fix(keycloak): bump keycloak-kms-proxy to 0.2.1 - #3248
fix(keycloak): bump keycloak-kms-proxy to 0.2.1#3248Andrei Kvapil (kvaps) wants to merge 1 commit into
Conversation
v0.2.1 fixes silent ciphertext passthrough on the proxy read path: pgjdbc's server-prepared statements (Describe-statement flow and warm Bind/Execute reuse) never produced a RowDescription during Execute, so the decrypt plan was never built and raw $KKP$ envelopes reached Keycloak — breaking verify-email and leaking ciphertext into id_token claims. The release also adds fail-loud metrics for undecrypted passthrough and double-encrypted rows. The previous default also pointed at a non-existent v-prefixed image tag (the release workflow publishes semver tags without the prefix), so pulling the proxy with defaults could never succeed. Assisted-By: Claude Signed-off-by: Andrei Kvapil <kvapss@gmail.com>
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe Keycloak KMS proxy container image tag used for database encryption was updated from v0.1.0 to 0.2.1 in the Keycloak values.yaml configuration file. ChangesKeycloak KMS Proxy Image Update
Estimated code review effort: 1 (Trivial) | ~2 minutes Suggested labels: Suggested reviewers: ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request updates the keycloak-kms-proxy component to version 0.2.1. The change addresses a significant vulnerability where encrypted data was incorrectly passed through to Keycloak during server-prepared statements, potentially exposing PII. Additionally, it fixes a deployment issue caused by an incorrect image tag reference in the configuration. Highlights
New Features🧠 You can now enable Memory (public preview) to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize the Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counterproductive. You can react with 👍 and 👎 on Gemini (@gemini-code-assist) comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. Footnotes
|
There was a problem hiding this comment.
Code Review
This pull request updates the image tag for the keycloak-kms-proxy from v0.1.0 to 0.2.1 in the Keycloak system package's values.yaml configuration. There are no review comments, and I have no additional feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
|
closed in favor #3239 |
What this PR does
Bumps the
keycloak-kms-proxyimage in the keycloak system package to v0.2.1.v0.2.1 fixes silent ciphertext passthrough on the proxy read path: pgjdbc's server-prepared statements (the Describe-statement flow and warm Bind/Execute reuse) never produce a RowDescription during Execute, so the decrypt plan was never built and raw
$KKP$envelopes reached Keycloak — breaking the verify-email flow and leaking ciphertext intoid_tokenemail claims. The release also tracks simple-protocol queries and Sync boundaries (result-queue desyncs), and adds fail-loud metrics (kkp_ciphertext_passthrough_total,kkp_double_encrypted_total) so any undecrypted PII leaving the proxy is alertable.The previous default also pointed at a non-existent
v-prefixed image tag (v0.1.0) — the kms-proxy release workflow publishes semver tags without the prefix, so pulling the proxy with chart defaults could never succeed.Screenshots
N/A — no UI changes.
Release note
Summary by CodeRabbit