fix: disable config cache, trigger reconcile if generation changes (#649)

raffis · web-flow · commit 9789905169ef · 2026-04-30T12:07:49.000+02:00
diff --git a/Makefile b/Makefile
@@ -123,7 +123,7 @@ deploy: manifests kustomize ## Deploy controller to the K8s cluster specified in
 undeploy: ## Undeploy controller from the K8s cluster specified in ~/.kube/config. Call with ignore-not-found=true to ignore resource not found errors during deletion.
 	$(KUSTOMIZE) build config/default | kubectl delete --ignore-not-found=$(ignore-not-found) -f -
 
-TEST_PROFILE=keycloak-v20
+TEST_PROFILE=keycloak-v26
 CLUSTER=kind
 
 .PHONY: kind-test
diff --git a/chart/keycloak-controller/crds/keycloak.infra.doodle.com_keycloakclients.yaml b/chart/keycloak-controller/crds/keycloak.infra.doodle.com_keycloakclients.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: keycloakclients.keycloak.infra.doodle.com
 spec:
   group: keycloak.infra.doodle.com
diff --git a/chart/keycloak-controller/crds/keycloak.infra.doodle.com_keycloakrealms.yaml b/chart/keycloak-controller/crds/keycloak.infra.doodle.com_keycloakrealms.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: keycloakrealms.keycloak.infra.doodle.com
 spec:
   group: keycloak.infra.doodle.com
diff --git a/chart/keycloak-controller/crds/keycloak.infra.doodle.com_keycloakusers.yaml b/chart/keycloak-controller/crds/keycloak.infra.doodle.com_keycloakusers.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: keycloakusers.keycloak.infra.doodle.com
 spec:
   group: keycloak.infra.doodle.com
diff --git a/config/base/crd/bases/keycloak.infra.doodle.com_keycloakclients.yaml b/config/base/crd/bases/keycloak.infra.doodle.com_keycloakclients.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: keycloakclients.keycloak.infra.doodle.com
 spec:
   group: keycloak.infra.doodle.com
diff --git a/config/base/crd/bases/keycloak.infra.doodle.com_keycloakrealms.yaml b/config/base/crd/bases/keycloak.infra.doodle.com_keycloakrealms.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: keycloakrealms.keycloak.infra.doodle.com
 spec:
   group: keycloak.infra.doodle.com
diff --git a/config/base/crd/bases/keycloak.infra.doodle.com_keycloakusers.yaml b/config/base/crd/bases/keycloak.infra.doodle.com_keycloakusers.yaml
@@ -3,7 +3,7 @@ apiVersion: apiextensions.k8s.io/v1
 kind: CustomResourceDefinition
 metadata:
   annotations:
-    controller-gen.kubebuilder.io/version: v0.18.0
+    controller-gen.kubebuilder.io/version: v0.20.0
   name: keycloakusers.keycloak.infra.doodle.com
 spec:
   group: keycloak.infra.doodle.com
diff --git a/config/tests/base/keycloakrealm.yaml b/config/tests/base/keycloakrealm.yaml
@@ -37,14 +37,11 @@ spec:
     webAuthnPolicyAuthenticatorAttachment: not specified
     webAuthnPolicyAvoidSameAuthenticatorRegister: false
     webAuthnPolicyCreateTimeout: 0
-    webAuthnPolicyExtraOrigins: []
     webAuthnPolicyPasswordlessAcceptableAaguids: []
     webAuthnPolicyPasswordlessAttestationConveyancePreference: not specified
     webAuthnPolicyPasswordlessAuthenticatorAttachment: not specified
     webAuthnPolicyPasswordlessAvoidSameAuthenticatorRegister: false
     webAuthnPolicyPasswordlessCreateTimeout: 0
-    webAuthnPolicyPasswordlessExtraOrigins: []
-    webAuthnPolicyPasswordlessPasskeysEnabled: false
     webAuthnPolicyPasswordlessRequireResidentKey: not specified
     webAuthnPolicyPasswordlessRpId: ""
     webAuthnPolicyPasswordlessSignatureAlgorithms:
diff --git a/config/tests/cases/keycloak-v18/kustomization.yaml b/config/tests/cases/keycloak-v18/kustomization.yaml
diff --git a/config/tests/cases/keycloak-v24/kustomization.yaml b/config/tests/cases/keycloak-v24/kustomization.yaml
@@ -36,12 +36,3 @@ images:
 - name: ghcr.io/doodlescheduling/keycloak-controller
   newTag: latest
   newName: keycloak-controller
-
-patchesStrategicMerge:
-- | 
-  apiVersion: keycloak.infra.doodle.com/v1beta1
-  kind: KeycloakRealm
-  metadata:
-    name: test
-  spec:
-    version: 24.0.1
diff --git a/config/tests/cases/keycloak-v26/kustomization.yaml b/config/tests/cases/keycloak-v26/kustomization.yaml
@@ -9,20 +9,20 @@ resources:
 helmCharts:
 - repo: https://codecentric.github.io/helm-charts
   name: keycloakx
-  version: 2.0.0
+  version: 7.1.11
   releaseName: keycloakx
   namespace: keycloak-system
   valuesInline:
     image:
-      tag: "20.0.1"
+      tag: "26.6.1"
 
