diff --git a/api/bases/cinder.openstack.org_cinderapis.yaml b/api/bases/cinder.openstack.org_cinderapis.yaml
index 1f51f92d8..a6878de2b 100644
--- a/api/bases/cinder.openstack.org_cinderapis.yaml
+++ b/api/bases/cinder.openstack.org_cinderapis.yaml
@@ -48,11 +48,11 @@ spec:
                 items:
                   type: string
                 type: array
-              databaseHostname:
-                type: string
-              databaseUser:
+              databaseAccount:
                 default: cinder
                 type: string
+              databaseHostname:
+                type: string
               debug:
                 properties:
                   service:
@@ -876,12 +876,8 @@ spec:
                 type: object
               passwordSelectors:
                 default:
-                  database: CinderDatabasePassword
                   service: CinderPassword
                 properties:
-                  database:
-                    default: CinderDatabasePassword
-                    type: string
                   service:
                     default: CinderPassword
                     type: string
diff --git a/api/bases/cinder.openstack.org_cinderbackups.yaml b/api/bases/cinder.openstack.org_cinderbackups.yaml
index d1df4a27b..278c85ced 100644
--- a/api/bases/cinder.openstack.org_cinderbackups.yaml
+++ b/api/bases/cinder.openstack.org_cinderbackups.yaml
@@ -48,11 +48,11 @@ spec:
                 items:
                   type: string
                 type: array
-              databaseHostname:
-                type: string
-              databaseUser:
+              databaseAccount:
                 default: cinder
                 type: string
+              databaseHostname:
+                type: string
               debug:
                 properties:
                   service:
@@ -825,12 +825,8 @@ spec:
                 type: object
               passwordSelectors:
                 default:
-                  database: CinderDatabasePassword
                   service: CinderPassword
                 properties:
-                  database:
-                    default: CinderDatabasePassword
-                    type: string
                   service:
                     default: CinderPassword
                     type: string
diff --git a/api/bases/cinder.openstack.org_cinders.yaml b/api/bases/cinder.openstack.org_cinders.yaml
index 208f7d561..810c4f686 100644
--- a/api/bases/cinder.openstack.org_cinders.yaml
+++ b/api/bases/cinder.openstack.org_cinders.yaml
@@ -362,11 +362,11 @@ spec:
                 type: object
               customServiceConfig:
                 type: string
-              databaseInstance:
-                type: string
-              databaseUser:
+              databaseAccount:
                 default: cinder
                 type: string
+              databaseInstance:
+                type: string
               dbPurge:
                 properties:
                   age:
@@ -1151,12 +1151,8 @@ spec:
                 type: object
               passwordSelectors:
                 default:
-                  database: CinderDatabasePassword
                   service: CinderPassword
                 properties:
-                  database:
-                    default: CinderDatabasePassword
-                    type: string
                   service:
                     default: CinderPassword
                     type: string
diff --git a/api/bases/cinder.openstack.org_cinderschedulers.yaml b/api/bases/cinder.openstack.org_cinderschedulers.yaml
index ffbbf26d5..2b3173843 100644
--- a/api/bases/cinder.openstack.org_cinderschedulers.yaml
+++ b/api/bases/cinder.openstack.org_cinderschedulers.yaml
@@ -48,11 +48,11 @@ spec:
                 items:
                   type: string
                 type: array
-              databaseHostname:
-                type: string
-              databaseUser:
+              databaseAccount:
                 default: cinder
                 type: string
