Before reporting an issue

[x] I have read and understood the above terms for submitting issues, and I understand that my issue may be closed without action if I do not follow them.

Area

operator

Describe the bug

Tried to update a Keycloak instance deployed with the operator from 26.2.2 to 26.2.4. It failed with this error log from the operator pod:

2025-05-25 11:53:53,970 ERROR [io.jav.ope.pro.eve.EventProcessor] (ReconcilerExecutor-keycloakcontroller-58) Error during event processing ExecutionScope{ resource id: ResourceID{name='keycloak-main', namespace='keycloak'}, version: 87591812}: java.lang.NullPointerExcep

at org.keycloak.operator.controllers.KeycloakUpdateJobDependentResource.lambda$createPodSpec$0(KeycloakUpdateJobDependentResource.java:146)
at java.base/java.util.stream.ReferencePipeline$2$1.accept(ReferencePipeline.java:178)
at java.base/java.util.ArrayList$ArrayListSpliterator.forEachRemaining(ArrayList.java:1708)
at java.base/java.util.stream.AbstractPipeline.copyInto(AbstractPipeline.java:509)
at java.base/java.util.stream.AbstractPipeline.wrapAndCopyInto(AbstractPipeline.java:499)
at java.base/java.util.stream.ForEachOps$ForEachOp.evaluateSequential(ForEachOps.java:151)
at java.base/java.util.stream.ForEachOps$ForEachOp$OfRef.evaluateSequential(ForEachOps.java:174)
at java.base/java.util.stream.AbstractPipeline.evaluate(AbstractPipeline.java:234)
at java.base/java.util.stream.ReferencePipeline.forEach(ReferencePipeline.java:596)
at org.keycloak.operator.controllers.KeycloakUpdateJobDependentResource.createPodSpec(KeycloakUpdateJobDependentResource.java:146)
at org.keycloak.operator.controllers.KeycloakUpdateJobDependentResource.addPodSpecTemplate(KeycloakUpdateJobDependentResource.java:126)
at org.keycloak.operator.controllers.KeycloakUpdateJobDependentResource.desired(KeycloakUpdateJobDependentResource.java:91)
at org.keycloak.operator.controllers.KeycloakUpdateJobDependentResource.desired(KeycloakUpdateJobDependentResource.java:50)
at io.javaoperatorsdk.operator.processing.dependent.AbstractDependentResource.reconcile(AbstractDependentResource.java:73)
at io.javaoperatorsdk.operator.processing.dependent.SingleDependentResourceReconciler.reconcile(SingleDependentResourceReconciler.java:19)
at io.javaoperatorsdk.operator.processing.dependent.AbstractDependentResource.reconcile(AbstractDependentResource.java:66)
at org.keycloak.operator.controllers.KeycloakUpdateJobDependentResource_ClientProxy.reconcile(Unknown Source)
at org.keycloak.operator.update.impl.AutoUpdateLogic.onUpdate(AutoUpdateLogic.java:52)
at org.keycloak.operator.update.impl.BaseUpdateLogic.decideUpdate(BaseUpgradeLogic.java:78)
at org.keycloak.operator.controllers.KeycloakController.reconcile(KeycloakController.java:138)
at org.keycloak.operator.controllers.KeycloakController.reconcile(KeycloakController.java:57)
at org.keycloak.operator.controllers.KeycloakController_ClientProxy.reconcile(Unknown Source)
at io.javaoperatorsdk.operator.processing.Controller$1.execute(Controller.java:161)
at io.javaoperatorsdk.operator.processing.Controller$1.execute(Controller.java:117)
at io.javaoperatorsdk.operator.api.monitoring.Metrics.timeControllerExecution(Metrics.java:159)
at io.javaoperatorsdk.operator.processing.Controller.reconcile(Controller.java:116)
at io.javaoperatorsdk.operator.processing.event.ReconciliationDispatcher.reconcileExecution(ReconciliationDispatcher.java:153)
at io.javaoperatorsdk.operator.processing.event.ReconciliationDispatcher.handleReconcile(ReconciliationDispatcher.java:130)
at io.javaoperatorsdk.operator.processing.event.ReconciliationDispatcher.handleDispatch(ReconciliationDispatcher.java:97)
at io.javaoperatorsdk.operator.processing.event.ReconciliationDispatcher.handleExecution(ReconciliationDispatcher.java:68)
at io.javaoperatorsdk.operator.processing.event.EventProcessor$ReconcilerExecutor.run(EventProcessor.java:467)
at java.base/java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1144)
at java.base/java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:642)
at java.base/java.lang.Thread.run(Thread.java:1583)

From a quick glance I think this desiredPullSecrets can be null if not imagePullSecrets are specified in the Keycloak CRD instance, so when it tries to use the contains method on it in the next line it throws the exception. Tried with the operator in both 26.2.2 and 26.2.4 and both failed with the same message.

It seems this variable is new from version 26.2.1, so I will mark it as a regression.

Version

26.2.4

Regression

[x] The issue is a regression

Expected behavior

ImagePullSecrets are optional and thus it should not fail if they are not defined in the Keycloak resource.

Actual behavior

Keycloak operator fails to update the pods

How to Reproduce?

• Install the operator in the latest version
• Install a keycloak instance using the operator CRD, without specifying imagePullSecret for an older version (e.g. 26.2.3).
• Try to update the keycloak instance to a newer version (e.g. 26.2.4)
• It fails and the log will be printed

Anything else?

No response