jklein
d8b392bf64
Validate Helm Charts / Detect changed charts (pull_request) Successful in 11s
Validate Helm Charts / Resource quantities (pull_request) Successful in 15s
Validate Helm Charts / Build keycloak (pull_request) Successful in 4s
Validate Helm Charts / Trivy config keycloak (pull_request) Successful in 17s
Install-test / Install-test keycloak (pull_request) Successful in 3m9s
Validate Helm Charts / Install-test (pull_request) Successful in 3m9s
51 lines
2.5 KiB
YAML
51 lines
2.5 KiB
YAML
apiVersion: v2
|
|
name: keycloak
|
|
description: A Helm chart to deploy Keycloak, an OpenID Connect and SAML identity provider, as a two-node cluster on Kubernetes
|
|
icon: https://www.keycloak.org/resources/images/icon.svg
|
|
|
|
type: application
|
|
|
|
# appVersion is the exact image tag of quay.io/keycloak/keycloak. No "v"
|
|
# prefix here - upstream tags are plain three-part versions (26.8.0).
|
|
#
|
|
# THE TAG LANDSCAPE, AND WHY THIS CHART NEEDS NO VERSION CONSTRAINT. Measured
|
|
# on 2026-10-04 against quay.io's tag API, this registry carries four shapes
|
|
# side by side:
|
|
#
|
|
# 1. release tags 26.8.0, 26.7.5, ... <- what we track
|
|
# 2. REBUILD tags 26.8.0-0, 26.7.3-1, 26.7.2-2 - the same app
|
|
# version rebuilt (base image or CVE fix) without an app-version bump.
|
|
# 26.8.0-0 resolves to the SAME manifest digest as 26.8.0.
|
|
# 3. floating minor tags 26.8, 26.7, 26.6, ... - they move
|
|
# 4. floating names latest, nightly - they move daily
|
|
#
|
|
# This is the same GENUS of trap as garage's commit-SHA tags and stalwart's
|
|
# moving names, and it is the one case in this repo where the answer came out
|
|
# the other way: plain `docker` versioning already excludes all three unwanted
|
|
# shapes, so the renovate.json5 block carries NO versioningTemplate. Docker
|
|
# versioning splits a tag at the first dash and only ever offers candidates
|
|
# with the SAME suffix - our value has none, so the -N rebuilds are invisible
|
|
# to it - and 26.8 fails on the missing third part while latest/nightly parse
|
|
# as no version at all.
|
|
#
|
|
# THAT IS MEASURED, NOT ASSUMED, and the measurement is written down because
|
|
# the next round will otherwise add a constraint "to be safe" (renovate 44.132.5,
|
|
# --platform=local --dry-run=lookup against the real registry):
|
|
# appVersion 26.8.0 -> updates [], warnings []
|
|
# appVersion 26.7.0 -> exactly one: 26.8.0 (minor)
|
|
# appVersion 26.7.4 -> exactly two: 26.7.5 (patch), 26.8.0 (minor)
|
|
# No run offered a rebuild tag, a floating minor, latest or nightly.
|
|
#
|
|
# AND THE OTHER HALF, WHICH THE VERSION NUMBER CANNOT CARRY: Keycloak supports
|
|
# a rolling update only WITHIN a minor line. A minor jump needs the cluster
|
|
# shut down. The global `automerge: true` in renovate.json5 applies here
|
|
# anyway - a deliberate acceptance of that risk, not an oversight - so the
|
|
# procedure lives in NOTES.txt and on the wiki page instead of in a
|
|
# packageRules entry. Read the "MINOR UPGRADES" section of NOTES.txt before
|
|
# merging an app-version PR that changes the minor.
|
|
version: 1.1.0+up26.8.0
|
|
appVersion: "26.8.0"
|
|
|
|
maintainers:
|
|
- name: jklein
|