docs: release notes for v0.8.0

Author: cardoe

changelog.d/20261016_120000_doug.goldstein_mariadb_operator_db_conn.md

@@ -25,6 +25,38 @@ off for it rather than for the prose above:
 <!-- markdownlint-disable MD033 MD022 -->
 <!-- scriv-insert-here -->
 
+<a id='changelog-v0.8.0'></a>
+## v0.8.0 — released 2026-10-29
+
+### Deploy repo changes
+
+Services are moving to get their `[database] connection` from the MariaDB operator instead of from a `<SERVICE>_DB_PASSWORD` Helm value. For each converted service the chart renders the `Database`, `User`, `Grant` and `Connection` resources, and the operator writes the connection string into the `<service>-db-conn` Secret, which is projected into every workload of that service that talks to the database. The service's `components/<service>/<service>-mariadb-db.yaml` is removed.
+
+Converted so far: Neutron, Placement, Glance, Keystone.
+
+The `<service>-db-password` Secret (`username` and `password` keys) is still read from your deploy repo, and the chart no longer renders it, so it must exist before this change syncs. Pods wait for `<service>-db-conn`, so a missing Secret shows up as pods stuck in `ContainerCreating`.
+
+Argo CD prunes the old `Grant` named `<service>-grant`; the chart's is named `<service>`. Check that both are Ready after the sync:
+
+```bash
+SERVICE=neutron  # or placement, glance, keystone
+kubectl -n openstack get database,user,grant,connection -l application=$SERVICE
+```
+
+The old `<service>-grant` can get stuck terminating. With `privileges: [ALL]` and `grantOption: true`, the operator's finalizer fails on delete with `Error 1064 ... near 'ON `<service>`.* FROM '<service>'@'%''` (seen on mariadb-operator 25.8.4). If `<service>-grant` is still present with a `deletionTimestamp`, revoke the privileges by hand and then remove the finalizer so the object can go away:
+
+```bash
+SERVICE=neutron  # or placement, glance, keystone
+kubectl mariadb -n openstack mariadb -e "REVOKE ALL PRIVILEGES, GRANT OPTION FROM '$SERVICE'@'%';"
+kubectl -n openstack patch grant $SERVICE-grant --type=merge -p '{"metadata":{"finalizers":null}}'
+```
+
+Set `SERVICE` to each converted service in turn.
+
+Patching the finalizer alone leaves the old grant in the database. The new `<service>` Grant re-applies the privileges for the same account.
+
+`<SERVICE>_DB_PASSWORD` in `secret-openstack.yaml` is no longer used by a converted service and can be removed from your deploy repo once every cluster is on this version.
+
 <a id='changelog-v0.7.0'></a>
 ## v0.7.0 — released 2026-10-26