diff --git a/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/ServiceApi.java b/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/ServiceApi.java
index 7fc87099bc..3a42c4d31c 100644
--- a/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/ServiceApi.java
+++ b/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/ServiceApi.java
@@ -40,5 +40,5 @@ public interface ServiceApi {
    /**
     * The operation returns a list of tenants which the current token provides access to.
     */
-   Set<Tenant> listTenants();
+   Set<? extends Tenant> listTenants();
 }
diff --git a/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/ServiceAsyncApi.java b/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/ServiceAsyncApi.java
index b32482ff45..c890d35b10 100644
--- a/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/ServiceAsyncApi.java
+++ b/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/ServiceAsyncApi.java
@@ -57,5 +57,5 @@ public interface ServiceAsyncApi {
    @Path("/tenants")
    @RequestFilters(AuthenticateRequest.class)
    @ExceptionParser(ReturnEmptySetOnNotFoundOr404.class)
-   ListenableFuture<Set<Tenant>> listTenants();
+   ListenableFuture<? extends Set<? extends Tenant>> listTenants();
 }
diff --git a/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/TenantApi.java b/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/TenantApi.java
index f4b9e5b5fa..68a0118f43 100644
--- a/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/TenantApi.java
+++ b/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/TenantApi.java
@@ -40,7 +40,7 @@ public interface TenantApi {
    /**
     * The operation returns a list of tenants which the current token provides access to.
     */
-   Set<Tenant> list();
+   Set<? extends Tenant> list();
 
    /**
     * Retrieve information about a tenant, by tenant ID
diff --git a/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/TenantAsyncApi.java b/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/TenantAsyncApi.java
index e03a38a87f..43b1ebefe9 100644
--- a/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/TenantAsyncApi.java
+++ b/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/TenantAsyncApi.java
@@ -62,7 +62,7 @@ public interface TenantAsyncApi {
    @Path("/tenants")
    @RequestFilters(AuthenticateRequest.class)
    @ExceptionParser(ReturnEmptySetOnNotFoundOr404.class)
-   ListenableFuture<Set<Tenant>> list();
+   ListenableFuture<? extends Set<? extends Tenant>> list();
 
    /** @see TenantApi#get(String) */
    @GET
@@ -71,7 +71,7 @@ public interface TenantAsyncApi {
    @Path("/tenants/{tenantId}")
    @RequestFilters(AuthenticateRequest.class)
    @ExceptionParser(ReturnNullOnNotFoundOr404.class)
-   ListenableFuture<Tenant> get(@PathParam("tenantId") String tenantId);
+   ListenableFuture<? extends Tenant> get(@PathParam("tenantId") String tenantId);
 
    /** @see TenantApi#getByName(String) */
    @GET
@@ -80,6 +80,6 @@ public interface TenantAsyncApi {
    @Path("/tenants")
    @RequestFilters(AuthenticateRequest.class)
    @ExceptionParser(ReturnNullOnNotFoundOr404.class)
-   ListenableFuture<Tenant> getByName(@QueryParam("name") String tenantName);
+   ListenableFuture<? extends Tenant> getByName(@QueryParam("name") String tenantName);
 
 }
diff --git a/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/TokenApi.java b/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/TokenApi.java
index ebd9baa17d..9b14b2a9f4 100644
--- a/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/TokenApi.java
+++ b/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/TokenApi.java
@@ -72,6 +72,6 @@ public interface TokenApi {
     *
     * @return the set of endpoints
     */
-   Set<Endpoint> listEndpointsForToken(String token);
+   Set<? extends Endpoint> listEndpointsForToken(String token);
 
 }
diff --git a/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/TokenAsyncApi.java b/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/TokenAsyncApi.java
index 3f53195649..2473400a78 100644
--- a/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/TokenAsyncApi.java
+++ b/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/TokenAsyncApi.java
@@ -64,7 +64,7 @@ public interface TokenAsyncApi {
    @Path("/tokens/{token}")
    @RequestFilters(AuthenticateRequest.class)
    @ExceptionParser(ReturnNullOnNotFoundOr404.class)
-   ListenableFuture<Token> get(@PathParam("token") String token);
+   ListenableFuture<? extends Token> get(@PathParam("token") String token);
 
    /** @see TokenApi#getUserOfToken(String) */
    @GET
@@ -73,7 +73,7 @@ public interface TokenAsyncApi {
    @Path("/tokens/{token}")
    @RequestFilters(AuthenticateRequest.class)
    @ExceptionParser(ReturnNullOnNotFoundOr404.class)
-   ListenableFuture<User> getUserOfToken(@PathParam("token") String token);
+   ListenableFuture<? extends User> getUserOfToken(@PathParam("token") String token);
 
