feat(neutron): let the MariaDB operator render the database connection

Have the neutron chart declare the Database, User, Grant and Connection
resources and project the operator-written neutron-db-conn secret into
every workload that talks to the database, instead of generating a
[database] connection from the NEUTRON_DB_PASSWORD Helm value.

The password is read from the existing neutron-db-password secret
(mariadb_db.password_secret.create: false) and the resources attach to
the MariaDB named mariadb (mariadb_ref) while clients keep connecting
through the mariadb-primary service.

This needs a neutron chart carrying the mariadb_db.password_secret and
mariadb_db.mariadb_ref values; the chart pin must be bumped before this
syncs. components/neutron/neutron-mariadb-db.yaml is no longer needed
and NEUTRON_DB_PASSWORD is dropped from openstack-secrets.tpl.yaml.

Author: cardoe

changelog.d/20261016_120000_doug.goldstein_neutron_db_conn_snippet.md

@@ -0,0 +1,13 @@
+### Deploy repo changes
+
+Neutron now gets its `[database] connection` from the MariaDB operator instead of from the `NEUTRON_DB_PASSWORD` Helm value. The chart renders the `Database`, `User`, `Grant` and `Connection` resources, and the operator writes the connection string into the `neutron-db-conn` Secret, which is projected into every Neutron workload that talks to the database. `components/neutron/neutron-mariadb-db.yaml` is removed.
+
+The `neutron-db-password` Secret (`username` and `password` keys) is still read from your deploy repo, and the chart no longer renders it, so it must exist before this change syncs. Neutron pods wait for `neutron-db-conn`, so a missing Secret shows up as pods stuck in `ContainerCreating`.
+
+Argo CD prunes the old `Grant` named `neutron-grant`; the chart's is named `neutron`. Check that both are Ready after the sync:
+
+```bash
+kubectl -n openstack get database,user,grant,connection -l application=neutron
+```
+
+`NEUTRON_DB_PASSWORD` in `secret-openstack.yaml` is no longer used by Neutron and can be removed from your deploy repo once every cluster is on this version.

charts/argocd-understack/values.yaml

@@ -404,7 +404,7 @@ site:
     wave: 2
     # -- Chart version for Neutron
     # renovate: datasource=helm depName=neutron registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
-    chartVersion: 2026.1.107+a39ebbeb1
+    chartVersion: 2026.2.1+b90c3a6ab
 
   # -- Placement (Placement Service)
   placement:

components/neutron/kustomization.yaml

@@ -3,6 +3,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - neutron-mariadb-db.yaml
   - neutron-rabbitmq-queue.yaml
   - job-neutron-post-deploy.yaml

components/neutron/neutron-mariadb-db.yaml

@@ -69,6 +69,11 @@ conf:
         #ovn_nb_connection: "tcp:ovn-ovsdb-nb.openstack.svc:6641"
         #ovn_sb_connection: "tcp:ovn-ovsdb-sb.openstack.svc:6642"
   neutron:
+    database:
+      # The MariaDB operator writes the connection string into the
+      # neutron-db-conn secret, which is projected into the config directory
+      # below, so the chart must not generate one from the DB password.
+      connection: null
     DEFAULT:
       # https://docs.openstack.org/neutron/latest/admin/config-wsgi.html
       # the api_workers set the number of uWSGI processes as well
@@ -157,21 +162,34 @@ pod:
     neutron_db_sync:
       - secret:
           name: neutron-ks-etc
+      - secret:
+          name: neutron-db-conn
     neutron_ironic_agent:
       - secret:
           name: neutron-ks-etc
     neutron_server:
       - secret:
           name: neutron-ks-etc
+      - secret:
+          name: neutron-db-conn
     neutron_ovn_maintenance_worker:
       - secret:
           name: neutron-ks-etc
+      - secret:
+          name: neutron-db-conn
     neutron_rpc_server:
       - secret:
           name: neutron-ks-etc
+      - secret:
+          name: neutron-db-conn
     neutron_periodic_worker:
       - secret:
           name: neutron-ks-etc
+      - secret:
+          name: neutron-db-conn
+    neutron_ovn_db_sync:
+      - secret:
+          name: neutron-db-conn
 
   use_fqdn:
     neutron_agent: false
@@ -310,8 +328,20 @@ dependencies:
       services: []
 
 
+# The chart declares the Database, User, Grant and Connection resources instead
+# of the db-init job. The password is read from the neutron-db-password secret
+# in the deploy repo rather than rendered from Helm values.
+mariadb_db:
+  api_group: k8s.mariadb.com
+  # the MariaDB resource is named mariadb, while clients connect through the
+  # mariadb-primary service set in endpoints.oslo_db.hosts
+  mariadb_ref: mariadb
+  password_secret:
+    create: false
+
 manifests:
   job_db_init: false
+  mariadb_db: true
   job_rabbit_init: false
   pod_rally_test: false
   secret_db: false

components/neutron/values.yaml

@@ -30,9 +30,6 @@ endpoints:
       # this is what the ironic service uses to connect to MariaDB
       ironic:
         password: "${IRONIC_DB_PASSWORD}"
-      # this is what the neutron service uses to connect to MariaDB
-      neutron:
-        password: "${NEUTRON_DB_PASSWORD}"
       # this is what the nova service uses to connect to MariaDB
       nova:
         password: "${NOVA_DB_PASSWORD}"