Commit graph

90 commits

Author SHA1 Message Date
Steven Hawkins
51b6f9b291
fix: promotes keycloak and realm import to v2beta1 (#45840)
closes: #45795

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2026-04-04 16:46:28 +02:00
Gilvan Filho
ed66ac6b0c
add labels and annotations to service monitor (serviceMonitorSpec) (#47298)
* add labels and annotations to service monitor (serviceMonitorSpec)

closes #42626

Signed-off-by: Gilvan Filho <gilvan.sfilho@gmail.com>

* add labels and annotations to service monitor (serviceMonitorSpec)

Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
Signed-off-by: Gilvan Filho <gilvan.sfilho@gmail.com>

---------

Signed-off-by: Gilvan Filho <gilvan.sfilho@gmail.com>
Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
2026-03-23 17:35:44 +00:00
Copilot
d600298df7
operator: add support for configurable Kubernetes Service port and name in Keycloak CRD (#46683)
closes: #46633

* Add support for configurable Kubernetes Service port and name in Keycloak CRD

- Add serviceHttpPort and serviceHttpsPort fields to HttpSpec for configuring the service port independently of container port
- Add serviceName field to HttpSpec for customizing the service name
- Update KeycloakServiceDependentResource to use service ports with targetPort
- Update KeycloakClientBaseController to use service ports for admin URL
- Add unit tests and update test YAML

Co-authored-by: shawkins <2475669+shawkins@users.noreply.github.com>

* Remove HasMetadata getServiceName overload; add integration test for custom service name and port

Co-authored-by: shawkins <2475669+shawkins@users.noreply.github.com>

* refining the integration test

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

* Add documentation for configurable Service name and port in operator guide and release notes

Co-authored-by: shawkins <2475669+shawkins@users.noreply.github.com>

* Apply review suggestions to documentation wording

Co-authored-by: shawkins <2475669+shawkins@users.noreply.github.com>

---------

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: shawkins <2475669+shawkins@users.noreply.github.com>
Co-authored-by: Steve Hawkins <shawkins@redhat.com>
2026-03-04 10:49:51 -05:00
Sebastian Łaskawiec
35d725fe1b
Moved adding Kubernetes/OpenShift CAs to the server (#44506)
* Kubernetes Truststore moved to the server

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@gmail.com>

* Update quarkus/config-api/src/main/java/org/keycloak/config/TruststoreOptions.java

Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>

* addressing review comments and updating upgrade instructions

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

* updating help command output

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

* Update docs/guides/server/keycloak-truststore.adoc

Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@gmail.com>

* Comments addressed

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@gmail.com>

* lint errors fix

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@gmail.com>

* Update docs/documentation/upgrading/topics/changes/changes-26_6_0.adoc

Signed-off-by: Steven Hawkins <shawkins@redhat.com>

---------

Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@gmail.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>
Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Co-authored-by: Steven Hawkins <shawkins@redhat.com>
Co-authored-by: Copilot <175728472+Copilot@users.noreply.github.com>
Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
2026-03-04 16:39:10 +01:00
Michal Vavřík
0937fe6574
feat(quarkus): validate and doc min poolMaxSize is 4+ for JDBC PING (#46737)
Currently when migration tasks are run, we see that the app startup fails with DB pool size 3 or less for JDBC_PING.
Hence, we started to validate that the minimal max pool size is 4 for JDBC PING.

Closes: https://github.com/keycloak/keycloak/issues/46673

Signed-off-by: Michal Vavřík <michal.vavrik@aol.com>
2026-03-03 14:19:55 +01:00
Steven Hawkins
db7c0422ab
fix: adding generic operator upgrade instructions (#46380)
* fix: adding generic operator upgrade instructions

closes: #40902

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

* Update docs/guides/operator/installation.adoc

Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>

---------

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>
Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
2026-02-20 18:36:12 +01:00
Ruchika Jha
f92c27e26d
Make rolling updates for patch releases fully supported and Updated docs, release notes and upgrading guide for zero-downtime patch releases
Closes #45381
Closes #45756

Signed-off-by: Ruchika <ruchika.jha1@ibm.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2026-02-16 15:11:16 +00:00
andymunro
88eb05d114
Update Operator instructions for Custom Access (#46036)
Closes #45992

Signed-off-by: AndyMunro <amunro@redhat.com>
2026-02-09 12:45:15 +01:00
Ryan Emerson
e3c4ec6112 Document the minimum required ServiceMonitor CRD version
Signed-off-by: Ryan Emerson <remerson@ibm.com>
2026-02-03 14:55:11 +00:00
Tomáš Kyjovský
b247ef12cd
Fix indentation in sample Keycloak CR YAML in Operator rolling updates doc
Closes #45755 

Signed-off-by: Tomas Kyjovsky <tkyjovsk@ibm.com>
2026-01-26 16:52:27 +01:00
Jens Erat
adeb41e82b
Extend documentation on ServiceMonitor creation (#45071)
The documentation so far only mentions how to disable the ServiceMonitor, leading to the assumption that it is enabled by default.

