pal-e-docs

Review: Revert Keycloak image tag to 26.0.7 (fix IaC drift from failed upgrade)

review-1999-2026-08-03 Review

review ready
Project

Verdict: READY

Re-review: Previous review flagged story:app-store-submission as invalid. Label corrected to story:superuser-deploy. All issues resolved.

Template Completeness

Issue type: Bug — validated against template-issue-bug.
  • [x] Type — present (Bug)
  • [x] Lineage — present (regression from #577 / PR #578)
  • [x] Repo — present (ldraney/pal-e-platform)
  • [x] What Broke — present (IaC drift: Terraform says 26.7.0, running pod is 26.0.7)
  • [x] Repro Steps — present (3 steps)
  • [x] Expected Behavior — present
  • [x] Environment — present (prod/keycloak, versions noted)
  • [x] Acceptance Criteria — present (3 criteria)
  • [x] Related — present (references #577)

Traceability

  • [x] story:superuser-deploy label — verified in project-pal-e-platform user-stories table ("I can deploy infrastructure changes via tofu plan/apply and see them succeed in Woodpecker CI without manual intervention.")
  • [x] story note verified — found in project-pal-e-platform user-stories section
  • [x] arch:keycloak label — verified
  • [x] arch note verified — arch-keycloak note exists in pal-e-docs
  • [x] Forgejo issue — ldraney/pal-e-platform#579, open

File Targets

  • [x] terraform/modules/keycloak/main.tf — verified: file exists, line 152. HEAD (commit b0bb663, PR #578) shows image = "quay.io/keycloak/keycloak:26.7.0". Working tree has uncommitted revert to 26.0.7. Confirms the drift described in the issue.

Repo Placement

OK. Issue filed on ldraney/pal-e-platform, fix is in ldraney/pal-e-platform. Single repo, no mismatch.

Dependencies

No keycloak-related items in in_progress, todo, or next_up columns. Issue #577 (the original upgrade) is closed. No blockers. No items blocked by this ticket. Note: working tree already has the revert uncommitted — agent should create a fresh branch from HEAD rather than committing the working-tree change.

Acceptance Criteria

3 criteria, all agent-verifiable:
  • terraform/modules/keycloak/main.tf image tag is 26.0.7 — verifiable by reading line 152
  • PR merged and pipeline green — verifiable via Woodpecker CI
  • tofu apply no longer attempts upgrade — verifiable by running tofu plan (requires cluster access)

Blast Radius

Low. The version string 26.7.0 appears only in terraform/modules/keycloak/main.tf:152. Single-line revert. The running pod is already on 26.0.7 (manual kubectl rollback was performed). No other files reference the Keycloak image version. No downstream consumers affected — this change aligns IaC with running state.

Decomposition Assessment

1 file target, 1 repo, 3 acceptance criteria, estimated <2 minutes. No decomposition needed.

Recommendation

No action needed.