openstack/openstack-helm — Week of 2026-10-17

Identity and configuration surface. The headline change lands declarative Keystone identity management (~3,900 lines), letting charts drive users, projects, roles, and domains from Helm values. Alongside it, pod.mandatory_access_control now gets validated in validate.yaml, and the helm-toolkit snippets that rendered seccomp and AppArmor annotations were retired in favor of the native pod security fields. The default pod resources also lose their CPU limits.

Chart hardening sweep. The bulk of the week is a long tail of per-chart fixes across cinder, ironic, magnum, mistral, octavia, cyborg, glance, placement, skyline, blazar, cloudkitty, swift, trove, aodh, and more: sizing previously-unsized init containers, defining missing pod annotations, wiring governing services and update strategies for conductor/engine daemons, tightening security contexts, and gating cron jobs on db-sync. Cyborg in particular picks up uWSGI for its API, non-root api/conductor, tolerations, and logging config. Smaller functional fixes include watcher API moving under uWSGI, a Ceilometer definitions sync to 2026.2, Grafana upgraded to v13, nginx TLS sidecars running unprivileged, Nova using distinct reply queues for liveness vs. readiness probes, and skyline's TLS DB connection fix.

Release notes workflow. Chart release notes are now generated into Chart.yaml and CHANGELOG.md is dropped; a follow-up lets the generator take a note from the commit subject while preferring an explicit reno note.

Tooling and CI. New deployment jobs for designate and ironic landed, manila deploy was collapsed onto a single node, the watcher job joined the check pipeline, and PowerDNS switched to the official upstream image.