Release Notes: v0.8.x

Operator-facing upgrade notes for the v0.8 series, newest first. See the
Release Notes index for how to read these pages.

Changes that have merged to main but are not yet in a tagged release are on
the Unreleased page.

v0.8.0 — released 2026-10-29

Deploy repo changes

Services are moving to get their [database] connection from the MariaDB operator instead of from a <SERVICE>_DB_PASSWORD Helm value. For each converted service the chart renders the Database, User, Grant and Connection resources, and the operator writes the connection string into the <service>-db-conn Secret, which is projected into every workload of that service that talks to the database. The service's components/<service>/<service>-mariadb-db.yaml is removed.

Converted so far: Neutron, Placement, Glance, Keystone.

The <service>-db-password Secret (username and password keys) is still read from your deploy repo, and the chart no longer renders it, so it must exist before this change syncs. Pods wait for <service>-db-conn, so a missing Secret shows up as pods stuck in ContainerCreating.

Argo CD prunes the old Grant named <service>-grant; the chart's is named <service>. Check that both are Ready after the sync:

SERVICE=neutron  # or placement, glance, keystone
kubectl -n openstack get database,user,grant,connection -l application=$SERVICE

The old <service>-grant can get stuck terminating. With privileges: [ALL] and grantOption: true, the operator's finalizer fails on delete with Error 1064 ... near 'ON `<service>`.* FROM '<service>'@'%'' (seen on mariadb-operator 25.8.4). If <service>-grant is still present with a deletionTimestamp, revoke the privileges by hand and then remove the finalizer so the object can go away:

SERVICE=neutron  # or placement, glance, keystone
kubectl mariadb -n openstack mariadb -e "REVOKE ALL PRIVILEGES, GRANT OPTION FROM '$SERVICE'@'%';"
kubectl -n openstack patch grant $SERVICE-grant --type=merge -p '{"metadata":{"finalizers":null}}'

Set SERVICE to each converted service in turn.

Patching the finalizer alone leaves the old grant in the database. The new <service> Grant re-applies the privileges for the same account.

<SERVICE>_DB_PASSWORD in secret-openstack.yaml is no longer used by a converted service and can be removed from your deploy repo once every cluster is on this version.