Example versioning scheme
Versions follow the format `
| Setting | Default | Override Path |
|---|---|---|
| PVC size | 50Gi | `prometheus.prometheusSpec.storageSpec.volumeClaimTemplate.spec.resources.requests.storage` |
| Time-based retention | 10d | `prometheus.prometheusSpec.retention` |
| Size-based retention | Disabled | `prometheus.prometheusSpec.retentionSize` |
```yaml title="uds-bundle.yaml"
packages:
- name: core
repository: registry.defenseunicorns.com/public/core
ref: x.x.x-upstream
overrides:
kube-prometheus-stack:
kube-prometheus-stack:
values:
# Increase PVC size for longer retention
- path: prometheus.prometheusSpec.storageSpec.volumeClaimTemplate.spec.resources.requests.storage
value: "100Gi"
# Keep data for 30 days
- path: prometheus.prometheusSpec.retention
value: "30d"
# Safety cap: drop oldest data if disk usage exceeds this limit
- path: prometheus.prometheusSpec.retentionSize
value: "90GB"
```
> [!NOTE]
> If you are resizing storage on an existing deployment, follow the [Resize Prometheus PVCs](/operations/troubleshooting--runbooks/resize-prometheus-pvc/) runbook, because PVC resizing requires additional steps beyond updating your bundle.
To estimate disk needs, use the upstream formula from the [Prometheus storage documentation](https://prometheus.io/docs/prometheus/latest/storage/):
```text
needed_disk_space = retention_time_seconds × ingested_samples_per_second × bytes_per_sample
```
In practice, `bytes_per_sample` averages 1–2 bytes after compression. Start with the defaults, then query `prometheus_tsdb_storage_blocks_bytes` in Grafana to observe actual usage and project growth before resizing.
> [!TIP]
> Use the `prometheus_tsdb_storage_blocks_bytes` metric in Grafana to monitor actual disk usage over time. This is the most reliable way to right-size your PVC rather than guessing upfront.
> [!CAUTION]
> If stored data exceeds PVC capacity, Prometheus will crash-loop. Always provision PVC size with headroom above your expected retention volume. `retentionSize` acts as a safety cap: Prometheus drops the oldest blocks when this limit is reached.
4. **Create and deploy your bundle**
```bash
uds create 2. **Authentication** → **Flows** → **UDS Authentication** → set the **MFA** sub-flow to **Required**
3. Inside the **MFA** sub-flow, set **WebAuthn Passwordless Authenticator** to **Required** | ### Problem: X.509/CAC login fails with OCSP error in airgapped environment **Symptoms:** Certificate authentication fails with an OCSP revocation check error. Logs show the OCSP responder is unreachable. **Solution:** Configure OCSP fail-open behavior or disable OCSP checking via `realmInitEnv`. To allow authentication when the OCSP responder is unreachable (fail-open): ```yaml - path: realmInitEnv value: X509_OCSP_FAIL_OPEN: "true" ``` To disable OCSP checking entirely: ```yaml - path: realmInitEnv value: X509_OCSP_CHECKING_ENABLED: "false" ``` > [!CAUTION] > Disabling OCSP checking means revoked certificates will not be rejected. Understand your organization's compliance requirements before using this setting. If your environment uses CRL-based revocation instead of OCSP, configure the CRL path: ```yaml - path: realmInitEnv value: X509_CRL_CHECKING_ENABLED: "true" X509_CRL_RELATIVE_PATH: "crls/DODROOTCA3.crl##crls/DODIDCA_81.crl" # Relative to /opt/keycloak/conf; use ## between multiple paths X509_CRL_ABORT_IF_NON_UPDATED: "false" # Set true to fail authentication if CRL is expired ``` > [!NOTE] > CRL files must be present on the Keycloak pod at the path specified in `X509_CRL_RELATIVE_PATH`, relative to `/opt/keycloak/conf`. To include CRL files in a custom image, see the [uds-identity-config repository](https://github.com/defenseunicorns/uds-identity-config). ### Problem: MFA is not required after enabling WebAuthn or OTP **Symptoms:** Users can log in without completing an MFA step. **Solution:** Confirm that both the flow toggle and at least one MFA method are enabled. For WebAuthn to work as a required step, `WEBAUTHN_ENABLED: true` must be set; for OTP, `OTP_ENABLED: true`. Verify the realm was redeployed after the override was applied. ## Reference: X.509/CAC with additional MFA > [!NOTE] > CAC authentication (X.509 certificate + PIN) already satisfies multi-factor requirements in most security frameworks: the certificate is "something you have" and the PIN is "something you know." `X509_MFA_ENABLED` adds a second software factor on top of CAC, which is rarely needed and can be impractical in classified environments where personal devices aren't permitted. Confirm this is an explicit requirement before enabling it. If you do need to require an additional factor after CAC authentication, use this configuration in the `realmAuthFlows` block from step 2 in place of the values shown there, then recreate and deploy the bundle: ```yaml - path: realmAuthFlows value: X509_AUTH_ENABLED: true X509_MFA_ENABLED: true OTP_ENABLED: true # At least one MFA method must also be enabled WEBAUTHN_ENABLED: false ``` `X509_MFA_ENABLED: true` has no effect unless at least one of `OTP_ENABLED` or `WEBAUTHN_ENABLED` is also enabled. ## Related documentation - [Keycloak: Authentication](https://www.keycloak.org/docs/latest/server_admin/#configuring-authentication) - upstream reference for Keycloak authentication flow configuration - [Configure the CA truststore](/how-to-guides/identity--authorization/configure-truststore/) - Configure the CA certificate bundle required for X.509/CAC authentication. - [Configure user accounts and security policies](/how-to-guides/identity--authorization/configure-user-account-settings/) - Set password complexity and email verification alongside auth flow configuration. ----- # Configure OAuth 2.0 device flow > Configure a UDS Package to use OAuth 2.0 Device Authorization Grant for CLI tools and headless devices that cannot use browser-based redirects. import { Steps } from '@astrojs/starlight/components'; ## What you'll accomplish You'll configure a UDS Package to use the [OAuth 2.0 Device Authorization Grant](https://oauth.net/2/device-flow/) so that CLI tools, automation scripts, or headless devices can obtain tokens without a browser redirect. Once configured, the application can initiate a device code flow and present users with a short code to enter on a separate device. ## Prerequisites - UDS Core deployed - [UDS CLI](https://github.com/defenseunicorns/uds-cli/releases) installed - A UDS `Package` CR for the application that needs device flow ## Before you begin The Device Authorization Grant is designed for applications that either have no browser or cannot handle redirect-based authentication (for example, CLI tools, IoT devices, or CI/CD pipelines where a browser redirect is impractical). This flow creates a **public client** (a client with no secret). Two important constraints apply to public clients in UDS Core: - `standardFlowEnabled` must be explicitly set to `false`. The UDS operator will reject the `Package` CR if it is not. Public clients in UDS Core are restricted to device flow only. - `publicClient: true` is incompatible with `serviceAccountsEnabled: true` > [!NOTE] > If your application needs **both** device flow and a standard browser redirect flow, create two separate SSO clients in the same `Package` CR, one for each flow. They cannot be combined in a single client. ## Steps
By logging in you agree to the following:
- Authorized use only
- Activity may be monitored
## Metadata
| Field | Type | Description |
|---|---|---|
| name | string (enum):
|
## Spec
| Field | Type | Description |
|---|---|---|
| attributes | Attributes | |
| networking | Networking | |
| caBundle | CaBundle | |
| expose | Expose | |
| policy | Policy |
### Attributes
| Field | Type | Description |
|---|---|---|
| clusterName | string | Friendly name to associate with your UDS cluster |
| tags | string[] | Tags to apply to your UDS cluster |
### Networking
| Field | Type | Description |
|---|---|---|
| kubeApiCIDR | string | CIDR range for your Kubernetes control plane nodes. This is a manual override that can be used instead of relying on Pepr to automatically watch and update the values |
| kubeNodeCIDRs | string[] | CIDR(s) for all Kubernetes nodes (not just control plane). Similar reason to above,annual override instead of relying on watch |
### CaBundle
| Field | Type | Description |
|---|---|---|
| certs | string | Contents of user provided CA bundle certificates |
| includeDoDCerts | boolean | Include DoD CA certificates in the bundle |
| includePublicCerts | boolean | Include public CA certificates in the bundle |
### Expose
| Field | Type | Description |
|---|---|---|
| domain | string | Domain all cluster services will be exposed on |
| adminDomain | string | Domain all cluster services on the admin gateway will be exposed on |
### Policy
-----
# Exemptions CR (v1alpha1)
| Field | Type | Description |
|---|---|---|
| allowAllNsExemptions | boolean | Allow UDS Exemption custom resources to live in any namespace (default false) |
# Exemptions
| Field | Type | Description |
|---|---|---|
| spec | Spec |
## Spec
| Field | Type | Description |
|---|---|---|
| exemptions | Exemptions[] | Policy exemptions |
### Exemptions
| Field | Type | Description |
|---|---|---|
| title | string | title to give the exemption for reporting purposes |
| description | string | Reasons as to why this exemption is needed |
| policies | Policies[] (enum):
| A list of policies to override |
| matcher | Matcher | Resource to exempt (Regex allowed for name) |
#### Matcher
-----
# Operator & CRDs
> Index of the UDS Operator and the three custom resources it manages, covering Package, Exemption, and ClusterConfig.
import { Card, CardGrid, LinkCard } from '@astrojs/starlight/components';
The UDS Operator manages the lifecycle of UDS custom resources and their associated Kubernetes resources. It uses [Pepr](https://github.com/defenseunicorns/pepr) to watch for changes and reconcile desired state.