+              databaseHostname:
+                type: string
               debug:
                 properties:
                   service:
@@ -825,12 +825,8 @@ spec:
                 type: object
               passwordSelectors:
                 default:
-                  database: CinderDatabasePassword
                   service: CinderPassword
                 properties:
-                  database:
-                    default: CinderDatabasePassword
-                    type: string
                   service:
                     default: CinderPassword
                     type: string
diff --git a/api/bases/cinder.openstack.org_cindervolumes.yaml b/api/bases/cinder.openstack.org_cindervolumes.yaml
index 50f31a5ba..fc8777049 100644
--- a/api/bases/cinder.openstack.org_cindervolumes.yaml
+++ b/api/bases/cinder.openstack.org_cindervolumes.yaml
@@ -48,11 +48,11 @@ spec:
                 items:
                   type: string
                 type: array
-              databaseHostname:
-                type: string
-              databaseUser:
+              databaseAccount:
                 default: cinder
                 type: string
+              databaseHostname:
+                type: string
               debug:
                 properties:
                   service:
@@ -825,12 +825,8 @@ spec:
                 type: object
               passwordSelectors:
                 default:
-                  database: CinderDatabasePassword
                   service: CinderPassword
                 properties:
-                  database:
-                    default: CinderDatabasePassword
-                    type: string
                   service:
                     default: CinderPassword
                     type: string
diff --git a/api/v1beta1/common_types.go b/api/v1beta1/common_types.go
index e2f6358ad..ce4a20c44 100644
--- a/api/v1beta1/common_types.go
+++ b/api/v1beta1/common_types.go
@@ -29,17 +29,16 @@ type CinderTemplate struct {
 
 	// +kubebuilder:validation:Optional
 	// +kubebuilder:default=cinder
-	// DatabaseUser - optional username used for cinder DB, defaults to cinder
-	// TODO: -> implement needs work in mariadb-operator, right now only cinder
-	DatabaseUser string `json:"databaseUser"`
+	// DatabaseAccount - optional MariaDBAccount used for cinder DB, defaults to cinder
+	DatabaseAccount string `json:"databaseAccount"`
 
 	// +kubebuilder:validation:Required
-	// Secret containing OpenStack password information for CinderDatabasePassword
+	// Secret containing OpenStack password information
 	Secret string `json:"secret"`
 
 	// +kubebuilder:validation:Optional
-	// +kubebuilder:default={database: CinderDatabasePassword, service: CinderPassword}
-	// PasswordSelectors - Selectors to identify the DB and ServiceUser password from the Secret
+	// +kubebuilder:default={service: CinderPassword}
+	// PasswordSelectors - Selectors to identify the ServiceUser password from the Secret
 	PasswordSelectors PasswordSelector `json:"passwordSelectors"`
 }
 
@@ -84,11 +83,6 @@ type CinderServiceTemplate struct {
 
 // PasswordSelector to identify the DB and AdminUser password from the Secret
 type PasswordSelector struct {
-	// +kubebuilder:validation:Optional
-	// +kubebuilder:default="CinderDatabasePassword"
-	// Database - Selector to get the cinder database user password from the Secret
-	// TODO: not used, need change in mariadb-operator
-	Database string `json:"database"`
 	// +kubebuilder:validation:Optional
 	// +kubebuilder:default="CinderPassword"
 	// Service - Selector to get the cinder service password from the Secret
diff --git a/config/crd/bases/cinder.openstack.org_cinderapis.yaml b/config/crd/bases/cinder.openstack.org_cinderapis.yaml
index 1f51f92d8..a6878de2b 100644
--- a/config/crd/bases/cinder.openstack.org_cinderapis.yaml
+++ b/config/crd/bases/cinder.openstack.org_cinderapis.yaml
@@ -48,11 +48,11 @@ spec:
                 items:
                   type: string
                 type: array
-              databaseHostname:
