# Release notes

## 2026.1.0-86

- Ensure the ks-service.sh script exits if 'openstack service list' command fails.
- The ``helm-toolkit.utils.to_oslo_conf`` template no longer emits a line
  for keys whose value is ``nil``. Previously Go templates rendered nil as
  the literal string ``<no value>``, which oslo.config then rejected (for
  example, ``HostnameOpt`` fails with "is not a valid host address").
  Charts can now explicitly null an oslo.config key in their values to
  fall back to the service's built-in default, instead of having to
  override it with a real placeholder string.
- fixes
- Gate the RabbitMQ client certificate mount and the REQUIRE X509 environment
  in the rabbit-init job manifest on the presence of a TLS secret (tlsSecret)
  instead of the manifests.certificates value, so messaging TLS can be
  toggled independently of certificate rendering.
- Gate the MariaDB client certificate mount and the REQUIRE X509 grant in the
  mysql db-init and db-drop job manifests on the tls.oslo_db value so database
  TLS can be toggled independently of the manifests.certificates value.

### New Features

- The ``helm-toolkit.manifests.certificates`` template now accepts an
  optional ``secretName`` parameter. When provided, it sets the name of the
  rendered cert-manager ``Certificate`` (both ``metadata.name`` and
  ``spec.secretName``) instead of deriving it from the endpoint's
  ``host_fqdn_override.default.tls.secretName``.
- The ``keystone_openrc_env_vars`` snippet now supports alternative
  Keystone authentication plugins via two new optional parameters
  in ``identity.openrc`` values: ``exclude_vars`` (a list of default
  environment variable names to omit) and ``extra_vars`` (a list of
  additional environment variable entries to inject). This enables
  the use of federated auth methods such as ``v3oidcaccesstoken``
  in ks-service, ks-endpoints, ks-user, and bootstrap jobs without
  requiring template overrides. The change is fully backwards-compatible.

### Upgrade Notes

- The charts no longer render ``Ingress`` resources, nor the auxiliary
  ``Service`` objects and TLS secrets that used to back them. Charts now
  deploy only the applications and their ClusterIP ``Service`` objects.
  Expose services outside the cluster by supplying the necessary objects
  through the ``.Values.extraObjects`` field, for example a Gateway API
  ``HTTPRoute`` (plus a ``BackendTLSPolicy`` for backend re-encryption) or,
  if preferred, an ``Ingress`` together with its ``Service``. Ready-to-use
  Gateway API examples are provided under
  ``values_overrides/<chart>/gateway.yaml``.
- The mTLS client certificate that each chart presents on outbound
  connections to MariaDB and RabbitMQ is now named after the chart-local
  value ``secrets.tls.client.<chart>`` rather than the shared
  ``endpoints.oslo_db.host_fqdn_override.default.tls.secretName``. This
  prevents a name collision for deployments whose values tooling renders
  endpoints from a single shared endpoint catalog, where the ``oslo_db``
  endpoint (and therefore its ``secretName``) is identical across every
  chart. The pod ``client-certs`` volume already references the same
  chart-local value, so the certificate and its mount remain in lockstep.
  No action is required for existing deployments: the default
  ``secrets.tls.client.<chart>`` value matches the previously rendered
  certificate name.

### API Changes

- Removed all ingress-related values from the charts: the
  ``manifests.ingress*``, ``manifests.service_ingress*`` and
  ``manifests.secret_ingress_tls`` toggles, the ``endpoints.ingress``
  controller endpoint and the ``network.<service>.ingress`` blocks. The
  now-unused ``helm-toolkit.manifests.ingress``,
  ``helm-toolkit.manifests.service_ingress`` and
  ``helm-toolkit.manifests.secret_ingress_tls`` helpers were removed as well.

### Bug Fixes

- Populate ``[cache] memcache_servers`` from the ``oslo_cache`` internal
  memcache endpoint for heat, neutron, trove, and zaqar when a cache section
  exists and ``memcache_servers`` has not already been set by user overrides.
  
  This brings these charts in line with other OpenStack-Helm services that
  already populate ``memcache_servers`` from the ``oslo_cache`` endpoint while
  keeping explicit overrides authoritative.

## 2026.1.0

- Add support for etcSources to db-sync job.
- If the specific job that is static dependency has its manifest disabled
  the user needs to have a long diff to replace out just that one job from
  being depended on. This makes it automatically disable waiting on those
  jobs if they've been disabled to make the dependency management easier
  for users.

### New Features

- Update default ingress classes and annotations for charts to make them implementation
  agnostic. They used to be nginx specific because we always used ingress-nginx as the most
  common choice. Ingress-nginx is deprecated and will become unmaintained in Feb/2026.
  