## Custom resource schemas
| Field | Type | Description |
|---|---|---|
| namespace | string | |
| name | string | |
| kind | string (enum):
|
# Packages
| Field | Type | Description |
|---|---|---|
| spec | Spec |
## Spec
| Field | Type | Description |
|---|---|---|
| network | Network | Network configuration for the package |
| monitor | Monitor[] | Create Service or Pod Monitor configurations |
| sso | Sso[] | Create SSO client configurations |
| caBundle | CaBundle | CA bundle configuration for the package |
### Network
| Field | Type | Description |
|---|---|---|
| expose | Expose[] | Expose a service on an Istio Gateway |
| allow | Allow[] | Allow specific traffic (namespace will have a default-deny policy) |
| serviceMesh | ServiceMesh | Service Mesh configuration for the package |
#### Expose
| Field | Type | Description |
|---|---|---|
| description | string | A description of this expose entry, this will become part of the VirtualService name |
| host | string | The hostname to expose the service on |
| gateway | string | The name of the gateway to expose the service on (default: tenant) |
| domain | string | The domain to expose the service on, only valid for additional gateways (not tenant, admin, or passthrough) |
| service | string | The name of the service to expose |
| port | number | The port number to expose |
| selector | Selector for Pods targeted by the selected Services (so the NetworkPolicy can be generated correctly). | |
| targetPort | number | The service targetPort. This defaults to port and is only required if the service port is different from the target port (so the NetworkPolicy can be generated correctly). |
| advancedHTTP | AdvancedHTTP | Advanced HTTP settings for the route. |
| match | Match[] | Match conditions to be satisfied for the rule to be activated. Not permitted when using the passthrough gateway. |
| podLabels | Deprecated: use selector | |
| uptime | Uptime | Uptime monitoring configuration for this exposed service. Presence of checks.paths enables monitoring. |
##### AdvancedHTTP
| Field | Type | Description |
|---|---|---|
| corsPolicy | CorsPolicy | Cross-Origin Resource Sharing policy (CORS). |
| directResponse | DirectResponse | A HTTP rule can either return a direct_response, redirect or forward (default) traffic. |
| headers | Headers | |
| match | Match[] | Match conditions to be satisfied for the rule to be activated. Not permitted when using the passthrough gateway. |
| redirect | Redirect | A HTTP rule can either return a direct_response, redirect or forward (default) traffic. |
| retries | Retries | Retry policy for HTTP requests. |
| rewrite | Rewrite | Rewrite HTTP URIs and Authority headers. |
| timeout | string | Timeout for HTTP requests, default is disabled. |
###### CorsPolicy
| Field | Type | Description |
|---|---|---|
| allowCredentials | boolean | Indicates whether the caller is allowed to send the actual request (not the preflight) using credentials. |
| allowHeaders | string[] | List of HTTP headers that can be used when requesting the resource. |
| allowMethods | string[] | List of HTTP methods allowed to access the resource. |
| allowOrigin | string[] | |
| allowOrigins | AllowOrigins[] | String patterns that match allowed origins. |
| exposeHeaders | string[] | A list of HTTP headers that the browsers are allowed to access. |
| maxAge | string | Specifies how long the results of a preflight request can be cached. |
| unmatchedPreflights | string (enum):
| Indicates whether preflight requests not matching the configured allowed origin shouldn't be forwarded to the upstream. Valid Options: FORWARD, IGNORE |
###### AllowOrigins
| Field | Type | Description |
|---|---|---|
| exact | string | |
| prefix | string | |
| regex | string | [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax). |
###### DirectResponse
| Field | Type | Description |
|---|---|---|
| body | Body | Specifies the content of the response body. |
###### Body
| Field | Type | Description |
|---|---|---|
| bytes | string | response body as base64 encoded bytes. |
| string | string |
###### Request
| Field | Type | Description |
|---|---|---|
| add | ||
| remove | string[] | |
| set |
###### Response
| Field | Type | Description |
|---|---|---|
| add | ||
| remove | string[] | |
| set |
###### Match
| Field | Type | Description |
|---|---|---|
| ignoreUriCase | boolean | Flag to specify whether the URI matching should be case-insensitive. |
| method | Method | HTTP Method values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax). |
| name | string | The name assigned to a match. |
| queryParams | Query parameters for matching. | |
| uri | Uri | URI to match values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax). |
###### Method
| Field | Type | Description |
|---|---|---|
| exact | string | |
| prefix | string | |
| regex | string | [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax). |
###### Uri
| Field | Type | Description |
|---|---|---|
| exact | string | |
| prefix | string | |
| regex | string | [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax). |
###### Redirect
| Field | Type | Description |
|---|---|---|
| authority | string | On a redirect, overwrite the Authority/Host portion of the URL with this value. |
| derivePort | string (enum):
| On a redirect, dynamically set the port: * FROM_PROTOCOL_DEFAULT: automatically set to 80 for HTTP and 443 for HTTPS. Valid Options: FROM_PROTOCOL_DEFAULT, FROM_REQUEST_PORT |
| port | integer | On a redirect, overwrite the port portion of the URL with this value. |
| redirectCode | integer | On a redirect, Specifies the HTTP status code to use in the redirect response. |
| scheme | string | On a redirect, overwrite the scheme portion of the URL with this value. |
| uri | string | On a redirect, overwrite the Path portion of the URL with this value. |
###### Retries
| Field | Type | Description |
|---|---|---|
| attempts | integer | Number of retries to be allowed for a given request. |
| backoff | string | Specifies the minimum duration between retry attempts. |
| perTryTimeout | string | Timeout per attempt for a given request, including the initial call and any retries. |
| retryIgnorePreviousHosts | boolean | Flag to specify whether the retries should ignore previously tried hosts during retry. |
| retryOn | string | Specifies the conditions under which retry takes place. |
| retryRemoteLocalities | boolean | Flag to specify whether the retries should retry to other localities. |
###### Rewrite
| Field | Type | Description |
|---|---|---|
| authority | string | rewrite the Authority/Host header with this value. |
| uri | string | rewrite the path (or the prefix) portion of the URI with this value. |
| uriRegexRewrite | UriRegexRewrite | rewrite the path portion of the URI with the specified regex. |
###### UriRegexRewrite
| Field | Type | Description |
|---|---|---|
| match | string | [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax). |
| rewrite | string | The string that should replace into matching portions of original URI. |
##### Match
| Field | Type | Description |
|---|---|---|
| ignoreUriCase | boolean | Flag to specify whether the URI matching should be case-insensitive. |
| method | Method | HTTP Method values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax). |
| name | string | The name assigned to a match. |
| queryParams | Query parameters for matching. | |
| uri | Uri | URI to match values are case-sensitive and formatted as follows: - `exact: "value"` for exact string match - `prefix: "value"` for prefix-based match - `regex: "value"` for [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax). |
###### Method
| Field | Type | Description |
|---|---|---|
| exact | string | |
| prefix | string | |
| regex | string | [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax). |
###### Uri
| Field | Type | Description |
|---|---|---|
| exact | string | |
| prefix | string | |
| regex | string | [RE2 style regex-based match](https://github.com/google/re2/wiki/Syntax). |
##### Uptime
| Field | Type | Description |
|---|---|---|
| checks | Checks | HTTP probe checks configuration for blackbox-exporter. Defining paths enables uptime monitoring. |
###### Checks
| Field | Type | Description |
|---|---|---|
| paths | string[] | List of paths to check for uptime monitoring, appended to the host. |
#### Allow
| Field | Type | Description |
|---|---|---|
| labels | The labels to apply to the policy | |
| description | string | A description of the policy, this will become part of the policy name |
| direction | string (enum):
| The direction of the traffic |
| selector | Labels to match pods in the namespace to apply the policy to. Leave empty to apply to all pods in the namespace | |
| remoteNamespace | string | The remote namespace to allow traffic to/from. Use * or empty string to allow all namespaces |
| remoteSelector | The remote pod selector labels to allow traffic to/from | |
| remoteGenerated | string (enum):
| Custom generated remote selector for the policy |
| remoteCidr | string | Custom generated policy CIDR |
| remoteHost | string | Remote host to allow traffic out to |
| remoteProtocol | string (enum):
| Protocol used for external connection |
| port | number | The port to allow (protocol is always TCP) |
| ports | number[] | A list of ports to allow (protocol is always TCP) |
| remoteServiceAccount | string | The remote service account to restrict incoming traffic from within the remote namespace. Only valid for Ingress rules. |
| serviceAccount | string | The service account to restrict outgoing traffic from within the package namespace. Only valid for Egress rules. |
| podLabels | Deprecated: use selector | |
| remotePodLabels | Deprecated: use remoteSelector |
#### ServiceMesh
| Field | Type | Description |
|---|---|---|
| mode | string (enum):
| Set the service mesh mode for this package (namespace), defaults to ambient |
### Monitor
| Field | Type | Description |
|---|---|---|
| description | string | A description of this monitor entry, this will become part of the ServiceMonitor name |
| portName | string | The port name for the serviceMonitor |
| targetPort | number | The service targetPort. This is required so the NetworkPolicy can be generated correctly. |
| selector | Selector for Services that expose metrics to scrape | |
| podSelector | Selector for Pods targeted by the selected Services (so the NetworkPolicy can be generated correctly). Defaults to `selector` when not specified. | |
| path | string | HTTP path from which to scrape for metrics, defaults to `/metrics` |
| kind | string (enum):
| The type of monitor to create; PodMonitor or ServiceMonitor. ServiceMonitor is the default. |
| fallbackScrapeProtocol | string (enum):
| The protocol for Prometheus to use if a scrape returns a blank, unparsable, or otherwise invalid Content-Type |
| authorization | Authorization | Authorization settings. |
#### Authorization
| Field | Type | Description |
|---|---|---|
| credentials | Credentials | Selects a key of a Secret in the namespace that contains the credentials for authentication. |
| type | string | Defines the authentication type. The value is case-insensitive. "Basic" is not a supported value. Default: "Bearer" |
##### Credentials
| Field | Type | Description |
|---|---|---|
| key | string | The key of the secret to select from. Must be a valid secret key. |
