# Release notes

## 2026.1.0-72

- Use a dedicated client certificate when connecting to MariaDB over TLS
  instead of reusing the MariaDB server certificate on the client side. The
  MariaDB connection TLS is now gated on the `tls.oslo_db` value so it can be
  enabled independently of other TLS settings.
- Use a single dedicated client certificate (manila-client) for all mutual TLS
  backend connections (MariaDB and RabbitMQ) instead of rendering separate
  certificates, and allow enabling mutual TLS to RabbitMQ independently via
  the tls.oslo_messaging value. The MariaDB client certificate secret was
  renamed from manila-mariadb-client to manila-client.
- Add an optional StatefulSet manifest for the manila-share service, gated
  by ``manifests.statefulset_share`` (disabled by default). When enabled,
  the existing ``deployment_share`` manifest is suppressed and each pod
  gets a stable, unique hostname (manila-share-0, manila-share-1, ...).
  If ``conf.manila.DEFAULT.host`` is left empty, each pod uses its own pod
  name as the backend host, which is the supported way to run more than
  one manila-share replica. The static ``host: manila-share-worker``
  default remains and is only safe with a single replica.
- Removed the trivial per-daemon start scripts. The daemon commands
  are now specified inline as the container ``command`` in the
  Deployment, DaemonSet and StatefulSet manifests, dropping the
  ConfigMap data entry and ``/tmp/*.sh`` volume mount for each.
- Add database purge CronJob for Manila. This job allows for the automated
  purging of soft-deleted database records in Manila, helping to manage
  database size and performance over time.
- When host is not explicitly configured, Manila uses the pod name as the backend host.
  In Kubernetes deployments this causes the host value to change whenever the pod is
  recreated, which breaks persistence and backend association behavior.
  
  Use a stable value (host: manila-share-worker) similar to the existing approach
  used in the Cinder chart. This avoids host changes across pod restarts while
  preserving consistent backend identity until proper clustered support is adopted.
- Removed the unused ``endpoints.oslo_db.auth.admin.secret.tls`` metadata and
  the orphaned oslo_db client-certificate volume in the share statefulset;
  the shared ``client-certs`` volume (from ``secrets.tls.client.manila``) is
  used instead.
- Add configurable terminationGracePeriodSeconds for manila-api to improve
  reliability during upgrades and maintenance. The value can be configured
  via values.yaml.

### New Features

- The ``helm-toolkit.manifests.certificates`` template now accepts an
  optional ``secretName`` parameter. When provided, it sets the name of the
  rendered cert-manager ``Certificate`` (both ``metadata.name`` and
  ``spec.secretName``) instead of deriving it from the endpoint's
  ``host_fqdn_override.default.tls.secretName``.

### Upgrade Notes

- The charts no longer render ``Ingress`` resources, nor the auxiliary
  ``Service`` objects and TLS secrets that used to back them. Charts now
  deploy only the applications and their ClusterIP ``Service`` objects.
  Expose services outside the cluster by supplying the necessary objects
  through the ``.Values.extraObjects`` field, for example a Gateway API
  ``HTTPRoute`` (plus a ``BackendTLSPolicy`` for backend re-encryption) or,
  if preferred, an ``Ingress`` together with its ``Service``. Ready-to-use
  Gateway API examples are provided under
  ``values_overrides/<chart>/gateway.yaml``.
- The mTLS client certificate that each chart presents on outbound
  connections to MariaDB and RabbitMQ is now named after the chart-local
  value ``secrets.tls.client.<chart>`` rather than the shared
  ``endpoints.oslo_db.host_fqdn_override.default.tls.secretName``. This
  prevents a name collision for deployments whose values tooling renders
  endpoints from a single shared endpoint catalog, where the ``oslo_db``
  endpoint (and therefore its ``secretName``) is identical across every
  chart. The pod ``client-certs`` volume already references the same
  chart-local value, so the certificate and its mount remain in lockstep.
  No action is required for existing deployments: the default
  ``secrets.tls.client.<chart>`` value matches the previously rendered
  certificate name.