     command:
       - "/opt/keycloak/bin/kc.sh"
       - "start"
+      - "--health-enabled=true"
       - "--http-enabled=true"
       - "--http-port=8080"
       - "--hostname-strict=false"
-      - "--hostname-strict-https=false"
     extraEnv: |
       - name: KEYCLOAK_ADMIN
         value: admin
@@ -44,5 +44,4 @@ patchesStrategicMerge:
   metadata:
     name: test
   spec:
-    version: 20.0.1
-   
+    version: latest-26
diff --git a/internal/controllers/keycloakrealm_controller.go b/internal/controllers/keycloakrealm_controller.go
@@ -334,7 +334,7 @@ func (r *KeycloakRealmReconciler) reconcile(ctx context.Context, realm infrav1be
 	}
 
 	// rate limiter
-	if readyCondition != nil && readyCondition.Status == metav1.ConditionTrue && (realm.Spec.Interval == nil || time.Since(readyCondition.LastTransitionTime.Time) < realm.Spec.Interval.Duration) && checksum == realm.Status.ObservedSHA256 {
+	if readyCondition != nil && readyCondition.Status == metav1.ConditionTrue && (realm.Spec.Interval == nil || time.Since(readyCondition.LastTransitionTime.Time) < realm.Spec.Interval.Duration && checksum == realm.Status.ObservedSHA256 && realm.Generation == realm.Status.ObservedGeneration) {
 		logger.V(1).Info("skip reconciliation, last transition time too recent")
 
 		if realm.Spec.Interval != nil {
@@ -454,7 +454,7 @@ func (r *KeycloakRealmReconciler) createReconciler(ctx context.Context, realm in
 		passwordField = realm.Spec.AuthSecret.PasswordField
 	}
 
-	tag := fmt.Sprintf("latest-%s", realm.Spec.Version)
+	var tag string
 	username, password, err := getSecret(ctx, r.Client, realm, usernameField, passwordField)
 	if err != nil {
 		return realm, ctrl.Result{}, err
@@ -466,8 +466,10 @@ func (r *KeycloakRealmReconciler) createReconciler(ctx context.Context, realm in
 			return realm, reconcile.Result{}, err
 		}
 
-		logger.Info("keycloak version detected", "version", version)
-		tag = fmt.Sprintf("latest-%s", version)
+		tag = fmt.Sprintf("latest-%s", getMajor(version))
+		logger.Info("keycloak version detected", "version", version, "tag", tag)
+	} else {
+		tag = realm.Spec.Version
 	}
 
 	containers := []corev1.Container{
@@ -490,6 +492,10 @@ func (r *KeycloakRealmReconciler) createReconciler(ctx context.Context, realm in
 					Name:  "IMPORT_FILES_LOCATIONS",
 					Value: "/realm/realm.json",
 				},
+				{
+					Name:  "IMPORT_CACHE_ENABLED",
+					Value: "false",
+				},
 				{
 					Name: "KEYCLOAK_USER",
 					ValueFrom: &corev1.EnvVarSource{
@@ -559,6 +565,15 @@ func (r *KeycloakRealmReconciler) createReconciler(ctx context.Context, realm in
 	return realm, ctrl.Result{}, err
 }
 