| name | string | Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names |
| optional | boolean | Specify whether the Secret or its key must be defined |
### Sso
| Field | Type | Description |
|---|---|---|
| enableAuthserviceSelector | Labels to match pods to automatically protect with authservice. Leave empty to disable authservice protection | |
| secretConfig | SecretConfig | Configuration for the generated Kubernetes Secret |
| clientId | string | The client identifier registered with the identity provider. |
| secret | string | The OAuth/OIDC client secret value sent to Keycloak. Typically left blank and auto-generated by Keycloak. Not to be confused with secretConfig, which configures the Kubernetes Secret resource. |
| secretName | string | Deprecated: use secretConfig.name |
| secretLabels | Deprecated: use secretConfig.labels | |
| secretAnnotations | Deprecated: use secretConfig.annotations | |
| secretTemplate | Deprecated: use secretConfig.template | |
| name | string | Specifies display name of the client |
| description | string | A description for the client, can be a URL to an image to replace the login logo |
| baseUrl | string | Default URL to use when the auth server needs to redirect or link back to the client. |
| adminUrl | string | This URL will be used for every binding to both the SP's Assertion Consumer and Single Logout Services. |
| protocol | string (enum):
| Specifies the protocol of the client, either 'openid-connect' or 'saml' |
| attributes | Specifies attributes for the client. | |
| protocolMappers | ProtocolMappers[] | Protocol Mappers to configure on the client |
| rootUrl | string | Root URL appended to relative URLs |
| redirectUris | string[] | Valid URI pattern a browser can redirect to after a successful login. Simple wildcards are allowed such as 'https://unicorns.uds.dev/*' |
| webOrigins | string[] | Allowed CORS origins. To permit all origins of Valid Redirect URIs, add '+'. This does not include the '*' wildcard though. To permit all origins, explicitly add '*'. |
| enabled | boolean | Whether the SSO client is enabled |
| alwaysDisplayInConsole | boolean | Always list this client in the Account UI, even if the user does not have an active session. |
| standardFlowEnabled | boolean | Enables the standard OpenID Connect redirect based authentication with authorization code. |
| serviceAccountsEnabled | boolean | Enables the client credentials grant based authentication via OpenID Connect protocol. |
| publicClient | boolean | Defines whether the client requires a client secret for authentication |
| clientAuthenticatorType | string (enum):
| The client authenticator type |
| defaultClientScopes | string[] | Default client scopes |
| groups | Groups | The client SSO group type |
#### SecretConfig
| Field | Type | Description |
|---|---|---|
| name | string | The name of the secret to store the client secret |
| labels | Additional labels to apply to the generated secret, can be used for pod reloading | |
| annotations | Additional annotations to apply to the generated secret, can be used for pod reloading with a selector | |
| template | A template for the generated secret |
#### ProtocolMappers
| Field | Type | Description |
|---|---|---|
| name | string | Name of the mapper |
| protocol | string (enum):
| Protocol of the mapper |
| protocolMapper | string | Protocol Mapper type of the mapper |
| consentRequired | boolean | Whether user consent is required for this mapper |
| config | Configuration options for the mapper. |
#### Groups
| Field | Type | Description |
|---|---|---|
| anyOf | string[] | List of groups allowed to access the client |
### CaBundle
| Field | Type | Description |
|---|---|---|
| configMap | ConfigMap | ConfigMap configuration for CA bundle |
#### ConfigMap
-----
# UDS Policies
> Complete reference for UDS Core security policies enforced by Pepr admission webhooks, aligned with Kubernetes Pod Security Standards.
UDS Core enforces security policies via [Pepr](https://docs.pepr.dev/) admission webhooks. These policies align with the [Kubernetes Pod Security Standards](https://kubernetes.io/docs/concepts/security/pod-security-standards/) (restricted profile) and add Istio-specific controls to prevent unauthorized overrides to service mesh behavior.
Policy names below link to the upstream standard or reference documentation. For how-to guidance on creating exemptions, see [Create UDS policy exemptions](/how-to-guides/policy--compliance/create-policy-exemptions/). For troubleshooting denied or mutated resources, see the [Policy Violations](/operations/troubleshooting--runbooks/policy-violations/) runbook.
### Exemptions
Exemptions can be specified by an [`Exemption` CR](/reference/operator--crds/exemptions-v1alpha1-cr/).
If a resource is exempted, it will be annotated as `uds-core.pepr.dev/uds-core-policies.| Field | Type | Description |
|---|---|---|
| name | string | The name of the ConfigMap to create (default: uds-trust-bundle) |
| key | string | The key name inside the ConfigMap (default: ca-bundle.pem) |
| labels | Additional labels to apply to the generated ConfigMap (default: {}) | |
| annotations | Additional annotations to apply to the generated ConfigMap (default: {}) |
Severity: **high**
Host namespaces (Process ID namespace, Inter-Process Communication namespace, and network namespace) allow access to shared information and can be used to elevate privileges. Pods should not be allowed access to host namespaces. This policy ensures fields which make use of these host namespaces are set to `false`. | | [Disallow NodePort Services](https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport) | `DisallowNodePortServices` | Subject: **Service**
Severity: **medium**
A Kubernetes Service of type NodePort uses a host port to receive traffic from any source. A NetworkPolicy cannot be used to control traffic to host ports. Although NodePort Services can be useful, their use must be limited to Services with additional upstream security checks. This policy validates that any new Services do not use the `NodePort` type. | | Disallow Privileged [Escalation](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted) and [Pods](https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline) | `DisallowPrivileged` | Subject: **Pod**
Severity: **high**
Privilege escalation, such as via set-user-ID or set-group-ID file mode, should not be allowed. Privileged mode also disables most security mechanisms and must not be allowed. This policy ensures the `allowPrivilegeEscalation` field is set to false and `privileged` is set to false or undefined. | | [Disallow SELinux Options](https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline) | `DisallowSELinuxOptions` | Subject: **Pod**
Severity: **high**
SELinux options can be used to escalate privileges. This policy ensures that the `seLinuxOptions` specified are not used. | | [Drop All Capabilities](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted) | `DropAllCapabilities` | Subject: **Pod**
Severity: **medium**
Capabilities permit privileged actions without giving full root access. All capabilities should be dropped from a Pod, with only those required added back. This policy ensures that all containers explicitly specify `drop: ["ALL"]`. | | [Require Non-root User](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted) | `RequireNonRootUser` | Subject: **Pod**
Severity: **high**
Following the least privilege principle, containers should not be run as root. This policy ensures containers either have `runAsNonRoot` set to `true` or `runAsUser` > 0. | | [Restrict Capabilities](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted) | `RestrictCapabilities` | Subject: **Pod**
Severity: **high**
Capabilities permit privileged actions without giving full root access. Adding capabilities beyond the default set must not be allowed. This policy ensures users cannot add additional capabilities beyond the allowed list to a Pod. | | [Restrict External Names](https://kubernetes.io/docs/concepts/services-networking/service/#externalname) | `RestrictExternalNames` | Subject: **Service**
Severity: **medium**
ExternalName services resolve to a DNS CNAME record, which can be used to redirect traffic to malicious endpoints. An attacker can point back to localhost or internal IP addresses for exploitation. This policy restricts services using external names to a specified list. | | [Restrict hostPath Volume Writable Paths](https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline) | `RestrictHostPathWrite` | Subject: **Pod**
Severity: **medium**
hostPath volumes consume the underlying node's file system. If hostPath volumes are not universally disabled, they should be required to be read-only. Pods which are allowed to mount hostPath volumes in read/write mode pose a security risk even if confined to a "safe" file system on the host and may escape those confines. This policy checks containers for hostPath volumes and validates they are explicitly mounted in readOnly mode. | | [Restrict Host Ports](https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline) | `RestrictHostPorts` | Subject: **Pod**
Severity: **high**
Access to host ports allows potential snooping of network traffic and should not be allowed, or at minimum restricted to a known list. This policy ensures only approved ports are defined in container's `hostPort` field. | | [Restrict Proc Mount](https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline) | `RestrictProcMount` | Subject: **Pod**
Severity: **high**
The default /proc masks are set up to reduce the attack surface. This policy ensures nothing but the specified procMount can be used. By default only "Default" is allowed. | | [Restrict Seccomp](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted) | `RestrictSeccomp` | Subject: **Pod**
Severity: **high**
The SecComp profile should not be explicitly set to Unconfined. This policy, requiring Kubernetes v1.19 or later, ensures that the `seccompProfile.Type` is undefined or restricted to the values in the allowed list. By default, this is `RuntimeDefault` or `Localhost`. | | [Restrict SELinux Type](https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline) | `RestrictSELinuxType` | Subject: **Pod**
Severity: **high**
SELinux options can be used to escalate privileges. This policy ensures that the `seLinuxOptions` type field is undefined or restricted to the allowed list. | | [Restrict Istio User](https://istio.io/latest/docs/ops/deployment/application-requirements/#pod-requirements) | `RestrictIstioUser` | Subject: **Pod**
Severity: **high**
The Istio proxy user/group (1337) should only be used by trusted Istio components. This policy enforces that only Istio waypoint pods, Istio gateways, or Istio proxies (sidecars) can run as UID/GID 1337. This prevents unauthorized pods from running with elevated privileges that could be used to bypass security controls. | | [Restrict Istio Sidecar Configuration Overrides](https://istio.io/latest/docs/reference/config/annotations/) | `RestrictIstioSidecarOverrides` | Subject: **Pod**
Severity: **high**
Certain Istio sidecar configuration annotations can be used to override secure defaults, introducing security risks. This policy prevents the usage of dangerous Istio annotations that can modify secure sidecar configuration, such as custom proxy images or bootstrap configurations.