    /** @see TokenApi#isValid(String) */
    @HEAD
@@ -89,6 +89,6 @@ public interface TokenAsyncApi {
    @Path("/tokens/{token}/endpoints")
    @RequestFilters(AuthenticateRequest.class)
    @ExceptionParser(ReturnEmptySetOnNotFoundOr404.class)
-   ListenableFuture<Set<Endpoint>> listEndpointsForToken(@PathParam("token") String token);
+   ListenableFuture<? extends Set<? extends Endpoint>> listEndpointsForToken(@PathParam("token") String token);
 
 }
diff --git a/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/UserApi.java b/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/UserApi.java
index 88ab62e9a1..619ecf0153 100644
--- a/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/UserApi.java
+++ b/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/UserApi.java
@@ -48,7 +48,7 @@ public interface UserApi {
     * 
     * @return the list of users
     */
-   Set<User> list();
+   Set<? extends User> list();
 
    /**
     * Retrieve information about a user, by user ID
@@ -73,13 +73,13 @@ public interface UserApi {
     * 
     * @return the set of Roles granted to the user
     */
-   Set<Role> listRolesOfUser(String userId);
+   Set<? extends Role> listRolesOfUser(String userId);
 
    /**
     * List the roles a user has been granted on a specific tenant
     * 
     * @return the set of roles
     */
-   Set<Role> listRolesOfUserOnTenant(String userId, String tenantId);
+   Set<? extends Role> listRolesOfUserOnTenant(String userId, String tenantId);
 
 }
diff --git a/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/UserAsyncApi.java b/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/UserAsyncApi.java
index 7e3cf607ce..d7ba6a8bcb 100644
--- a/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/UserAsyncApi.java
+++ b/apis/openstack-keystone/src/main/java/org/jclouds/openstack/keystone/v2_0/features/UserAsyncApi.java
@@ -61,7 +61,7 @@ public interface UserAsyncApi {
    @Path("/users")
    @RequestFilters(AuthenticateRequest.class)
    @ExceptionParser(ReturnEmptySetOnNotFoundOr404.class)
-   ListenableFuture<Set<User>> list();
+   ListenableFuture<? extends Set<? extends User>> list();
 
    /** @see UserApi#get(String) */
    @GET
@@ -70,7 +70,7 @@ public interface UserAsyncApi {
    @Path("/users/{userId}")
    @RequestFilters(AuthenticateRequest.class)
    @ExceptionParser(ReturnNullOnNotFoundOr404.class)
-   ListenableFuture<User> get(@PathParam("userId") String userId);
+   ListenableFuture<? extends User> get(@PathParam("userId") String userId);
    
    /** @see UserApi#getByName(String) */
    @GET
@@ -79,7 +79,7 @@ public interface UserAsyncApi {
    @Path("/users")
    @RequestFilters(AuthenticateRequest.class)
    @ExceptionParser(ReturnNullOnNotFoundOr404.class)
-   ListenableFuture<User> getByName(@QueryParam("name") String userName);
+   ListenableFuture<? extends User> getByName(@QueryParam("name") String userName);
    
    /** @see UserApi#listRolesOfUser(String) */
    @GET
@@ -88,7 +88,7 @@ public interface UserAsyncApi {
    @Path("/users/{userId}/roles")
    @RequestFilters(AuthenticateRequest.class)
    @ExceptionParser(ReturnEmptySetOnNotFoundOr404.class)
-   ListenableFuture<Set<Role>> listRolesOfUser(@PathParam("userId") String userId);
+   ListenableFuture<? extends Set<? extends Role>> listRolesOfUser(@PathParam("userId") String userId);
 
    /** @see UserApi#listRolesOfUserOnTenant(String, String) */
    @GET
@@ -97,5 +97,5 @@ public interface UserAsyncApi {
    @Path("/tenants/{tenantId}/users/{userId}/roles")
    @RequestFilters(AuthenticateRequest.class)
    @ExceptionParser(ReturnEmptySetOnNotFoundOr404.class)
-   ListenableFuture<Set<Role>> listRolesOfUserOnTenant(@PathParam("userId") String userId, @PathParam("tenantId") String tenantId);
+   ListenableFuture<? extends Set<? extends Role>> listRolesOfUserOnTenant(@PathParam("userId") String userId, @PathParam("tenantId") String tenantId);
 }
diff --git a/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/ServiceApiExpectTest.java b/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/ServiceApiExpectTest.java
index e51d72fe05..f5e63a22af 100644
--- a/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/ServiceApiExpectTest.java
+++ b/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/ServiceApiExpectTest.java
@@ -50,7 +50,7 @@ public class ServiceApiExpectTest extends BaseKeystoneRestApiExpectTest<Keystone
                HttpResponse.builder().statusCode(200)
                         .payload(payloadFromResourceWithContentType("/tenant_list.json", APPLICATION_JSON)).build())
                .getServiceApi();
-      Set<Tenant> tenants = api.listTenants();
+      Set<? extends Tenant> tenants = api.listTenants();
       assertNotNull(tenants);
       assertFalse(tenants.isEmpty());
 
