Skip to content
Unified Defense StackUnified Defense Stack

UDS Core 1.9

UDS Core 1.9 delivers two major capabilities: native Zarf values for direct, validated package customization, and UDP exposure managed by the UDS Operator through Envoy Gateway. You can now override supported Helm settings without building a bundle solely for customization, and declaratively expose UDP services through the existing Package CR. This release also fixes SAML SSO certificate selection during Keycloak signing key rotation.

Notable features

Section titled “Notable features”
  • Direct package customization with native Zarf values: Customize a UDS Core package during deployment with --values values.yaml, or set individual paths with --set-values <component>.<chart>.<path>=<value>. You no longer need to create or rebuild a UDS bundle solely to override supported Helm settings. UDS Core publishes values files and generated schemas across all seven package layers. During deployment, each package validates supplied settings and protects configuration that UDS Core owns, including image references, registries, and security contexts. Shared global.domain and global.adminDomain values configure applicable charts across the stack. Existing Zarf variable workflows remain supported, and explicit values take precedence. Zarf values remain an alpha feature. See the Zarf values reference (#2762).
  • Declarative UDP exposure through Envoy Gateway: You can now expose UDP services through the existing Package CR by setting protocol: UDP on a spec.network.expose entry. Enable the optional envoy-gateway component, plus envoy-default-gateway for the shared Gateway mode. Omit gateway to use the shared Gateway managed by UDS Core, or set it to a Gateway that you manage. The UDS Operator creates, reconciles, and cleans up the required Gateway API UDPRoute and ingress NetworkPolicy, plus Gateway listeners in shared mode, so you no longer manage those resources manually. UDP routes use ports rather than hostnames, and admission rejects conflicting port assignments on the same Gateway. UDP traffic bypasses Istio, so Istio AuthorizationPolicy and mTLS do not protect it. See Expose UDP applications (#2760).
  • SAML signing key rotation fix: The UDS Operator now selects the active signing certificate when Keycloak publishes multiple certificates during key rotation. It also reports failures to fetch the descriptor or find a signing certificate on the Package CR instead of writing an invalid SSO secret (#2799).

Dependency updates

Section titled “Dependency updates”
PackagePreviousUpdated
Envoy Gatewayv1.8.1v1.8.2
Grafana13.0.113.1.0
Grafana Helm chart12.3.312.7.2
k8s-sidecar2.7.32.8.1
Keycloak26.6.226.7.0
Loki Helm chart18.4.018.5.1
Metrics Serverv0.8.1v0.9.0
Metrics Server Helm chart3.13.03.13.1
UDS Portal0.4.00.5.0
Prometheusv3.12.0v3.13.1
Alertmanagerv0.33.0v0.33.1
Node Exporterv1.11.1v1.12.1
Prometheus Operatorv0.92.0v0.92.1
kube-prometheus-stack Helm chart87.2.087.16.1
Prometheus Blackbox Exporter Helm chart11.13.011.15.1
prometheus-operator-crds Helm chart30.0.030.0.1
Vector0.56.00.57.0
Vector Helm chart0.56.00.57.0
Public root CA certificatesn/aUpdated

Upgrade considerations

Section titled “Upgrade considerations”

Upgrade UDS CLI or Zarf before deploying

Section titled “Upgrade UDS CLI or Zarf before deploying”

Before you install or upgrade UDS Core 1.9, update to UDS CLI v0.34.0 or later. If your workflow invokes Zarf directly, use Zarf v0.79.0 or later. These versions include the package pull behavior required to retrieve and validate the values files and schemas shipped with UDS Core 1.9.

Existing Zarf variables remain compatible. You do not need to migrate DOMAIN, ADMIN_DOMAIN, or other configuration based on variables to Zarf values for this release.

Section titled “Related documentation”
Cookie SettingsPrivacy Policy