-                type: string
-              databaseUser:
+              databaseAccount:
                 default: cinder
                 type: string
+              databaseHostname:
+                type: string
               debug:
                 properties:
                   service:
@@ -876,12 +876,8 @@ spec:
                 type: object
               passwordSelectors:
                 default:
-                  database: CinderDatabasePassword
                   service: CinderPassword
                 properties:
-                  database:
-                    default: CinderDatabasePassword
-                    type: string
                   service:
                     default: CinderPassword
                     type: string
diff --git a/config/crd/bases/cinder.openstack.org_cinderbackups.yaml b/config/crd/bases/cinder.openstack.org_cinderbackups.yaml
index d1df4a27b..278c85ced 100644
--- a/config/crd/bases/cinder.openstack.org_cinderbackups.yaml
+++ b/config/crd/bases/cinder.openstack.org_cinderbackups.yaml
@@ -48,11 +48,11 @@ spec:
                 items:
                   type: string
                 type: array
-              databaseHostname:
-                type: string
-              databaseUser:
+              databaseAccount:
                 default: cinder
                 type: string
+              databaseHostname:
+                type: string
               debug:
                 properties:
                   service:
@@ -825,12 +825,8 @@ spec:
                 type: object
               passwordSelectors:
                 default:
-                  database: CinderDatabasePassword
                   service: CinderPassword
                 properties:
-                  database:
-                    default: CinderDatabasePassword
-                    type: string
                   service:
                     default: CinderPassword
                     type: string
diff --git a/config/crd/bases/cinder.openstack.org_cinders.yaml b/config/crd/bases/cinder.openstack.org_cinders.yaml
index 208f7d561..810c4f686 100644
--- a/config/crd/bases/cinder.openstack.org_cinders.yaml
+++ b/config/crd/bases/cinder.openstack.org_cinders.yaml
@@ -362,11 +362,11 @@ spec:
                 type: object
               customServiceConfig:
                 type: string
-              databaseInstance:
-                type: string
-              databaseUser:
+              databaseAccount:
                 default: cinder
                 type: string
+              databaseInstance:
+                type: string
               dbPurge:
                 properties:
                   age:
@@ -1151,12 +1151,8 @@ spec:
                 type: object
               passwordSelectors:
                 default:
-                  database: CinderDatabasePassword
                   service: CinderPassword
                 properties:
-                  database:
-                    default: CinderDatabasePassword
-                    type: string
                   service:
                     default: CinderPassword
                     type: string
diff --git a/config/crd/bases/cinder.openstack.org_cinderschedulers.yaml b/config/crd/bases/cinder.openstack.org_cinderschedulers.yaml
index ffbbf26d5..2b3173843 100644
--- a/config/crd/bases/cinder.openstack.org_cinderschedulers.yaml
+++ b/config/crd/bases/cinder.openstack.org_cinderschedulers.yaml
@@ -48,11 +48,11 @@ spec:
                 items:
                   type: string
                 type: array
-              databaseHostname:
-                type: string
-              databaseUser:
+              databaseAccount:
                 default: cinder
                 type: string
+              databaseHostname:
+                type: string
               debug:
                 properties:
                   service:
@@ -825,12 +825,8 @@ spec:
                 type: object
               passwordSelectors:
                 default:
-                  database: CinderDatabasePassword
