Skip to content
Unified Defense StackUnified Defense Stack

UDS Core 1.10

UDS Core 1.10 removes the implicit Keycloak preview feature group from the default startup configuration. Deployments that depend on preview features must enable them explicitly through keycloak.keycloak.features.additional. This release also improves classification banner compatibility with single-page and full-viewport applications.

Notable features

Section titled “Notable features”
  • Explicit Keycloak feature selection: UDS Core no longer passes the generic preview feature group to Keycloak by default. Use the new keycloak.keycloak.features.additional value to enable individual optional features alongside the required fips feature. See the identity and authorization configuration reference (#2838).
  • Classification banner application compatibility: Classification banners now support single-page and full-viewport applications. The updated response handling supports buffered and streamed HTML while preserving space for the banner above application content. See Enable the classification banner (#2710).

Dependency updates

Section titled “Dependency updates”
PackagePreviousUpdated
Authservice1.1.51.1.8
Envoy Gatewayv1.8.2v1.8.3
Envoy Proxyv1.38.3v1.39.0
Gateway API CRDsv1.5.1v1.6.1
Istio1.29.31.30.3
Loki3.7.33.7.4
Loki Helm chart18.5.118.7.0
k8s-sidecar2.8.12.10.0
Pepr1.2.21.3.0
Prometheusv3.13.1v3.13.2
Prometheus Operatorv0.92.1v0.93.0
kube-prometheus-stack Helm chart87.16.188.1.4
Prometheus Blackbox Exporter Helm chart11.15.111.16.0
prometheus-operator-crds Helm chart30.0.131.0.0

Upgrade considerations

Section titled “Upgrade considerations”

Keycloak session behavior

Section titled “Keycloak session behavior”

Keycloak stores regular user sessions in the database independently of stateless mode, so established SSO sessions remain available during the upgrade. In-progress authentication sessions and action tokens created while stateless mode is enabled may not carry over after UDS Core disables it. Affected users may need to restart an in-progress sign-in or account action.

Istio 1.30 compatibility changes

Section titled “Istio 1.30 compatibility changes”

UDS Core 1.10 upgrades Istio from 1.29.3 to 1.30.3. Most deployments require no additional action, but review these changes if your deployment uses custom mesh tooling or configuration (#2724):

  • XDS debug endpoint authentication: Istio now requires authentication for the syncz and config_dump endpoints on port 15010. Review custom tooling and istioctl workflows that use plaintext XDS connections.
  • CNI configuration permissions: Istio changes the default permissions for CNI configuration files from 0644 to 0600. Review tooling that reads these files as a non-root group member.
  • Excluded ambient namespaces: The Istio CNI agent now honors excludeNamespaces. Istio removes existing ambient workloads in excluded namespaces from the mesh and does not enroll new workloads in those namespaces.
  • Sidecar service selection: Istio changes how sidecar proxies select a service when the same hostname exists in multiple namespaces. Review deployments that use the same hostname for Kubernetes Service resources and non-Kubernetes services.

UDS Core packages Gateway API CRDs v1.6.1 as part of this upgrade, so you do not need to install them separately. Review the Istio 1.30 upgrade notes for complete compatibility details.

Pre-upgrade steps

Section titled “Pre-upgrade steps”

  1. Review Keycloak feature dependencies

    If your deployment relies on a Keycloak feature that UDS Core previously enabled through the generic preview group, add that feature to the keycloak.keycloak.features.additional list before upgrading. Prefer the specific feature name over preview so unrelated preview features do not activate.

Post-upgrade verification

Section titled “Post-upgrade verification”

  1. Verify Keycloak startup and SSO flows

    Confirm that the Keycloak StatefulSet becomes ready and test the SSO flows used by your deployment. If you enabled an additional feature, verify its expected behavior separately.

Section titled “Related documentation”
Cookie SettingsPrivacy Policy