recipe-maintainers/keycloak
0
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

chore: upgrade mariadb to 13.0 #13

Closed
autonomic-bot wants to merge 0 commits from upgrade-fd00114 into main
pull from: upgrade-fd00114
merge into: :main
Conversation 3 Commits - Files Changed -
+2 -1
autonomic-bot commented 2026-10-30 03:32:39 +00:00
Owner
Copy Link
Copy Source

Upgrade: mariadb 12.3 → 13.0 (db sidecar)

The app image keycloak/keycloak is already current at 26.8.1 (abra recipe upgrade reports no newer version). This PR moves only the database sidecar.

service image current new
app keycloak/keycloak 26.8.1 26.8.1 (unchanged)
db mariadb 12.3 13.0

What changed

  1. compose.yml: image: "mariadb:12.3" → "mariadb:13.0" (13.0 currently resolves to 13.0.2 GA).
  2. compose.yml: added MARIADB_AUTO_UPGRADE=1 to the db service. The official mariadb entrypoint otherwise skips the system-table upgrade on a major-version change — observed live on cc-ci as MariaDB upgrade (mariadb-upgrade ...) required, but skipped due to $MARIADB_AUTO_UPGRADE setting. With the flag set, the entrypoint logged Major version upgrade detected from 12.3.3-MariaDB to 13.0.2-MariaDB. Check required! → Finished mariadb-upgrade. This matches the existing precedent in nextcloud (MARIADB_AUTO_UPGRADE=1).

Compatibility check (is this bump right for the recipe?)

  • Keycloak 26.8's supported MariaDB matrix lists the LTS lines (11.8/11.4/10.11/10.6); this recipe was already on the rolling 12.3 line, and MariaDB 13.0 is the direct evolution of 12.3 (rolling release, 13.0.2 GA 2026-09-15). Keycloak uses ordinary InnoDB/JPA tables only — no Galera, no replication, no binlog_format=STATEMENT.
  • MariaDB 13.0's removals (DES_ENCRYPT/DES_DECRYPT, --secure-auth, --old, default YEAR(2)) are not used by Keycloak or this compose file. The backup hooks use mariadb-dump/mariadb, still present in 13.0.
  • Live dev deploy on cc-ci (step 2b, --chaos, torn down): deployed 12.3, initialized the schema + created data, then redeployed the same data volume at 13.0. mariadb-upgrade completed, keycloak 26.8.1 bootstrapped, OIDC discovery returned HTTP 200, and pre-upgrade rows survived (6 clients / 1 realm / 1 user). No crash-loop, no migration error.

Operator action required

  • Take a backup before deploying. The first boot on 13.0 runs mariadb-upgrade against the existing data directory; on large databases this can take time. In-place downgrade is not supported — roll forward or restore from backupbot.
  • No env/volume renames beyond MARIADB_AUTO_UPGRADE.

Advisory scan (deterministic)

7 CVEs fixed by moving MariaDB 12.3 → 13.0 (advisory patched ranges), including critical CVE-2026-49261 and high CVE-2026-44168, CVE-2026-48163, CVE-2026-48165.

Upstream release notes

Upstream release notes: db mariadb 12.3→13.0: https://mariadb.com/docs/release-notes/community-server/13.0/13.0.2.md (series overview: https://mariadb.com/docs/release-notes/community-server/13.0/mariadb-13.0-changes-and-improvements.md)
Upstream release notes: app keycloak 26.8.1 (unchanged): https://github.com/keycloak/keycloak/releases

Version label

Left untouched in this PR (per the upgrader workflow). Recommended release after merge:

abra recipe release keycloak -x

→ major bump to 11.0.0+26.8.1: this is a major DB engine upgrade whose first boot performs a required in-place schema/system-table migration, i.e. an operator-visible breaking change.

Nothing was merged — operator to review.

Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review.