                   service: CinderPassword
                 properties:
-                  database:
-                    default: CinderDatabasePassword
-                    type: string
                   service:
                     default: CinderPassword
                     type: string
diff --git a/config/crd/bases/cinder.openstack.org_cindervolumes.yaml b/config/crd/bases/cinder.openstack.org_cindervolumes.yaml
index 50f31a5ba..fc8777049 100644
--- a/config/crd/bases/cinder.openstack.org_cindervolumes.yaml
+++ b/config/crd/bases/cinder.openstack.org_cindervolumes.yaml
@@ -48,11 +48,11 @@ spec:
                 items:
                   type: string
                 type: array
-              databaseHostname:
-                type: string
-              databaseUser:
+              databaseAccount:
                 default: cinder
                 type: string
+              databaseHostname:
+                type: string
               debug:
                 properties:
                   service:
@@ -825,12 +825,8 @@ spec:
                 type: object
               passwordSelectors:
                 default:
-                  database: CinderDatabasePassword
                   service: CinderPassword
                 properties:
-                  database:
-                    default: CinderDatabasePassword
-                    type: string
                   service:
                     default: CinderPassword
                     type: string
diff --git a/config/samples/cinder_v1beta1_cinder.yaml b/config/samples/cinder_v1beta1_cinder.yaml
index 69b4e936a..adf895f50 100644
--- a/config/samples/cinder_v1beta1_cinder.yaml
+++ b/config/samples/cinder_v1beta1_cinder.yaml
@@ -9,7 +9,7 @@ spec:
     [DEFAULT]
     debug = true
   databaseInstance: openstack
-  databaseUser: cinder
+  databaseAccount: cinder
   rabbitMqClusterName: rabbitmq
   cinderAPI: {}
   cinderScheduler: {}
diff --git a/config/samples/cinder_v1beta1_cinder_tls.yaml b/config/samples/cinder_v1beta1_cinder_tls.yaml
index a3a729c66..25c0bab52 100644
--- a/config/samples/cinder_v1beta1_cinder_tls.yaml
+++ b/config/samples/cinder_v1beta1_cinder_tls.yaml
@@ -9,7 +9,7 @@ spec:
     [DEFAULT]
     debug = true
   databaseInstance: openstack
-  databaseUser: cinder
+  databaseAccount: cinder
   rabbitMqClusterName: rabbitmq
   cinderAPI:
     tls:
diff --git a/controllers/cinder_controller.go b/controllers/cinder_controller.go
index c84e31e23..5e916a0eb 100644
--- a/controllers/cinder_controller.go
+++ b/controllers/cinder_controller.go
@@ -348,7 +348,7 @@ func (r *CinderReconciler) reconcileDelete(ctx context.Context, instance *cinder
 	Log.Info(fmt.Sprintf("Reconciling Service '%s' delete", instance.Name))
 
 	// remove db finalizer first
-	db, err := mariadbv1.GetDatabaseByName(ctx, helper, instance.Name)
+	db, err := mariadbv1.GetDatabaseByNameAndAccount(ctx, helper, instance.Name, instance.Spec.DatabaseAccount, instance.Namespace)
 	if err != nil && !k8s_errors.IsNotFound(err) {
 		return ctrl.Result{}, err
 	}
@@ -383,13 +383,12 @@ func (r *CinderReconciler) reconcileInit(
 	//
 	// create service DB instance
 	//
-	db := mariadbv1.NewDatabase(
-		instance.Name,
-		instance.Spec.DatabaseUser,
-		instance.Spec.Secret,
-		map[string]string{
-			"dbName": instance.Spec.DatabaseInstance,
-		},
+	db := mariadbv1.NewDatabaseForAccount(
+		instance.Spec.DatabaseInstance, // mariadb/galera service to target
+		instance.Name,                  // name used in CREATE DATABASE in mariadb
+		instance.Name,                  // CR name for MariaDBDatabase
+		instance.Spec.DatabaseAccount,  // CR name for MariaDBAccount
+		instance.Namespace,             // namespace
 	)
 	// create or patch the DB
 	ctrlResult, err := db.CreateOrPatchDB(
@@ -518,6 +517,28 @@ func (r *CinderReconciler) reconcileNormal(ctx context.Context, instance *cinder
 
 	configVars := make(map[string]env.Setter)
 
+	// ensure MariaDBAccount exists.  This account record may be created by
