[nova][keystone] workload identity?