Skip to content
Unified Defense StackUnified Defense Stack

UDS Core 1.15

UDS Core 1.15 restores login and issuer validation through additional Keycloak SSO hostnames while hardening Keycloak ingress handling. This release also improves checkpoint startup and Prometheus upgrade reliability, and adds redirect prefix rewriting to the Package CR.

Notable features

Section titled “Notable features”
  • Additional Keycloak SSO hostnames: Keycloak now derives its public hostname from trusted request data instead of fixed hostname settings. This restores discovery, login, token issuer validation, and protected application sessions through additional SSO hostnames, resolving the known issue in UDS Core 1.12 through 1.14 (#3044).
  • Keycloak ingress hardening: Core-managed Keycloak routes now remove untrusted forwarding headers, set trusted HTTPS forwarding values, add HTTP Strict Transport Security (HSTS) with includeSubDomains, and vary responses by origin. The Keycloak affinity cookie now also uses the Secure attribute. Grafana declares its exact HTTPS SSO origin while retaining login and logout redirects (#3000).
  • Checkpoint startup reliability: The checkpoint development package now reduces K3s node status reporting intervals and isolates Istio CNI configuration from Flannel startup rewrites. These changes prevent startup races that could exceed the deployment readiness timeout (#3039).
  • Prometheus upgrade reliability: Prometheus now gives a newly created config-reloader container time to install its termination handler before Kubernetes replaces the Pod during rapid StatefulSet revisions. This prevents terminating Pods from blocking the final Prometheus revision during upgrades (#3077).
  • Redirect prefix rewriting: Set spec.network.expose[].advancedHTTP.redirect.prefixRewrite on a Package to replace the matched path prefix in an HTTP redirect. UDS Core adds this field through the Istio 1.31.1 schema update (#3067).

Dependency updates

Section titled “Dependency updates”
PackagePreviousUpdated
Alertmanager0.34.00.34.1
Blackbox Exporter0.28.00.29.0
Envoy Gatewayv1.9.1v1.9.2
Envoy Proxyv1.39.1v1.39.4
Gateway API CRDsv1.6.1v1.6.3
Grafana13.2.113.2.3
Grafana Helm chart13.2.613.4.0
Istio1.30.31.31.1
k8s-sidecar2.11.22.14.1
Loki Helm chart18.13.718.15.1
Pepr2.0.02.0.3
Prometheus3.14.03.15.0
Prometheus Operator0.93.10.94.1
UDS Identity Config0.32.00.32.2
Vector0.58.00.59.0
Vector Helm chart0.58.00.59.0
Velero1.18.21.18.4
Velero plugins1.14.21.14.4
Velero Helm chart12.1.012.2.0
kube-prometheus-stack Helm chart88.5.292.2.0
Prometheus Blackbox Exporter Helm chart11.17.211.20.0
prometheus-operator-crds Helm chart31.0.132.0.1

Upgrade considerations

Section titled “Upgrade considerations”

Identity Config updates (0.32.2)

Section titled “Identity Config updates (0.32.2)”

UDS Identity Config 0.32.2 restores multi-domain and claim token behavior affected by earlier hostname changes. This release also includes plugin and dependency updates. No manual realm steps are required for existing clusters.

Section titled “Related documentation”
Cookie SettingsPrivacy Policy