[Release-1.6] Update Keycloak operator version to 26.6.2 (!8848) · Merge requests · Sylva-projects / sylva-core

What does this MR do and why?

The keycloak unit intermittently fails on release-1.6 with timeout waiting for: [Keycloak/keycloak/keycloak status: 'InProgress'] even though keycloak itself is healthy and the keycloak statefulset is ready.

The keycloak-operator patches the Keycloak CR's status, and in keycloak 26.4.0 the operator can fail to do it because of exhausted retries due to https://github.com/keycloak/keycloak/issues/43198

When it might happen:

During cp node rolling update, when one of the node goes down, the apiServer on that node is removed from the available endpoints. Already established TCP connections to that apiServer might not be reset/closed, so requests using those connections can stay stuck until they timeout.

The Keycloak controller gets the resource from the informer cache for reconciliation. If the watch connection to API server is also affected, the informer cache can remain stale and keep the older resourceVersion.

2026-08-09 20:50:49,853 WARN  [io.jav.ope.pro.eve.EventProcessor] (ReconcilerExecutor-keycloakcontroller-135) Uncaught error during event processing ExecutionScope{ resource id: ResourceID{name='keycloak', namespace='keycloak'}, version: 187290} - but another reconciliation will be attempted because a superseding event has been received or another retry attempt is pending.: io.javaoperatorsdk.operator.AggregatedOperatorException: Exception(s) during workflow execution.        


>>> Note the resourceVersion here is 187290 and controller keeps retrying with the same

During the same time, the keycloak controller itself writes the error into the Keycloak CR status by making new write request to API server on another node, and that request goes through. This moves the resourceVersion of the object forward, but the controller keeps retrying with the older one.

manager: kustomize-controller
time: "2026-08-09T19:46:44Z"

manager: keycloakcontroller
subresource: status
time: "2026-08-09T20:50:49Z"       >>>> Same time when operator is during mid-reconcile

resourceVersion: "188311"        >>>> The resorceVersion moved forward on the object

  - lastTransitionTime: "2026-08-09T20:50:49.709826406Z"
    message: "...The timeout period of 10000ms has been exceeded while executing
      GET /api/v1/namespaces/keycloak/secrets/keycloak-bootstrap-admin ..."
    type: HasErrors

When the reconciliation is retried, it continues with the older resourceVersion, which leads to a conflict on the status update, resulting in exhausted retries and leads to the same issue as https://github.com/keycloak/keycloak/issues/43198, with the 409 error:

Operation cannot be fulfilled on keycloaks.k8s.keycloak.org "keycloak": the object has been modified; please apply your changes to the latest version and try again.

Fix:

This MR fixes it by updating to keycloak operator version 26.6.2. Combined with !8565 (merged), which pins the Keycloak version, this upgrade of the operator would not result in a change of the Keycloak version being used.

Test coverage

CI configuration

Below you can choose test deployment variants to run in this MR's CI.

Click to open to CI configuration

Legend:

Icon	Meaning	Available values
☁️	Infra Provider	`capd`, `capo`, `capm3`
🚀	Bootstrap Provider	`kubeadm` (alias `kadm`), `rke2`, `okd`, `ck8s`
🐧	Node OS	`ubuntu`, `suse`, `na`, `leapmicro`
🛠️	Deployment Options	Deployment option list and description
🎬	Pipeline Scenarios	Available scenario list and description
🟢	Enabled units	Any available units name, by default apply to management and workload cluster. Can be prefixed by `mgmt:` or `wkld:` to be applied only to a specific cluster type
🔴	Disabled units	Any available units name, by default apply to management and workload cluster. Can be prefixed by `mgmt:` or `wkld:` to be applied only to a specific cluster type
🏗️	Target platform	Can be used to select specific deployment environment Available platform list and description
⚡	Pipeline control	`autorun`, `manual` or `blocking`. Can be used to override global config and start a deployment pipeline the required way

Global config for deployment pipelines

autorun pipelines
allow failure on pipelines
record sylvactl events

Notes:

Enabling autorun will make deployment pipelines to be run automatically without human interaction
Disabling allow failure will make deployment pipelines mandatory for pipeline success.
if both autorun and allow failure are disabled, deployment pipelines will need manual triggering but will be blocking the pipeline

Be aware: after configuration change, pipeline is not triggered automatically. Please run it manually (by clicking the run pipeline button in Pipelines tab) or push new code.

Edited Aug 27, 2026 by Ishita Mittal

[Release-1.6] Update Keycloak operator version to 26.6.2

What does this MR do and why?

Fix:

Test coverage

CI configuration

Global config for deployment pipelines

Merge request reports