+func getMajor(version string) string {
+	version = strings.TrimPrefix(version, "v")
+	parts := strings.Split(version, ".")
+	if len(parts) > 0 {
+		return parts[0]
+	}
+	return ""
+}
+
 func getSecret(ctx context.Context, c client.Client, realm infrav1beta1.KeycloakRealm, usernameField, passwordField string) (string, string, error) {
 	namespace := realm.Spec.AuthSecret.Namespace
 	if namespace == "" {
diff --git a/internal/controllers/keycloakrealm_controller_test.go b/internal/controllers/keycloakrealm_controller_test.go
@@ -107,7 +107,7 @@ var _ = Describe("KeycloakRealm controller", func() {
 					Namespace: "default",
 				},
 				Spec: v1beta1.KeycloakRealmSpec{
-					Version: "22.0.1",
+					Version: "latest-22",
 					Address: "http://my-keycloak",
 					AuthSecret: v1beta1.SecretReference{
 						Name: authSecret.Name,
@@ -163,6 +163,10 @@ var _ = Describe("KeycloakRealm controller", func() {
 					Name:  "IMPORT_FILES_LOCATIONS",
 					Value: "/realm/realm.json",
 				},
+				{
+					Name:  "IMPORT_CACHE_ENABLED",
+					Value: "false",
+				},
 				{
 					Name: "KEYCLOAK_USER",
 					ValueFrom: &corev1.EnvVarSource{
@@ -187,7 +191,7 @@ var _ = Describe("KeycloakRealm controller", func() {
 				},
 			}
 
-			Expect(pod.Spec.Containers[0].Image).Should(Equal("test:latest-22.0.1"))
+			Expect(pod.Spec.Containers[0].Image).Should(Equal("test:latest-22"))
 			Expect(pod.Spec.Containers[0].Env).Should(Equal(envs))
 			Expect(reconciledInstance.Status.SubResourceCatalog).Should(HaveLen(0))
 
@@ -346,6 +350,10 @@ var _ = Describe("KeycloakRealm controller", func() {
 					Name:  "IMPORT_FILES_LOCATIONS",
 					Value: "/realm/realm.json",
 				},
+				{
+					Name:  "IMPORT_CACHE_ENABLED",
+					Value: "false",
+				},
 				{
 					Name: "KEYCLOAK_USER",
 					ValueFrom: &corev1.EnvVarSource{
@@ -370,7 +378,7 @@ var _ = Describe("KeycloakRealm controller", func() {
 				},
 			}
 
-			Expect(pod.Spec.Containers[0].Image).Should(Equal("test:latest-22.0.1"))
+			Expect(pod.Spec.Containers[0].Image).Should(Equal("test:latest-22"))
 			Expect(pod.Spec.Containers[0].Env).Should(Equal(envs))
 			Expect(reconciledInstance.Status.SubResourceCatalog).Should(HaveLen(0))
 		})
@@ -422,7 +430,7 @@ var _ = Describe("KeycloakRealm controller", func() {
 					Namespace: "default",
 				},
 				Spec: v1beta1.KeycloakRealmSpec{
-					Version: "22.0.1",
+					Version: "latest-22",
 					Address: "http://my-keycloak",
 					AuthSecret: v1beta1.SecretReference{
 						Name: authSecret.Name,
@@ -537,7 +545,7 @@ var _ = Describe("KeycloakRealm controller", func() {
 					Namespace: "default",
 				},
 				Spec: v1beta1.KeycloakRealmSpec{
-					Version: "22.0.1",
+					Version: "latest-22",
 					Address: "http://my-keycloak",
 
