feat: improve Keycloak availability

[slaskawi]

Description

This Pull Request introduces a set of changes that aim to improve the availability of the SSO service within the UDS Registry.

Related Issue

Relates to #2289

Type of change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Other (security config, docs update, etc)

Steps to Validate

• Backwards compatible changes verified manually
• Deploy in UDS Registry to test the rest

Checklist before merging

• Test, docs, adr added or updated as needed
• Contributor Guide followed

[Copilot]

Pull request overview

This PR adjusts Keycloak’s HA behavior and operator guidance to improve SSO availability, primarily via session stickiness configuration and more graceful shutdown handling.

Changes:

• Introduces autoscaling.sessionStickiness.enabled values and schema support, and gates the Istio DestinationRule for sticky sessions on both autoscaling and this flag, plus adds helm-unittest coverage.
• Adds Keycloak/Quarkus shutdown delay environment variables and a conditional Infinispan sticky-session configuration tied to autoscaling.
• Updates HA documentation for Keycloak’s waypoint HPA, including a higher recommended minReplicas and a new availability-focused tip.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/keycloak/chart/values.yaml	Adds autoscaling.sessionStickiness.enabled defaulting to true to control session stickiness behavior when autoscaling is enabled.
src/keycloak/chart/values.schema.json	Extends the autoscaling schema to include the new sessionStickiness.enabled boolean so values validation matches the new setting.
src/keycloak/chart/tests/kc_session_stickiness_test.yaml	Adds helm-unittest coverage ensuring the DestinationRule for sticky sessions is only rendered when autoscaling and session stickiness are both enabled, and validates the rendered resource fields.
src/keycloak/chart/templates/statefulset.yaml	Adds Quarkus shutdown delay env vars and wires autoscaling/sessionStickiness into Keycloak’s Infinispan sticky-session encoder configuration.
src/keycloak/chart/templates/destination-rule.yaml	Changes the render condition for the sticky-session DestinationRule to require both autoscaling.enabled and autoscaling.sessionStickiness.enabled.
docs/reference/configuration/resource-configuration-and-ha.md	Updates the Keycloak waypoint HPA example to use minReplicas: 2 and adds a tip explaining why 2 replicas are recommended for HA deployments.

Comments suppressed due to low confidence (1)

docs/reference/configuration/resource-configuration-and-ha.md:233

• The documentation here still states that the waypoint HPA example "includes the default values", but waypoint.horizontalPodAutoscaler.minReplicas in values.yaml defaults to 1 while this example and the surrounding tip use 2. Please either update the actual default in values.yaml to 2 or adjust the docs text to clarify that this is a recommended override (not the chart default) so users are not misled about the out-of-the-box configuration.

You can also configure autoscaling for the Keycloak [waypoint](https://istio.io/latest/docs/ambient/usage/waypoint/) (its Istio Layer7 proxy). The independent scalability of the waypoint proxy ensures that you never encounter a bottleneck due to service mesh integration. An HPA is enabled by default for the waypoint, with access to the configuration parameters via values. The below override example includes the default values which could be changed based on your needs:

```yaml
packages:
  - name: core
    repository: oci://ghcr.io/defenseunicorns/packages/uds/core
    ref: x.x.x
    overrides:
      keycloak:
        keycloak:
          values:
            - path: waypoint.horizontalPodAutoscaler.minReplicas
              value: 2
            - path: waypoint.horizontalPodAutoscaler.maxReplicas
              value: 5
            - path: waypoint.horizontalPodAutoscaler.metrics
              value:

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.