chore(deps): update helm release openstack-helm/cinder to v2026.2.15+87bd2f7d3

changelog.d/20261104_130000_doug.goldstein_cinder_mariadb_operator_db_conn.md

@@ -0,0 +1,22 @@
+### Deploy repo changes
+
+Cinder now gets its `[database] connection` from the MariaDB operator instead of from the `CINDER_DB_PASSWORD` Helm value. The chart renders the `Database`, `User`, `Grant` and `Connection` resources, and the operator writes the connection string into the `cinder-db-conn` Secret, which is projected into every Cinder workload that talks to the database. `components/cinder/cinder-mariadb-db.yaml` is removed.
+
+The `cinder-db-password` Secret (`username` and `password` keys) is still read from your deploy repo, and the chart no longer renders it, so it must exist before this change syncs. Pods wait for `cinder-db-conn`, so a missing Secret shows up as pods stuck in `ContainerCreating`.
+
+Argo CD prunes the old `Grant` named `cinder-grant`; the chart's is named `cinder`. Check that both are Ready after the sync:
+
+```bash
+kubectl -n openstack get database,user,grant,connection -l application=cinder
+```
+
+The old `cinder-grant` can get stuck terminating. With `privileges: [ALL]` and `grantOption: true`, the operator's finalizer fails on delete with ``Error 1064 ... near 'ON `cinder`.* FROM 'cinder'@'%'' `` (seen on mariadb-operator 25.8.4). If `cinder-grant` is still present with a `deletionTimestamp`, revoke the privileges by hand and then remove the finalizer so the object can go away:
+
+```bash
+kubectl mariadb -n openstack mariadb -e "REVOKE ALL PRIVILEGES, GRANT OPTION FROM 'cinder'@'%';"
+kubectl -n openstack patch grant cinder-grant --type=merge -p '{"metadata":{"finalizers":null}}'
+```
+
+Patching the finalizer alone leaves the old grant in the database. The new `cinder` Grant re-applies the privileges for the same account.
+
+`CINDER_DB_PASSWORD` in `secret-openstack.yaml` is no longer used and can be removed from your deploy repo once every cluster is on this version.

charts/argocd-understack/values.yaml

@@ -374,7 +374,7 @@ site:
     wave: 2
     # -- Chart version for Cinder
     # renovate: datasource=helm depName=cinder registryUrl=https://tarballs.opendev.org/openstack/openstack-helm
-    chartVersion: 2026.1.73+a39ebbeb1
+    chartVersion: 2026.2.15+87bd2f7d3
 
   # -- Ironic (Bare Metal Service)
   ironic:

components/cinder/kustomization.yaml

@@ -3,5 +3,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - cinder-mariadb-db.yaml
   - cinder-rabbitmq-queue.yaml

components/cinder/values.yaml

@@ -14,6 +14,11 @@ conf:
       volume_backend_name: netapp_nvme
       volume_driver: cinder_understack.dynamic_netapp_driver.NetappCinderDynamicDriver
   cinder:
+    database:
+      # The MariaDB operator writes the connection string into the
+      # cinder-db-conn secret, which the chart projects into the config
+      # directory, so the chart must not generate one from the DB password.
+      connection: null
     DEFAULT:
       enabled_backends: netapp_nvme
       default_volume_type: __DEFAULT__
@@ -182,13 +187,26 @@ dependencies:
       services: []
 
 
+# The chart declares the Database, User, Grant and Connection resources instead
+# of the db-init job. The password is read from the cinder-db-password secret
+# in the deploy repo rather than rendered from Helm values.
+mariadb_db:
+  api_group: k8s.mariadb.com
+  # the MariaDB resource is named mariadb, while clients connect through the
+  # mariadb-primary service set in endpoints.oslo_db.hosts
+  mariadb_ref: mariadb
+  password_secret:
+    create: false
+
 manifests:
   job_backup_storage_init: false
   job_bootstrap: false
   job_clean: false
   job_db_init: false
   job_db_drop: false
+  mariadb_db: true
   job_rabbit_init: false
+  rabbitmq_topology: false
   job_storage_init: false
   pod_rally_test: false
   secret_db: false

components/openstack-secrets.tpl.yaml

@@ -30,9 +30,6 @@ endpoints:
       # this is what the horizon dashboard service uses to connect to MariaDB
       horizon:
         password: "${HORIZON_DB_PASSWORD}"
-      # this is what the cinder service uses to connect to MariaDB
-      cinder:
-        password: "${CINDER_DB_PASSWORD}"
       # this is what the octavia service uses to connect to MariaDB
       octavia:
         password: "${OCTAVIA_DB_PASSWORD}"