diff --git a/stable/keycloak/Chart.yaml b/stable/keycloak/Chart.yaml
index a4d6e245ae..5ecee0ea88 100644
--- a/stable/keycloak/Chart.yaml
+++ b/stable/keycloak/Chart.yaml
@@ -1,6 +1,6 @@
 name: keycloak
-version: 2.0.0
-appVersion: 3.4.3.Final
+version: 3.0.0
+appVersion: 4.0.0.Final
 description: Open Source Identity and Access Management For Modern Applications and Services
 keywords:
   - sso
diff --git a/stable/keycloak/README.md b/stable/keycloak/README.md
index a944a0341b..dbfdf69bc6 100644
--- a/stable/keycloak/README.md
+++ b/stable/keycloak/README.md
@@ -45,7 +45,7 @@ Parameter | Description | Default
 `init.image.pullPolicy` | Init image pull policy | `IfNotPresent`
 `keycloak.replicas` | The number of Keycloak replicas | `1`
 `keycloak.image.repository` | The Keycloak image repository | `jboss/keycloak`
-`keycloak.image.tag` | The Keycloak image tag | `3.4.3.Final`
+`keycloak.image.tag` | The Keycloak image tag | `4.0.0.Final`
 `keycloak.image.pullPolicy` | The Keycloak image pull policy | `IfNotPresent`
 `keycloak.image.pullSecrets` | Image pull secrets | `[]`
 `keycloak.username` | Username for the initial Keycloak admin user | `keycloak`
@@ -82,10 +82,10 @@ Parameter | Description | Default
 `keycloak.ingress.path` | if `true`, an ingress is created | `/`
 `keycloak.ingress.hosts` | a list of ingress hosts | `[keycloak.example.com]`
 `keycloak.ingress.tls` | a list of [IngressTLS](https://v1-9.docs.kubernetes.io/docs/reference/generated/kubernetes-api/v1.9/#ingresstls-v1beta1-extensions) items | `[]`
-`keycloak.persistence.deployPostgres` | If true, the PostgreSQL chart is installed | `true`
+`keycloak.persistence.deployPostgres` | If true, the PostgreSQL chart is installed | `false`
 `keycloak.persistence.existingSecret` | Name of an existing secret to be used for the database password (if `keycloak.persistence.deployPostgres=false`). Otherwise a new secret is created | `""`
 `keycloak.persistence.existingSecretKey` | The key for the database password in the existing secret (if `keycloak.persistence.deployPostgres=false`) | `password`
-`keycloak.persistence.dbVendor` | One of `H2`, `POSTGRES`, or `MYSQL` (if `deployPostgres=false`) | `H2`
+`keycloak.persistence.dbVendor` | One of `h2`, `postgres`, `mysql`, or `mariadb` (if `deployPostgres=false`) | `h2`
 `keycloak.persistence.dbName` | The name of the database to connect to (if `deployPostgres=false`) | `keycloak`
 `keycloak.persistence.dbHost` | The database host name (if `deployPostgres=false`) | `mykeycloak`
 `keycloak.persistence.dbPort` | The database host port (if `deployPostgres=false`) | `5432`
@@ -121,12 +121,15 @@ It is important that these values be configured as strings. Otherwise, installat
 
 ### Database Setup
 
-By default, the [PostgreSQL](https://github.com/kubernetes/charts/tree/master/stable/postgresql) chart is deployed and used as database.
-Please refer to this chart for additional PostgreSQL configuration options. If PostgreSQL is disabled, Keycloak uses an embedded H2 database which is only suitable for testing with a single replica.
+By default, Keycloak uses an embedded H2 database.
+This is only suitable for testing purposes.
+All data is lost when Keycloak is shut down.
+Optionally, the [PostgreSQL](https://github.com/kubernetes/charts/tree/master/stable/postgresql) chart is deployed and used as database.
+Please refer to this chart for additional PostgreSQL configuration options.
 
 #### Using an External Database
 
-The Keycloak Docker image supports PostgreSQL and MySQL. The password for the database user is read from a Kubernetes secret. It is possible to specify an existing secret that is not managed with this chart. The key in the secret the password is read from may be specified as well (defaults to `password`).
+The Keycloak Docker image supports PostgreSQL, MySQL, MariaDB, and H2. The password for the database user is read from a Kubernetes secret. It is possible to specify an existing secret that is not managed with this chart. The key in the secret the password is read from may be specified as well (defaults to `password`).
 
 ```yaml
 keycloak:
@@ -135,12 +138,15 @@ keycloak:
     # Disable deployment of the PostgreSQL chart
     deployPostgres: false
 
+    # The database vendor. Can be either "postgres", "mysql", "mariadb", or "h2"
+    dbVendor: postgres
+
+    ## The following values only apply if "deployPostgres" is set to "false"
+
     # Optionally specify an existing secret
     existingSecret: "my-database-password-secret"
     existingSecretKey: "password-key in-my-database-secret"
 
-    dbVendor: POSTGRES # for MySQL use "MYSQL"
-
     dbName: keycloak
     dbHost: mykeycloak
     dbPort: 5432 # 5432 is PostgreSQL's default port. For MySQL it would be 3306
@@ -205,6 +211,7 @@ keycloak:
     - name: theme
       emptyDir: {}
 ```
+
 ### Setting a Custom Realm
 
