Migrate Keycloak from Bitnami chart to Codecentric KeycloakX

charts/openhands-secrets/templates/keycloak-realm.yaml

@@ -6,7 +6,7 @@ metadata:
 type: Opaque
 data:
   realm-name: {{ .Values.config.keycloak_realm_name | b64enc | quote }}
-  server-url: {{ "http://keycloak" | b64enc | quote }}
+  server-url: {{ "http://openhands-keycloak-http" | b64enc | quote }}
   client-id: {{ .Values.config.keycloak_client_id | b64enc | quote }}
   client-secret: {{ .Values.config.keycloak_client_secret | b64enc | quote }}
   smtp-password: {{ .Values.config.keycloak_smtp_password | b64enc | quote }}

charts/openhands/Chart.lock

@@ -2,9 +2,9 @@ dependencies:
 - name: clickhouse
   repository: oci://registry-1.docker.io/bitnamicharts
   version: 9.2.5
-- name: keycloak
-  repository: oci://registry-1.docker.io/bitnamicharts
-  version: 24.7.5
+- name: keycloakx
+  repository: https://codecentric.github.io/helm-charts
+  version: 7.1.9
 - name: langfuse
   repository: https://langfuse.github.io/langfuse-k8s
   version: 1.2.13
@@ -25,6 +25,9 @@ dependencies:
   version: 1.9.0
 - name: runtime-api
   repository: oci://ghcr.io/all-hands-ai/helm-charts
-  version: 0.1.24
-digest: sha256:bca3722cdd4840a4557955ea2b80e38991cc2d0a0211855a791cf98e37410e45
-generated: "2026-03-18T00:28:58.972983917-04:00"
+  version: 0.2.6
+- name: automation
+  repository: oci://ghcr.io/all-hands-ai/helm-charts
+  version: 0.1.0
+digest: sha256:9704eb8e0893624e1ab033871f04966cc9446437d785a89dce7b249de8c05ac0
+generated: "2026-04-03T17:26:28.296356-04:00"

charts/openhands/Chart.yaml

@@ -12,9 +12,10 @@ dependencies:
     repository: oci://registry-1.docker.io/bitnamicharts
     version: 9.2.5
     condition: clickhouse.enabled
-  - name: keycloak
-    version: 24.7.5
-    repository: oci://registry-1.docker.io/bitnamicharts
+  - name: keycloakx
+    alias: keycloak
+    version: 7.1.9
+    repository: https://codecentric.github.io/helm-charts
     condition: keycloak.enabled
   - name: langfuse
     repository: https://langfuse.github.io/langfuse-k8s

charts/openhands/example-values.yaml

@@ -34,10 +34,18 @@ keycloak:
   enabled: true
   ingress:
     enabled: false
-    hostname: "auth.app.example.com"
     annotations: {}
     # Value should match your Issuer/ClusterIssuer and uncomment if you're using cert-manager for certificates
     # cert-manager.io/cluster-issuer: letsencrypt
+    rules: []
+    #  - host: auth.app.example.com
+    #    paths:
+    #      - path: /
+    #        pathType: Prefix
+    tls: []
+    #  - secretName: keycloak-tls
+    #    hosts:
+    #      - auth.app.example.com
 
 postgresql:
   enabled: true

charts/openhands/templates/_init-containers.yaml

@@ -30,7 +30,7 @@
       done
   env:
     - name: DATABASES
-      value: "{{ .Values.keycloak.externalDatabase.database }}{{- if (index .Values "litellm-helm").enabled }} {{ (index .Values "litellm-helm").db.database }}{{- end }}{{- if .Values.langfuse.enabled }} {{ .Values.langfuse.postgresql.auth.database }}{{- end }}"
+      value: "{{ .Values.keycloak.database.database }}{{- if (index .Values "litellm-helm").enabled }} {{ (index .Values "litellm-helm").db.database }}{{- end }}{{- if .Values.langfuse.enabled }} {{ .Values.langfuse.postgresql.auth.database }}{{- end }}"
     {{- include "openhands.env" . | nindent 4 }}
 {{- end }}
 {{- if .Values.databaseMigrations.migrate }}

charts/openhands/templates/troubleshoot/support-bundle.yaml

@@ -75,7 +75,7 @@ spec:
           maxAge: 168h
     {{- end }}
     {{- if .Values.keycloak.enabled }}
-    # Keycloak logs (Bitnami chart)
+    # Keycloak logs (KeycloakX chart)
     - logs:
         name: app/{{ .Release.Name }}-keycloak/logs
         namespace: {{ .Release.Namespace }}
@@ -243,7 +243,7 @@ spec:
     {{- end }}
     {{- if .Values.keycloak.enabled }}
     - statefulsetStatus:
-        name: keycloak
+        name: {{ .Release.Name }}-keycloak
         namespace: {{ .Release.Namespace }}
         outcomes:
           - fail:

charts/openhands/values.yaml

@@ -287,85 +287,83 @@ clickhouse:
 