+	// openstack-operator or the cloud operator up front without a specific
+	// MariaDBDatabase configured yet.   Otherwise, a MariaDBAccount CR is
+	// created here with a generated username as well as a secret with
+	// generated password.   The MariaDBAccount is created without being
+	// yet associated with any MariaDBDatabase.
+	_, _, err = mariadbv1.EnsureMariaDBAccount(
+		ctx, helper, instance.Spec.DatabaseAccount,
+		instance.Namespace, false,
+	)
+
+	if err != nil {
+		instance.Status.Conditions.Set(condition.FalseCondition(
+			mariadbv1.MariaDBAccountReadyCondition,
+			condition.ErrorReason,
+			condition.SeverityWarning,
+			mariadbv1.MariaDBAccountNotReadyMessage,
+			err.Error()))
+
+		return ctrl.Result{}, err
+	}
+
 	//
 	// create RabbitMQ transportURL CR and get the actual URL from the associated secret that is created
 	//
@@ -875,6 +896,11 @@ func (r *CinderReconciler) reconcileNormal(ctx context.Context, instance *cinder
 	instance.Status.Conditions.MarkTrue(condition.CronJobReadyCondition, condition.CronJobReadyMessage)
 	// create CronJob - end
 
+	err = mariadbv1.DeleteUnusedMariaDBAccountFinalizers(ctx, helper, instance.Name, instance.Spec.DatabaseAccount, instance.Namespace)
+	if err != nil {
+		return ctrl.Result{}, err
+	}
+
 	Log.Info(fmt.Sprintf("Reconciled Service '%s' successfully", instance.Name))
 	return ctrl.Result{}, nil
 }
@@ -946,6 +972,11 @@ func (r *CinderReconciler) generateServiceConfigs(
 		return err
 	}
 
+	databaseAccount, dbSecret, err := mariadbv1.GetAccountAndSecret(ctx, h, instance.Spec.DatabaseAccount, instance.Namespace)
+	if err != nil {
+		return err
+	}
+
 	templateParameters := make(map[string]interface{})
 	templateParameters["ServiceUser"] = instance.Spec.ServiceUser
 	templateParameters["ServicePassword"] = string(ospSecret.Data[instance.Spec.PasswordSelectors.Service])
@@ -953,8 +984,8 @@ func (r *CinderReconciler) generateServiceConfigs(
 	templateParameters["KeystonePublicURL"] = keystonePublicURL
 	templateParameters["TransportURL"] = string(transportURLSecret.Data["transport_url"])
 	templateParameters["DatabaseConnection"] = fmt.Sprintf("mysql+pymysql://%s:%s@%s/%s",
-		instance.Spec.DatabaseUser,
-		string(ospSecret.Data[instance.Spec.PasswordSelectors.Database]),
+		databaseAccount.Spec.UserName,
+		string(dbSecret.Data[mariadbv1.DatabasePasswordSelector]),
 		instance.Status.DatabaseHostname,
 		cinder.DatabaseName)
 	templateParameters["MemcachedServersWithInet"] = strings.Join(memcached.Status.ServerListWithInet, ",")
diff --git a/go.mod b/go.mod
index befa29f76..c9b5d9a55 100644
--- a/go.mod
+++ b/go.mod
@@ -92,3 +92,5 @@ replace github.com/openshift/api => github.com/openshift/api v0.0.0-202304141430
 // needed to to cert-manager v1.11.4 see https://github.com/cert-manager/cert-manager/blob/v1.11.4/go.mod#L263C1-L264C104
 // remove this once we bump to cert-manager v1.12.x
 replace github.com/Venafi/vcert/v4 => github.com/jetstack/vcert/v4 v4.9.6-0.20230519122548-219f317ae107 //allow-merging
+
+replace github.com/openstack-k8s-operators/mariadb-operator/api => github.com/zzzeek/mariadb-operator/api v0.3.1-0.20240220154131-35c205caf022 //allow-merging
diff --git a/go.sum b/go.sum
index e04e603ae..c3de28bfd 100644
--- a/go.sum
+++ b/go.sum
@@ -90,8 +90,6 @@ github.com/openstack-k8s-operators/lib-common/modules/storage v0.3.1-0.202402161
 github.com/openstack-k8s-operators/lib-common/modules/storage v0.3.1-0.20240216173409-86913e6d5885/go.mod h1:sK82mkh2UzITsbNa/y6AKTZftHQnsYigqRx+rFbfZM4=
 github.com/openstack-k8s-operators/lib-common/modules/test v0.3.1-0.20240216173409-86913e6d5885 h1:ioJ2MO3vAcBkLM+0UBu5IuKW/DPXcyiNSOLq0Xvn+Nw=
 github.com/openstack-k8s-operators/lib-common/modules/test v0.3.1-0.20240216173409-86913e6d5885/go.mod h1:82nzS+DbBe1tzaMvNHH8FctmZzQ14ZAJysFGsMJiivo=
-github.com/openstack-k8s-operators/mariadb-operator/api v0.3.1-0.20240215091212-cbf2ad281f43 h1:azblrnuVV8sLWihuqS7lJMrwpo1dtB1K5vvkug0agw4=