 A realm can be added by creating a secret or configmap for the realm json file and then supplying this into the chart.
diff --git a/stable/keycloak/ci/h2-values.yaml b/stable/keycloak/ci/h2-values.yaml
new file mode 100644
index 0000000000..a05e4b9c00
--- /dev/null
+++ b/stable/keycloak/ci/h2-values.yaml
@@ -0,0 +1 @@
+# No config change. Just use defaults.
\ No newline at end of file
diff --git a/stable/keycloak/ci/postgres-ha-values.yaml b/stable/keycloak/ci/postgres-ha-values.yaml
new file mode 100644
index 0000000000..55a2fa08f5
--- /dev/null
+++ b/stable/keycloak/ci/postgres-ha-values.yaml
@@ -0,0 +1,5 @@
+keycloak:
+  replicas: 3
+  persistence:
+    deployPostgres: true
+    dbVendor: postgres
diff --git a/stable/keycloak/templates/NOTES.txt b/stable/keycloak/templates/NOTES.txt
index 5822d3c32e..eb04e032b5 100644
--- a/stable/keycloak/templates/NOTES.txt
+++ b/stable/keycloak/templates/NOTES.txt
@@ -42,9 +42,9 @@ Keycloak can be accessed:
 
 {{- end }}
 
-{{- if .Release.IsInstall -}}
-Login with the following credentials:
+{{- if .Release.IsInstall }}
 
+Login with the following credentials:
 Username: {{ .Values.keycloak.username }}
 
 To retrieve the initial user password run:
diff --git a/stable/keycloak/templates/_helpers.tpl b/stable/keycloak/templates/_helpers.tpl
index 45e8757c61..5519b9997e 100644
--- a/stable/keycloak/templates/_helpers.tpl
+++ b/stable/keycloak/templates/_helpers.tpl
@@ -64,37 +64,43 @@ Create the name for the password secret key.
 {{/*
 Create environment variables for database configuration.
 */}}
-{{- define "keycloak.externalDbConfig" -}}
+{{- define "keycloak.dbEnvVars" -}}
+{{- if .Values.keycloak.persistence.deployPostgres }}
+{{- if not (eq "postgres" .Values.keycloak.persistence.dbVendor) }}
+{{ fail (printf "ERROR: 'Setting keycloak.persistence.deployPostgres' to 'true' requires setting 'keycloak.persistence.dbVendor' to 'postgres' (is: '%s')!" .Values.keycloak.persistence.dbVendor) }}
+{{- end }}
+- name: DB_VENDOR
+  value: postgres
+- name: DB_ADDR
+  value: {{ template "keycloak.postgresql.fullname" . }}
+- name: DB_PORT
+  value: "5432"
+- name: DB_DATABASE
+  value: {{ .Values.postgresql.postgresDatabase | quote }}
+- name: DB_USER
+  value: {{ .Values.postgresql.postgresUser | quote }}
+- name: DB_PASSWORD
+  valueFrom:
+    secretKeyRef:
+      name: {{ template "keycloak.postgresql.fullname" . }}
+      key: postgres-password
+{{- else }}
 - name: DB_VENDOR
   value: {{ .Values.keycloak.persistence.dbVendor | quote }}
-{{- if eq .Values.keycloak.persistence.dbVendor "POSTGRES" }}
-- name: POSTGRES_PORT_5432_TCP_ADDR
+{{- if not (eq "h2" .Values.keycloak.persistence.dbVendor) }}
+- name: DB_ADDR
   value: {{ .Values.keycloak.persistence.dbHost | quote }}
-- name: POSTGRES_PORT_5432_TCP_PORT
+- name: DB_PORT
   value: {{ .Values.keycloak.persistence.dbPort | quote }}
-- name: POSTGRES_USER
+- name: DB_DATABASE
+  value: {{ .Values.keycloak.persistence.dbName | quote }}
+- name: DB_USER
   value: {{ .Values.keycloak.persistence.dbUser | quote }}
-- name: POSTGRES_PASSWORD
+- name: DB_PASSWORD
   valueFrom:
     secretKeyRef:
       name: {{ template "keycloak.externalDbSecret" . }}
       key: {{ include "keycloak.dbPasswordKey" . | quote }}
-- name: POSTGRES_DATABASE
-  value: {{ .Values.keycloak.persistence.dbName | quote }}
-{{- else if eq .Values.keycloak.persistence.dbVendor "MYSQL" }}
-- name: MYSQL_PORT_3306_TCP_ADDR
-  value: {{ .Values.keycloak.persistence.dbHost | quote }}
-- name: MYSQL_PORT_3306_TCP_PORT
-  value: {{ .Values.keycloak.persistence.dbPort | quote }}
-- name: MYSQL_USER
-  value: {{ .Values.keycloak.persistence.dbUser | quote }}
-- name: MYSQL_PASSWORD
-  valueFrom:
-    secretKeyRef:
-      name: {{ template "keycloak.externalDbSecret" . }}
-      key: {{ include "keycloak.dbPasswordKey" . | quote }}
-- name: MYSQL_DATABASE
-  value: {{ .Values.keycloak.persistence.dbName | quote }}
+{{- end }}
 {{- end }}
 {{- end -}}
-
diff --git a/stable/keycloak/templates/configmap.yaml b/stable/keycloak/templates/configmap.yaml
index a419d45404..1f1668f246 100644
--- a/stable/keycloak/templates/configmap.yaml
+++ b/stable/keycloak/templates/configmap.yaml
@@ -39,7 +39,7 @@ data:
 {{ .discovery | indent 4 }}
 {{- end }}
 