 keycloak:
   enabled: false
-  url: "http://keycloak"
-  fullnameOverride: keycloak
-  replicaCount: 1
-  production: true
-  proxyHeaders: forwarded
-  ingress:
-    enabled: false
-    # REQUIRED: Update to a hostname in a DNS domain you own
-    # hostname: auth.app.example.com
-    servicePort: 80
-    tls: true
-    annotations: {}
-      # UPDATE: if you use cert-manager, enter your clusterIssuer may not match.
-      # cert-manager.io/cluster-issuer: letsencrypt-production
-    ingressClassName: traefik
-  auth:
-    adminUser: tmpadmin
-    existingSecret: keycloak-admin
-    passwordSecretKey: admin-password
+  url: "http://openhands-keycloak-http"
+  replicas: 1
+
+  command:
+    - "/opt/keycloak/bin/kc.sh"
+  args:
+    - "start"
+
+  image:
+    repository: quay.io/keycloak/keycloak
+    tag: "26.5.5"
+    pullPolicy: IfNotPresent
+
+  database:
+    vendor: postgres
+    hostname: oh-main-postgresql
+    port: 5432
+    database: bitnami_keycloak
+    existingSecret: postgres-password
+    existingSecretKey: password
+
+  dbchecker:
+    enabled: true
+    image:
+      repository: docker.io/library/busybox
+      tag: "1.37"
+
+  proxy:
+    enabled: true
+    mode: xforwarded
+
+  http:
+    relativePath: "/"
+
   service:
     type: ClusterIP
+    httpPort: 80
+
   serviceAccount:
+    create: true
     name: "keycloak-sa"
-  postgresql:
+
+  ingress:
     enabled: false
-  externalDatabase:
-    host: oh-main-postgresql
-    database: bitnami_keycloak
-    existingSecret: postgres-password
-    existingSecretUserKey: username
-    existingSecretPasswordKey: password
-  extraEnvVars:
+    ingressClassName: traefik
+    annotations: {}
+      # UPDATE: if you use cert-manager, enter your clusterIssuer may not match.
+      # cert-manager.io/cluster-issuer: letsencrypt-production
+    rules: []
+    #  - host: auth.app.example.com
+    #    paths:
+    #      - path: /
+    #        pathType: Prefix
+    tls: []
+    #  - secretName: keycloak-tls
+    #    hosts:
+    #      - auth.app.example.com
+
+  extraEnv: |
+    - name: KEYCLOAK_ADMIN
+      value: tmpadmin
+    - name: KEYCLOAK_ADMIN_PASSWORD
+      valueFrom:
+        secretKeyRef:
+          name: keycloak-admin
+          key: admin-password
     - name: KC_FEATURES
       value: token-exchange,admin-fine-grained-authz
-    - name: KC_HTTP_ENABLED
-      value: "true"
-    - name: KC_PROXY_HEADERS
-      value: "xforwarded"
+    - name: KC_HOSTNAME_STRICT
+      value: "false"
     - name: KC_SPI_LOGIN_PROTOCOL_OPENID_CONNECT_LEGACY_LOGOUT_REDIRECT_URI
       value: "true"
-  image:
-    repository: bitnamilegacy/keycloak
-  waitForDb:
-    image: "bitnamilegacy/postgresql:latest"
-  initContainers:
-    - name: wait-for-db
-      # The Bitnami Keycloak subchart renders initContainers through common.tplvalues.render,
-      # so this template expression is evaluated at deploy time rather than being treated as
-      # a literal string. This lets us override just the image (e.g. for Replicated proxy)
-      # without duplicating the entire init container.
-      image: '{{ .Values.waitForDb.image }}'
-      command: ['sh', '-c']
-      args:
-        - |
-          echo "Waiting for database \"$KEYCLOAK_DATABASE_NAME\" at $KEYCLOAK_DATABASE_HOST:$KEYCLOAK_DATABASE_PORT..."
-          until PGPASSWORD=$DB_PASS pg_isready -h "$KEYCLOAK_DATABASE_HOST" -p "$KEYCLOAK_DATABASE_PORT" -U "$DB_USER" -d "$KEYCLOAK_DATABASE_NAME" > /dev/null 2>&1; do
-            echo "PostgreSQL is unavailable - sleeping 5s"
-            sleep 5
-          done
-          echo "PostgreSQL is ready, checking database exists..."
-          until PGPASSWORD=$DB_PASS psql -h "$KEYCLOAK_DATABASE_HOST" -p "$KEYCLOAK_DATABASE_PORT" -U "$DB_USER" -d "$KEYCLOAK_DATABASE_NAME" -c "SELECT 1" > /dev/null 2>&1; do
-            echo "Database \"$KEYCLOAK_DATABASE_NAME\" not ready - sleeping 5s"
-            sleep 5
-          done
-          echo "Database \"$KEYCLOAK_DATABASE_NAME\" is ready!"
-      envFrom:
-        - configMapRef:
-            name: keycloak-env-vars
-      env:
-        - name: DB_USER
-          valueFrom:
-            secretKeyRef:
-              name: postgres-password
-              key: username
-        - name: DB_PASS
-          valueFrom:
-            secretKeyRef:
-              name: postgres-password
-              key: password
+    - name: KC_DB_USERNAME
+      valueFrom:
+        secretKeyRef:
+          name: postgres-password
+          key: username
 
 langfuse:
   # Enable this if you want to use langfuse for tracing

replicated/application.yaml

@@ -26,8 +26,8 @@ spec:
     - openhands/ingress/openhands-mcp-ingress
 
     # keycloak
-    - openhands/statefulset/keycloak
-    - openhands/service/keycloak
+    - openhands/statefulset/openhands-keycloak
+    - openhands/service/openhands-keycloak-http
 
     # postgres
     - '{{repl if ConfigOptionEquals "postgres_type" "embedded_postgres"}}openhands/statefulset/openhands-postgresql{{repl end}}'