have to be present in a SCS cloud as well as supported services, which APIs are considered by some standards and may even be tested for their integration but are optional in a sense that their omission will not violate SCS conformance.
+
+## Motivation
+
+There are many OpenStack APIs and their corresponding services that can be deployed on the IaaS level.
+These services have differences in the quality of their implementation and liveness and some of them may be easily omitted when creating an IaaS deployment.
+To fulfill all SCS-provided standards only a subset of these APIs are required.
+Some more but not all remaining OpenStack APIs are also supported additionally by the SCS project and may be part of its reference implementation.
+This results in different levels of support for specific services.
+This document will give readers insight about how the SCS classifies the OpenStack APIs accordingly.
+If a cloud provides all mandatory and any number of supported OpenStack APIs, it can be tested for SCS-compliance.
+Any unsupported APIs will not be tested.
+
+## Mandatory IaaS APIs
+
+The following IaaS APIs MUST be present in SCS-compliant IaaS deployments and could be implemented with the corresponding OpenStack services.
+The endpoints of services MUST be findable through the `catalog list` of the identity API[^1].
+
+| Mandatory API service type | corresponding OpenStack Service | description |
+|-----|-----|-----|
+| **block-storage** | Cinder | Block Storage service |
+| **compute** | Nova | Compute service |
+| **identity** | Keystone | Identity service |
+| **image** | Glance | Image service |
+| **load-balancer** | Octavia | Load-balancer service |
+| **network** | Neutron | Networking service |
+| **object-store-s3**[^2] | N/A | s3 compatible Object Storage service |
+
+Aliases for these service types are only permitted where defined by the [OpenStack Service Type Authority](https://specs.openstack.org/openstack/service-types-authority/#aliases-optional).
+Catalog entries SHOULD use the canonical service type, not aliases.
+
+## Supported IaaS APIs
+
+The following IaaS APIs MAY be present in SCS-compliant IaaS deployment, e.g. implemented through the corresponding OpenStack services, and are considered in the SCS standards.
+
+| Supported API service type | corresponding OpenStack Service | description |
+|-----|-----|-----|
+| **baremetal** | Ironic | Bare Metal provisioning service |
+| **rating** | CloudKitty | Rating/Billing service |
+| **dns** | Designate | DNS service |
+| **instance-ha** | Masakari | Instances High Availability service |
+| **key-manager** | Barbican | Key Manager service |
+| **object-store** | Swift | Object Store with different possible backends |
+| **orchestration** | Heat | Orchestration service |
+| **shared-file-system** | Manila | Shared File Systems service |
+| **time-series-database**[^2] | Gnocchi | Time Series Database service |
+
+## Unsupported IaaS APIs
+
+All other OpenStack services, whose APIs are not mentioned in the mandatory or supported lists will not be tested for their compatibility and conformance in SCS clouds by the SCS community.
+Those services MAY be integrated into IaaS deployments by a Cloud Service Provider on their own responsibility but SCS will not assume they are present and potential issues that occur during deployment or usage have to be handled by the CSP on their own accord.
+The SCS standard offers no guarantees for compatibility or reliability of services categorized as unsupported.
+
+## Related Documents
+
+[The OpenStack Services](https://www.openstack.org/software/)
+
+[^1]: [Integrate into the service catalog of Keystone](https://docs.openstack.org/keystone/latest/contributor/service-catalog.html)
+[^2]: These service types have not been assigned by the OpenStack Service Type Authority