**Blocked annotations:** `sidecar.istio.io/bootstrapOverride`, `sidecar.istio.io/discoveryAddress`, `sidecar.istio.io/proxyImage`, `proxy.istio.io/config`, `sidecar.istio.io/userVolume`, `sidecar.istio.io/userVolumeMount`. | | [Restrict Istio Traffic Interception Overrides](https://istio.io/latest/docs/reference/config/annotations/) | `RestrictIstioTrafficOverrides` | Subject: **Pod**
Severity: **high**
Istio traffic annotations or labels can be used to modify how traffic is intercepted and routed, which can lead to security bypasses or unintended network paths. This policy prevents the usage of annotations or labels that bypass secure networking controls, including disabling sidecar injection via label or annotation.
**Blocked annotations:** `sidecar.istio.io/inject`, `traffic.sidecar.istio.io/excludeInboundPorts`, `traffic.sidecar.istio.io/excludeInterfaces`, `traffic.sidecar.istio.io/excludeOutboundIPRanges`, `traffic.sidecar.istio.io/excludeOutboundPorts`, `traffic.sidecar.istio.io/includeInboundPorts`, `traffic.sidecar.istio.io/includeOutboundIPRanges`, `traffic.sidecar.istio.io/includeOutboundPorts`, `sidecar.istio.io/interceptionMode`, `traffic.sidecar.istio.io/kubevirtInterfaces`, `istio.io/redirect-virtual-interfaces`.
**Blocked labels:** `sidecar.istio.io/inject`. | | [Restrict Istio Ambient Mesh Overrides](https://istio.io/latest/docs/reference/config/annotations/) | `RestrictIstioAmbientOverrides` | Subject: **Pod**
Severity: **high**
Istio ambient mesh annotations can be used to modify secure mesh behavior. This policy prevents the usage of annotations that bypass secure ambient mesh controls.
**Blocked annotations:** `ambient.istio.io/bypass-inbound-capture`. | | [Restrict Volume Types](https://kubernetes.io/docs/concepts/security/pod-security-standards/#restricted) | `RestrictVolumeTypes` | Subject: **Pod**
Severity: **medium**
Volume types, beyond the core set, should be restricted to limit exposure to potential vulnerabilities in Container Storage Interface (CSI) drivers. In addition, HostPath volumes should not be allowed. Allowed types: `configMap`, `csi`, `downwardAPI`, `emptyDir`, `ephemeral`, `image`, `persistentVolumeClaim`, `projected`, `secret`. | ## Big Bang Kyverno policy comparison UDS Core policies were partially inspired by [Big Bang Kyverno policies](https://repo1.dso.mil/big-bang/product/packages/kyverno-policies) created for the DoD [Big Bang](https://p1.dso.mil/services/big-bang) platform. The table below maps each policy between the two platforms.
Full policy comparison
#### Policies in UDS Core only | UDS Core Policy | Notes | | --- | --- | | `RestrictIstioUser` | Blocks non-Istio pods from running as UID/GID 1337 | | `RestrictIstioSidecarOverrides` | Blocks dangerous sidecar configuration annotations | | `RestrictIstioTrafficOverrides` | Blocks traffic interception bypass annotations/labels | | `RestrictIstioAmbientOverrides` | Blocks ambient mesh bypass annotations | #### Policies in both Big Bang and UDS Core | UDS Core Policy | Big Bang Policy | Notes | | --- | --- | --- | | `DisallowHostNamespaces` | [disallow-host-namespaces](https://repo1.dso.mil/big-bang/product/packages/kyverno-policies/-/blob/main/chart/templates/disallow-host-namespaces.yaml) | | | `DisallowNodePortServices` | [disallow-nodeport-services](https://repo1.dso.mil/big-bang/product/packages/kyverno-policies/-/blob/main/chart/templates/disallow-nodeport-services.yaml) | | | `DisallowPrivileged` | [disallow-privilege-escalation](https://repo1.dso.mil/big-bang/product/packages/kyverno-policies/-/blob/main/chart/templates/disallow-privilege-escalation.yaml) | Combined with privileged containers check | | `DisallowPrivileged` | [disallow-privileged-containers](https://repo1.dso.mil/big-bang/product/packages/kyverno-policies/-/blob/main/chart/templates/disallow-privileged-containers.yaml) | Combined with privilege escalation check | | `DisallowSELinuxOptions` | [disallow-selinux-options](https://repo1.dso.mil/big-bang/product/packages/kyverno-policies/-/blob/main/chart/templates/disallow-selinux-options.yaml) | | | `DropAllCapabilities` | [require-drop-all-capabilities](https://repo1.dso.mil/big-bang/product/packages/kyverno-policies/-/blob/main/chart/templates/require-drop-all-capabilities.yaml) | Enforced as both mutation and validation | | `RequireNonRootUser` | [require-non-root-user](https://repo1.dso.mil/big-bang/product/packages/kyverno-policies/-/blob/main/chart/templates/require-non-root-user.yaml) | Enforced as both mutation and validation | | `RestrictCapabilities` | [restrict-capabilities](https://repo1.dso.mil/big-bang/product/packages/kyverno-policies/-/blob/main/chart/templates/restrict-capabilities.yaml) | | | `RestrictExternalNames` | [restrict-external-names](https://repo1.dso.mil/big-bang/product/packages/kyverno-policies/-/blob/main/chart/templates/restrict-external-names.yaml) | | | `RestrictHostPathWrite` | [restrict-host-path-write](https://repo1.dso.mil/big-bang/product/packages/kyverno-policies/-/blob/main/chart/templates/restrict-host-path-write.yaml) | | | `RestrictHostPorts` | [restrict-host-ports](https://repo1.dso.mil/big-bang/product/packages/kyverno-policies/-/blob/main/chart/templates/restrict-host-ports.yaml) | | | `RestrictProcMount` | [restrict-proc-mount](https://repo1.dso.mil/big-bang/product/packages/kyverno-policies/-/blob/main/chart/templates/restrict-proc-mount.yaml) | | | `RestrictSeccomp` | [restrict-seccomp](https://repo1.dso.mil/big-bang/product/packages/kyverno-policies/-/blob/main/chart/templates/restrict-seccomp.yaml) | | | `RestrictSELinuxType` | [restrict-selinux-type](https://repo1.dso.mil/big-bang/product/packages/kyverno-policies/-/blob/main/chart/templates/restrict-selinux-type.yaml) | | | `RestrictVolumeTypes` | [restrict-volume-types](https://repo1.dso.mil/big-bang/product/packages/kyverno-policies/-/blob/main/chart/templates/restrict-volume-types.yaml) | | #### Policies in Big Bang only The following Big Bang Kyverno policies are not yet implemented in UDS Core and will be evaluated for future inclusion. | Big Bang Policy | Notes | | --- | --- | | [restrict-sysctls](https://repo1.dso.mil/big-bang/product/packages/kyverno-policies/-/blob/main/chart/templates/restrict-sysctls.yaml) | [PSS Baseline](https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline). | | [restrict-apparmor](https://repo1.dso.mil/big-bang/product/packages/kyverno-policies/-/blob/main/chart/templates/restrict-apparmor.yaml) | [PSS Baseline](https://kubernetes.io/docs/concepts/security/pod-security-standards/#baseline). | | [restrict-host-path-mount-pv](https://repo1.dso.mil/big-bang/product/packages/kyverno-policies/-/blob/main/chart/templates/restrict-host-path-mount-pv.yaml) | | | [restrict-host-path-mount](https://repo1.dso.mil/big-bang/product/packages/kyverno-policies/-/blob/main/chart/templates/restrict-host-path-mount.yaml) | | | [restrict-image-registries](https://repo1.dso.mil/big-bang/product/packages/kyverno-policies/-/blob/main/chart/templates/restrict-image-registries.yaml) | In UDS, Zarf handles registry control at the packaging layer. | | [require-image-signature](https://repo1.dso.mil/big-bang/product/packages/kyverno-policies/-/blob/main/chart/templates/require-image-signature.yaml) | Disabled in Big Bang by default. | | [restrict-external-ips](https://repo1.dso.mil/big-bang/product/packages/kyverno-policies/-/blob/main/chart/templates/restrict-external-ips.yaml) | | | [require-non-root-group](https://repo1.dso.mil/big-bang/product/packages/kyverno-policies/-/blob/main/chart/templates/require-non-root-group.yaml) | Partially mitigated; `RequireNonRootUser` mutation defaults `runAsGroup` to `1000`. | | [disallow-auto-mount-service-account-token](https://repo1.dso.mil/big-bang/product/packages/kyverno-policies/-/blob/main/chart/templates/disallow-auto-mount-service-account-token.yaml) | Audit-only in Big Bang. |**Migration:** Use `allow.selector`, `allow.remoteSelector`, `expose.selector`, `expose.advancedHTTP.match` instead | Package `v1beta1` | | `sso.secretName`, `sso.secretLabels`, `sso.secretAnnotations`, `sso.secretTemplate` | 0.60.0 ([#2264](https://github.com/defenseunicorns/uds-core/pull/2264)) | **Reason:** Simplified field structure.