  Now for all test jobs we use HAProxy Ingress as the default implementation. However any
  other implementation can be used as far as it suppports annotations similar to
  'nginx.ingress.kubernetes.io/rewrite-target' or 'haproxy.org/path-rewrite' which are
  used in many OpenStack-Helm charts.
- Added an extraObjects list to every chart to allow for adding extra
  Kubernetes objects along side the chart without modifying the chart.
  It has the added benefit of using Helm's built in templating so
  you are able to utilize other values supplied to the chart.
- Added emptyDir mounted at /var/lock and set OSLO_LOCK_PATH env var to
  this path for oslo.concurrency support in all OpenStack services.
- Add an ability to add more path into ingress rules, and add more ports into service.
- Add support for using existing image registry secrets in ServiceAccounts.
  
  The ``imagePullSecrets`` field on ServiceAccounts is now controlled solely
  by ``endpoints.oci_image_registry.auth.enabled``. When auth is enabled,
  the secret name is always looked up from ``secrets.oci_image_registry``.
  
  To use an existing registry secret without creating a new one, set
  ``manifests.secret_registry: false`` and configure the existing secret
  name via ``secrets.oci_image_registry``::
  
    # Use an existing shared registry secret
    manifests:
      secret_registry: false
    secrets:
      oci_image_registry:
        <chart-name>: "my-shared-registry-secret"
    endpoints:
      oci_image_registry:
        auth:
          enabled: true

### Upgrade Notes

- Support for Helm 2 has been removed by removal of the helm3_hook value across all charts.
  It is no longer possible to set helm3_hook to False to support Helm 2.

### Bug Fixes

- Added new snippet to include failover OpenRC environment variables in backup cron jobs for
  MariaDB and PostgreSQL charts.

## 2025.2.0

- The 'service' domain and project are not scoped to regions in most multi-region
  installations and will instead be shared so it does not make sense to include
  the region name in the description for those.
- Add priorityClassName and runtimeClassName snippets
- Removing non-used script which allows to create bucket using admin user.
  Actually any user can do this and there is better script which is
  utilized by elasticsearch chart:
  elasticsearch/templates/bin/_create_s3_buckets.sh.tpl
  The only requirement is - to create the user.
  Also, removing S3_ADMIN_<> env vars from job manifests
  (see helm-toolkit.snippets.rgw_s3_admin_env_vars)
  because those vars are not used by actual scripts.
  We now use ceph.conf and keyring to create a user.
  ceph.conf and keyring can be provisioned by either
  ceph chart or ceph-adapter-rook chart.
- Modify job_ks_user template to be able to create multiple Keystone users
- Corrected helm-toolkit.snippets.kubernetes_pod_rbac_serviceaccount to
  cover the case when service account must have access to endpoint in
  different namespace. In that case Role/Binding are getting created
  in that endpoint namespace, but now rolebinding will be point to
  the service account in the original namespace, which is $.Release.Namespace.
  This was tested with elasticsearch chart where
  s3.clients.local-rgw-elasticsearch.settings.endpoint was pointing to
  another namespace. With whose changes job-s3-user was able to detect
  availability of that enpoint. Before changes init container had this error in the logs:
  Resolving dependency Service rook-ceph-rgw-default in namespace ceph failed: endpoints "rook-ceph-rgw-default" is forbidden: User
  "system:serviceaccount:osh-infra:elasticsearch-s3-user" cannot get resource "endpoints" in API group "" in the namespace "ceph"

### New Features

- Update apparmor values to use security_context instead of annotations.
- Add support for runtimeClassName and priorityClassName

