feat(renovate): track the Keycloak operator (the real Keycloak version), never auto-merge it #88

Merged

jakman85 merged 2 commits from feat/renovate-track-keycloak-operator into main

2026-10-30 08:14:02 +00:00

Author	SHA1	Message	Date
jakman85andClaude Opus 5.5	8ed4e30201	docs(decisions): handoff for feat/renovate-track-keycloak-operator gate / gate (pull_request) Successful in 2m57s Details gate / conformance (pull_request) Has been skipped Details Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-30 03:06:56 -05:00
jakman85andClaude Opus 5.5	24db269ea8	feat(renovate): track the Keycloak operator (the real Keycloak version), never auto-merge it The Keycloak CR has no spec.image, so the operator's RELATED_IMAGE_KEYCLOAK picks the server image; the three keycloak-k8s-resources release URLs in platform/keycloak/kustomization.yaml are therefore THE Keycloak version, and Renovate could not see them (no `# renovate:` marker). They now carry markers under one depName (one branch, groupName keycloak-operator), with a packageRule: automerge false, labels needs-review + blast-radius; majors still wait on the dashboard. The untagged quay.io/keycloak/keycloak in catalog/keycloak.yaml renders apps/wave-1/keycloak.yaml, which no kustomization lists. It is pinned to the operator's 26.0.6 as documentation, re-rendered, and Renovate is disabled for that image so it cannot raise PRs against a file nothing deploys. The render is kept (not deleted): it is the fixture for apps/wave-1/tests/app-slis.test.yaml's keycloak SLI rule tests. README: an "Upgrading Keycloak" section — an operator bump must be checked against passkey-reconciler.yaml's 26.0.6 Admin API assumptions. Co-Authored-By: Claude Opus 5.5 <[email protected]>	2026-10-30 03:02:25 -05:00

Author

SHA1

Message

Date

jakman85andClaude Opus 5.5

8ed4e30201

docs(decisions): handoff for feat/renovate-track-keycloak-operator

gate / gate (pull_request) Successful in 2m57s

Details

gate / conformance (pull_request) Has been skipped

Details

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-10-30 03:06:56 -05:00

jakman85andClaude Opus 5.5

24db269ea8

feat(renovate): track the Keycloak operator (the real Keycloak version), never auto-merge it

The Keycloak CR has no spec.image, so the operator's RELATED_IMAGE_KEYCLOAK picks the
server image; the three keycloak-k8s-resources release URLs in
platform/keycloak/kustomization.yaml are therefore THE Keycloak version, and Renovate
could not see them (no `# renovate:` marker). They now carry markers under one depName
(one branch, groupName keycloak-operator), with a packageRule: automerge false, labels
needs-review + blast-radius; majors still wait on the dashboard.

The untagged quay.io/keycloak/keycloak in catalog/keycloak.yaml renders
apps/wave-1/keycloak.yaml, which no kustomization lists. It is pinned to the operator's
26.0.6 as documentation, re-rendered, and Renovate is disabled for that image so it
cannot raise PRs against a file nothing deploys. The render is kept (not deleted): it is
the fixture for apps/wave-1/tests/app-slis.test.yaml's keycloak SLI rule tests.

README: an "Upgrading Keycloak" section — an operator bump must be checked against
passkey-reconciler.yaml's 26.0.6 Admin API assumptions.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

2026-10-30 03:02:25 -05:00