**Migration:** Use `sso.secretConfig.name`, `.labels`, `.annotations`, `.template` instead | Package `v1beta1` | ## Recently removed This section lists features that were removed in recent major releases for historical reference. | Feature | Deprecated In | Removed In | Migration | | ----------------------------------------------------------- | ------------- | ---------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Keycloak `x509LookupProvider`, `mtlsClientCert` helm values | 0.47.0 | 1.0.0 | Use `thirdPartyIntegration.tls.tlsCertificateHeader` and `thirdPartyIntegration.tls.tlsCertificateFormat`; remove any existing overrides utilizing the removed values | | `CA_CERT` Zarf variable | 0.58.0 | 1.0.0 | Use `CA_BUNDLE_CERTS` instead | | Keycloak `fips` helm value | 0.43.0 | 1.0.0 | FIPS mode is now always enabled; remove any `fips` overrides from your values including `fipsAllowWeakPasswords`. See [Enable FIPS Mode](https://github.com/defenseunicorns/uds-core/blob/main/docs/how-to-guides/identity--authorization/enable-fips-mode.mdx) for password handling guidance. | | `operator.KUBEAPI_CIDR`, `operator.KUBENODE_CIDRS` | 0.48.0 | 1.0.0 | Use `cluster.networking.kubeApiCIDR` and `cluster.networking.kubeNodeCIDRs` instead | ----- # Overview > Index of UDS Core project policies covering versioning, deprecations, and security vulnerability disclosure. import { Card, CardGrid, LinkCard } from '@astrojs/starlight/components'; Project policies that govern how UDS Core is versioned, released, deprecated, and handles vulnerability disclosure.
uds.
## uds
CLI for UDS Bundles
```
uds COMMAND [flags]
```
### Options
```
-a, --architecture string Architecture for UDS bundles and Zarf packages
-h, --help help for uds
--insecure Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
-l, --log-level string Log level when running UDS-CLI. Valid options are: warn, info, debug, trace (default "info")
--no-color Disable color output
--no-log-file Disable log file creation
--no-progress Disable fancy UI progress bars, spinners, logos, etc
--oci-concurrency int Number of concurrent layer operations to perform when interacting with a remote bundle. (default 3)
--skip-signature-validation Skip signature validation for packages
--tmpdir string Specify the temporary directory to use for intermediate files
--uds-cache string Specify the location of the UDS cache directory (default "~/.uds-cache")
```
### SEE ALSO
* [uds completion](/reference/commands/uds_completion/) - Generate the autocompletion script for the specified shell
* [uds create](/reference/commands/uds_create/) - Create a bundle from a given directory or the current directory
* [uds deploy](/reference/commands/uds_deploy/) - Deploy a bundle from a local tarball or oci:// URL
* [uds dev](/reference/commands/uds_dev/) - [beta] Commands useful for developing bundles
* [uds inspect](/reference/commands/uds_inspect/) - Display the metadata of a bundle
* [uds list](/reference/commands/uds_list/) - [alpha] List deployed bundles in the cluster
* [uds logs](/reference/commands/uds_logs/) - View most recent UDS CLI logs
* [uds monitor](/reference/commands/uds_monitor/) - Monitor a UDS Cluster
* [uds publish](/reference/commands/uds_publish/) - Publish a bundle from the local file system to a remote registry
* [uds pull](/reference/commands/uds_pull/) - Pull a bundle from a remote registry and save to the local file system
* [uds remove](/reference/commands/uds_remove/) - Remove a bundle that has been deployed already
* [uds run](/reference/commands/uds_run/) - Run a task using maru-runner
* [uds version](/reference/commands/uds_version/) - Shows the version of the running UDS-CLI binary
-----
# uds completion
> UDS CLI command reference for uds completion.
## uds completion
Generate the autocompletion script for the specified shell
### Synopsis
Generate the autocompletion script for uds for the specified shell.
See each sub-command's help for details on how to use the generated script.
### Options
```
-h, --help help for completion
```
### Options inherited from parent commands
```
-a, --architecture string Architecture for UDS bundles and Zarf packages
--insecure Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
-l, --log-level string Log level when running UDS-CLI. Valid options are: warn, info, debug, trace (default "info")
--no-color Disable color output
--no-log-file Disable log file creation
--no-progress Disable fancy UI progress bars, spinners, logos, etc
--oci-concurrency int Number of concurrent layer operations to perform when interacting with a remote bundle. (default 3)
--skip-signature-validation Skip signature validation for packages
--tmpdir string Specify the temporary directory to use for intermediate files
--uds-cache string Specify the location of the UDS cache directory (default "~/.uds-cache")
```
### SEE ALSO
* [uds](/reference/commands/uds/) - CLI for UDS Bundles
* [uds completion bash](/reference/commands/uds_completion_bash/) - Generate the autocompletion script for bash
* [uds completion fish](/reference/commands/uds_completion_fish/) - Generate the autocompletion script for fish
* [uds completion zsh](/reference/commands/uds_completion_zsh/) - Generate the autocompletion script for zsh
-----
# uds completion bash
> UDS CLI command reference for uds completion bash.
## uds completion bash
Generate the autocompletion script for bash
### Synopsis
Generate the autocompletion script for the bash shell.
This script depends on the 'bash-completion' package.
If it is not installed already, you can install it via your OS's package manager.
To load completions in your current shell session:
source <(uds completion bash)
To load completions for every new session, execute once:
#### Linux:
uds completion bash > /etc/bash_completion.d/uds
#### macOS:
uds completion bash > $(brew --prefix)/etc/bash_completion.d/uds
You will need to start a new shell for this setup to take effect.
```
uds completion bash
```
### Options
```
-h, --help help for bash
--no-descriptions disable completion descriptions
```
### Options inherited from parent commands
```
-a, --architecture string Architecture for UDS bundles and Zarf packages
--insecure Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
-l, --log-level string Log level when running UDS-CLI. Valid options are: warn, info, debug, trace (default "info")
--no-color Disable color output
--no-log-file Disable log file creation
--no-progress Disable fancy UI progress bars, spinners, logos, etc
--oci-concurrency int Number of concurrent layer operations to perform when interacting with a remote bundle. (default 3)
--skip-signature-validation Skip signature validation for packages
--tmpdir string Specify the temporary directory to use for intermediate files
--uds-cache string Specify the location of the UDS cache directory (default "~/.uds-cache")
```
### SEE ALSO
* [uds completion](/reference/commands/uds_completion/) - Generate the autocompletion script for the specified shell
-----
# uds completion fish
> UDS CLI command reference for uds completion fish.
