UDS Core 1.11

Note

For general upgrade procedures, see the Upgrade Overview.

UDS Core 1.11 expands classification banner configuration so operators can apply different banner text and footer behavior by host and path. This release also exposes Pepr admission webhook annotations through Zarf values, fixes several upgrade and templating issues, and bumps UDS Identity Config to 0.30.0 for registration and client policy fixes.

Danger

Do not install or upgrade to UDS Core v1.11.0. Upgrade directly to v1.11.1, which updates Keycloak to 26.7.2 and addresses CVE-2026-18963, a critical vulnerability in the reset-credentials flow. An unauthenticated attacker may reset another user’s password without completing email verification, and MFA alone does not mitigate this risk. If you already run v1.11.0, upgrade to v1.11.1. If you cannot upgrade immediately, use the temporary Forgot Password mitigation under Upgrade considerations.

Notable features

• Multiple classification banners: UDS Core now supports a classificationBanners list with per-entry text, addFooter, enabledHosts, and optional pathPrefixes values. The legacy classificationBanner value remains supported, but emits a deprecation note when enabled. See Enable the classification banner (#2851).
• Pepr webhook annotation overrides: Base and Standard package schemas now expose .pepr-uds-core.module.admission.webhookAnnotations, allowing operators to set admission webhook annotations through Zarf values (#2886).
• Functional layer Zarf values: The backup-restore and metrics-server functional layers now include default Zarf values and generated schemas, matching the configuration surface exposed by the larger packages. See the Zarf values reference (#2867).
• Checkpoint restore stability: Checkpoint packages now remove persisted node IP state before creating checkpoints, preventing restore failures when k3d assigns the restored server a different address (#2881).
• Istio ambient gateway readiness: UDS Core now waits for Pepr admission Pods to become ready and ambient-enabled before deploying Istio gateways, reducing intermittent admission webhook EOF failures during startup and upgrades (#2871).
• Keycloak PDB templating fix: The Keycloak PodDisruptionBudget template now renders correctly when enabled (#2878).

Dependency updates

Package	Previous	Updated
Keycloak	26.7.0	26.7.2
UDS Identity Config	0.29.0	0.30.0
Loki	3.7.4	3.7.6
Loki Helm chart	18.7.0	18.7.6
k8s-sidecar	2.10.0	2.10.1
Pepr	1.3.0	2.0.0
Prometheus Operator	v0.93.0	v0.93.1
kube-prometheus-stack Helm chart	88.1.4	88.2.0
Prometheus Blackbox Exporter Helm chart	11.16.0	11.17.2
prometheus-operator-crds Helm chart	31.0.0	31.0.1

Upgrade considerations

Forgot Password mitigation

If you cannot upgrade immediately, temporarily disable Forgot Password in every Keycloak realm, including the master realm:

1. Open the Keycloak admin console at https://keycloak.<admin_domain>/.
2. Sign in with an administrator account.
3. Use Manage realms to select the realm you want to configure.
4. Open Realm Settings, then select the Login tab.
5. Turn off Forgot Password.
6. Repeat the change for every realm, including master.
7. Sign out of the admin console.

Re-enable Forgot Password after upgrading

After Keycloak 26.7.2 is running, restore Forgot Password in each realm where you applied the temporary mitigation, including the master realm:

1. Open the Keycloak admin console at https://keycloak.<admin_domain>/.
2. Sign in with an administrator account.
3. Use Manage realms to select the realm you want to configure.
4. Open Realm Settings, then select the Login tab.
5. Turn on Forgot Password.
6. Repeat the change for every affected realm, including master.
7. Confirm that password recovery is available on the realm login page, then sign out of the admin console.

Pepr 2.0 compatibility

UDS Core packages Pepr 2.0 in this release. No manual platform upgrade step is expected for standard UDS Core deployments, but operators who maintain custom Pepr modules or repo automation should review the Pepr 2.0.0 release, especially the removal of pepr format.

Identity Config updates (0.30.0)

Identity Config 0.30.0 includes the following changes. No manual realm steps are required for existing clusters.

• Keycloak self-registration password validation: Registration now enforces Keycloak password validation when email verification is enabled (#905).
• Client policy full-scope handling: The UDS client policy no longer blocks setting fullScopeAllowed on clients (#901).

Related documentation

• Upgrade Overview - general upgrade procedures and checklists
• Enable the classification banner - configure and verify classification banners
• Zarf values reference - configure UDS Core packages with native Zarf values
• Identity and authorization configuration - configure Keycloak and UDS Identity Config settings
• UDS Core 1.11.0 Changelog - full changelog
• UDS Identity Config 0.30.0 Changelog - identity-config changelog
• Full diff (1.10.0…1.11.1) - all changes between versions