apiVersion: v2
name: keycloak
description: A Helm chart to deploy Keycloak, an OpenID Connect and SAML identity provider, as a two-node cluster on Kubernetes
icon: https://www.keycloak.org/resources/images/icon.svg

type: application

# appVersion is the exact image tag of quay.io/keycloak/keycloak. No "v"
# prefix here - upstream tags are plain three-part versions (26.8.0).
#
# THE TAG LANDSCAPE, AND WHY THIS CHART NEEDS NO VERSION CONSTRAINT. Measured
# on 2026-10-04 against quay.io's tag API, this registry carries four shapes
# side by side:
#
#   1. release tags           26.8.0, 26.7.5, ...   <- what we track
#   2. REBUILD tags           26.8.0-0, 26.7.3-1, 26.7.2-2 - the same app
#      version rebuilt (base image or CVE fix) without an app-version bump.
#      26.8.0-0 resolves to the SAME manifest digest as 26.8.0.
#   3. floating minor tags    26.8, 26.7, 26.6, ... - they move
#   4. floating names         latest, nightly       - they move daily
#
# This is the same GENUS of trap as garage's commit-SHA tags and stalwart's
# moving names, and it is the one case in this repo where the answer came out
# the other way: plain `docker` versioning already excludes all three unwanted
# shapes, so the renovate.json5 block carries NO versioningTemplate. Docker
# versioning splits a tag at the first dash and only ever offers candidates
# with the SAME suffix - our value has none, so the -N rebuilds are invisible
# to it - and 26.8 fails on the missing third part while latest/nightly parse
# as no version at all.
#
# THAT IS MEASURED, NOT ASSUMED, and the measurement is written down because
# the next round will otherwise add a constraint "to be safe" (renovate 44.132.5,
# --platform=local --dry-run=lookup against the real registry):
#   appVersion 26.8.0 -> updates [], warnings []
#   appVersion 26.7.0 -> exactly one: 26.8.0 (minor)
#   appVersion 26.7.4 -> exactly two: 26.7.5 (patch), 26.8.0 (minor)
# No run offered a rebuild tag, a floating minor, latest or nightly.
#
# AND THE OTHER HALF, WHICH THE VERSION NUMBER CANNOT CARRY: Keycloak supports
# a rolling update only WITHIN a minor line. A minor jump needs the cluster
# shut down. The global `automerge: true` in renovate.json5 applies here
# anyway - a deliberate acceptance of that risk, not an oversight - so the
# procedure lives in NOTES.txt and on the wiki page instead of in a
# packageRules entry. Read the "MINOR UPGRADES" section of NOTES.txt before
# merging an app-version PR that changes the minor.
version: 1.2.0+up26.8.0
appVersion: "26.8.0"

maintainers:
  - name: jklein