## 2025.1.0

- Mount volumes requested into the job's pod.
- 0.1.0 Initial Chart
- 0.1.1 Add extra DNS names to Ingress
- 0.1.2 Make database backups work with openstack Train
- 0.1.3 Fix ks-user script case matching for domain
- 0.1.4 Update ingress tpl in helmtoolkit
- 0.1.5 Add capability to delete a backup archive
- 0.2.0 Update default Kubernetes API for use with Helm v3
- 0.2.1 Change Issuer to ClusterIssuer
- 0.2.2 Revert Change Issuer to ClusterIssuer
- 0.2.3 Allow openstack service list to retry in event of keystone connection issues
- 0.2.4 Added detailed FiXME for ks-service script bug and code changes
- 0.2.5 Added logic to support cert-manager versioning
- 0.2.6 Add metadata in job templates
- 0.2.7 Replace brace expansion with more standardized Posix approach
- 0.2.8 Override the expiry of Ingress TLS certificate
- 0.2.9 Jobs; put labels only in the template spec
- 0.2.10 Add more S3 configuration options
- 0.2.11 Revert S3 User & Bucket job scripts to v0.2.9
- 0.2.12 Remove hook-delete-policy
- 0.2.13 Modify connection args for s3 bucket creation when TLS is enabled
- 0.2.14 Remove TLS_OPTION argument from s3 bucket creation job
- 0.2.15 Adding TLS rabbitmq logic
- 0.2.16 Add manual mode to the created backup file name
- 0.2.17 Update db backup/restore retry for sending to remote
- 0.2.18 Make Rabbit-init job more robust
- 0.2.19 Revoke all privileges for PUBLIC role in postgres dbs
- 0.2.20 Modify the template of rbac_role to make secrets accessible
- 0.2.21 Fix issue with db backup error return code being eaten
- 0.2.22 Add ability to set labels to add to resources
- 0.2.23 Helm 3 - Fix Job labels
- 0.2.24 Migrate Ingress resources to networking.k8s.io/v1
- 0.2.25 Set Security Context to ks-user job
- 0.2.26 Revert Set Security Context to ks-user job
- 0.2.27 Correct private key size input for Certificates and remove minor version support
- 0.2.28 Set Security context to ks-user job at pod and container level
- 0.2.29 Enhance mariadb backup
- 0.2.30 Add ability to image pull secrets on pods
- 0.2.31 Add log strings for alert generation
- 0.2.32 Consolidate mon_endpoints discovery
- 0.2.33 Remove set -x
- 0.2.34 Modify database backup logic to maintain minimum number of backups
- 0.2.35 Database B/R improvements
- 0.2.36 Enable taint toleration for Openstack services jobs
- 0.2.37 Updated chart naming for subchart compatibility
- 0.2.38 Minor change to display archive directory with files in sub-directory
- 0.2.39 Removed tillerVersion from Chart to pass helm3 linting
- 0.2.40 Revert chart naming for subchart compatibility
- 0.2.41 Database B/R - archive name parser added
- 0.2.42 Database B/R - fix to make script compliant with a retention policy
- 0.2.43 Support having a single external ingress controller
- 0.2.44 Added OCI registry authentication
- 0.2.45 Modify use_external_ingress_controller place in openstack-helm values.yaml
- 0.2.46 Fixed for getting kibana ingress value parameters
- 0.2.47 Adjusting of kibana ingress value parameters
- 0.2.48 Added verify_databases_backup_archives function call to backup process and added remote backup sha256 hash verification
- 0.2.49 Moved RabbitMQ Guest Admin removal to init
- 0.2.50 Allow tls for external ingress without specifying key and crt
- 0.2.51 Added a random delay up to 300 seconds to remote backup upload/download for load spreading purpose
- 0.2.52 Decreased random delay to up to 30 seconds and switched remote backup verification protocol to md5
- 0.2.53 Update create db user queries
- 0.2.54 Fix dependency resolver to ignore non-existing dependencyKey when dependencyMixinParam is a slice
- 0.2.55 Updated deprecated IngressClass annotation
- 0.2.56 Expose S3 credentials from Rook bucket CRD secret
- 0.2.57 Safer file removal
- 0.2.58 Backups verification improvements
- 0.2.59 Added throttling remote backups
- 0.2.60 Change default ingress pathType to Prefix
- 0.2.61 Add custom pod annotations snippet
- 0.2.62 Add custom secret annotations snippet
- 0.2.63 Add custom job annotations snippet and wire it into job templates
- 0.2.64 Use custom secret annotations snippet in other secret templates
- 0.2.65 Escape special characters in password for DB connection
- 0.2.66 Align db scripts with sqlalchemy 2.0
- 0.2.67 Use quay.io/airshipit/kubernetes-entrypoint:latest-ubuntu_focal by default
- 0.2.68 Use quay.io/airshipit/kubernetes-entrypoint:latest-ubuntu_focal by default
- 0.2.69 Use quay.io/airshipit/kubernetes-entrypoint:latest-ubuntu_focal by default
- 0.2.70 Decode url-encoded password for rabbit connection
- 0.2.71 Add snippet with service parameters
- 0.2.72 Add snippet configmap_oslo_policy
- 0.2.73 Add ability to get multiple hosts endpoint
- 0.2.74 Remove trailing slash in endpoinds
- 0.2.75 Add daemonset_overrides_root util
- 0.2.76 update tookit to support fqdn alias
- 0.2.77 Add recommended kubernetes name label to pods definition
- 0.2.78 Fix db-init and db-drop scripts to make them work with sqlalchemy >2.0
- 0.2.79 Update Chart.yaml apiVersion to v2
- 2024.2.0 Update version to align with the Openstack release cycle

## 2024.2.0

Before 2024.2.0 all the OpenStack-Helm charts were versioned independently.
Here we provide all the release notes for the chart for all versions before 2024.2.0.
