revoked token means invalid token, indicating tokens which are not expired, but the valid field is set to False.

glance fetch the revoked token list and store them in local file(signing_dir/revoked.pem). If you token id(pki format) in revoked token list, glance will reject it.

keystone provides api for deleting token:

DELETE: /token/{token_id}

actually, this api set the valid field of token to false in db.Then the token is so called revoked token

The code result in getting revoked token list nest in keystoneclient.middleware.auth_token.

It has sth to do with the verify mechanism of pki format token.

All components interact with keystone(if keystone's token format is set to PKI) will result in it.

Maybe you would like to read the code of keystoneclient.middleware.auth_token,if you want to know the details.