How to benefit from the latest Keycloak features

Keycloak delivers multiple updates every year. To benefit from new features, and to stay up to date with the latest security fixes, you need to upgrade. At the same time an upgrade might bring breaking changes and can lead to downtimes. So how should you approach this?

In this talk you'll learn how to upgrade with confidence in a timely manner and with less effort.

After a short recap of the latest Keycloak features, this talk shows how to navigate the release schedule of Keycloak and explains how preview and deprecated features work. It also shows how to prepare for the next upgrade using the resources provided by the Keycloak project, and what additional measures you should take in your deployment and test pipelines to smoothen the upgrade process. Finally, it will detail how you provide feedback to the Keycloak project ahead of an upcoming release.

Transcript

1. How to benefit from the latest Keycloak features Alexander Schwartz | Principal Software Engineer | Red Hat Keycloak DevDay | Darmstadt (DE) | 2025-03-06
2. Keycloak is an Open Source Identity and Access Management Solution 🎂 Initial commit 2013-07-02 🏆 Cloud Native Computing Foundation Incubating project since April 2023 📜 Apache License, Version 2.0 ⭐ 26k GitHub stars
3. The best way to benefit from the latest Keycloak features …
4. The best way to benefit from the latest Keycloak features … … is upgrading! and bugfixes
5. How often does Keycloak release? • Features (every 3 months) • Patches (on average every two weeks)
6. Keycloak release cadence • Major release (every 2-3 years), next one planned for March 31 2026 Can contain breaking changes, and can remove deprecated features. • Minor release (every 3 months) Breaking changes are opt-in • Patch releases Fixing errors and CVE • Container respin On demand to handle CVE fixes in the base image • Separated releases for client libraries https://www.keycloak.org/2024/10/release-updates Only available on the main line!
7. Changes in latest minor releases KC 26.1: • New transport stack “jdbc-ping”, all other transport stacks except “kubernetes” are now deprecated.
8. Changes in latest minor releases KC 26.1: • New transport stack “jdbc-ping”, all other transport stacks except “kubernetes” are now deprecated. KC 26.2 (planned): • First iteration on rolling updates for Operator image changes as a preview feature, but not automatically enabled while in preview.
9. Milestones and epics
10. Reporting bugs 🐛
11. Reporting bugs 🐛 and getting them fixed 🦋
12. • Reproduce with the latest Keycloak release • Provide steps and details of the deployment (compose file?) The Keycloak team monitors this and tracks the SLOs Reporting
13. • Provide a pull request, or help testing the pull request or the latest nightly release. • Once it is released: Install the latest patch release in your production environment. Getting it fixed
14. Preparing for an upgrade … via Tests! ✅
15. Functional Tests Implement one of the following: • Deploy Keycloak to a test environment and run integration tests. • Use Testcontainers to set up a minimal environment and implement smoke tests. • … Then: 1. Run it against Keycloak’s nightly build (or release branches). 2. Analyze failures and update your deployment or report bugs.
16. If you are running Keycloak in a non-standard way In addition to the previous slide: Contribute documentation and tests to the main Keycloak project (or pay someone to do it).
17. Run Load Tests The Keycloak Benchmark Projekt provides • Dataset Generation (Realms, Users, Groups, etc.) • Load Drivers based on Gatling https://github.com/keycloak/keycloak-benchmark
18. Making upgrades smoother • Persistent User sessions enabled by default (26.0) ➡ Users are still logged in after upgrades • Protostream serialization for all internal commands and cache entries (26.0) ➡ Preparation for a future rolling upgrades • Upgrade compatibility command (26.2, t.b.c) ➡ New CLI command to test if two images support rolling upgrades (starting with comparing if Keycloak version is equal)
19. Tracking translation changes ahead of a release • Notifications on updated or added keys. • Continuous translation by volunteers and language maintainers.
20. Summary
21. The best way to benefit from the latest Keycloak features and fixes…
22. The best way to benefit from the latest Keycloak features and fixes… … is automated testing, regular upgrading, and contributing!
23. One more thing …
24. 2025 is a great time 󰭈 to start hosting your SSO/IAM/IdP.
25. 2025 is a great time 󰭈 to start hosting your SSO/IAM/IdP. Join forces to bring Keycloak to the masses 📣 !
26. In 2025, let’s make Keycloak even more ✨ appealing to new and existing users, 💡 simple to get started with, 󰠼 safe to run, scale and extend, and 📊 efficient to host and maintain.
27. • Keycloak https://www.keycloak.org/ • Keycloak Nightly Release https://www.keycloak.org/nightly/ • Keycloak Testcontainers https://testcontainers.com/modules/keycloak/ • Realm Configuration Management https://www.keycloak.org/2024/09/realm-config-management-tools-survey-results • Keycloak Upgrade Compatibility https://www.keycloak.org/nightly/server/update-compatibility • Grafana Dashboards, Metrics and Service Level Indicators https://www.keycloak.org/nightly/observability/grafana-dashboards • Keycloak Hour of Code https://www.meetup.com/keycloak-hour-of-code/ Links Slides:
28. Contact Alexander Schwartz Principal Software Engineer aschwart@redhat.com https://www.ahus1.de @ahus1.de @ahus1@fosstodon.org