diff --git a/releasenotes/notes/Make-keystone-default-roles-tests-default-a65a62864b93a296.yaml b/releasenotes/notes/Make-keystone-default-roles-tests-default-a65a62864b93a296.yaml
new file mode 100644
index 0000000..d38181a
--- /dev/null
+++ b/releasenotes/notes/Make-keystone-default-roles-tests-default-a65a62864b93a296.yaml
@@ -0,0 +1,8 @@
+---
+upgrade:
+  - |
+    The default tempest tests will now expect the keystone default roles RBAC
+    enabled. The legacy behavior can be enabled by setting
+    "RBAC_test_type: advanced" in the [load_balancer] section of your
+    tempest.conf. This change also removes the ability to test system scoped
+    tokens with Octavia.