## uds completion fish
Generate the autocompletion script for fish
### Synopsis
Generate the autocompletion script for the fish shell.
To load completions in your current shell session:
uds completion fish | source
To load completions for every new session, execute once:
uds completion fish > ~/.config/fish/completions/uds.fish
You will need to start a new shell for this setup to take effect.
```
uds completion fish [flags]
```
### Options
```
-h, --help help for fish
--no-descriptions disable completion descriptions
```
### Options inherited from parent commands
```
-a, --architecture string Architecture for UDS bundles and Zarf packages
--insecure Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
-l, --log-level string Log level when running UDS-CLI. Valid options are: warn, info, debug, trace (default "info")
--no-color Disable color output
--no-log-file Disable log file creation
--no-progress Disable fancy UI progress bars, spinners, logos, etc
--oci-concurrency int Number of concurrent layer operations to perform when interacting with a remote bundle. (default 3)
--skip-signature-validation Skip signature validation for packages
--tmpdir string Specify the temporary directory to use for intermediate files
--uds-cache string Specify the location of the UDS cache directory (default "~/.uds-cache")
```
### SEE ALSO
* [uds completion](/reference/commands/uds_completion/) - Generate the autocompletion script for the specified shell
-----
# uds completion zsh
> UDS CLI command reference for uds completion zsh.
## uds completion zsh
Generate the autocompletion script for zsh
### Synopsis
Generate the autocompletion script for the zsh shell.
If shell completion is not already enabled in your environment you will need
to enable it. You can execute the following once:
echo "autoload -U compinit; compinit" >> ~/.zshrc
To load completions in your current shell session:
source <(uds completion zsh)
To load completions for every new session, execute once:
#### Linux:
uds completion zsh > "${fpath[1]}/_uds"
#### macOS:
uds completion zsh > $(brew --prefix)/share/zsh/site-functions/_uds
You will need to start a new shell for this setup to take effect.
```
uds completion zsh [flags]
```
### Options
```
-h, --help help for zsh
--no-descriptions disable completion descriptions
```
### Options inherited from parent commands
```
-a, --architecture string Architecture for UDS bundles and Zarf packages
--insecure Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
-l, --log-level string Log level when running UDS-CLI. Valid options are: warn, info, debug, trace (default "info")
--no-color Disable color output
--no-log-file Disable log file creation
--no-progress Disable fancy UI progress bars, spinners, logos, etc
--oci-concurrency int Number of concurrent layer operations to perform when interacting with a remote bundle. (default 3)
--skip-signature-validation Skip signature validation for packages
--tmpdir string Specify the temporary directory to use for intermediate files
--uds-cache string Specify the location of the UDS cache directory (default "~/.uds-cache")
```
### SEE ALSO
* [uds completion](/reference/commands/uds_completion/) - Generate the autocompletion script for the specified shell
-----
# uds create
> UDS CLI command reference for uds create.
## uds create
Create a bundle from a given directory or the current directory
```
uds create [DIRECTORY] [flags]
```
### Options
```
-c, --confirm Confirm bundle creation without prompting
-h, --help help for create
-n, --name string Specify the name of the bundle
-o, --output string Specify the output directory or oci:// URL for the created bundle
-k, --signing-key string Path to private key file for signing bundles
-p, --signing-key-password string Password to the private key file used for signing bundles
-v, --version string Specify the version of the bundle
```
### Options inherited from parent commands
```
-a, --architecture string Architecture for UDS bundles and Zarf packages
--insecure Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
-l, --log-level string Log level when running UDS-CLI. Valid options are: warn, info, debug, trace (default "info")
--no-color Disable color output
--no-log-file Disable log file creation
--no-progress Disable fancy UI progress bars, spinners, logos, etc
--oci-concurrency int Number of concurrent layer operations to perform when interacting with a remote bundle. (default 3)
--skip-signature-validation Skip signature validation for packages
--tmpdir string Specify the temporary directory to use for intermediate files
--uds-cache string Specify the location of the UDS cache directory (default "~/.uds-cache")
```
### SEE ALSO
* [uds](/reference/commands/uds/) - CLI for UDS Bundles
-----
# uds deploy
> UDS CLI command reference for uds deploy.
## uds deploy
Deploy a bundle from a local tarball or oci:// URL
```
uds deploy [BUNDLE_TARBALL|OCI_REF] [flags]
```
### Options
```
-c, --confirm Confirms bundle deployment without prompting. ONLY use with bundles you trust
--force-conflicts Force Helm to take ownership of conflicting fields during Server-Side Apply operations. Use when external tools (kubectl, HPAs, etc.) have modified resources. Defaults to false.
-h, --help help for deploy
-p, --packages stringArray Specify which zarf packages you would like to deploy from the bundle. By default all zarf packages in the bundle are deployed.
-r, --resume Only deploys packages from the bundle which haven't already been deployed
--retries int Specify the number of retries for package deployments (applies to all pkgs in a bundle) (default 3)
--set stringToString Specify deployment variables to set on the command line (KEY=value) (default [])
```
### Options inherited from parent commands
```
-a, --architecture string Architecture for UDS bundles and Zarf packages
--insecure Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
-l, --log-level string Log level when running UDS-CLI. Valid options are: warn, info, debug, trace (default "info")
--no-color Disable color output
--no-log-file Disable log file creation
--no-progress Disable fancy UI progress bars, spinners, logos, etc
--oci-concurrency int Number of concurrent layer operations to perform when interacting with a remote bundle. (default 3)
--skip-signature-validation Skip signature validation for packages
--tmpdir string Specify the temporary directory to use for intermediate files
--uds-cache string Specify the location of the UDS cache directory (default "~/.uds-cache")
```
### SEE ALSO
* [uds](/reference/commands/uds/) - CLI for UDS Bundles
-----
# uds dev
> UDS CLI command reference for uds dev.
## uds dev
[beta] Commands useful for developing bundles
### Options
```
-h, --help help for dev
```
### Options inherited from parent commands
```
-a, --architecture string Architecture for UDS bundles and Zarf packages
--insecure Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
-l, --log-level string Log level when running UDS-CLI. Valid options are: warn, info, debug, trace (default "info")
--no-color Disable color output
--no-log-file Disable log file creation
--no-progress Disable fancy UI progress bars, spinners, logos, etc
--oci-concurrency int Number of concurrent layer operations to perform when interacting with a remote bundle. (default 3)
--skip-signature-validation Skip signature validation for packages
--tmpdir string Specify the temporary directory to use for intermediate files
--uds-cache string Specify the location of the UDS cache directory (default "~/.uds-cache")
```
### SEE ALSO
* [uds](/reference/commands/uds/) - CLI for UDS Bundles
* [uds dev deploy](/reference/commands/uds_dev_deploy/) - [beta] Creates and deploys a UDS bundle in dev mode
-----
# uds dev deploy
> UDS CLI command reference for uds dev deploy.
## uds dev deploy
[beta] Creates and deploys a UDS bundle in dev mode
### Synopsis
[beta] Creates and deploys a UDS bundle from a given directory or OCI repository in dev mode, setting package options like YOLO mode for faster iteration.
```
uds dev deploy [BUNDLE_DIR|OCI_REF] [flags]
```
### Options
```
-f, --flavor string [beta] Specify which zarf package flavor you want to use.
--force-conflicts Force Helm to take ownership of conflicting fields during Server-Side Apply operations. Use when external tools (kubectl, HPAs, etc.) have modified resources. Defaults to false.
--force-create [beta] For local bundles with local packages, specify whether to create a zarf package even if it already exists.
-h, --help help for deploy
-p, --packages stringArray Specify which zarf packages you would like to deploy from the bundle. By default all zarf packages in the bundle are deployed.
-r, --ref stringToString Specify which zarf package ref you want to deploy. By default the ref set in the bundle yaml is used. (default [])
--set stringToString Specify deployment variables to set on the command line (KEY=value) (default [])
```
### Options inherited from parent commands
```
-a, --architecture string Architecture for UDS bundles and Zarf packages
--insecure Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
-l, --log-level string Log level when running UDS-CLI. Valid options are: warn, info, debug, trace (default "info")
--no-color Disable color output
--no-log-file Disable log file creation
--no-progress Disable fancy UI progress bars, spinners, logos, etc
--oci-concurrency int Number of concurrent layer operations to perform when interacting with a remote bundle. (default 3)
--skip-signature-validation Skip signature validation for packages
--tmpdir string Specify the temporary directory to use for intermediate files
--uds-cache string Specify the location of the UDS cache directory (default "~/.uds-cache")
```
### SEE ALSO
* [uds dev](/reference/commands/uds_dev/) - [beta] Commands useful for developing bundles
-----
# uds inspect
> UDS CLI command reference for uds inspect.