-{{- if and $highAvailability (eq $.Values.keycloak.persistence.dbVendor "POSTGRES") }}
+{{- if and $highAvailability (eq $.Values.keycloak.persistence.dbVendor "postgres") }}
 {{ .postgresql | indent 4 }}
 {{- end }}
 
diff --git a/stable/keycloak/templates/statefulset.yaml b/stable/keycloak/templates/statefulset.yaml
index a6dbb02720..139b59994e 100644
--- a/stable/keycloak/templates/statefulset.yaml
+++ b/stable/keycloak/templates/statefulset.yaml
@@ -63,21 +63,7 @@ spec:
                   name: {{ template "keycloak.fullname" . }}-http
                   key: password
           {{- end }}
-          {{- if .Values.keycloak.persistence.deployPostgres }}
-            - name: POSTGRES_PORT_5432_TCP_ADDR
-              value: {{ template "keycloak.postgresql.fullname" . }}
-            - name: POSTGRES_USER
-              value: {{ .Values.postgresql.postgresUser | quote }}
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: {{ template "keycloak.postgresql.fullname" . }}
-                  key: postgres-password
-            - name: POSTGRES_DATABASE
-              value: {{ .Values.postgresql.postgresDatabase | quote }}
-          {{- else }}
-{{ include "keycloak.externalDbConfig" . | indent 12 }}
-          {{- end }}
+{{ include "keycloak.dbEnvVars" . | indent 12 }}
 {{- with .Values.keycloak.extraEnv }}
 {{ tpl . $ | indent 12 }}
 {{- end }}
diff --git a/stable/keycloak/values.yaml b/stable/keycloak/values.yaml
index 17d61c1c32..d22ded0768 100644
--- a/stable/keycloak/values.yaml
+++ b/stable/keycloak/values.yaml
@@ -1,7 +1,7 @@
 init:
   image:
     repository: alpine
-    tag: 3.6
+    tag: 3.7
     pullPolicy: IfNotPresent
 
 keycloak:
@@ -9,7 +9,7 @@ keycloak:
 
   image:
     repository: jboss/keycloak
-    tag: 3.4.3.Final
+    tag: 4.0.0.Final
     pullPolicy: IfNotPresent
 
     ## Optionally specify an array of imagePullSecrets.
@@ -34,7 +34,7 @@ keycloak:
   preStartScript:
 
   ## Additional arguments to start command e.g. -Dkeycloak.import= to load a realm
-  extraArgs:
+  extraArgs: ""
 
   ## Username for the initial Keycloak admin user
   username: keycloak
@@ -194,7 +194,10 @@ keycloak:
   ## Persistence configuration
   persistence:
     # If true, the Postgres chart is deployed
-    deployPostgres: true
+    deployPostgres: false
+
+    # The database vendor. Can be either "postgres", "mysql", "mariadb", or "h2"
+    dbVendor: h2
 
     ## The following values only apply if "deployPostgres" is set to "false"
 
@@ -204,9 +207,6 @@ keycloak:
     # The key in the existing secret that stores the password
     existingSecretKey: password
 
-    # The database vendor. Can be either "POSTGRES" or "MYSQL"
-    dbVendor: POSTGRES
-
     dbName: keycloak
     dbHost: mykeycloak
     dbPort: 5432