-github.com/openstack-k8s-operators/mariadb-operator/api v0.3.1-0.20240215091212-cbf2ad281f43/go.mod h1:52Ja/B4RrrytMmKh+Kf+/BPe7Fq40Pi77vcFH4yJeoU=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
@@ -114,6 +112,8 @@ github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcU
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
+github.com/zzzeek/mariadb-operator/api v0.3.1-0.20240220154131-35c205caf022 h1:GYSerUlfrs77MTb9NKFdc4c+/W39HlbHCScCkVz3IJQ=
+github.com/zzzeek/mariadb-operator/api v0.3.1-0.20240220154131-35c205caf022/go.mod h1:PDqfLbP4ZWqQHAu1OtbjfpOGQUKSzLqRJChvE/9pcyQ=
 go.uber.org/goleak v1.2.1 h1:NBol2c7O1ZokfZ0LEU9K6Whx/KnwvepVetCUhtKja4A=
 go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
 go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
diff --git a/test/functional/cinder_controller_test.go b/test/functional/cinder_controller_test.go
index bba5adeb1..f1c21fd02 100644
--- a/test/functional/cinder_controller_test.go
+++ b/test/functional/cinder_controller_test.go
@@ -22,12 +22,14 @@ import (
 	. "github.com/onsi/gomega"
 	. "github.com/openstack-k8s-operators/lib-common/modules/common/test/helpers"
 	corev1 "k8s.io/api/core/v1"
+	"k8s.io/apimachinery/pkg/types"
 	"k8s.io/utils/ptr"
 
 	cinderv1 "github.com/openstack-k8s-operators/cinder-operator/api/v1beta1"
 	memcachedv1 "github.com/openstack-k8s-operators/infra-operator/apis/memcached/v1beta1"
 	condition "github.com/openstack-k8s-operators/lib-common/modules/common/condition"
 	util "github.com/openstack-k8s-operators/lib-common/modules/common/util"
+	mariadb_test "github.com/openstack-k8s-operators/mariadb-operator/api/test/helpers"
 )
 
 var _ = Describe("Cinder controller", func() {
@@ -62,7 +64,7 @@ var _ = Describe("Cinder controller", func() {
 		It("should have the Spec fields initialized", func() {
 			Cinder := GetCinder(cinderTest.Instance)
 			Expect(Cinder.Spec.DatabaseInstance).Should(Equal("openstack"))
-			Expect(Cinder.Spec.DatabaseUser).Should(Equal(cinderTest.CinderDataBaseUser))
+			Expect(Cinder.Spec.DatabaseAccount).Should(Equal(cinderTest.CinderDataBaseAccount))
 			Expect(Cinder.Spec.MemcachedInstance).Should(Equal(cinderTest.MemcachedInstance))
 			Expect(Cinder.Spec.RabbitMqClusterName).Should(Equal(cinderTest.RabbitmqClusterName))
 			Expect(Cinder.Spec.ServiceUser).Should(Equal(cinderTest.CinderServiceUser))
@@ -627,4 +629,83 @@ var _ = Describe("Cinder controller", func() {
 			}, timeout, interval).Should(Succeed())
 		})
 	})
+
+	// Run MariaDBAccount suite tests.  these are pre-packaged ginkgo tests
+	// that exercise standard account create / update patterns that should be
+	// common to all controllers that ensure MariaDBAccount CRs.
+	mariadb_test.MariaDBAccountSuiteTests(
+		"Cinder",
+		// Populate test variables which will run inside of BeforeEach
+		func(harness *mariadb_test.MariaDBTestHarness) {
+			harness.PopulateHarness(
+				cinderTest.Instance.Namespace,
+				cinderTest.Instance.Name,
+				"Cinder",
+				mariadb,
+				timeout,
+				interval,
+			)
+		},
+		// Generate a fully running Cinder service given an accountName
+		// needs to make it all the way to the end where the mariadb finalizers
+		// are removed from unused accounts since that's part of what we are testing
+		func(accountName types.NamespacedName) {
+			spec := GetTLSCinderSpec()
+			spec["databaseAccount"] = accountName.Name
+
+			DeferCleanup(th.DeleteInstance, CreateCinder(cinderTest.Instance, spec))
+			DeferCleanup(k8sClient.Delete, ctx, CreateCinderMessageBusSecret(cinderTest.Instance.Namespace, cinderTest.RabbitmqSecretName))
+			DeferCleanup(th.DeleteInstance, CreateCinderAPI(cinderTest.Instance, GetDefaultCinderAPISpec()))
+			DeferCleanup(th.DeleteInstance, CreateCinderScheduler(cinderTest.Instance, GetDefaultCinderSchedulerSpec()))
+			DeferCleanup(th.DeleteInstance, CreateCinderVolume(cinderTest.Instance, GetDefaultCinderVolumeSpec()))
+			DeferCleanup(
+				mariadb.DeleteDBService,
+				mariadb.CreateDBService(
+					cinderTest.Instance.Namespace,
+					GetCinder(cinderName).Spec.DatabaseInstance,
+					corev1.ServiceSpec{
