Provide Keycloak 11.0.3 as Iron Bank image

Summary

Big Bang has a blocking issue releasing with Iron Bank 12.x and needs the latest 11.x to be available in Iron Bank. Currently, 11.0.1 is available in Iron Bank, but Big Bang needs a bug fix that was put into 11.0.2. Requesting, that the latest 11.x release be put into Iron Bank. Currently, that is 11.0.3.

I noticed that this issue approved version 11.0.3 already, so it may be just a matter of getting the image into place in Iron Bank.

Version 11.x should not replace 12.x in Iron Bank. For now, both versions should be made available.

Version Information

Current version: 11.0.1

Updated version: 11.0.3

Under support: Yes

Definition of Done

Hardening:

• Container builds successfully
• Container version has been updated in greylist file
• Branch has been merged into development

Justifications:

• All findings have been justified per the above documentation
• Justifications have been provided to the container hardening team

Approval Process:

• Peer review from Container Hardening Team
• Findings Approver has reviewed and approved all justifications
• Approval request has been sent to Authorizing Official
• Approval request has been processed by Authorizing Official

/cc @ironbank-notifications/updates

added ContainerUpdate label

You can confirm with @joshwolf about why this IB version is necessary.

FYI
this is the specific keycloak issue number that fixes the bug in version 11.0.1
https://issues.redhat.com/browse/KEYCLOAK-15373?jql=text%20~%20%22We%20are%20sorry...%20An%20internal%20server%20error%20has%20occurred%22

assigned to @shen_vickie

@michaelmcleroy looks like the current repo is currently supporting 12.x.x. If Keycloak 11.x.x also needs to be made available and maintained, should we separate it from the current repo? @sean.melissari

@shen_vickie The latest details surrounding Keycloak for BigBang is the following:

• Nic C. has stated that we can support multiple versions of KeyCloak in Iron Bank so the major versions automatically get updates made to the base image. This is only while we transition customers forward from Keycloak 10.
• Platform One customizes the registration process by adding a plugin to Keycloak. The plugin is tightly coupled with Keycloak.
• In our attempt to update the P1 plugin from version 10, we ran into a bug in version 12.x and 11.0.1. This bug was fixed in 11.0.3. So Big Bang can't use Keycloak 12.x or 11.0.1, but might be able to use 11.0.3.
• The Big Bang plugin currently works with Keycloak 10.x. So, the immediate need for Big Bang is to get Keycloak 10.x available in Iron Bank.

TL;DR: Yes, we need multiple versions of Keycloak maintained. But, focus should be on Keycloak 10.x first.

marked this issue as related to keycloak1002#1 (closed)

looks like the renovate bot issue 9 has recently triggered a keylock upgrade from 11.0.3 to 12.0.4. The upgrade has been updated into master. I'm communicating with the team for a solution to address the current issue so we can maintain all three keycloak major versions going forward. To keep the naming consistent can we pin keycloak version to a major version and rename keycloak1002 repo to keycloak10, split the current keycloak repo into two separate keycloak11 and keycloak12? Let me know if anyone has other suggestions. Will need @jeason @sean.melissari's help to fix this. @michaelmcleroy @sanders--bah @kwami.delali @andriipanchuk.

added 1 deleted label

Keycloak does not support multiple LTS releases and instead supports only a single version of Keycloak at any given time. Asking to support every major release of Keycloak causes additional workload for no benefit. We currently have Keycloak 10.0.2 that is being supported out of band but ultimately breaking this a part into multiple "supported" instances is opposite to what the upstream supports or allows for. Each version since we've supported Keycloak will be added to the registry so Big Bang should be able to pull any of those images that were hardened at any given point. The problem is that the version requested by Big Bang is from before we had a registry which is why it doesn't show up. Repositories don't make sense to go backwards in time which is why the project was forked into keycloak10002.

@jeason makes sense and thanks for the explanation of the use case. @michaelmcleroy keycloak v11.0.0 and v11.0.1 images are currently available to be pulled from the IB registry. Below are the docker cli to pull the images if needed. Let me know if our responses resolve this issue. Feel free to reach out if you have further questions. For 11.0.1 docker pull registry1.dso.mil/ironbank/opensource/keycloak/keycloak@sha256:66e170d17d5f24b064735e45eca96605439ac258b12065f2de64dedb05f0168c For 11.0.0 docker pull registry1.dso.mil/ironbank/opensource/keycloak/keycloak@sha256:66e170d17d5f24b064735e45eca96605439ac258b12065f2de64dedb05f0168c

Please check with @megamind to confirm, but the P1 plugin we use is hitting a bug in v11.0.1 that was fixed in v11.0.3. A different bug is in v12.x that will be fixed in v13.x. So, the only possible version beyond v10 that may work is > v11.0.3 for now.

@jeason, Big Bang would like to move to the latest, but due to problems in the custom registration in the newer versions, we are stuck at v10.x, which you have opened as a one-off solution. I'm going to check with @megamind to see if v11.0.3 is still viable to get off v10.x.

@michaelmcleroy I also tried to ping @megamind via MM, but I have not gotten a response back. We'll wait for your clarification on the requirements to proceed on this issue. thanks.

version 13 is now released. This issue can probably be closed
keycloak#13 (closed)

Keycloak 13.x is available in registry1. Closing for now. Reopen if 11.0.3 is still a requirement.

closed