Getting a service monitor created also requires enabling metrics in keycloak, though:

658faf210f/operator/src/main/java/org/keycloak/operator/controllers/KeycloakServiceMonitorDependentResource.java (L50)

While the missing setting creates a warning, the administrator should already have this information before applying the configuration.

Closes #45070

Signed-off-by: Jens Erat <email@jenserat.de>
2026-01-05 09:10:18 +01:00
AvivGuiser
3c8af6dec5
set auto-mount service account token to false in keycloak pods (#40605)
Some checks failed
Weblate Sync / Trigger Weblate to pull the latest changes (push) Has been cancelled
closes #38843

Signed-off-by: AvivGuiser <avivguiser@gmail.com>
Co-authored-by: Steven Hawkins <shawkins@redhat.com>
2025-11-14 15:41:39 +00:00
Martin Bartoš
8502cc3ae1
Including OTLP headers for tracing (#43122)
* Including OTLP headers for tracing

Closes #41007

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Polishing, add test for the util class, address review

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Remove the WildcardOptionsUtil#isKcWildcardOption

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

---------

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
2025-10-31 15:46:05 +01:00
Martin Bartoš
b807a45091
Divide logging guide to sub-guides for every log handler (#43132)
* Divide logging guide to sub-guides for every log handler

Closes #43125

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Ability to set level offset to guides, remove emojis

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Add all relevant options to the logging guide

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Update docs/guides/server/logging/file.adoc

Co-authored-by: andymunro <48995441+andymunro@users.noreply.github.com>
Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Update docs/guides/server/logging/syslog.adoc

Co-authored-by: andymunro <48995441+andymunro@users.noreply.github.com>
Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Update docs/guides/server/logging/syslog.adoc

Co-authored-by: andymunro <48995441+andymunro@users.noreply.github.com>
Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Update docs/guides/server/logging/syslog.adoc

Co-authored-by: andymunro <48995441+andymunro@users.noreply.github.com>
Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Update docs/guides/server/logging/syslog.adoc

Co-authored-by: andymunro <48995441+andymunro@users.noreply.github.com>
Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Update docs/guides/server/logging/console.adoc

Co-authored-by: andymunro <48995441+andymunro@users.noreply.github.com>
Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Update docs/guides/server/logging/console.adoc

Co-authored-by: andymunro <48995441+andymunro@users.noreply.github.com>
Signed-off-by: Martin Bartoš <mabartos@redhat.com>

* Improve link to other section

Signed-off-by: Martin Bartoš <mabartos@redhat.com>

---------

Signed-off-by: Martin Bartoš <mabartos@redhat.com>
Co-authored-by: andymunro <48995441+andymunro@users.noreply.github.com>
2025-10-17 16:37:48 +02:00
Steven Hawkins
43ee41e8a8
fix: refining activation condition error handling (#43197)
closes: #43096

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2025-10-15 11:44:39 +00:00
Alexander Schwartz
3b8bcd3f8a
Use quoted values for boolean and number values in Operator examples
Closes #43459

Signed-off-by: Alexander Schwartz <alexander.schwartz@ibm.com>
2025-10-14 18:53:00 +02:00
Ryan Emerson
bda79de605
Update docs to reflect that Operator ClusterRoleBinding contains hardcoded namespace
- Added missing labels to Operator roles

Closes #42678

Signed-off-by: Ryan Emerson <remerson@ibm.com>
2025-09-19 17:27:26 +02:00
Steven Hawkins
26597c2d9a
fix: adding docs about mTLS and probes (#42561)
closes: #42191

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2025-09-16 16:30:37 +02:00
Ryan Emerson
6e7a836c96
Create default ServiceMonitor with Operator
Closes #40406

