Skip to content
Unified Defense StackUnified Defense Stack

UDS Core 1.12

UDS Core 1.12 gives you more control over network access and Keycloak client configuration. This release also separates public and administrative Keycloak hostnames and updates UDS Identity Config and monitoring dependencies.

Notable features

Section titled “Notable features”
  • Envoy Gateway network access: Set additionalNetworkAllow to add network.allow entries to the Envoy Gateway Package, enabling integrations such as Envoy AI Gateway. See Configure Core network access (#2891).
  • Password reset links: Administrator-triggered password reset emails for locked-out users now contain usable sso.<domain> links. Self-service resets already used this public hostname. Realm administration remains on keycloak.<admin_domain>, and the paired hostname configuration hardens URL generation by keeping public and administrative URLs on their configured origins (#2898).
  • SSO client scope controls: Set spec.sso[].fullScopeAllowed: false when an application uses explicit role scope mappings and client scopes. Omitted values continue to default to true, preserving existing Keycloak behavior. See Identity and authorization configuration (#2873).
  • Portal domain resolution: Portal now correctly resolves the root domain and custom gateway domains (#2933).
  • Checkpoint loading fix: Checkpoint packages now load correctly on a Docker daemon with no previously loaded images (#2900).

Dependency updates

Section titled “Dependency updates”
PackagePreviousUpdated
UDS Identity Config0.30.00.31.0
Portal0.5.00.5.1
Prometheus3.13.23.14.0
Alertmanager0.33.10.34.0
Kube State Metrics2.19.12.20.0
kube-prometheus-stack Helm chart88.2.088.5.2

Upgrade considerations

Section titled “Upgrade considerations”

Known issue: additional Keycloak SSO hostnames

Section titled “Known issue: additional Keycloak SSO hostnames”

UDS Core 1.12 introduced configured public and administrative Keycloak hostnames (#2898). Deployments that route an additional public SSO hostname to the same Keycloak instance, such as a vanity or VDI login domain, may fail to complete login on UDS Core 1.12 through 1.14. Users have reported the error “Restart login cookie not found” when accessing the additional hostname. OIDC clients that use that hostname for discovery and issuer validation may also be affected.

If your deployment depends on an additional SSO hostname, test the complete login flow and token issuer validation in a non-production environment before upgrading. Defer the production upgrade if that flow fails, and contact Product Support. A generally applicable fix has not yet been validated.

Identity Config updates (0.31.0)

Section titled “Identity Config updates (0.31.0)”

Identity Config 0.31.0 includes the following changes. No manual realm changes are required for existing clusters.

  • Request-aware hostname provider: Enables separate public and administrative Keycloak hostnames.
Section titled “Related documentation”
Cookie SettingsPrivacy Policy