fix(keycloak, foundationdb): apply operator CRD updates on upgrade

packages/core/platform/sources/foundationdb-operator.yaml

@@ -20,3 +20,9 @@ spec:
       install:
         namespace: cozy-foundationdb-operator
         releaseName: foundationdb-operator
+        # helm-controller leaves existing CRDs alone on upgrade, so a cluster
+        # installed before v1.6.0 keeps the v2.13.0 schema under the v2.30.0
+        # operator, and the apiserver prunes the fields added since,
+        # status.backupDetails.restorable among them. The schema diff adds
+        # fields and drops none, so replace is safe.
+        upgradeCRDs: CreateReplace

packages/core/platform/sources/keycloak-operator.yaml

@@ -20,3 +20,10 @@ spec:
       install:
         namespace: cozy-keycloak
         releaseName: keycloak-operator
+        # helm-controller leaves existing CRDs alone on upgrade, so a cluster
+        # installed before v1.2.0 keeps the v1.25.0 schema and the apiserver
+        # prunes the realm session settings keycloak-configure sets. v1.32.0
+        # drops the realm, targetRealm and keycloakOwner fields deprecated in
+        # favour of realmRef and keycloakRef. The platform renders only the
+        # refs, so replace is safe.
+        upgradeCRDs: CreateReplace

packages/core/platform/tests/sources_foundationdb_operator_crds_test.yaml

@@ -0,0 +1,20 @@
+suite: foundationdb-operator applies CRD updates on upgrade
+# The fdb-operator v2.30.0 CRDs add fields the v2.13.0 ones lack, among them
+# status.backupDetails.restorable on FoundationDBBackup. Helm never upgrades
+# CRDs shipped in crds/, so without CreateReplace a cluster installed before
+# v1.6.0 keeps the v2.13.0 CRDs and the apiserver prunes those fields on every
+# write. Pin the policy so an upgrade cannot silently regress.
+templates:
+  - templates/sources.yaml
+release:
+  name: cozystack
+  namespace: cozy-system
+tests:
+  - it: foundationdb-operator PackageSource sets upgradeCRDs to CreateReplace
+    documentSelector:
+      path: metadata.name
+      value: cozystack.foundationdb-operator
+    asserts:
+      - equal:
+          path: spec.variants[0].components[0].install.upgradeCRDs
+          value: CreateReplace

packages/core/platform/tests/sources_keycloak_operator_crds_test.yaml

@@ -0,0 +1,22 @@
+suite: keycloak-operator applies CRD updates on upgrade
+# keycloak-configure sets spec.sessions and spec.organizationsEnabled, and
+# spec.login when configured, on the cozy ClusterKeycloakRealm. The CRDs of
+# keycloak-operator v1.25.0 declare none of them. Helm never upgrades CRDs
+# shipped in crds/, so without CreateReplace a cluster installed before v1.2.0
+# keeps those CRDs, the apiserver drops the fields without an error, and the
+# operator never applies them to the realm. Pin the policy so an upgrade cannot
+# silently regress.
+templates:
+  - templates/sources.yaml
+release:
+  name: cozystack
+  namespace: cozy-system
+tests:
+  - it: keycloak-operator PackageSource sets upgradeCRDs to CreateReplace
+    documentSelector:
+      path: metadata.name
+      value: cozystack.keycloak-operator
+    asserts:
+      - equal:
+          path: spec.variants[0].components[0].install.upgradeCRDs
+          value: CreateReplace

packages/system/keycloak-operator/Makefile

@@ -4,6 +4,9 @@ export NAMESPACE=cozy-keycloak
 include ../../../hack/common-envs.mk
 include ../../../hack/package.mk
 
+test:
+	helm unittest .
+
 image:
 	docker buildx build images/keycloak-operator \
 		$(call image-tags,keycloak-operator,v$(COZYSTACK_VERSION)) \

packages/system/keycloak-operator/tests/crds_test.yaml

@@ -0,0 +1,19 @@
+suite: keycloak-operator CRDs declare the realm settings the platform sets
+# keycloak-configure renders the cozy ClusterKeycloakRealm with spec.sessions
+# and spec.organizationsEnabled, and spec.login when configured. The apiserver
+# drops any field the CRD does not declare without an error, so with a chart
+# that lacks them the realm never gets those settings.
+includeCrds: true
+templates:
+  - charts/keycloak-operator/crds/v1.edp.epam.com_clusterkeycloakrealms.yaml
+tests:
+  - it: declares the session, organization and login settings
+    asserts:
+      - exists:
+          path: spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.sessions.properties.ssoSessionSettings.properties.idleTimeout
+      - exists:
+          path: spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.sessions.properties.ssoSessionSettings.properties.maxLifespan
+      - exists:
+          path: spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.organizationsEnabled
+      - exists:
+          path: spec.versions[0].schema.openAPIV3Schema.properties.spec.properties.login