Release 2.0.0

Release 2.0.0

Merges develop into main for Release 2. FM is a full rewrite: a FastAPI service that speaks the GSMA OPG.04 E/WBI to partner operators and takes its work from SRM and OEG. The R1 Connexion stack is gone (!12 (merged)).

flowchart LR
  OEG["OEG"] -- "HTTP /internal<br/>partners, agreements, federation, identity" --> FM
  SRM["SRM"] -- "HTTP /internal<br/>onboard, deploy, terminate, instances, zones" --> FM
  FM["Federation Manager 2.0.0"] -- "E/WBI (OPG.04)<br/>OAuth2 client credentials" --> P["partner FM"]
  P -- "E/WBI + callbacks<br/>token must carry our audience" --> FM
  FM --> DB[("fm database<br/>Alembic migrations")]

/internal listens on its own port and never on the EWBI one (!33 (merged)).

What changed since v1.0.0-release

Federation lifecycle

• FastAPI rewrite with the OPG.04 E/WBI surface, OAuth2 and the SRM command loop (!11 (merged)), aligned with GSMA and wired through SRM (!10 (merged)).
• Partner registration admin API (!20 (merged)); the partner client secret is accepted by value and stored encrypted (!30 (merged)).
• GetFederationDetails answered as the partner (!21 (merged)); onPartnerStatusEvent callbacks received (!22 (merged)).
• Recovery from stale federated state (!26 (merged)).
• Our identity on GET /internal/identity (!28 (merged)).

Zones and agreements

• Our own zones offered to partners (!23 (merged)), the zone subscription flow (!24 (merged)), and sync of partner zones with clean-up of ended subscriptions (!36 (merged)).
• Partner agreements through the internal API (!35 (merged)); one agreement per partner, edited in place (!40 (merged)).
• Zone changes pushed on validity dates and retried, and withdrawn subscriptions released (!41 (merged)).

Applications

• App onboarding (!25 (merged)), Helm applications onboarded at partners (!37 (merged)) with capability kind workload (!31 (merged)).
• RemoveApp (!15 (merged)) and terminate of a federated instance at the partner when SRM hands it over (!27 (merged)).
• Partner-hosted service instances readable by SRM (!34 (merged)); the requested instance name kept at the partner (!38 (merged)).
• Inbound QoD sessions (!16 (merged)) and device-location queries from SRM (!14 (merged)).

Security and operations

• Partner tokens not issued for us are refused (!39 (merged)).
• Keycloak signing keys from FM_KEYCLOAK_JWKS_URL when set (!32 (merged)).
• ProblemDetails on the partner registry and identity routes (!29 (merged)).
• Logging and topology hiding (!17 (merged)), persistence fixes (!19 (merged)), Alembic migrations (!18 (merged)), CI aligned with OEG and SRM (!13 (merged)).

Tested

develop at 853bb20f (image ci-develop-853bb20f, pipeline green), deployed fresh with Helm 2.0 on the i2cat three-operator test environment on 2026-10-23 and federated pairwise:

• Ansible R2 e2e suite: 23/23 passed. Covers EWBI auth (no token, wrong Keycloak, another partner's federation), federation through OEG, a federation that survives an FM restart, ending and re-establishing a federation, and partner zones.
• Agreements and instances suite: 10/10 passed. Covers the second agreement refused with 409 and relayed by OEG, PATCH in place, end and start dates, a missed withdrawal resent, a token without our audience refused, a federated deploy from operator 1 onto operator 2's zone with the requested names kept, and a delete on both sides.

After merging

Tag v2.0.0 and publish the image as labs.etsi.org:5050/oop/code/federation-manager:2.0.0, which the Helm chart defaults to. CI doesn't push that tag on its own.