UDS Core 1.14

UDS Core 1.14 adds keyless signatures to published Core packages and UDS CLI Next demo bundles. This release also adds default disruption budgets for HA Keycloak deployments, rejects conflicting HTTP expose routes across namespaces, and improves HTTP/2 gateway routing.

⚠ Breaking changes

Change	Impact	Action required
HA-only Keycloak disruption budgets	Upgrades remove existing chart-managed PodDisruptionBudgets (PDBs) when `autoscaling.enabled` is `false`. The chart now defaults to `maxUnavailable: 1` and rejects configurations that also set `minAvailable`, even when the PDB is disabled.	Configure an external PostgreSQL database and enable autoscaling if you require a chart-managed PDB. Set `podDisruptionBudget.maxUnavailable` to `null` when using `minAvailable` (#2980).

Notable features

Signed release artifacts: Published standard and functional layer Core packages now carry keyless signatures backed by GitHub OIDC. The upstream k3d-core-demo-next and k3d-core-slim-dev-next bundles also carry signatures for both amd64 and arm64. Publishing verifies signatures before uploading the artifacts (#2945, #2972).
Default Keycloak HA disruption budget: Enabling autoscaling.enabled now creates a PDB with maxUnavailable: 1 and unhealthyPodEvictionPolicy: AlwaysAllow. Set podDisruptionBudget.enabled to false to disable it in HA mode. See Keycloak high availability (#2980).
HTTP expose collision validation: The UDS Operator now rejects Package creates and updates when HTTP routes in different namespaces share a gateway and hostname and either route is a catch-all. Both routes can share a host when their advancedHTTP.match entries constrain routing (#2783).
HTTP 421 filter change (reverted in 1.14.1): In 1.14.0, the misdirected-request filter permitted HTTP/2 connection reuse when the requested host had a route on the selected gateway listener (#2997). Version 1.14.1 reverts this behavior to fix the CAC login regression.
Velero network access: Set velero.uds-velero-config.additionalNetworkAllow to add custom network.allow entries to the Velero Package. See Configure Core network access (#2977).
Stable UDPRoute API: The UDS Operator now generates UDP routes using gateway.networking.k8s.io/v1 instead of v1alpha2. See Expose UDP applications (#2999).
Keycloak security update: Keycloak 26.7.4 includes upstream security fixes and bug fixes. UDS Identity Config remains at 0.32.0, the version already included in UDS Core 1.13.1 (#2969, Keycloak release notes).

Dependency updates

Package	Previous	Updated
Falco	0.44.1	0.45.0
Falco Helm chart	9.1.0	9.2.0
Grafana	13.1.0	13.2.1
Grafana Helm chart	12.7.2	13.2.6
Keycloak	26.7.3	26.7.4
Loki	3.7.7	3.7.8
Loki Helm chart	18.12.1	18.13.7
k8s-sidecar (Grafana)	2.8.1	2.11.2
Portal	0.5.1	0.5.2

Upgrade considerations

UDS Core 1.14.0 changed the misdirected-request filter to allow HTTP/2 connection reuse when the requested host has a route on the selected gateway listener (#2997). A browser can reuse a tenant application’s SIMPLE TLS connection for sso.<domain>, bypassing the new TLS handshake that would request a client certificate under Keycloak’s OPTIONAL_MUTUAL policy. Users may reach Keycloak without a CAC certificate prompt and cannot complete CAC login. This issue is resolved in 1.14.1.

Until you are able to upgrade, quit and reopen the browser, then navigate directly to https://sso.<domain> before opening a tenant application. Opening another SSO application in the same browser session may not restore the certificate prompt.

Known issue: additional Keycloak SSO hostnames

UDS Core 1.12 introduced configured public and administrative Keycloak hostnames (#2898). Deployments that route an additional public SSO hostname to the same Keycloak instance, such as a vanity or VDI login domain, may fail to complete login on UDS Core 1.12 through 1.14. Users have reported the error “Restart login cookie not found” when accessing the additional hostname. OIDC clients that use that hostname for discovery and issuer validation may also be affected.

If your deployment depends on an additional SSO hostname, test the complete login flow and token issuer validation in a non-production environment before upgrading. Defer the production upgrade if that flow fails, and contact Product Support. A generally applicable fix has not yet been validated.

Pre-upgrade steps

Before upgrading, review these changes:

Configure Core package signature verification

Add keylessVerification to every Core package reference in your bundle, including functional layers:

packages:
  - name: core
    repository: registry.defenseunicorns.com/public/core
    ref: 1.14.0-upstream
    keylessVerification:
      # Accept Core release tags signed by the publishing workflow
      certificateIdentityRegexp: ^https://github\.com/defenseunicorns/uds-core/\.github/workflows/publish\.yaml@refs/tags/v[0-9]+\.[0-9]+\.[0-9]+$
      certificateOIDCIssuer: https://token.actions.githubusercontent.com

For layer examples, see Build a functional layer bundle.

Review Keycloak PDB overrides

To retain a chart-managed PDB with autoscaling currently disabled, configure an external PostgreSQL database and set autoscaling.enabled to true. If you use podDisruptionBudget.minAvailable, set podDisruptionBudget.maxUnavailable to null. See Keycloak high availability for setup and node-drain precautions.
Resolve conflicting HTTP expose entries

Review Package resources in different namespaces that share a gateway and hostname. Use distinct hosts or gateways, or constrain both routes with advancedHTTP.match, such as URI paths. Catch-all routes can block subsequent Package updates. See Expose applications on gateways (#2783).
Review custom Grafana overrides

If you customize Grafana containers or commands, review the chart changes. Grafana, dashboard download, and sidecar containers now default to readOnlyRootFilesystem: true; mount writable paths where needed.

Upgrade Overview - general upgrade procedures and checklists
Keycloak high availability - external database, autoscaling, and disruption budgets
Build a functional layer bundle - signed Core layer references
Expose applications on gateways - HTTP routing constraints
UDS Core 1.14.0 Changelog - full changelog
Full diff (1.13.1…1.14.1) - all changes between versions