feat(netbird)!: controller-agnostic ingressGrpc annotations; bump netbird 0.77.1, keycloak 26.7.2

.github/workflows/ci.yaml

@@ -59,7 +59,9 @@ jobs:
           cache: false
 
       - name: Install helmfmt
-        run: go install github.com/digitalstudium/helmfmt@latest
+        # Pinned: @latest is not reproducible and v0.6.1 fails to build
+        # (undefined: sprigStubNames), which broke this job for every PR.
+        run: go install github.com/digitalstudium/helmfmt@v0.6.0
 
       - name: Check Helm template formatting
         run: |

CHANGELOG.md

@@ -7,6 +7,47 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## Unreleased
 
+### Changed
+
+- **netbird**: `server.ingressGrpc.annotations` is now empty by default
+  instead of carrying four `nginx.ingress.kubernetes.io/*` annotations.
+  `server.ingressGrpc.className` is configurable, so nginx-specific keys
+  were applied to Ingresses managed by HAProxy, Traefik, and other
+  controllers where they are meaningless. The nginx annotations remain in
+  `values.yaml` as a commented example. Fixes #134.
+
+  **Migration** — if you use ingress-nginx and relied on the defaults, add
+  them explicitly:
+
+  ```yaml
+  server:
+    ingressGrpc:
+      annotations:
+        nginx.ingress.kubernetes.io/backend-protocol: "GRPC"
+        nginx.ingress.kubernetes.io/ssl-redirect: "true"
+        nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
+        nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
+  ```
+
+  You will not silently lose gRPC: the chart now **fails at template time**
+  when `ingressGrpc.className` contains `nginx` and the annotations omit
+  `nginx.ingress.kubernetes.io/backend-protocol`, since ingress-nginx
+  proxies the backend as HTTP/1.1 without it. Non-nginx controllers are
+  unaffected and need no annotations.
+- **netbird**: Bump appVersion from 0.73.2 to 0.77.1, covering upstream
+  0.74.x–0.77.x. Notable additions: Agent Network (a per-account LLM
+  gateway built on the existing reverse proxy, self-hosted only), a
+  rewritten desktop client, relay `X-Real-Ip` handling restricted to
+  configured trusted proxies, and privileged-caller checks for local SSH
+  daemon settings. No config keys, env vars, ports, or protocols used by
+  this chart changed, and no manual database migration is required.
+  See [v0.77.1 release notes](https://github.com/netbirdio/netbird/releases/tag/v0.77.1)
+  (#116–#132, #135).
+- **netbird**: Bump dashboard image from v2.39.0 to v2.91.0 to stay paired
+  with server 0.77.x. The dashboard's environment contract is unchanged —
+  every variable the chart sets is still rendered by upstream's own
+  `dashboard.env` — so no values changes are required.
+
 ## [0.6.0] — 2026-06-23
 
 ### Added

charts/keycloak/CHANGELOG.md

@@ -4,6 +4,36 @@ All notable changes to the Keycloak Helm chart will be documented in this file.
 
 ## Unreleased
 
+### Changed
+
+- Use `KC_BOOTSTRAP_ADMIN_USERNAME` / `KC_BOOTSTRAP_ADMIN_PASSWORD` for the
+  initial admin instead of `KEYCLOAK_ADMIN` / `KEYCLOAK_ADMIN_PASSWORD`,
+  which upstream has deprecated and logs a warning for on every start
+  (`KC-SERVICES0110`). No values change is required — `admin.username` and
+  `admin.password` are unchanged; only the environment variable names the
+  chart emits differ. As before, these apply only when bootstrapping a
+  fresh database.
+
+### Security
+
+- Bump Keycloak appVersion from 26.6.3 to 26.7.2 (#115, #120, #129, #133)
+  - 26.7.2 fixes CVE-2026-59888 / CVE-2026-59889 (jackson-databind) and
+    26.7.0 fixes CVE-2026-9796 (admin role rename TOCTOU allowing
+    realm-wide privilege escalation from `manage-clients`)
+  - 26.7.2 also fixes an upgrade failure where the stateless cluster
+    provider captured a null NodeInfo before `postInit` when preview
+    features were enabled — this is why the chart moves straight to
+    26.7.2 rather than 26.7.0
+  - No `KC_*` option used by this chart changed. Options removed upstream
+    in 26.7.0 (persistent-session batching, `token-exchange-external-internal:v2`)
+    are not used here, and ports, health endpoints, and the container
+    entrypoint are unchanged
+  - See upstream release notes for
+    [26.7.0](https://github.com/keycloak/keycloak/releases/tag/26.7.0) and
+    [26.7.2](https://github.com/keycloak/keycloak/releases/tag/26.7.2)
+
+## [26.6.3] — 2026-06-11
+
 ### Fixed
 
