# Release notes

## 2026.1.0-87

- Removed the trivial per-daemon start scripts. The daemon commands
  are now specified inline as the container ``command`` in the
  Deployment, DaemonSet and StatefulSet manifests, dropping the
  ConfigMap data entry and ``/tmp/*.sh`` volume mount for each.
- Adds a new DaemonSet template for ovn-bgp-agent, gated on
  `manifests.daemonset_ovn_bgp_agent`. The agent runs on nodes where both
  openvswitch and ovn-controller are deployed. The template includes a
  sidecar for frr, which is gated on `sidecars.frr` and defaults to false.
- Add support for ``ovn-chassis-mac-mappings`` configuration on the OVN
  chassis. This is required for VLAN tenant networks in OVN; without it,
  traffic on VLAN tenant networks is silently dropped.
  
  Two new configuration options are introduced:
  
  * ``conf.ovn_chassis_mac_mappings``: explicitly set the MAC mappings,
    e.g. ``physnet1:fa:16:3e:aa:bb:cc``.
  * ``conf.auto_chassis_mac_mappings``: when ``true``,
    auto-generate a deterministic locally-administered unicast MAC per
    provider network per chassis using a hash of the hostname and physnet
    name. This guarantees a unique MAC per node without requiring manual
    per-node configuration.
  
  Both options are disabled by default to maintain backward compatibility.

### New Features

- The ``helm-toolkit.manifests.certificates`` template now accepts an
  optional ``secretName`` parameter. When provided, it sets the name of the
  rendered cert-manager ``Certificate`` (both ``metadata.name`` and
  ``spec.secretName``) instead of deriving it from the endpoint's
  ``host_fqdn_override.default.tls.secretName``.

### Upgrade Notes

- The charts no longer render ``Ingress`` resources, nor the auxiliary
  ``Service`` objects and TLS secrets that used to back them. Charts now
  deploy only the applications and their ClusterIP ``Service`` objects.
  Expose services outside the cluster by supplying the necessary objects
  through the ``.Values.extraObjects`` field, for example a Gateway API
  ``HTTPRoute`` (plus a ``BackendTLSPolicy`` for backend re-encryption) or,
  if preferred, an ``Ingress`` together with its ``Service``. Ready-to-use
  Gateway API examples are provided under
  ``values_overrides/<chart>/gateway.yaml``.
- The mTLS client certificate that each chart presents on outbound
  connections to MariaDB and RabbitMQ is now named after the chart-local
  value ``secrets.tls.client.<chart>`` rather than the shared
  ``endpoints.oslo_db.host_fqdn_override.default.tls.secretName``. This
  prevents a name collision for deployments whose values tooling renders
  endpoints from a single shared endpoint catalog, where the ``oslo_db``
  endpoint (and therefore its ``secretName``) is identical across every
  chart. The pod ``client-certs`` volume already references the same
  chart-local value, so the certificate and its mount remain in lockstep.
  No action is required for existing deployments: the default
  ``secrets.tls.client.<chart>`` value matches the previously rendered
  certificate name.

### API Changes

- Removed all ingress-related values from the charts: the
  ``manifests.ingress*``, ``manifests.service_ingress*`` and
  ``manifests.secret_ingress_tls`` toggles, the ``endpoints.ingress``
  controller endpoint and the ``network.<service>.ingress`` blocks. The
  now-unused ``helm-toolkit.manifests.ingress``,
  ``helm-toolkit.manifests.service_ingress`` and
  ``helm-toolkit.manifests.secret_ingress_tls`` helpers were removed as well.

### Bug Fixes

- Populate ``[cache] memcache_servers`` from the ``oslo_cache`` internal
  memcache endpoint for heat, neutron, trove, and zaqar when a cache section
  exists and ``memcache_servers`` has not already been set by user overrides.
  
  This brings these charts in line with other OpenStack-Helm services that
  already populate ``memcache_servers`` from the ``oslo_cache`` endpoint while
  keeping explicit overrides authoritative.

