Releases

Find your installed Lifecycle versions and the release information for an upgrade.

Record your installed versions before you upgrade or troubleshoot Lifecycle. The chart, application, UI, identity service, CLI, and infrastructure can have different versions.

Find your installed versions

Set the Helm release name and namespace:

Show the installed chart and application version:

Record the applied values:

Show the installed CLI version:

Find release information

Read the Lifecycle changelog.
Read the Helm chart releases.
Read the Lifecycle CLI releases.
Use the schema and API reference from the Lifecycle deployment that you run.

Before adopting a release

Read Compatibility and deprecation policy.
Follow the day-two upgrade checklist.
Record the installed versions and Helm values.
Read the release notes for each component that changes.
Test the upgrade and restore procedure in a non-production deployment.

Adopt Lifecycle MCP

These steps were verified with Lifecycle chart 0.9.11. This chart bundles lifecycle-keycloak chart 0.7.6.

Lifecycle MCP and its change tools are off by default. Use this procedure for an installed Lifecycle deployment.

Before you enable MCP

Confirm that Lifecycle authentication works at its canonical public URL.
Confirm that Lifecycle web has the management client credentials and a valid ENCRYPTION_KEY.
Back up the Keycloak realm and its matching Kubernetes Secrets.
Confirm that the installed chart includes the MCP Keycloak credentials.

For a new bundled Keycloak realm, the initial import creates the management client. The chart creates the Secret and injects the credential into Lifecycle web. Do not create a second MCP client secret. Continue with Verify the management client.

For an existing realm, complete the following migration first.

Prepare the existing realm

Select the Lifecycle realm in Keycloak Admin Console. The console can open in the master realm.
Record the effective management client values.
Record the anonymous client registration policies.

For the Lifecycle umbrella chart, use these values:

Client ID: keycloak.clients.lifecycleApiKeycloakManagement.clientId
Secret reference: keycloak.clients.lifecycleApiKeycloakManagement.clientSecret.secretKeyRef

The default Client ID is lifecycle-api-keycloak-management. For the standalone lifecycle-keycloak chart, remove the keycloak. prefix.

Create the management client

Open Clients → Create client.
Set Client type to OpenID Connect.
Set Client ID to the effective Helm value. Do not use the display name as the Client ID.
Optionally set Name to Lifecycle API Keycloak management.
Select Next.
Turn Client authentication on.
Turn Service accounts roles on.
Turn the standard, implicit, and direct-access flows off.
Leave the login URLs empty.
Select Save.

Configure and connect the client secret

Open Credentials. Confirm that Client Authenticator is Client Id and Secret.

The management client secret must have the same value in Keycloak and the referenced Kubernetes Secret. Lifecycle web reads the credential through these environment variables:

KEYCLOAK_MANAGEMENT_CLIENT_ID
KEYCLOAK_MANAGEMENT_CLIENT_SECRET

When you use the Lifecycle umbrella chart, do not add these variables manually. The chart sets them only on Lifecycle web from these values:

Client ID: keycloak.clients.lifecycleApiKeycloakManagement.clientId
Secret name and key: keycloak.clients.lifecycleApiKeycloakManagement.clientSecret.secretKeyRef

The Secret key defaults to clientSecret. If the Secret name is empty, the chart uses its release-specific generated Secret.

If an external secret manager owns the credential, use this pattern:

Before the Helm upgrade, confirm that the Secret exists in the release namespace. For the standalone lifecycle-keycloak chart, remove the keycloak. prefix from the values.

For a non-chart deployment, set both environment variables on Lifecycle web only.

The Admin Console generates the secret. It cannot set an existing secret value. Use one approved method:

Use Keycloak admin automation to set the client secret from the referenced Secret.
Alternatively, regenerate the Keycloak secret. Store it in the referenced Secret. Restart Lifecycle web.

Do not print or log the secret. A Helm value change does not rotate an existing Keycloak client secret.

Do not put this secret in an MCP client configuration. MCP clients use OAuth dynamic registration.

The secret is only the credential step. Complete the client settings, service roles, scope mappings, and token verification before enablement.

Configure direct service roles

Open Service accounts roles.
Turn Hide inherited roles on.
If Keycloak assigned direct roles by default, remove them.
Select Assign role → Client roles.
Assign manage-clients from the realm-management client.
Assign manage-realm from the realm-management client.
Confirm that no other direct role is assigned.

Configure client scope mappings

Open Client scopes → Setup.
Keep the dedicated scope and the basic and roles default scopes.
Remove all other default and optional scope assignments.
Open the dedicated client scope.
Open Scope.
Turn Full scope allowed off.
Select Assign role → Client roles.
Assign manage-clients and manage-realm from realm-management.
Confirm that no other direct scope role is assigned.

Keycloak can add realm defaults to a client that you create in the Admin Console. Remove those defaults after you assign the service account roles.

Verify the management client

Request a client-credentials token with an approved administration tool.
Do not print or log the secret or token.
Inspect resource_access.realm-management.roles in the token.
Confirm that it includes manage-clients and manage-realm.

The token can contain composite roles. Do not require an exact role count for this token check.

Protect the existing Keycloak configuration

Lifecycle creates or reconciles reserved Keycloak objects during enablement. These objects include the mcp scope, five mappers, scope mappings, profiles, and anonymous client registration policies.

Enablement removes the exact stock Trusted Hosts policy when it exists. It accepts an absent stock policy. It fails if customized or duplicate reserved objects conflict with the required configuration.

Disable does not restore the previous Keycloak configuration. Keep the realm backup until you complete validation.

Enable Lifecycle MCP

Open Platform administration → Lifecycle MCP.
Confirm the displayed Remote MCP URL.
Turn Enable Lifecycle MCP on.
Confirm that no issue alert appears.
Confirm that the status is Read only.
Confirm that read tools are available and change tools are off.
When agents need change tools, turn Allow changes on.
Add the URL to a compatible MCP client.
Complete Lifecycle OAuth sign-in.

Lifecycle verifies the Keycloak and OAuth contract before it keeps MCP on. Lifecycle MCP accepts OAuth bearer tokens only.

Recover from failed enablement

If verification fails, Lifecycle keeps MCP off. Correct the reported issue. Then, retry enablement.

For a configuration issue, verify these details:

APP_HOST is the canonical public Lifecycle URL.
APP_HOST uses HTTPS unless it is a loopback URL.
The OIDC issuer and JWKS endpoints are reachable by Lifecycle.
OIDC discovery advertises the exact issuer and dynamic client registration.
OIDC discovery advertises S256 PKCE and a usable RS256 signing key.
ENCRYPTION_KEY is a 64-character hexadecimal value.
Lifecycle web has the Keycloak management client ID and secret.

A failed probe can leave managed objects or a Lifecycle MCP enablement probe client. If cleanup fails and the client remains, remove the probe client.

Disabling MCP is a containment action, not a rollback. A Helm upgrade does not repair a partially configured realm. Restore the saved realm only when you must roll back the Keycloak changes.

Read Lifecycle MCP for tools, permissions, client setup, and troubleshooting.

Day-two operations Compatibility and deprecation policy