diff --git a/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/ServiceApiLiveTest.java b/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/ServiceApiLiveTest.java
index 67125bf387..b12c5ae014 100644
--- a/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/ServiceApiLiveTest.java
+++ b/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/ServiceApiLiveTest.java
@@ -37,7 +37,7 @@ public class ServiceApiLiveTest extends BaseKeystoneApiLiveTest {
 
    public void testTenants() {
       ServiceApi api = keystoneContext.getApi().getServiceApi();
-      Set<Tenant> result = api.listTenants();
+      Set<? extends Tenant> result = api.listTenants();
       assertNotNull(result);
       assertFalse(result.isEmpty());
 
diff --git a/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/TenantApiExpectTest.java b/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/TenantApiExpectTest.java
index c30cd16da9..094d657221 100644
--- a/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/TenantApiExpectTest.java
+++ b/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/TenantApiExpectTest.java
@@ -56,7 +56,7 @@ public class TenantApiExpectTest extends BaseKeystoneRestApiExpectTest<KeystoneA
                HttpResponse.builder().statusCode(200).payload(
                         payloadFromResourceWithContentType("/tenant_list.json", APPLICATION_JSON)).build())
                .getTenantApi().get();
-      Set<Tenant> tenants = api.list();
+      Set<? extends Tenant> tenants = api.list();
       assertNotNull(tenants);
       assertFalse(tenants.isEmpty());
 
@@ -74,7 +74,7 @@ public class TenantApiExpectTest extends BaseKeystoneRestApiExpectTest<KeystoneA
             HttpResponse.builder().statusCode(200).payload(
                   payloadFromResourceWithContentType("/tenant_list_att.json", APPLICATION_JSON)).build())
             .getTenantApi().get();
-      Set<Tenant> tenants = api.list();
+      Set<? extends Tenant> tenants = api.list();
       assertNotNull(tenants);
       assertFalse(tenants.isEmpty());
 
diff --git a/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/TenantApiLiveTest.java b/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/TenantApiLiveTest.java
index 3411e4ebaa..8c09e41c95 100644
--- a/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/TenantApiLiveTest.java
+++ b/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/TenantApiLiveTest.java
@@ -38,7 +38,7 @@ public class TenantApiLiveTest extends BaseKeystoneApiLiveTest {
 
    public void testTenants() {
       TenantApi api = keystoneContext.getApi().getTenantApi().get();
-      Set<Tenant> result = api.list();
+      Set<? extends Tenant> result = api.list();
       assertNotNull(result);
       assertFalse(result.isEmpty());
 
diff --git a/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/TokenApiExpectTest.java b/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/TokenApiExpectTest.java
index 54f518d487..9132077d6e 100644
--- a/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/TokenApiExpectTest.java
+++ b/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/TokenApiExpectTest.java
@@ -138,7 +138,7 @@ public class TokenApiExpectTest extends BaseKeystoneRestApiExpectTest<KeystoneAp
             authenticatedGET().endpoint(endpoint + "/v2.0/tokens/XXXXXX/endpoints").build(),
             HttpResponse.builder().statusCode(200).payload(payloadFromResourceWithContentType("/user_endpoints.json", APPLICATION_JSON)).build())
             .getTokenApi().get();
-      Set<Endpoint> endpoints = api.listEndpointsForToken("XXXXXX");
+      Set<? extends Endpoint> endpoints = api.listEndpointsForToken("XXXXXX");
       
       assertEquals(endpoints, ImmutableSet.of(
             Endpoint.builder().publicURL(URI.create("https://csnode.jclouds.org/v2.0/"))
diff --git a/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/TokenApiLiveTest.java b/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/TokenApiLiveTest.java
index d4eb9cb166..7328190ef6 100644
--- a/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/TokenApiLiveTest.java
+++ b/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/TokenApiLiveTest.java
@@ -82,7 +82,7 @@ public class TokenApiLiveTest extends BaseKeystoneApiLiveTest {
    public void testTokenEndpoints() {
 