## 2026.1.0

- Add missing apiVersion and kind to volumeClaimTemplates for ovn-ovsdb-nb and ovn-ovsdb-sb StatefulSet.
- Add support for overriding OVN environment variables.
  OVN relies on environment variables to control the behavior of its services.
  This allowing users to override these variables enables finer tuning of OVN
  services when needed.
- Add support for ovn_monitor_all.
- Update Ceph to Tentacle 20.2.0 and replaced image sources from docker.io/openstackhelm with quay.io/airshipit
- Use `ip add replace` instead of `ip addr add` in the init script to
  make it idempotent and avoid errors when the script tries to assign
  the same IP address to the interface on subsequent runs.

### New Features

- Update default ingress classes and annotations for charts to make them implementation
  agnostic. They used to be nginx specific because we always used ingress-nginx as the most
  common choice. Ingress-nginx is deprecated and will become unmaintained in Feb/2026.
  
  Now for all test jobs we use HAProxy Ingress as the default implementation. However any
  other implementation can be used as far as it suppports annotations similar to
  'nginx.ingress.kubernetes.io/rewrite-target' or 'haproxy.org/path-rewrite' which are
  used in many OpenStack-Helm charts.
- Added an extraObjects list to every chart to allow for adding extra
  Kubernetes objects along side the chart without modifying the chart.
  It has the added benefit of using Helm's built in templating so
  you are able to utilize other values supplied to the chart.
- Added emptyDir mounted at /var/lock and set OSLO_LOCK_PATH env var to
  this path for oslo.concurrency support in all OpenStack services.

### Upgrade Notes

- Support for Helm 2 has been removed by removal of the helm3_hook value across all charts.
  It is no longer possible to set helm3_hook to False to support Helm 2.

## 2025.2.0

- Update system id annotation key. This is to align with the
  openstack-helm-infra repo retirement.
- This change introduces the use of a PersistentVolumeClaim (PVC) mounted at /var/lib/ovn
  to store OVN database files (ovnnb_db.db and ovnsb_db.db). Previously, the OVN databases
  were stored on ephemeral pod storage, which caused the databases to be lost whenever the
  OVN pods were restarted. This resulted in network outages and forced a full synchronization
  between the Neutron database and OVN, impacting cluster stability.
  The issue was introduced by commit ffd183a164be190afcc2ce4de27de7e72ab8d386, which caused
  problems during OVN upgrades due to the lack of persistent storage.
  By storing the OVN databases on a persistent volume, pod restarts and upgrades can be
  performed safely without data loss or network disruption.
- Add a missing support for oci_image_registry.

### New Features

- Update apparmor values to use security_context instead of annotations.
- Add support for runtimeClassName and priorityClassName

## 2025.1.0

- Add OVN Kubernetes support
- Add OVN network logging parser
- 0.1.0 Add OVN!
- 0.1.1 Fix ovn db persistence issue
- 0.1.2 Add bridge-mapping configuration
- 0.1.3 Fix system-id reuse
- 0.1.4 Add support for OVN HA + refactor
- 0.1.5 Add ubuntu_focal and ubuntu_jammy overrides
- 0.1.6 Fix ovsdb port number
- 0.1.7 Use host network for ovn controller pods
- 0.1.8 Fix attaching interfaces to the bridge
- 0.1.9 Make ovn db file path as configurable
- 0.1.10 Fix typo in the controller init script
- 0.1.11 Use quay.io/airshipit/kubernetes-entrypoint:latest-ubuntu_focal by default
- 0.1.12 Fix oci_image_registry secret name
- 0.1.13 Allow share OVN DB NB/SB socket
- 0.1.14 Make the label for OVN controller gateway configurable
- 0.1.15 Fix resources
- 0.1.16 Update Chart.yaml apiVersion to v2
- 2024.2.0 Update version to align with the Openstack release cycle

### New Features

- Implement daemonset overrides

## 2024.2.0

Before 2024.2.0 all the OpenStack-Helm charts were versioned independently.
Here we provide all the release notes for the chart for all versions before 2024.2.0.