+						Ports: []corev1.ServicePort{{Port: 3306}},
+					},
+				),
+			)
+			infra.SimulateTransportURLReady(cinderTest.CinderTransportURL)
+			DeferCleanup(infra.DeleteMemcached, infra.CreateMemcached(namespace, cinderTest.MemcachedInstance, memcachedSpec))
+			infra.SimulateMemcachedReady(cinderTest.CinderMemcached)
+			DeferCleanup(keystone.DeleteKeystoneAPI, keystone.CreateKeystoneAPI(cinderTest.Instance.Namespace))
+			mariadb.SimulateMariaDBAccountCompleted(accountName)
+			mariadb.SimulateMariaDBDatabaseCompleted(cinderTest.Instance)
+			th.SimulateJobSuccess(cinderTest.CinderDBSync)
+
+			DeferCleanup(k8sClient.Delete, ctx, th.CreateCABundleSecret(cinderTest.CABundleSecret))
+			DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(cinderTest.InternalCertSecret))
+			DeferCleanup(k8sClient.Delete, ctx, th.CreateCertSecret(cinderTest.PublicCertSecret))
+			keystone.SimulateKeystoneServiceReady(cinderTest.CinderKeystoneService)
+			keystone.SimulateKeystoneEndpointReady(cinderTest.CinderKeystoneEndpoint)
+
+			th.AssertServiceExists(cinderTest.CinderServicePublic)
+			th.AssertServiceExists(cinderTest.CinderServiceInternal)
+
+			// check keystone endpoints
+			keystoneEndpoint := keystone.GetKeystoneEndpoint(cinderTest.CinderKeystoneEndpoint)
+			endpoints := keystoneEndpoint.Spec.Endpoints
+			Expect(endpoints).To(HaveKeyWithValue("public", "https://cinder-public."+namespace+".svc:8776/v3"))
+			Expect(endpoints).To(HaveKeyWithValue("internal", "https://cinder-internal."+namespace+".svc:8776/v3"))
+
+		},
+		// Change the account name in the service to a new name
+		func(newAccountName types.NamespacedName) {
+
+			Eventually(func(g Gomega) {
+				cinder := GetCinder(cinderName)
+				cinder.Spec.DatabaseAccount = newAccountName.Name
+				g.Expect(th.K8sClient.Update(ctx, cinder)).Should(Succeed())
+			}, timeout, interval).Should(Succeed())
+
+		},
+		// delete the instance to exercise finalizer removal
+		func() {
+			th.DeleteInstance(GetCinder(cinderName))
+		},
+	)
+
 })
diff --git a/test/functional/cinder_test_data.go b/test/functional/cinder_test_data.go
index 6f2e0204e..64dcf4558 100644
--- a/test/functional/cinder_test_data.go
+++ b/test/functional/cinder_test_data.go
@@ -39,7 +39,7 @@ type CinderTestData struct {
 	RabbitmqClusterName    string
 	RabbitmqSecretName     string
 	MemcachedInstance      string
-	CinderDataBaseUser     string
+	CinderDataBaseAccount  string
 	CinderPassword         string
 	CinderServiceUser      string
 	DatabaseHostname       string
@@ -150,10 +150,10 @@ func GetCinderTestData(cinderName types.NamespacedName) CinderTestData {
 			Namespace: cinderName.Namespace,
 			Name:      "internalapi",
 		},
-		RabbitmqClusterName: "rabbitmq",
-		RabbitmqSecretName:  "rabbitmq-secret",
-		MemcachedInstance:   MemcachedInstance,
-		CinderDataBaseUser:  "cinder",
+		RabbitmqClusterName:   "rabbitmq",
+		RabbitmqSecretName:    "rabbitmq-secret",
+		MemcachedInstance:     MemcachedInstance,
+		CinderDataBaseAccount: "cinder",
 		// Password used for both db and service
 		CinderPassword:    "12345678",
 		CinderServiceUser: "cinder",
diff --git a/test/kuttl/common/assert_sample_deployment.yaml b/test/kuttl/common/assert_sample_deployment.yaml
index c774b6ad9..e2c50f1f0 100644
--- a/test/kuttl/common/assert_sample_deployment.yaml
+++ b/test/kuttl/common/assert_sample_deployment.yaml
@@ -8,7 +8,7 @@ spec:
     [DEFAULT]
     debug = true
   databaseInstance: openstack
-  databaseUser: cinder
+  databaseAccount: cinder
   rabbitMqClusterName: rabbitmq
   cinderAPI:
     replicas: 1
diff --git a/test/kuttl/common/assert_tls_sample_deployment.yaml b/test/kuttl/common/assert_tls_sample_deployment.yaml
index 9d00ba88b..cb247d656 100644
--- a/test/kuttl/common/assert_tls_sample_deployment.yaml
+++ b/test/kuttl/common/assert_tls_sample_deployment.yaml
@@ -8,7 +8,7 @@ spec:
     [DEFAULT]
     debug = true
   databaseInstance: openstack
-  databaseUser: cinder
+  databaseAccount: cinder
   rabbitMqClusterName: rabbitmq
   cinderAPI:
     replicas: 1