cc @trav @notplants

## Upgrade: `mariadb` 12.3 → 13.0 (db sidecar) The app image `keycloak/keycloak` is already current at **26.8.1** (`abra recipe upgrade` reports no newer version). This PR moves only the **database sidecar**. | service | image | current | new | |---------|-------|---------|-----| | app | keycloak/keycloak | 26.8.1 | 26.8.1 (unchanged) | | db | mariadb | 12.3 | **13.0** | ### What changed 1. `compose.yml`: `image: "mariadb:12.3"` → `"mariadb:13.0"` (13.0 currently resolves to 13.0.2 GA). 2. `compose.yml`: added `MARIADB_AUTO_UPGRADE=1` to the `db` service. The official mariadb entrypoint otherwise **skips** the system-table upgrade on a major-version change — observed live on cc-ci as `MariaDB upgrade (mariadb-upgrade ...) required, but skipped due to $MARIADB_AUTO_UPGRADE setting`. With the flag set, the entrypoint logged `Major version upgrade detected from 12.3.3-MariaDB to 13.0.2-MariaDB. Check required!` → `Finished mariadb-upgrade`. This matches the existing precedent in `nextcloud` (`MARIADB_AUTO_UPGRADE=1`). ### Compatibility check (is this bump right for the recipe?) - Keycloak 26.8's supported MariaDB matrix lists the LTS lines (11.8/11.4/10.11/10.6); this recipe was already on the rolling 12.3 line, and MariaDB 13.0 is the direct evolution of 12.3 (rolling release, 13.0.2 GA 2026-09-15). Keycloak uses ordinary InnoDB/JPA tables only — no Galera, no replication, no `binlog_format=STATEMENT`. - MariaDB 13.0's removals (`DES_ENCRYPT`/`DES_DECRYPT`, `--secure-auth`, `--old`, default `YEAR(2)`) are not used by Keycloak or this compose file. The backup hooks use `mariadb-dump`/`mariadb`, still present in 13.0. - **Live dev deploy on cc-ci** (step 2b, `--chaos`, torn down): deployed 12.3, initialized the schema + created data, then redeployed the *same data volume* at 13.0. `mariadb-upgrade` completed, keycloak 26.8.1 bootstrapped, OIDC discovery returned HTTP 200, and pre-upgrade rows survived (6 clients / 1 realm / 1 user). No crash-loop, no migration error. ### Operator action required - **Take a backup before deploying.** The first boot on 13.0 runs `mariadb-upgrade` against the existing data directory; on large databases this can take time. In-place downgrade is not supported — roll forward or restore from backupbot. - No env/volume renames beyond `MARIADB_AUTO_UPGRADE`. ### Advisory scan (deterministic) **7 CVEs fixed** by moving MariaDB 12.3 → 13.0 (advisory patched ranges), including critical **CVE-2026-49261** and high **CVE-2026-44168**, **CVE-2026-48163**, **CVE-2026-48165**. ### Upstream release notes **Upstream release notes:** db mariadb 12.3→13.0: https://mariadb.com/docs/release-notes/community-server/13.0/13.0.2.md (series overview: https://mariadb.com/docs/release-notes/community-server/13.0/mariadb-13.0-changes-and-improvements.md) **Upstream release notes:** app keycloak 26.8.1 (unchanged): https://github.com/keycloak/keycloak/releases ### Version label Left untouched in this PR (per the upgrader workflow). Recommended release after merge: `abra recipe release keycloak -x` → major bump to `11.0.0+26.8.1`: this is a major DB engine upgrade whose first boot performs a required in-place schema/system-table migration, i.e. an operator-visible breaking change. **Nothing was merged — operator to review.** Tested green on the cc-ci recipe CI server (full suite, cold, against this PR head). NOT merged — for operator review. cc @trav @notplants
autonomic-bot added 1 commit 2026-10-30 03:32:39 +00:00
chore: upgrade mariadb to 13.0
cc-ci/testme cc-ci: success
Details
fd0011447b
autonomic-bot requested review from trav 2026-10-30 03:32:39 +00:00
autonomic-bot requested review from notplants 2026-10-30 03:32:39 +00:00
autonomic-bot commented 2026-10-30 03:32:45 +00:00
Author
Owner
Copy Link
Copy Source

!testme

!testme
autonomic-bot commented 2026-10-30 03:32:55 +00:00
Author
Owner
Copy Link
Copy Source

🌻 cc-ci — keycloak @ fd001144 ✅ passed

cc-ci result card

level

full logs · dashboard

<!-- cc-ci:testme --> 🌻 **cc-ci** — `keycloak` @ `fd001144` ✅ **passed** [![cc-ci result card](https://ci.autonomic.zone/runs/106/summary.png)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/106) [![level](https://ci.autonomic.zone/runs/106/badge.svg)](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/106) [full logs](https://drone.ci.autonomic.zone/recipe-maintainers/cc-ci/106) · [dashboard](https://ci.autonomic.zone/)
autonomic-bot commented 2026-11-02 17:22:55 +00:00
Author
Owner
Copy Link
Copy Source

Upstreamed to git.coopcloud.tech/coop-cloud/keycloak and released as 10.9.7+26.8.1: https://git.coopcloud.tech/coop-cloud/keycloak/src/tag/10.9.7+26.8.1 — closing.

Upstreamed to git.coopcloud.tech/coop-cloud/keycloak and released as `10.9.7+26.8.1`: https://git.coopcloud.tech/coop-cloud/keycloak/src/tag/10.9.7+26.8.1 — closing.
autonomic-bot closed this pull request 2026-11-02 17:22:56 +00:00

Pull request closed

Please reopen this pull request to perform a merge.
Sign in to join this conversation.
Reviewers
No Reviewers
trav
notplants
Labels
No items
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
aadil (alizeh) autonomic autonomic-bot kawaiipunk (KawaiiPunk) notplants spacehobo (Nick Moffitt) trav (Trav Fryer)
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: recipe-maintainers/keycloak#13