 - Set `publishNotReadyAddresses: true` on the JGroups headless service.

charts/keycloak/Chart.yaml

@@ -3,7 +3,7 @@ name: keycloak
 description: A Helm chart for deploying Keycloak IAM using the upstream quay.io/keycloak/keycloak image on Kubernetes
 type: application
 version: 26.6.3
-appVersion: "26.6.3"
+appVersion: "26.7.2"
 keywords:
   - keycloak
   - iam

charts/keycloak/README.md

@@ -233,11 +233,11 @@ This runs `kc.sh build` in an init container and passes `--optimized` to the mai
 
 ### Admin Credentials
 
-| Key                         | Type   | Default      | Description                               |
-| --------------------------- | ------ | ------------ | ----------------------------------------- |
-| `admin.username`            | string | `""`         | Admin username (maps to `KEYCLOAK_ADMIN`) |
-| `admin.password.secretName` | string | `""`         | Secret containing the admin password      |
-| `admin.password.secretKey`  | string | `"password"` | Key in the Secret                         |
+| Key                         | Type   | Default      | Description                                            |
+| --------------------------- | ------ | ------------ | ------------------------------------------------------ |
+| `admin.username`            | string | `""`         | Admin username (maps to `KC_BOOTSTRAP_ADMIN_USERNAME`) |
+| `admin.password.secretName` | string | `""`         | Secret containing the admin password                   |
+| `admin.password.secretKey`  | string | `"password"` | Key in the Secret                                      |
 
 ### Observability
 

charts/keycloak/templates/NOTES.txt

@@ -47,7 +47,7 @@ Admin Credentials:
 
   IMPORTANT: The admin user is only created on the first startup of a
   fresh Keycloak instance. If the database already contains users, the
-  KEYCLOAK_ADMIN / KEYCLOAK_ADMIN_PASSWORD environment variables are
+  KC_BOOTSTRAP_ADMIN_USERNAME / KC_BOOTSTRAP_ADMIN_PASSWORD variables are
   ignored. To reset credentials on an existing instance, use the
   Keycloak CLI (kcadm.sh) or the Admin REST API.
 {{- else }}

