Repository navigation
Keycloak Operator 26.3.0 fails to update to 26.3.0 #40890
Description
Before reporting an issue
- I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.
Area
operator
Describe the bug
When upgrading the Keycloak Operator to 26.3.0 on an existing Keycloak instance the Keycloak StatefulSet is not updated to the new version. The operator logs the following error:
2025-07-03 11:16:25,467 ERROR [io.jav.ope.pro.eve.EventProcessor] (ReconcilerExecutor-keycloakcontroller-96) Error during event processing ExecutionScope{ resource id: ResourceID{name='keycloak', namespace='keycloak'}, version: 1543606041}: io.javaoperatorsdk.operator.AggregatedOperatorException: Exception(s) during workflow execution. Details:
keycloak-operator-5c854d47ff-xzk42 keycloak-operator - org.keycloak.operator.controllers.KeycloakDeploymentDependentResource -> io.fabric8.kubernetes.client.KubernetesClientException: Failure executing: PATCH at: https://.../apis/apps/v1/namespaces/keycloak/statefulsets/keycloak?fieldManager=keycloakcontroller&force=true. Message: StatefulSet.apps "keycloak" is invalid: spec: Forbidden: updates to statefulset spec for fields other than 'replicas', 'ordinals', 'template', 'updateStrategy', 'persistentVolumeClaimRetentionPolicy' and 'minReadySeconds' are forbidden. Received status: Status(apiVersion=v1, code=422, details=StatusDetails(causes=[StatusCause(field=spec, message=Forbidden: updates to statefulset spec for fields other than 'replicas', 'ordinals', 'template', 'updateStrategy', 'persistentVolumeClaimRetentionPolicy' and 'minReadySeconds' are forbidden, reason=FieldValueForbidden, additionalProperties={})], group=apps, kind=StatefulSet, name=keycloak, retryAfterSeconds=null, uid=null, additionalProperties={}), kind=Status, message=StatefulSet.apps "keycloak" is invalid: spec: Forbidden: updates to statefulset spec for fields other than 'replicas', 'ordinals', 'template', 'updateStrategy', 'persistentVolumeClaimRetentionPolicy' and 'minReadySeconds' are forbidden, metadata=ListMeta(_continue=null, remainingItemCount=null, resourceVersion=null, selfLink=null, additionalProperties={}), reason=Invalid, status=Failure, additionalProperties={}).
Version
26.3.0
Regression
- The issue is a regression
Expected behavior
The StatefulSet is updated to the new image or automatically recreated.
Actual behavior
The update does not happen.
How to Reproduce?
Install Keycloak Operator 26.2.5, create Keycloak, update to 26.3.0.
Anything else?
No response
Activity
bo0ts commentedon Jul 3, 2025
I suspect this is caused by #39419
shawkins commentedon Jul 3, 2025
I believe you are correct. We'll have to make that conditional for only new statefulsets.
bo0ts commentedon Jul 3, 2025
@shawkins I believe the operator used to be smart enough to recreate statefulsets when necessary.
shawkins commentedon Jul 3, 2025
A few releases back for a label change it has to consider whether to delete the statefulset to make that change. This is just a optional change to the statefulset - there's no need to recreate just for this.
bo0ts commentedon Jul 3, 2025
As a workaround it is possible to simply delete the statefulset and let the operator recreate it.
4 remaining items
shawkins commentedon Jul 3, 2025
I am looking at it.
There is an upgrade test that I though was catching things like this, but it's specifically for the labeling issue.
Which is fine.
vmuzikar commentedon Jul 3, 2025
Right, just wanted to point that out. The servicename was supposed to help pass some validations. But it doesn't have much value for existing StatefulSets that clearly were not affected by the validations.
fix: detecting when we can set the serviceName (keycloak#40894)
fix: detecting when we can set the serviceName (keycloak#40894)
fix: detecting when we can set the serviceName