mirror of
https://github.com/cozystack/cozystack.git
synced 2026-11-09 05:25:14 +09:00
Aleksei Sviridkin
a462e687a8
## What this PR does Bumps the Keycloak server image from `26.5.2` to `26.6.3` (latest upstream stable, published 2026-06-04), picking up the published security fixes the issue enumerates (patched Netty 4.1.135+/4.2.15+ and the bundled-package CVE fixes). Keycloak 26.6 adds zero-downtime patch upgrades and startup/liveness probes that report `UP` during DB migrations (smoother rolling updates on Kubernetes). Targeting 26.6.3 specifically — 26.6.0/26.6.1 shipped a migration-persistence bug (server exits with code 1 after an async realm migration) that later patches fix. The chart runs a plain Keycloak StatefulSet with no custom browser flows or realm import, so the `MigrateTo26_6_0` realm migration and the 26.6 runtime breaking changes (outbound HTTP redirects now opt-in, stricter WebAuthn attestation, SAML REDIRECT inflate capped at 128KB) don't affect chart-managed config. The StatefulSet env (`KC_DB`, `KC_CACHE=ispn`, `KC_PROXY_HEADERS`, health endpoints) stays valid in 26.6. Verified locally: `helm unittest` 2/2 pass; `helm template` renders the new image with cluster values. Closes #2878 ### Release note ```release-note chore(keycloak): bump Keycloak server image to 26.6.3 ``` <!-- This is an auto-generated comment: release notes by coderabbit.ai --> ## Summary by CodeRabbit * **Chores** * Updated the Keycloak container image to version 26.6.3. <!-- end of auto-generated comment: release notes by coderabbit.ai -->