charts/keycloak/templates/_helpers.tpl

@@ -114,52 +114,52 @@ KC_HEALTH_ENABLED: {{ .Values.healthEnabled | quote }}
 KC_METRICS_ENABLED: {{ .Values.metrics.enabled | quote }}
 KC_LOG_LEVEL: {{ .Values.logLevel | quote }}
 KC_HTTP_ENABLED: {{ .Values.httpEnabled | quote }}
-{{- if .Values.hostname }}
+  {{- if .Values.hostname }}
 KC_HOSTNAME: {{ .Values.hostname | quote }}
-{{- end }}
+  {{- end }}
 KC_HOSTNAME_STRICT: {{ .Values.hostnameStrict | quote }}
-{{- if .Values.hostnameAdmin }}
+  {{- if .Values.hostnameAdmin }}
 KC_HOSTNAME_ADMIN: {{ .Values.hostnameAdmin | quote }}
-{{- end }}
-{{- if .Values.proxyHeaders }}
+  {{- end }}
+  {{- if .Values.proxyHeaders }}
 KC_PROXY_HEADERS: {{ .Values.proxyHeaders | quote }}
-{{- end }}
-{{- if .Values.features }}
+  {{- end }}
+  {{- if .Values.features }}
 KC_FEATURES: {{ .Values.features | quote }}
-{{- end }}
-{{- if .Values.tls.enabled }}
+  {{- end }}
+  {{- if .Values.tls.enabled }}
 KC_HTTPS_CERTIFICATE_FILE: "/opt/keycloak/conf/tls/tls.crt"
 KC_HTTPS_CERTIFICATE_KEY_FILE: "/opt/keycloak/conf/tls/tls.key"
-{{- end }}
-{{- if eq (include "keycloak.database.isExternal" .) "true" }}
+  {{- end }}
+  {{- if eq (include "keycloak.database.isExternal" .) "true" }}
 KC_DB: {{ include "keycloak.database.vendor" . | quote }}
 KC_DB_URL_HOST: {{ .Values.database.host | quote }}
 KC_DB_URL_PORT: {{ include "keycloak.database.port" . | quote }}
 KC_DB_URL_DATABASE: {{ .Values.database.name | quote }}
 KC_DB_USERNAME: {{ .Values.database.user | quote }}
-  {{- if .Values.database.poolMinSize }}
+    {{- if .Values.database.poolMinSize }}
 KC_DB_POOL_MIN_SIZE: {{ .Values.database.poolMinSize | quote }}
-  {{- end }}
-  {{- if .Values.database.poolInitialSize }}
+    {{- end }}
+    {{- if .Values.database.poolInitialSize }}
 KC_DB_POOL_INITIAL_SIZE: {{ .Values.database.poolInitialSize | quote }}
-  {{- end }}
-  {{- if .Values.database.poolMaxSize }}
+    {{- end }}
+    {{- if .Values.database.poolMaxSize }}
 KC_DB_POOL_MAX_SIZE: {{ .Values.database.poolMaxSize | quote }}
-  {{- end }}
-  {{- if .Values.database.sslMode }}
-    {{- if eq .Values.database.type "postgresql" }}
+    {{- end }}
+    {{- if .Values.database.sslMode }}
+      {{- if eq .Values.database.type "postgresql" }}
 KC_DB_URL_PROPERTIES: {{ printf "?sslmode=%s" .Values.database.sslMode | quote }}
+      {{- end }}
     {{- end }}
   {{- end }}
-{{- end }}
-{{- if eq .Values.database.type "dev" }}
+  {{- if eq .Values.database.type "dev" }}
 KC_CACHE: "local"
-{{- else }}
+  {{- else }}
 KC_CACHE: "ispn"
 KC_CACHE_STACK: {{ .Values.cache.stack | quote }}
-{{- if eq .Values.cache.stack "kubernetes" }}
+    {{- if eq .Values.cache.stack "kubernetes" }}
 KC_CACHE_CONFIG_FILE: "cache-ispn.xml"
 JAVA_OPTS_APPEND: {{ printf "-Djgroups.dns.query=%s" (include "keycloak.headlessServiceFQDN" .) | quote }}
-{{- end }}
-{{- end }}
+    {{- end }}
+  {{- end }}
 {{- end }}

charts/keycloak/templates/deployment.yaml

@@ -43,13 +43,13 @@ spec:
             - configMapRef:
                 name: {{ include "keycloak.fullname" . }}-env
           env:
-{{- if eq (include "keycloak.database.isExternal" .) "true" }}
+  {{- if eq (include "keycloak.database.isExternal" .) "true" }}
             - name: KC_DB_PASSWORD
               valueFrom:
                 secretKeyRef:
                   name: {{ .Values.database.password.secretName }}
                   key: {{ .Values.database.password.secretKey }}
-{{- end }}
+  {{- end }}
           securityContext:
             runAsNonRoot: true
             runAsUser: 1000
@@ -85,9 +85,9 @@ spec:
 {{- if or $hasAdmin $hasExternalDB .Values.extraEnvVars }}
           env:
   {{- if $hasAdmin }}
-            - name: KEYCLOAK_ADMIN
+            - name: KC_BOOTSTRAP_ADMIN_USERNAME
               value: {{ .Values.admin.username | quote }}
-            - name: KEYCLOAK_ADMIN_PASSWORD
+            - name: KC_BOOTSTRAP_ADMIN_PASSWORD
               valueFrom:
                 secretKeyRef:
                   name: {{ .Values.admin.password.secretName }}

charts/keycloak/templates/headless-service.yaml

@@ -5,10 +5,10 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "keycloak.allLabels" . | nindent 4 }}
-  {{- with .Values.headlessService.annotations }}
+{{- with .Values.headlessService.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
-  {{- end }}
+{{- end }}
 spec:
   type: ClusterIP
   clusterIP: None

