Closed
Description
Before reporting an issue
- I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.
Area
operator
Describe the bug
Tried to update a Keycloak instance deployed with the operator from 26.2.2 to 26.2.4. It failed with this error log from the operator pod:
2025-05-25 11:53:53,970 ERROR [io.jav.ope.pro.eve.EventProcessor] (ReconcilerExecutor-keycloakcontroller-58) Error during event processing ExecutionScope{ resource id: ResourceID{name='keycloak-main', namespace='keycloak'}, version: 87591812}: java.lang.NullPointerExcep
at org.keycloak.operator.controllers.KeycloakUpdateJobDependentResource.lambda$createPodSpec$0(KeycloakUpdateJobDependentResource.java:146)
at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:178)
at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1708)
at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:151)
at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:174)
at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
at java.base/java.util.stream.ReferencePipeline.forEach(ReferencePipeline.java:596)
at org.keycloak.operator.controllers.KeycloakUpdateJobDependentResource.createPodSpec(KeycloakUpdateJobDependentResource.java:146)
at org.keycloak.operator.controllers.KeycloakUpdateJobDependentResource.addPodSpecTemplate(KeycloakUpdateJobDependentResource.java:126)
at org.keycloak.operator.controllers.KeycloakUpdateJobDependentResource.desired(KeycloakUpdateJobDependentResource.java:91)
at org.keycloak.operator.controllers.KeycloakUpdateJobDependentResource.desired(KeycloakUpdateJobDependentResource.java:50)
at io.javaoperatorsdk.operator.processing.dependent.AbstractDependentResource.reconcile(AbstractDependentResource.java:73)
at io.javaoperatorsdk.operator.processing.dependent.SingleDependentResourceReconciler.reconcile(SingleDependentResourceReconciler.java:19)
at io.javaoperatorsdk.operator.processing.dependent.AbstractDependentResource.reconcile(AbstractDependentResource.java:66)
at org.keycloak.operator.controllers.KeycloakUpdateJobDependentResource_ClientProxy.reconcile(Unknown Source)
at org.keycloak.operator.update.impl.AutoUpdateLogic.onUpdate(AutoUpdateLogic.java:52)
at org.keycloak.operator.update.impl.BaseUpdateLogic.decideUpdate(BaseUpgradeLogic.java:78)
at org.keycloak.operator.controllers.KeycloakController.reconcile(KeycloakController.java:138)
at org.keycloak.operator.controllers.KeycloakController.reconcile(KeycloakController.java:57)
at org.keycloak.operator.controllers.KeycloakController_ClientProxy.reconcile(Unknown Source)
at io.javaoperatorsdk.operator.processing.Controller$1.execute(Controller.java:161)
at io.javaoperatorsdk.operator.processing.Controller$1.execute(Controller.java:117)
at io.javaoperatorsdk.operator.api.monitoring.Metrics.timeControllerExecution(Metrics.java:159)
at io.javaoperatorsdk.operator.proc
70D4
essing.Controller.reconcile(Controller.java:116)
at io.javaoperatorsdk.operator.processing.event.ReconciliationDispatcher.reconcileExecution(ReconciliationDispatcher.java:153)
at io.javaoperatorsdk.operator.processing.event.ReconciliationDispatcher.handleReconcile(ReconciliationDispatcher.java:130)
at io.javaoperatorsdk.operator.processing.event.ReconciliationDispatcher.handleDispatch(ReconciliationDispatcher.java:97)
at io.javaoperatorsdk.operator.processing.event.ReconciliationDispatcher.handleExecution(ReconciliationDispatcher.java:68)
at io.javaoperatorsdk.operator.processing.event.EventProcessor$ReconcilerExecutor.run(EventProcessor.java:467)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
at java.base/java.lang.Thread.run(Thread.java:1583)
From a quick glance I think this desiredPullSecrets can be null if not imagePullSecrets are specified in the Keycloak CRD instance, so when it tries to use the contains method on it in the next line it throws the exception. Tried with the operator in both 26.2.2 and 26.2.4 and both failed with the same message.
It seems this variable is new from version 26.2.1, so I will mark it as a regression.
Version
26.2.4
Regression
- The issue is a regression
Expected behavior
ImagePullSecrets are optional and thus it should not fail if they are not defined in the Keycloak resource.
Actual behavior
Keycloak operator fails to update the pods
How to Reproduce?
- Install the operator in the latest version
- Install a keycloak instance using the operator CRD, without specifying imagePullSecret for an older version (e.g. 26.2.3).
- Try to update the keycloak instance to a newer version (e.g. 26.2.4)
- It fails and the log will be printed
Anything else?
No response