openstack/openstack-helm — Week of 2026-11-14

Rootwrap consolidation. The biggest churn of the week is a sweep across nova, neutron, and cinder to stop shipping rootwrap filters from the chart and instead use the filters baked into the service images, removing roughly a thousand lines of duplicated policy. A follow-up also stops mounting rootwrap and the fake iptables shim in the nova metadata pod, shrinking the deployment surface further.

New deployments and service features. Mistral gained a dedicated periodic server deployment, watcher picked up config hashes and pod tolerations to trigger restarts on config changes, and skyline grew overrides for the OpenStack service RBAC policies it proxies.

Config correctness fixes. Several small but pointed fixes landed around keystone and service wiring: switching [keystone_authtoken] to www_authenticate_uri instead of the deprecated auth_uri, preserving the cyborg keystone_authtoken password, setting the masakari taskflow connection when certificates are enabled, and moving nova's glance config from api_servers to endpoint_override (1015279). On the data side, the MariaDB operator now re-renders the Connection secret when its password changes and rewrites it on the next sweep if deleted, and ceph-osd will now fail pod init rather than silently proceed when CRUSH placement exhausts its retry loop.

Elsewhere. New docs guide AI coding agents through the repo, CI's describe-kubernetes-objects now gathers custom resources, and a dead gnocchi documentation link was replaced.