Signed-off-by: Ryan Emerson <remerson@ibm.com>
2025-09-16 10:57:35 +02:00
Steven Hawkins
ae1e1d3cc3
fix: allows for schedulings to be defined for operator jobs (#42310)
* fix: allows for schedulings to be defined for operator jobs

closes: #42057

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

* Update docs/guides/operator/advanced-configuration.adoc

Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>

---------

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>
Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
2025-09-10 16:28:12 +00:00
Steven Hawkins
e891336167
fix: expands our warnings/notes around placeholder usage (#42151)
addresses CVE-2025-9162

closes: #42046

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2025-08-28 17:06:55 +02:00
Steven Hawkins
183a96d6a1
enhance: adding the ability to set truststores via configmaps (#41796)
closes: #34114

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2025-08-28 16:55:52 +02:00
Steven Hawkins
c1afa376b2
fix: adding raw environment variables (#41768)
closes: #41766

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2025-08-14 20:17:15 +02:00
Ryan Emerson
a2fe32617c
Default to stretched clusters on Kubernetes when possible
Closes #41666

Signed-off-by: Ryan Emerson <remerson@ibm.com>
2025-08-08 08:09:04 +02:00
Martin Bartoš
0c213c2f3d
Fix formatting issue for Operator Realm Import docs (#41644)
Signed-off-by: Martin Bartoš <mabartos@redhat.com>
2025-08-04 13:55:42 -04:00
Steven Hawkins
f5f93ef6e1
fix: adding the ability to set the ingress tlsSecret (#41426)
* fix: adding the ability to set the ingress tlsSecret

closes: #34777

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

* Apply suggestions from code review

Co-authored-by: Martin Bartoš <mabartos@redhat.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>

---------

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>
Co-authored-by: Martin Bartoš <mabartos@redhat.com>
2025-08-04 09:28:46 -03:00
Gilvan Filho
e5bb7f5249
add labels and annotations to service (httpSpec) (#39925)
closes #23283

Signed-off-by: Gilvan Filho <gfilho@redhat.com>
2025-06-17 11:27:16 +02:00
AvivGuiser
7736ca20e9
support setting periodSeconds and failureThreashold in the Keyclock CR (#40117)
* add probe spec

Signed-off-by: AvivGuiser <avivguiser@gmail.com>

* make default for probes if not configured, add skeleton test files

Signed-off-by: AvivGuiser <avivguiser@gmail.com>

* fix tests

Signed-off-by: AvivGuiser <avivguiser@gmail.com>

* fix tests

Signed-off-by: AvivGuiser <avivguiser@gmail.com>

* add docs

Signed-off-by: AvivGuiser <avivguiser@gmail.com>

* move test to unittest and apiserver test

Signed-off-by: AvivGuiser <avivguiser@gmail.com>

* adding asserts to check new fields

Signed-off-by: AvivGuiser <avivguiser@gmail.com>

* fix test

Signed-off-by: AvivGuiser <aviv.guiser@placer.ai>

* update docs

Signed-off-by: AvivGuiser <aviv.guiser@placer.ai>

---------

Signed-off-by: AvivGuiser <avivguiser@gmail.com>
Signed-off-by: AvivGuiser <aviv.guiser@placer.ai>
2025-06-13 17:32:20 +00:00
Steven Hawkins
76bc9fadcb
fix: adding a -- separator for spi options (#40005)
* fix: adding a -- separator for spi options

closes: #39063

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

* adding a warning for ambiguous spi options

also adding a note about the change

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
# Conflicts:
#	docs/documentation/upgrading/topics/changes/changes-26_3_0.adoc

* updating docs to the new format

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
# Conflicts:
#	docs/guides/high-availability/examples/generated/keycloak-ispn.yaml
#	docs/guides/high-availability/examples/generated/keycloak.yaml

* internally using the new spi options

also adding a deprecation notice

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

* Apply suggestions from code review

Co-authored-by: Martin Bartoš <mabartos@redhat.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>

* correcting options output

adding + + inlining where needed

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

* adding test showing the env mapping with __

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

---------

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>
Co-authored-by: Martin Bartoš <mabartos@redhat.com>
2025-06-13 16:13:53 +02:00
Alexander Schwartz
4af3d7cc9d
Redirect requests from outdated theme version to the current theme version
Closes #39723

Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
2025-06-11 11:13:55 +02:00
Steven Hawkins
f8ba9d3429
fix: adding docs about Keycloak CR security (#40260)
closes: #40188

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2025-06-06 16:47:33 +02:00
Steven Hawkins
603ecf20eb
fix: adding a doc note about clean up (#39731)
closes: #39338