charts/keycloak/templates/service.yaml

@@ -5,10 +5,10 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "keycloak.allLabels" . | nindent 4 }}
-  {{- with .Values.service.annotations }}
+{{- with .Values.service.annotations }}
   annotations:
     {{- toYaml . | nindent 4 }}
-  {{- end }}
+{{- end }}
 spec:
   type: {{ .Values.service.type }}
   ports:

charts/keycloak/templates/servicemonitor.yaml

@@ -6,20 +6,20 @@ metadata:
   namespace: {{ .Release.Namespace }}
   labels:
     {{- include "keycloak.allLabels" . | nindent 4 }}
-    {{- with .Values.metrics.serviceMonitor.labels }}
+  {{- with .Values.metrics.serviceMonitor.labels }}
     {{- toYaml . | nindent 4 }}
-    {{- end }}
+  {{- end }}
 spec:
   selector:
     matchLabels:
       {{- include "keycloak.selectorLabels" . | nindent 6 }}
   endpoints:
     - port: management
       path: /metrics
-      {{- with .Values.metrics.serviceMonitor.interval }}
+  {{- with .Values.metrics.serviceMonitor.interval }}
       interval: {{ . }}
-      {{- end }}
-      {{- with .Values.metrics.serviceMonitor.scrapeTimeout }}
+  {{- end }}
+  {{- with .Values.metrics.serviceMonitor.scrapeTimeout }}
       scrapeTimeout: {{ . }}
-      {{- end }}
+  {{- end }}
 {{- end }}

charts/keycloak/tests/deployment_test.yaml

@@ -13,7 +13,7 @@ tests:
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
-          value: "quay.io/keycloak/keycloak:26.6.3"
+          value: "quay.io/keycloak/keycloak:26.7.2"
 
   - it: should use custom image tag when set
     set:
@@ -29,7 +29,7 @@ tests:
     asserts:
       - equal:
           path: spec.template.spec.containers[0].image
-          value: "my-registry/keycloak:26.6.3"
+          value: "my-registry/keycloak:26.7.2"
 
   - it: should set replica count
     set:
@@ -177,12 +177,12 @@ tests:
       - contains:
           path: spec.template.spec.containers[0].env
           content:
-            name: KEYCLOAK_ADMIN
+            name: KC_BOOTSTRAP_ADMIN_USERNAME
             value: "admin"
       - contains:
           path: spec.template.spec.containers[0].env
           content:
-            name: KEYCLOAK_ADMIN_PASSWORD
+            name: KC_BOOTSTRAP_ADMIN_PASSWORD
             valueFrom:
               secretKeyRef:
                 name: admin-secret
@@ -262,7 +262,7 @@ tests:
     asserts:
       - equal:
           path: spec.template.spec.initContainers[0].image
-          value: "quay.io/keycloak/keycloak:26.6.3"
+          value: "quay.io/keycloak/keycloak:26.7.2"
 
   - it: should set hardened securityContext on build init container
     set:

charts/keycloak/tests/serviceaccount_test.yaml

@@ -54,4 +54,4 @@ tests:
           content:
             helm.sh/chart: keycloak-26.6.3
             app.kubernetes.io/managed-by: Helm
-            app.kubernetes.io/version: "26.6.3"
+            app.kubernetes.io/version: "26.7.2"

charts/keycloak/values.yaml

@@ -109,7 +109,7 @@ features: ""
 
 # ── Admin Credentials ────────────────────────────────────────────────────
 admin:
-  # -- Admin username (maps to KEYCLOAK_ADMIN). Leave empty to skip initial admin creation
+  # -- Admin username (maps to KC_BOOTSTRAP_ADMIN_USERNAME). Leave empty to skip initial admin creation
   username: ""
   # -- Admin password via Kubernetes Secret reference
   password:

charts/netbird/Chart.yaml

@@ -3,7 +3,7 @@ name: netbird
 description: A Helm chart for deploying NetBird VPN management, signal, dashboard, and relay services on Kubernetes
 type: application
 version: 0.6.0
-appVersion: "0.73.2"
+appVersion: "0.77.1"
 keywords:
   - netbird
   - vpn