 					AuthSecret: v1beta1.SecretReference{
@@ -634,7 +642,7 @@ var _ = Describe("KeycloakRealm controller", func() {
 					Namespace: "default",
 				},
 				Spec: v1beta1.KeycloakRealmSpec{
-					Version: "22.0.1",
+					Version: "latest-22",
 					Address: "http://my-keycloak",
 					AuthSecret: v1beta1.SecretReference{
 						Name: authSecret.Name,
@@ -728,7 +736,7 @@ var _ = Describe("KeycloakRealm controller", func() {
 					Namespace: "default",
 				},
 				Spec: v1beta1.KeycloakRealmSpec{
-					Version: "22.0.1",
+					Version: "latest-22",
 					Address: "http://my-keycloak",
 					AuthSecret: v1beta1.SecretReference{
 						Name:          authSecret.Name,
@@ -785,6 +793,10 @@ var _ = Describe("KeycloakRealm controller", func() {
 					Name:  "IMPORT_FILES_LOCATIONS",
 					Value: "/realm/realm.json",
 				},
+				{
+					Name:  "IMPORT_CACHE_ENABLED",
+					Value: "false",
+				},
 				{
 					Name: "KEYCLOAK_USER",
 					ValueFrom: &corev1.EnvVarSource{
@@ -839,7 +851,7 @@ var _ = Describe("KeycloakRealm controller", func() {
 					Namespace: "default",
 				},
 				Spec: v1beta1.KeycloakRealmSpec{
-					Version: "22.0.1",
+					Version: "latest-22",
 					Address: "http://my-keycloak",
 					AuthSecret: v1beta1.SecretReference{
 						Name: authSecret.Name,
@@ -963,7 +975,7 @@ var _ = Describe("KeycloakRealm controller", func() {
 					Namespace: "default",
 				},
 				Spec: v1beta1.KeycloakRealmSpec{
-					Version: "22.0.1",
+					Version: "latest-22",
 					Address: "http://my-keycloak",
 					AuthSecret: v1beta1.SecretReference{
 						Name: authSecret.Name,
@@ -1093,7 +1105,7 @@ var _ = Describe("KeycloakRealm controller", func() {
 					Namespace: "default",
 				},
 				Spec: v1beta1.KeycloakRealmSpec{
-					Version: "22.0.1",
+					Version: "latest-22",
 					Address: "http://my-keycloak",
 					AuthSecret: v1beta1.SecretReference{
 						Name: authSecret.Name,
@@ -1226,7 +1238,7 @@ var _ = Describe("KeycloakRealm controller", func() {
 					Namespace: "default",
 				},
 				Spec: v1beta1.KeycloakRealmSpec{
-					Version: "22.0.1",
+					Version: "latest-22",
 					Address: "http://my-keycloak",
 					AuthSecret: v1beta1.SecretReference{
 						Name: authSecret.Name,
@@ -1347,7 +1359,7 @@ var _ = Describe("KeycloakRealm controller", func() {
 					Namespace: "default",
 				},
 				Spec: v1beta1.KeycloakRealmSpec{
-					Version: "22.0.1",
+					Version: "latest-22",
 					Address: "http://my-keycloak",
 					ReconcilerTemplate: &v1beta1.ReconcilerTemplate{
 						ObjectMetadata: v1beta1.ObjectMetadata{
@@ -1432,6 +1444,10 @@ var _ = Describe("KeycloakRealm controller", func() {
 					Name:  "IMPORT_FILES_LOCATIONS",
 					Value: "/realm/realm.json",
 				},
+				{
+					Name:  "IMPORT_CACHE_ENABLED",
+					Value: "false",
+				},
 				{
 					Name: "KEYCLOAK_USER",
 					ValueFrom: &corev1.EnvVarSource{
@@ -1534,7 +1550,7 @@ var _ = Describe("KeycloakRealm controller", func() {
 					Namespace: "default",
 				},
 				Spec: v1beta1.KeycloakRealmSpec{
-					Version: "22.0.1",
+					Version: "latest-22",
 					Address: "http://my-keycloak",
 					AuthSecret: v1beta1.SecretReference{
 						Name: "does-not-exists",
@@ -1610,7 +1626,7 @@ var _ = Describe("KeycloakRealm controller", func() {
 				},
 				Spec: v1beta1.KeycloakRealmSpec{
 					Interval: &metav1.Duration{Duration: time.Second * 100},
-					Version:  "22.0.1",
+					Version:  "latest-22",
 					Address:  "http://my-keycloak",
 					AuthSecret: v1beta1.SecretReference{
 						Name: authSecret.Name,
