From 87fca4dfe280fd35b4f594b4f75fad7b20a90085 Mon Sep 17 00:00:00 2001
From: IvanHunters <xorokhotnikov@gmail.com>
Date: Mon, 2 Mar 2026 20:07:01 +0300
Subject: [PATCH] fix(migration): protect keycloak HelmReleases during v1.0
 upgrade

In v0.41.x keycloak HelmReleases were created directly by the platform
chart (helmreleases.yaml). In v1.0 this template was removed and keycloak
is managed via Package API. Without protection, Helm deletes these
HelmReleases during upgrade, triggering FluxCD to run helm uninstall and
destroying all keycloak data (credentials, realm config, PostgreSQL DB).

Add migration 34 that annotates keycloak, keycloak-operator, and
keycloak-configure HelmReleases with helm.sh/resource-policy=keep before
the platform chart upgrade. This allows the Package operator to adopt
existing HelmReleases and FluxCD to perform helm upgrade instead of
a fresh install, preserving all data.

Signed-off-by: IvanHunters <xorokhotnikov@gmail.com>
---
 .../platform/images/migrations/migrations/34  | 34 +++++++++++++++++++
 packages/core/platform/values.yaml            |  2 +-
 2 files changed, 35 insertions(+), 1 deletion(-)
 create mode 100755 packages/core/platform/images/migrations/migrations/34

diff --git a/packages/core/platform/images/migrations/migrations/34 b/packages/core/platform/images/migrations/migrations/34
new file mode 100755
index 000000000..13d3be5f4
--- /dev/null
+++ b/packages/core/platform/images/migrations/migrations/34
@@ -0,0 +1,34 @@
+#!/bin/sh
+# Migration 34 --> 35
+# Protect keycloak HelmReleases from deletion during platform chart upgrade.
+#
+# In v0.41.x keycloak, keycloak-operator, and keycloak-configure HelmReleases
+# were created directly by the platform chart (helmreleases.yaml). In v1.0
+# this template was removed and keycloak is managed via Package API instead.
+# Without the keep annotation, Helm deletes these HelmReleases during upgrade,
+# which triggers FluxCD to run helm uninstall, destroying all keycloak data
+# (credentials, realm configuration, PostgreSQL database).
+#
+# The keep annotation ensures the HelmReleases survive the chart upgrade so
+# the Package operator can adopt them and FluxCD performs a helm upgrade
+# instead of a fresh install.
+
+set -euo pipefail
+
+echo "=== Protecting keycloak HelmReleases from deletion ==="
+
+for hr_name in keycloak keycloak-operator keycloak-configure; do
+  if kubectl get helmrelease "$hr_name" -n cozy-keycloak --no-headers 2>/dev/null | grep -q .; then
+    echo "  [ANNOTATE] hr/${hr_name} in cozy-keycloak"
+    kubectl annotate helmrelease "$hr_name" -n cozy-keycloak \
+      helm.sh/resource-policy=keep --overwrite
+  else
+    echo "  [SKIP] hr/${hr_name} not found in cozy-keycloak"
+  fi
+done
+
+echo "=== Done ==="
+
+# Stamp version
+kubectl create configmap -n cozy-system cozystack-version \
+  --from-literal=version=35 --dry-run=client -o yaml | kubectl apply -f-
diff --git a/packages/core/platform/values.yaml b/packages/core/platform/values.yaml
index 155cc78a1..80ebb9362 100644
--- a/packages/core/platform/values.yaml
+++ b/packages/core/platform/values.yaml
@@ -6,7 +6,7 @@ sourceRef:
 migrations:
   enabled: false
   image: ghcr.io/cozystack/cozystack/platform-migrations:v1.0.0@sha256:68dabdebc38ac439228ae07031cc70e0fa184a24bd4e5b3b22c17466b2a55201
-  targetVersion: 34
+  targetVersion: 35
 # Bundle deployment configuration
 bundles:
   system: