@@ -15,9 +15,9 @@
 format = md
 fragment_directory = changelog.d
 
-; The current series page. Bump this to release-notes/v0.8.md when the v0.8
+; The current series page. Bump this to release-notes/v0.9.md when the v0.9
 ; series opens -- it is the only edit a minor release needs here.
-changelog = docs/release-notes/v0.7.md
+changelog = docs/release-notes/v0.8.md
 
 ; Categories are headings inside the fragment, not part of its filename. Keep
 ; this list in sync with new_fragment.md.j2 and with unreleased.ini.
 
@@ -20,7 +20,8 @@ requests in a given tag, see the
 
 | Series | Status |
 | ------ | ------ |
-| [v0.7.x](v0.7.md) | Current |
+| [v0.8.x](v0.8.md) | Current |
+| [v0.7.x](v0.7.md) | Maintenance |
 | [v0.6.x](v0.6.md) | Maintenance |
 | [v0.5.x](v0.5.md) | Maintenance |
 | [v0.4.x](v0.4.md) | Maintenance |
 
@@ -1,3 +1,33 @@
+<!--
+Do not add or edit version sections in this file by hand. They are assembled by
+scriv from the fragments in changelog.d/ when a release is tagged.
+
+Adding a note? Run `scriv create` from the repository root and edit the fragment
+it generates, in the same pull request as your change. See RELEASING.md.
+-->
+# Release Notes: v0.8.x
+
+Operator-facing upgrade notes for the v0.8 series, newest first. See the
+[Release Notes index](index.md) for how to read these pages.
+
+Changes that have merged to `main` but are not yet in a tagged release are on
+the [Unreleased](unreleased.md) page.
+
+<!--
+Everything below this point is generated by scriv, so two rules are switched
+off for it rather than for the prose above:
+
+  MD033 -- scriv writes an <a id="..."> anchor before each version heading so
+           the GitHub release body can link straight to it.
+  MD022 -- it writes that anchor on the line immediately above the heading,
+           with no blank line between them.
+-->
+<!-- markdownlint-disable MD033 MD022 -->
+<!-- scriv-insert-here -->
+
+<a id='changelog-v0.8.0'></a>
+## v0.8.0 — released 2026-10-29
+
 ### Deploy repo changes
 
 Services are moving to get their `[database] connection` from the MariaDB operator instead of from a `<SERVICE>_DB_PASSWORD` Helm value. For each converted service the chart renders the `Database`, `User`, `Grant` and `Connection` resources, and the operator writes the connection string into the `<service>-db-conn` Secret, which is projected into every workload of that service that talks to the database. The service's `components/<service>/<service>-mariadb-db.yaml` is removed.
@@ -13,7 +43,7 @@ SERVICE=neutron  # or placement, glance, keystone
 kubectl -n openstack get database,user,grant,connection -l application=$SERVICE
 ```
 
-The old `<service>-grant` can get stuck terminating. With `privileges: [ALL]` and `grantOption: true`, the operator's finalizer fails on delete with `Error 1064 ... near 'ON `<service>`.* FROM '<service>'@'%''` (seen on mariadb-operator 25.8.4). If `<service>-grant` is still present with a `deletionTimestamp`, revoke the privileges by hand and then remove the finalizer so the object can go away:
+The old `<service>-grant` can get stuck terminating. With `privileges: [ALL]` and `grantOption: true`, the operator's finalizer fails on delete with ``Error 1064 ... near 'ON `<service>`.* FROM '<service>'@'%''`` (seen on mariadb-operator 25.8.4). If `<service>-grant` is still present with a `deletionTimestamp`, revoke the privileges by hand and then remove the finalizer so the object can go away:
 
 ```bash
 SERVICE=neutron  # or placement, glance, keystone
 
@@ -223,6 +223,7 @@ nav:
     - release-notes/index.md
     # generated by `make unreleased-notes` from changelog.d/, gitignored
     - release-notes/unreleased.md
+    - release-notes/v0.8.md
     - release-notes/v0.7.md
     - release-notes/v0.6.md
     - release-notes/v0.5.md