Skip to content
Unified Defense Stack Unified Defense Stack
You're viewing docs for v1.6.Go to the latest

UDS Core 1.6

UDS Core 1.6 adds the UDS Portal as a new layer in the upstream and unicorn flavors, brings macOS and sudo-free support to the checkpoint slim-dev package, introduces an allowlist for granting trusted in-cluster workloads access to the Keycloak Admin API, and bumps uds-identity-config to 0.28.0. The demo bundles now ship a keyless-signed Zarf init package, so deploying them requires UDS CLI v0.32.0 or later.

Notable features

Section titled “Notable features”
  • UDS Portal: the UDS Portal ships as a new layer in the upstream and unicorn flavors, providing a user-facing application portal that discovers and links the applications a user can access. The Portal is not present in the registry1 flavor. See UDS Portal concepts and Customize UDS Portal app tiles (#2699).
  • macOS support for the checkpoint slim-dev package: the published checkpoint slim-dev package now deploys on macOS and no longer requires sudo, significantly speeding up quick dev deploys of slim-dev. Checkpoint creation streams k3s and kubelet volume data over the Docker socket with docker cp instead of host bind-mounts, and deploy populates named Docker volumes that k3d can mount on any platform. Tested on Lima, OrbStack, and Linux. Deploy the checkpoint package with uds zarf package deploy oci://ghcr.io/defenseunicorns/dev/uds/checkpoints/k3d-core-slim-dev:1.6.0 (#2688).
  • Keycloak Admin API principal allowlist: a new adminApiAllowedPrincipals value on the Keycloak chart lets you allowlist specific Istio source principals (mTLS SPIFFE identities) to reach the Keycloak Admin API without routing through the admin gateway. The value defaults to [], so there is no behavioral change when unset. By default the keycloak-block-admin-access-from-public-gateway AuthorizationPolicy denies Admin API access to all sources outside the admin gateway and pepr-system; each configured principal is rendered as a notPrincipals exclusion scoped only to the Admin API DENY rules (#2714).
  • UDPRoute CRD type: UDS Core now generates the Gateway API UDPRoute TypeScript type, laying groundwork for future Envoy Gateway UDP ingress support. This is an internal type-generation change with no operator-facing configuration yet (#2704).
  • Branding update: the UDS acronym now expands to “Unified Defense Stack” (previously “Unicorn Delivery Service”). The Keycloak realm display name shown in the login UI now defaults to “Unified Defense Stack” when no override is set. Precedence is unchanged: an explicit themeCustomizations.settings.realmDisplayName takes priority, then realmInitEnv.DISPLAY_NAME, so existing clusters that set a display name keep it (#2708).

Dependency updates

Section titled “Dependency updates”
PackagePreviousUpdated
Istio1.29.21.29.3
Keycloak26.6.126.6.2
Prometheusv3.11.3v3.12.0
Vector0.55.00.56.0
Pepr1.2.01.2.1
UDS Identity Config0.27.00.28.0
Loki Helm chart17.0.117.1.7
kube-prometheus-stack Helm chart85.2.286.1.0
Vector Helm chart0.52.00.56.0
DoD root CA certsn/aUpdated

Upgrade considerations

Section titled “Upgrade considerations”

Identity Config updates (0.28.0)

Section titled “Identity Config updates (0.28.0)”

Identity Config 0.28.0 includes the following changes:

  • Adds a new usercertificateSKI user attribute extracted from x509 certificates.
  • Bumps the internal Keycloak compile dependency to 26.6.3 (security update); the deployed Keycloak server version remains 26.6.2.
  • Updates branding references to “Unified Defense Stack”.

No manual realm changes are required for this release.

Section titled “Related documentation”
Cookie Settings Privacy Policy