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
2025-05-15 14:08:31 +02:00
andymunro
afe6d4d4a0
Fix callouts
Closes #39590

Signed-off-by: AndyMunro <amunro@redhat.com>
2025-05-09 14:10:59 +00:00
andymunro
eb51c03f90
Edit Operator Guide
Closes #39543

Signed-off-by: AndyMunro <amunro@redhat.com>
2025-05-08 08:45:41 +02:00
andymunro
75557bc312
Adjust introductory sentences
Closes #39008

Signed-off-by: AndyMunro <amunro@redhat.com>
2025-04-25 09:18:04 +02:00
Alexander Schwartz
579b185e7a
Document operator Auto update strategy when used with podTemplate
Closes #39059

Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
2025-04-17 21:19:32 +02:00
Peter Zaoral
6d6f9667c6
Document how Keycloak is upgraded when Operator is upgraded via OLM (#38297)
Closes: #35901

Signed-off-by: Peter Zaoral <pzaoral@redhat.com>
2025-04-10 13:56:42 +02:00
Alexander Schwartz
73ee966feb
Sorting the chapters of the HA guide
Closes #38721

Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
2025-04-08 07:23:53 -03:00
Alexander Schwartz
c9b88c6bf6
Finalizing release notes and documentation for initial rolling update
Closes #38168

Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
2025-03-19 21:34:09 +01:00
Pedro Ruivo
96a5b19110
Operator: Implement an explicit update strategy
Closes #37416

Signed-off-by: Pedro Ruivo <pruivo@redhat.com>
2025-03-17 08:28:26 +01:00
Alexander Schwartz
151e019935
Make NetworkPolicy supported and enabled by default
Closes #36036

Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
Signed-off-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Co-authored-by: Pedro Ruivo <pruivo@users.noreply.github.com>
2025-03-10 11:12:38 +01:00
Alexander Schwartz
41c8623a94
Remove ForceRecreate Operation
Closes #37661

Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
2025-03-03 12:26:33 -03:00
Pedro Ruivo
a04c99e100
Operator: new CR status condition for upgrades
Closes #37220

Signed-off-by: Pedro Ruivo <pruivo@redhat.com>
2025-02-26 08:32:13 +01:00
Steven Hawkins
f774786db7
doc: adding a full example of overriding the startup probe timeout (#37096)
* doc: adding a full example of overriding the startup probe timeout

closes: #35261

Signed-off-by: Steve Hawkins <shawkins@redhat.com>

* Update docs/guides/operator/advanced-configuration.adoc

Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>

* Update docs/guides/operator/advanced-configuration.adoc

Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>

---------

Signed-off-by: Steve Hawkins <shawkins@redhat.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>
Co-authored-by: Alexander Schwartz <alexander.schwartz@gmx.net>
Co-authored-by: Václav Muzikář <vaclav@muzikari.cz>
2025-02-17 10:41:30 +01:00
Pedro Ruivo
81c65c8174
Rename operator strategy options
Closes #37090

Signed-off-by: Pedro Ruivo <pruivo@redhat.com>
2025-02-12 11:21:22 +01:00
Pedro Ruivo
c650984267
Operator: automatic upgrade strategy
Closes #36748

Signed-off-by: Pedro Ruivo <pruivo@redhat.com>
2025-02-10 18:54:14 +01:00
Pedro Ruivo
0f91e67b90
Feature flag: rolling-updates
Closes #36840

Signed-off-by: Pedro Ruivo <pruivo@redhat.com>
2025-02-06 17:03:50 +01:00
Pedro Ruivo
a6e9736697
New operator spec: upgrade strategy
Closes #36520

Signed-off-by: Pedro Ruivo <pruivo@redhat.com>
Signed-off-by: Alexander Schwartz <aschwart@redhat.com>
Co-authored-by: Alexander Schwartz <aschwart@redhat.com>
2025-01-28 10:57:33 +01:00
andymunro
9ab28e7ffe
Openshift conflict
Closes #36745

Signed-off-by: AndyMunro <amunro@redhat.com>
Signed-off-by: Steven Hawkins <shawkins@redhat.com>
Co-authored-by: Steven Hawkins <shawkins@redhat.com>
2025-01-24 17:48:36 +01:00
Pedro Ruivo
3767642f93
[Operator] Network Policy Rules
Closes #35598

Signed-off-by: Pedro Ruivo <pruivo@redhat.com>
2024-12-19 10:06:25 +01:00