## uds inspect
Display the metadata of a bundle
```
uds inspect [BUNDLE_TARBALL|OCI_REF|BUNDLE_YAML_FILE] [flags]
```
### Options
```
-e, --extract Create a folder of SBOMs contained in the bundle
-h, --help help for inspect
-k, --key string Path to a public key file that will be used to validate a signed bundle
-i, --list-images Derive images from a uds-bundle.yaml file and list them
-v, --list-variables List all configurable variables in a bundle (including zarf variables)
-s, --sbom Create a tarball of SBOMs contained in the bundle
```
### Options inherited from parent commands
```
-a, --architecture string Architecture for UDS bundles and Zarf packages
--insecure Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
-l, --log-level string Log level when running UDS-CLI. Valid options are: warn, info, debug, trace (default "info")
--no-color Disable color output
--no-log-file Disable log file creation
--no-progress Disable fancy UI progress bars, spinners, logos, etc
--oci-concurrency int Number of concurrent layer operations to perform when interacting with a remote bundle. (default 3)
--skip-signature-validation Skip signature validation for packages
--tmpdir string Specify the temporary directory to use for intermediate files
--uds-cache string Specify the location of the UDS cache directory (default "~/.uds-cache")
```
### SEE ALSO
* [uds](/reference/commands/uds/) - CLI for UDS Bundles
-----
# uds list
> UDS CLI command reference for uds list.
## uds list
[alpha] List deployed bundles in the cluster
```
uds list [flags]
```
### Options
```
-h, --help help for list
```
### Options inherited from parent commands
```
-a, --architecture string Architecture for UDS bundles and Zarf packages
--insecure Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
-l, --log-level string Log level when running UDS-CLI. Valid options are: warn, info, debug, trace (default "info")
--no-color Disable color output
--no-log-file Disable log file creation
--no-progress Disable fancy UI progress bars, spinners, logos, etc
--oci-concurrency int Number of concurrent layer operations to perform when interacting with a remote bundle. (default 3)
--skip-signature-validation Skip signature validation for packages
--tmpdir string Specify the temporary directory to use for intermediate files
--uds-cache string Specify the location of the UDS cache directory (default "~/.uds-cache")
```
### SEE ALSO
* [uds](/reference/commands/uds/) - CLI for UDS Bundles
-----
# uds logs
> UDS CLI command reference for uds logs.
## uds logs
View most recent UDS CLI logs
```
uds logs [flags]
```
### Options
```
-h, --help help for logs
```
### Options inherited from parent commands
```
-a, --architecture string Architecture for UDS bundles and Zarf packages
--insecure Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
-l, --log-level string Log level when running UDS-CLI. Valid options are: warn, info, debug, trace (default "info")
--no-color Disable color output
--no-log-file Disable log file creation
--no-progress Disable fancy UI progress bars, spinners, logos, etc
--oci-concurrency int Number of concurrent layer operations to perform when interacting with a remote bundle. (default 3)
--skip-signature-validation Skip signature validation for packages
--tmpdir string Specify the temporary directory to use for intermediate files
--uds-cache string Specify the location of the UDS cache directory (default "~/.uds-cache")
```
### SEE ALSO
* [uds](/reference/commands/uds/) - CLI for UDS Bundles
-----
# uds monitor
> UDS CLI command reference for uds monitor.
## uds monitor
Monitor a UDS Cluster
### Synopsis
Tools for monitoring a UDS Cluster and connecting to the UDS Engine for advanced troubleshooting
### Options
```
-h, --help help for monitor
-n, --namespace string Limit monitoring to a specific namespace
```
### Options inherited from parent commands
```
-a, --architecture string Architecture for UDS bundles and Zarf packages
--insecure Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
-l, --log-level string Log level when running UDS-CLI. Valid options are: warn, info, debug, trace (default "info")
--no-color Disable color output
--no-log-file Disable log file creation
--no-progress Disable fancy UI progress bars, spinners, logos, etc
--oci-concurrency int Number of concurrent layer operations to perform when interacting with a remote bundle. (default 3)
--skip-signature-validation Skip signature validation for packages
--tmpdir string Specify the temporary directory to use for intermediate files
--uds-cache string Specify the location of the UDS cache directory (default "~/.uds-cache")
```
### SEE ALSO
* [uds](/reference/commands/uds/) - CLI for UDS Bundles
* [uds monitor pepr](/reference/commands/uds_monitor_pepr/) - Observe Pepr operations in a UDS Cluster
-----
# uds monitor pepr
> UDS CLI command reference for uds monitor pepr.
## uds monitor pepr
Observe Pepr operations in a UDS Cluster
### Synopsis
View UDS Policy enforcements, UDS Operator events and additional Pepr operations
```
uds monitor pepr [policies | operator | allowed | denied | failed | mutated] [flags]
```
### Examples
```
# Aggregates all admission and operator logs into a single stream
uds monitor pepr
# Stream UDS Operator actions (Package processing, status updates, and errors)
uds monitor pepr operator
# Stream UDS Policy logs (Allow, Deny, Mutate)
uds monitor pepr policies
# Stream UDS Policy allow logs
uds monitor pepr allowed
# Stream UDS Policy deny logs
uds monitor pepr denied
# Stream UDS Policy mutation logs
uds monitor pepr mutated
# Stream UDS Policy deny logs and UDS Operator error logs
uds monitor pepr failed
```
### Options
```
-f, --follow Continuously stream Pepr logs
-h, --help help for pepr
--json Return the raw JSON output of the logs
--since duration Only return logs newer than a relative duration like 5s, 2m, or 3h. Defaults to all logs.
-t, --timestamps Show timestamps in Pepr logs
```
### Options inherited from parent commands
```
-a, --architecture string Architecture for UDS bundles and Zarf packages
--insecure Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
-l, --log-level string Log level when running UDS-CLI. Valid options are: warn, info, debug, trace (default "info")
-n, --namespace string Limit monitoring to a specific namespace
--no-color Disable color output
--no-log-file Disable log file creation
--no-progress Disable fancy UI progress bars, spinners, logos, etc
--oci-concurrency int Number of concurrent layer operations to perform when interacting with a remote bundle. (default 3)
--skip-signature-validation Skip signature validation for packages
--tmpdir string Specify the temporary directory to use for intermediate files
--uds-cache string Specify the location of the UDS cache directory (default "~/.uds-cache")
```
### SEE ALSO
* [uds monitor](/reference/commands/uds_monitor/) - Monitor a UDS Cluster
-----
# uds publish
> UDS CLI command reference for uds publish.
## uds publish
Publish a bundle from the local file system to a remote registry
```
uds publish [BUNDLE_TARBALL] [OCI_REF] [flags]
```
### Options
```
-h, --help help for publish
-v, --version string [Deprecated] Specify the version of the bundle to be published. This flag will be removed in a future version. Users should use the --version flag during creation to override the version defined in uds-bundle.yaml
```
### Options inherited from parent commands
```
-a, --architecture string Architecture for UDS bundles and Zarf packages
--insecure Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
-l, --log-level string Log level when running UDS-CLI. Valid options are: warn, info, debug, trace (default "info")
--no-color Disable color output
--no-log-file Disable log file creation
--no-progress Disable fancy UI progress bars, spinners, logos, etc
--oci-concurrency int Number of concurrent layer operations to perform when interacting with a remote bundle. (default 3)
--skip-signature-validation Skip signature validation for packages
--tmpdir string Specify the temporary directory to use for intermediate files
--uds-cache string Specify the location of the UDS cache directory (default "~/.uds-cache")
```
### SEE ALSO
* [uds](/reference/commands/uds/) - CLI for UDS Bundles
-----
# uds pull
> UDS CLI command reference for uds pull.
## uds pull
Pull a bundle from a remote registry and save to the local file system
```
uds pull [OCI_REF] [flags]
```
### Options
```
-h, --help help for pull
-k, --key string Path to a public key file that will be used to validate a signed bundle
-o, --output string Specify the output directory for the pulled bundle
```
### Options inherited from parent commands
```
-a, --architecture string Architecture for UDS bundles and Zarf packages
--insecure Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
-l, --log-level string Log level when running UDS-CLI. Valid options are: warn, info, debug, trace (default "info")
--no-color Disable color output
--no-log-file Disable log file creation
--no-progress Disable fancy UI progress bars, spinners, logos, etc
--oci-concurrency int Number of concurrent layer operations to perform when interacting with a remote bundle. (default 3)
--skip-signature-validation Skip signature validation for packages
--tmpdir string Specify the temporary directory to use for intermediate files
--uds-cache string Specify the location of the UDS cache directory (default "~/.uds-cache")
```
### SEE ALSO
* [uds](/reference/commands/uds/) - CLI for UDS Bundles
-----
# uds remove
> UDS CLI command reference for uds remove.
## uds remove
Remove a bundle that has been deployed already
```
uds remove [BUNDLE_TARBALL|OCI_REF] [flags]
```
### Options
```
-c, --confirm REQUIRED. Confirm the removal action to prevent accidental deletions
-h, --help help for remove
-p, --packages stringArray Specify which zarf packages you would like to remove from the bundle. By default all zarf packages in the bundle are removed.
