feat: let the MariaDB operator render the database connection

changelog.d/20261016_120000_doug.goldstein_mariadb_operator_db_conn.md

@@ -0,0 +1,28 @@
+### Deploy repo changes
+
+Services are moving to get their `[database] connection` from the MariaDB operator instead of from a `<SERVICE>_DB_PASSWORD` Helm value. For each converted service the chart renders the `Database`, `User`, `Grant` and `Connection` resources, and the operator writes the connection string into the `<service>-db-conn` Secret, which is projected into every workload of that service that talks to the database. The service's `components/<service>/<service>-mariadb-db.yaml` is removed.
+
+Converted so far: Neutron, Placement, Glance, Keystone.
+
+The `<service>-db-password` Secret (`username` and `password` keys) is still read from your deploy repo, and the chart no longer renders it, so it must exist before this change syncs. Pods wait for `<service>-db-conn`, so a missing Secret shows up as pods stuck in `ContainerCreating`.
+
+Argo CD prunes the old `Grant` named `<service>-grant`; the chart's is named `<service>`. Check that both are Ready after the sync:
+
+```bash
+SERVICE=neutron  # or placement, glance, keystone
+kubectl -n openstack get database,user,grant,connection -l application=$SERVICE
+```
+
+The old `<service>-grant` can get stuck terminating. With `privileges: [ALL]` and `grantOption: true`, the operator's finalizer fails on delete with `Error 1064 ... near 'ON `<service>`.* FROM '<service>'@'%''` (seen on mariadb-operator 25.8.4). If `<service>-grant` is still present with a `deletionTimestamp`, revoke the privileges by hand and then remove the finalizer so the object can go away:
+
+```bash
+SERVICE=neutron  # or placement, glance, keystone
+kubectl mariadb -n openstack mariadb -e "REVOKE ALL PRIVILEGES, GRANT OPTION FROM '$SERVICE'@'%';"
+kubectl -n openstack patch grant $SERVICE-grant --type=merge -p '{"metadata":{"finalizers":null}}'
+```
+
+Set `SERVICE` to each converted service in turn.
+
+Patching the finalizer alone leaves the old grant in the database. The new `<service>` Grant re-applies the privileges for the same account.
+
+`<SERVICE>_DB_PASSWORD` in `secret-openstack.yaml` is no longer used by a converted service and can be removed from your deploy repo once every cluster is on this version.

charts/argocd-understack/values.yaml

@@ -356,7 +356,7 @@ site:
     wave: 1
     # -- Chart version for Keystone
     # renovate: datasource=helm depName=keystone registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
-    chartVersion: 2026.1.61+a39ebbeb1
+    chartVersion: 2026.2.3+b5078da51
 
   # -- Glance (Image Service)
   glance:
@@ -368,7 +368,7 @@ site:
     wave: 2
     # -- Chart version for Glance
     # renovate: datasource=helm depName=glance registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
-    chartVersion: 2026.1.67+a39ebbeb1
+    chartVersion: 2026.2.3+b5078da51
 
   # -- Cinder (Block Storage Service)
   cinder:
@@ -404,7 +404,7 @@ site:
     wave: 2
     # -- Chart version for Neutron
     # renovate: datasource=helm depName=neutron registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
-    chartVersion: 2026.1.107+a39ebbeb1
+    chartVersion: 2026.2.1+b90c3a6ab
 
   # -- Placement (Placement Service)
   placement:
@@ -416,7 +416,7 @@ site:
     wave: 2
     # -- Chart version for Placement
     # renovate: datasource=helm depName=placement registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
-    chartVersion: 2026.1.58+a39ebbeb1
+    chartVersion: 2026.2.3+b5078da51
 
   # -- Nova (Compute Service)
   nova:

components/glance/kustomization.yaml

@@ -3,5 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - glance-mariadb-db.yaml
   - glance-rabbitmq-queue.yaml

components/glance/values.yaml

@@ -92,10 +92,16 @@ pod:
     glance_api:
       - secret:
           name: glance-ks-etc
+      - secret:
+          name: glance-db-conn
     glance_db_sync:
       - secret:
           name: glance-ks-etc
-    glance_metadefs_load: []
+      - secret:
+          name: glance-db-conn
+    glance_metadefs_load:
+      - secret:
+          name: glance-db-conn
   replicas:
     api: 2
   lifecycle:
@@ -128,6 +134,11 @@ pod:
 
 conf:
   glance:
+    database:
+      # The MariaDB operator writes the connection string into the
+      # glance-db-conn secret, which is projected into the config directory
+      # above, so the chart must not generate one from the DB password.
+      connection: null
     oslo_messaging_notifications:
       driver: messagingv2
     oslo_messaging_rabbit:
@@ -140,7 +151,19 @@ conf:
       # Kubernetes environment.
       processes: 2
 
+# The chart declares the Database, User, Grant and Connection resources instead
+# of the db-init job. The password is read from the glance-db-password secret
+# in the deploy repo rather than rendered from Helm values.
+mariadb_db:
+  api_group: k8s.mariadb.com
+  # the MariaDB resource is named mariadb, while clients connect through the
+  # mariadb-primary service set in endpoints.oslo_db.hosts
+  mariadb_ref: mariadb
+  password_secret:
+    create: false
+
 manifests:
+  mariadb_db: true
   # its pre-delete hook makes ArgoCD add pre-delete finalizers to the
   # Application, which the app-of-apps then fights. no-op for us anyway.
   job_clean: false

components/keystone/kustomization.yaml

@@ -3,5 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - keystone-mariadb-db.yaml
   - keystone-rabbitmq-queue.yaml

components/keystone/values.yaml

@@ -31,6 +31,18 @@ dependencies:
         - keystone-fernet-setup
 
 pod:
+  etcSources:
+    keystone_api:
+      - secret:
+          name: keystone-db-conn
+    keystone_db_sync:
+      - secret:
+          name: keystone-db-conn
+    # credential_rotate runs credential_migrate, which re-encrypts rows in the
+    # database
+    keystone_credential_rotate:
+      - secret:
+          name: keystone-db-conn
   resources:
     enabled: true
     api:
@@ -174,6 +186,11 @@ pod:
 
 conf:
   keystone:
+    database:
+      # The MariaDB operator writes the connection string into the
+      # keystone-db-conn secret, which is projected into the config directory
+      # above, so the chart must not generate one from the DB password.
+      connection: null
     auth:
       methods: password,token,openid,mapped,application_credential
     openid:
@@ -339,7 +356,19 @@ endpoints:
         default: 5556
     path: ''
 
+# The chart declares the Database, User, Grant and Connection resources instead
+# of the db-init job. The password is read from the keystone-db-password secret
+# in the deploy repo rather than rendered from Helm values.
+mariadb_db:
+  api_group: k8s.mariadb.com
+  # the MariaDB resource is named mariadb, while clients connect through the
+  # mariadb-primary service set in endpoints.oslo_db.hosts
+  mariadb_ref: mariadb
+  password_secret:
+    create: false
+
 manifests:
+  mariadb_db: true
   job_credential_cleanup: false
   job_db_init: false
   job_rabbit_init: false

components/neutron/kustomization.yaml

@@ -3,6 +3,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - neutron-mariadb-db.yaml
   - neutron-rabbitmq-queue.yaml
   - job-neutron-post-deploy.yaml