UDS Core 1.17
UDS Core 1.17 adds a CSS-only classification banner mode and improves Pepr admission webhook reliability. For expected authentication interruptions during the automated Keycloak 26.8.2 upgrade, see the Keycloak upgrade notice below.
Notable features
Section titled “Notable features”This release includes these features and fixes:
- CSS-only classification banners: Set
cssOnly: trueon aclassificationBannersentry to keep the page body unchanged. This mode supports server-rendered applications that remove injected banner elements during hydration. A Content Security Policy that blocks inline styles can prevent the banner from appearing. See Enable the classification banner (#3095). - Pepr admission webhook reliability: Fixes webhook connection resets that could occur while Istio CNI updates the inbound traffic path for Pepr admission pods (#3199).
- Grafana profile privacy: Disables Gravatar profile image requests by default, so Grafana does not contact Gravatar to look up profile images (#3203).
- Gateway TLS certificates: Rotates the tenant and admin gateway certificates (#3201).
Dependency updates
Section titled “Dependency updates”The following versions change from UDS Core 1.16.0:
| Package | Previous | Updated |
|---|---|---|
| Alertmanager | 0.34.1 | 0.34.2 |
| Envoy Gateway | 1.9.2 | 1.10.0 |
| Envoy Proxy | 1.39.4 | 1.40.2 |
| Falco | 0.45.1 | 0.45.2 |
| Falco Helm chart | 9.2.1 | 9.2.2 |
| Falcosidekick | 2.35.0 | 2.35.1 |
| Grafana (upstream and Unicorn) | 13.2.4 | 13.3.0 |
| Grafana (Iron Bank) | 13.2.3 | 13.3.0 |
| Grafana Helm chart | 13.4.0 | 14.3.1 |
| Keycloak | 26.8.1 | 26.8.2 |
| kube-prometheus-stack Helm chart | 92.14.0 | 93.1.0 |
| k8s-sidecar | 2.14.1 | 2.14.3 |
| Metrics Server | 0.9.0 | 0.9.1 |
| Prometheus | 3.15.1 | 3.16.0 |
| Prometheus Blackbox Exporter Helm chart | 11.20.2 | 11.21.1 |
| Prometheus Operator | 0.94.1 | 0.95.1 |
| prometheus-operator-crds Helm chart | 32.0.2 | 33.0.1 |
| UDS Identity Config | 0.32.4 | 0.32.6 |
| UDS Portal | 0.6.0 | 0.6.2 |
| UDS Portal Helm chart | 0.6.0 | 0.6.2 |
| Vector | 0.60.0 | 0.61.0 |
| Vector Helm chart | 0.60.0 | 0.61.0 |
Upgrade considerations
Section titled “Upgrade considerations”Keycloak upgrade notice
Section titled “Keycloak upgrade notice”Keycloak 26.8.2 upstream changes
Section titled “Keycloak 26.8.2 upstream changes”Keycloak 26.8.2 changes Admin API scope requirements and protocol mapper permissions. UDS Core automatically prepares UDS-managed clients. If you use custom service-account clients or delegated client administration, review these changes.
- Custom service-account clients that call the Admin API must include the built-in
kc-admin-apiclient scope, which provides an audience required by the API. - Keycloak 26.8.2 restricts protocol mapper changes through the Admin API. Delegated client admins need the
manage-realmrole unless the required mapper types are allowed in realm settings. For Dynamic Client Registration, those types must also be allowed by the client registration policy.
Identity Config updates (0.32.6)
Section titled “Identity Config updates (0.32.6)”UDS Core updates UDS Identity Config from 0.32.4 to 0.32.6. This version includes Keycloak 26.8.2 compatibility updates and restores passwordless credential registration. See the UDS Identity Config 0.32.6 changelog.
Related documentation
Section titled “Related documentation”- Upgrade Overview - general upgrade procedures and checklists
- Enable the classification banner - configure and verify classification banners
- UDS Core 1.17.0 Changelog - full changelog
- UDS Identity Config 0.32.6 Changelog - Identity Config changes included with Core
- Full diff (1.16.0…1.17.0) - all changes between versions