       TokenApi api = keystoneContext.getApi().getTokenApi().get();
-      Set<Endpoint> endpoints = api.listEndpointsForToken(token);
+      Set<? extends Endpoint> endpoints = api.listEndpointsForToken(token);
       assertNotNull(endpoints);
       assertFalse(endpoints.isEmpty());
 
diff --git a/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/UserApiExpectTest.java b/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/UserApiExpectTest.java
index bf828b9ac4..01eddeff07 100644
--- a/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/UserApiExpectTest.java
+++ b/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/UserApiExpectTest.java
@@ -56,7 +56,7 @@ public class UserApiExpectTest extends BaseKeystoneRestApiExpectTest<KeystoneApi
             authenticatedGET().endpoint(endpoint + "/v2.0/users").build(),
             HttpResponse.builder().statusCode(200).payload(payloadFromResourceWithContentType("/user_list.json", APPLICATION_JSON)).build())
             .getUserApi().get();
-      Set<User> users = api.list();
+      Set<? extends User> users = api.list();
       assertNotNull(users);
       assertFalse(users.isEmpty());
 
@@ -123,7 +123,7 @@ public class UserApiExpectTest extends BaseKeystoneRestApiExpectTest<KeystoneApi
             authenticatedGET().endpoint(endpoint + "/v2.0/users/3f6c1c9ba993495ead7d2eb2192e284f/roles").build(),
             HttpResponse.builder().statusCode(200).payload(payloadFromResourceWithContentType("/user_role_list.json", APPLICATION_JSON)).build())
             .getUserApi().get();
-      Set<Role> roles = api.listRolesOfUser("3f6c1c9ba993495ead7d2eb2192e284f");
+      Set<? extends Role> roles = api.listRolesOfUser("3f6c1c9ba993495ead7d2eb2192e284f");
       assertNotNull(roles);
       assertFalse(roles.isEmpty());
       assertEquals(roles, ImmutableSet.of(
@@ -154,7 +154,7 @@ public class UserApiExpectTest extends BaseKeystoneRestApiExpectTest<KeystoneApi
             authenticatedGET().endpoint(endpoint + "/v2.0/users/3f6c1c9ba993495ead7d2eb2192e284f/roles").build(),
             HttpResponse.builder().statusCode(200).payload(payloadFromResourceWithContentType("/user_tenant_role_list.json", APPLICATION_JSON)).build())
             .getUserApi().get();
-      Set<Role> roles = api.listRolesOfUser("3f6c1c9ba993495ead7d2eb2192e284f");
+      Set<? extends Role> roles = api.listRolesOfUser("3f6c1c9ba993495ead7d2eb2192e284f");
       assertNotNull(roles);
       assertFalse(roles.isEmpty());
       assertEquals(roles, ImmutableSet.of(
diff --git a/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/UserApiLiveTest.java b/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/UserApiLiveTest.java
index 6ce1f0714f..6e9759a953 100644
--- a/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/UserApiLiveTest.java
+++ b/apis/openstack-keystone/src/test/java/org/jclouds/openstack/keystone/v2_0/features/UserApiLiveTest.java
@@ -41,7 +41,7 @@ public class UserApiLiveTest extends BaseKeystoneApiLiveTest {
    public void testUsers() {
 
       UserApi api = keystoneContext.getApi().getUserApi().get();
-      Set<User> users = api.list();
+      Set<? extends User> users = api.list();
       assertNotNull(users);
       assertFalse(users.isEmpty());
       for (User user : users) {
@@ -54,12 +54,12 @@ public class UserApiLiveTest extends BaseKeystoneApiLiveTest {
    public void testUserRolesOnTenant() {
 
       UserApi api = keystoneContext.getApi().getUserApi().get();
-      Set<User> users = api.list();
-      Set<Tenant> tenants = keystoneContext.getApi().getTenantApi().get().list();
+      Set<? extends User> users = api.list();
+      Set<? extends Tenant> tenants = keystoneContext.getApi().getTenantApi().get().list();
 
       for (User user : users) {
          for (Tenant tenant : tenants) {
-            Set<Role> roles = api.listRolesOfUserOnTenant(user.getId(), tenant.getId());
+            Set<? extends Role> roles = api.listRolesOfUserOnTenant(user.getId(), tenant.getId());
             for (Role role : roles) {
                assertNotNull(role.getId());
             }
@@ -72,7 +72,7 @@ public class UserApiLiveTest extends BaseKeystoneApiLiveTest {
 
       UserApi api = keystoneContext.getApi().getUserApi().get();
       for (User user : api.list()) {
-         Set<Role> roles = api.listRolesOfUser(user.getId());
+         Set<? extends Role> roles = api.listRolesOfUser(user.getId());
          for (Role role : roles) {
             assertNotNull(role.getId());
          }