### API Changes

- Removed all ingress-related values from the charts: the
  ``manifests.ingress*``, ``manifests.service_ingress*`` and
  ``manifests.secret_ingress_tls`` toggles, the ``endpoints.ingress``
  controller endpoint and the ``network.<service>.ingress`` blocks. The
  now-unused ``helm-toolkit.manifests.ingress``,
  ``helm-toolkit.manifests.service_ingress`` and
  ``helm-toolkit.manifests.secret_ingress_tls`` helpers were removed as well.

### Bug Fixes

- Populate ``[cache] memcache_servers`` from the ``oslo_cache`` internal
  memcache endpoint for heat, neutron, trove, and zaqar when a cache section
  exists and ``memcache_servers`` has not already been set by user overrides.
  
  This brings these charts in line with other OpenStack-Helm services that
  already populate ``memcache_servers`` from the ``oslo_cache`` endpoint while
  keeping explicit overrides authoritative.

## 2026.1.0

- This change enhances the flexibility of the Manila Chart by introducing
  configurability for the CephFS backend. Previously, CephFS-related configuration values
  were statically defined within the manifests, limiting deployment customization.
  With this update, CephFS backend parameters can now be overridden via values.
- Add support for the Ceph File System (CephFS) backend in the manila.
- Allow users to add additional sources to the Projected Volume that is mounted
  at /etc/manila/manila.conf.d/ so they may more easily override configs or provide
  additional configs for the various services in the chart.

### New Features

- Update default ingress classes and annotations for charts to make them implementation
  agnostic. They used to be nginx specific because we always used ingress-nginx as the most
  common choice. Ingress-nginx is deprecated and will become unmaintained in Feb/2026.
  
  Now for all test jobs we use HAProxy Ingress as the default implementation. However any
  other implementation can be used as far as it suppports annotations similar to
  'nginx.ingress.kubernetes.io/rewrite-target' or 'haproxy.org/path-rewrite' which are
  used in many OpenStack-Helm charts.
- Added an extraObjects list to every chart to allow for adding extra
  Kubernetes objects along side the chart without modifying the chart.
  It has the added benefit of using Helm's built in templating so
  you are able to utilize other values supplied to the chart.
- Added emptyDir mounted at /var/lock and set OSLO_LOCK_PATH env var to
  this path for oslo.concurrency support in all OpenStack services.

### Upgrade Notes

- Support for Helm 2 has been removed by removal of the helm3_hook value across all charts.
  It is no longer possible to set helm3_hook to False to support Helm 2.

## 2025.2.0

- Fix Rally test pod template
- Use Manila API module for UWSGI configuration because WSGI script
  manila-wsgi has been removed.

### New Features

- Update apparmor values to use security_context instead of annotations.
- Add support for runtimeClassName and priorityClassName

## 2025.1.0

- Use more standard DB config setting

## 2024.2.0

Before 2024.2.0 all the OpenStack-Helm charts were versioned independently.
Here we provide all the release notes for the chart for all versions before 2024.2.0.

- 0.1.0 Initial Chart
- 0.1.1 Define service_type in keystone_authtoken to support application credentials with access rules
- 0.1.2 Add Zed overrides
- 0.1.3 Add 2023.1 overrides
- 0.1.4 Add Ubuntu Jammy overrides
- 0.1.5 Update port name of service-api.yaml
- 0.1.6 Add 2023.2 Ubuntu Jammy overrides
- 0.1.7 Properly config network host for share service
- 0.1.8 uses uWSGI for API service
- 0.1.9 Enable custom annotations for Openstack pods
- 0.1.10 Add 2024.1 overrides
- 0.1.11 Enable custom annotations for Openstack secrets
- 0.1.12 Update images used by default
- 0.1.13 Use quay.io/airshipit/kubernetes-entrypoint:latest-ubuntu_focal by default
- 0.1.14 Add 2024.2 Ubuntu Jammy overrides
- 0.1.15 Update Chart.yaml apiVersion to v2
- 2024.2.0 Update version to align with the Openstack release cycle
