openstack/openstack-helm — Week of 2026-11-07

Custom-resource provisioning. The week is dominated by a push to drive core services through Kubernetes custom resources instead of in-chart jobs. Remaining identity provisioning now flows through Keystone custom resources in a ~7,300-line change (1013884), and both database and messaging provisioning switch to MariaDB and RabbitMQ custom resources by default, each net-removing hundreds of lines of chart templating. A follow-on exposes an explicit, configurable cleanup policy on the MariaDB resource, and a refactor renames configmap-etc to secret-etc wherever it actually renders a Secret, aligning the template names with what they produce.

MariaDB stability. Several fixes harden the controller-driven MariaDB path: the master service selector is left to mariadb-controller, the chart rides out Kubernetes API failures and stuck server pods, the current primary is kept while it remains ready, and a stray debug log level on the controller is corrected.

Chart fixes elsewhere. Swift proxy/storage, Cyborg's agent DaemonSet, and Keystone's domain-manage job all learn to render pod.mounts volumes; Keystone's credential-cleanup job gains the ability to read config snippets. On the networking side, OVN clients can now be handed every member of the OVN databases, and the Neutron OVS agent is allowed to load its configured extensions. A deploy-env tweak keeps the control-plane node out of memory pressure, and a Selenium dashboard test is pinned to plain http:// under Chrome.

Packaging. Charts are now also published to quay.io/osh-charts.