```
### Options inherited from parent commands
```
-a, --architecture string Architecture for UDS bundles and Zarf packages
--insecure Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
-l, --log-level string Log level when running UDS-CLI. Valid options are: warn, info, debug, trace (default "info")
--no-color Disable color output
--no-log-file Disable log file creation
--no-progress Disable fancy UI progress bars, spinners, logos, etc
--oci-concurrency int Number of concurrent layer operations to perform when interacting with a remote bundle. (default 3)
--skip-signature-validation Skip signature validation for packages
--tmpdir string Specify the temporary directory to use for intermediate files
--uds-cache string Specify the location of the UDS cache directory (default "~/.uds-cache")
```
### SEE ALSO
* [uds](/reference/commands/uds/) - CLI for UDS Bundles
-----
# uds run
> UDS CLI command reference for uds run.
## uds run
Run a task using maru-runner
```
uds run [flags]
```
### Options
```
-h, --help help for run
```
### Options inherited from parent commands
```
-a, --architecture string Architecture for UDS bundles and Zarf packages
--insecure Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
-l, --log-level string Log level when running UDS-CLI. Valid options are: warn, info, debug, trace (default "info")
--no-color Disable color output
--no-log-file Disable log file creation
--no-progress Disable fancy UI progress bars, spinners, logos, etc
--oci-concurrency int Number of concurrent layer operations to perform when interacting with a remote bundle. (default 3)
--skip-signature-validation Skip signature validation for packages
--tmpdir string Specify the temporary directory to use for intermediate files
--uds-cache string Specify the location of the UDS cache directory (default "~/.uds-cache")
```
### SEE ALSO
* [uds](/reference/commands/uds/) - CLI for UDS Bundles
-----
# uds version
> UDS CLI command reference for uds version.
## uds version
Shows the version of the running UDS-CLI binary
### Synopsis
Displays the version of the UDS-CLI release that the current binary was built from.
```
uds version [flags]
```
### Options
```
-h, --help help for version
```
### Options inherited from parent commands
```
-a, --architecture string Architecture for UDS bundles and Zarf packages
--insecure Allow access to insecure registries and disable other recommended security enforcements such as package checksum and signature validation. This flag should only be used if you have a specific reason and accept the reduced security posture.
-l, --log-level string Log level when running UDS-CLI. Valid options are: warn, info, debug, trace (default "info")
--no-color Disable color output
--no-log-file Disable log file creation
--no-progress Disable fancy UI progress bars, spinners, logos, etc
--oci-concurrency int Number of concurrent layer operations to perform when interacting with a remote bundle. (default 3)
--skip-signature-validation Skip signature validation for packages
--tmpdir string Specify the temporary directory to use for intermediate files
--uds-cache string Specify the location of the UDS cache directory (default "~/.uds-cache")
```
### SEE ALSO
* [uds](/reference/commands/uds/) - CLI for UDS Bundles
-----
# Reference
> Index of UDS CLI reference material covering command syntax, configuration schemas, and IDE setup for validation and autocompletion.
import { CardGrid, LinkCard } from '@astrojs/starlight/components';
Authoritative details for UDS CLI configuration surfaces, command syntax, and schema validation. Use this section when you need exact flag behavior, field-level schema details, or IDE setup instructions.
Get Involved
-----
# Page Not Found
The page you're looking for doesn't exist or may have moved.
Use the sidebar to navigate, or return to the product home.
-----
# UDS Core
> Index of UDS Core documentation, a foundational runtime layer for secure Kubernetes deployments covering installation, concepts, configuration guides, reference, and operations.
import { Card, CardGrid, LinkCard } from '@astrojs/starlight/components';
| Setting | Default | Override Path |
|---|---|---|
| PVC size | 50Gi | `prometheus.prometheusSpec.storageSpec.volumeClaimTemplate.spec.resources.requests.storage` |
| Time-based retention | 10d | `prometheus.prometheusSpec.retention` |
| Size-based retention | Disabled | `prometheus.prometheusSpec.retentionSize` |
```yaml title="uds-bundle.yaml"
packages:
- name: core
repository: registry.defenseunicorns.com/public/core
ref: x.x.x-upstream
overrides:
kube-prometheus-stack:
kube-prometheus-stack:
values:
# Increase PVC size for longer retention
- path: prometheus.prometheusSpec.storageSpec.volumeClaimTemplate.spec.resources.requests.storage
value: "100Gi"
# Keep data for 30 days
- path: prometheus.prometheusSpec.retention
value: "30d"
# Safety cap: drop oldest data if disk usage exceeds this limit
- path: prometheus.prometheusSpec.retentionSize
value: "90GB"
```
> [!NOTE]
> If you are resizing storage on an existing deployment, follow the [Resize Prometheus PVCs](/operations/troubleshooting-and-runbooks/resize-prometheus-pvc/) runbook, because PVC resizing requires additional steps beyond updating your bundle.
To estimate disk needs, use the upstream formula from the [Prometheus storage documentation](https://prometheus.io/docs/prometheus/latest/storage/):
```text
needed_disk_space = retention_time_seconds × ingested_samples_per_second × bytes_per_sample
```
In practice, `bytes_per_sample` averages 1–2 bytes after compression. Start with the defaults, then query `prometheus_tsdb_storage_blocks_bytes` in Grafana to observe actual usage and project growth before resizing.
> [!TIP]
> Use the `prometheus_tsdb_storage_blocks_bytes` metric in Grafana to monitor actual disk usage over time. This is the most reliable way to right-size your PVC rather than guessing upfront.
> [!CAUTION]
> If stored data exceeds PVC capacity, Prometheus will crash-loop. Always provision PVC size with headroom above your expected retention volume. `retentionSize` acts as a safety cap: Prometheus drops the oldest blocks when this limit is reached.
4. **Create and deploy your bundle**
```bash
uds create 2. **Authentication** → **Flows** → **UDS Authentication** → set the **MFA** sub-flow to **Required**
3. Inside the **MFA** sub-flow, set **WebAuthn Passwordless Authenticator** to **Required** | ### Problem: X.509/CAC login fails with OCSP error in airgapped environment **Symptoms:** Certificate authentication fails with an OCSP revocation check error. Logs show the OCSP responder is unreachable. **Solution:** Configure OCSP fail-open behavior or disable OCSP checking via `realmInitEnv`. To allow authentication when the OCSP responder is unreachable (fail-open): ```yaml - path: realmInitEnv value: X509_OCSP_FAIL_OPEN: "true" ``` To disable OCSP checking entirely: ```yaml - path: realmInitEnv value: X509_OCSP_CHECKING_ENABLED: "false" ``` > [!CAUTION] > Disabling OCSP checking means revoked certificates will not be rejected. Understand your organization's compliance requirements before using this setting. If your environment uses CRL-based revocation instead of OCSP, configure the CRL path: ```yaml - path: realmInitEnv value: X509_CRL_CHECKING_ENABLED: "true" X509_CRL_RELATIVE_PATH: "crls/DODROOTCA3.crl##crls/DODIDCA_81.crl" # Relative to /opt/keycloak/conf; use ## between multiple paths X509_CRL_ABORT_IF_NON_UPDATED: "false" # Set true to fail authentication if CRL is expired ``` > [!NOTE] > CRL files must be present on the Keycloak pod at the path specified in `X509_CRL_RELATIVE_PATH`, relative to `/opt/keycloak/conf`. To include CRL files in a custom image, see the [uds-identity-config repository](https://github.com/defenseunicorns/uds-identity-config). ### Problem: MFA is not required after enabling WebAuthn or OTP **Symptoms:** Users can log in without completing an MFA step. **Solution:** Confirm that both the flow toggle and at least one MFA method are enabled. For WebAuthn to work as a required step, `WEBAUTHN_ENABLED: true` must be set; for OTP, `OTP_ENABLED: true`. Verify the realm was redeployed after the override was applied. ## Reference: X.509/CAC with additional MFA > [!NOTE] > CAC authentication (X.509 certificate + PIN) already satisfies multi-factor requirements in most security frameworks: the certificate is "something you have" and the PIN is "something you know." `X509_MFA_ENABLED` adds a second software factor on top of CAC, which is rarely needed and can be impractical in classified environments where personal devices aren't permitted. Confirm this is an explicit requirement before enabling it. If you do need to require an additional factor after CAC authentication, use this configuration in the `realmAuthFlows` block from step 2 in place of the values shown there, then recreate and deploy the bundle: ```yaml - path: realmAuthFlows value: X509_AUTH_ENABLED: true X509_MFA_ENABLED: true OTP_ENABLED: true # At least one MFA method must also be enabled WEBAUTHN_ENABLED: false ``` `X509_MFA_ENABLED: true` has no effect unless at least one of `OTP_ENABLED` or `WEBAUTHN_ENABLED` is also enabled. ## Related documentation - [Keycloak: Authentication](https://www.keycloak.org/docs/latest/server_admin/#configuring-authentication) - upstream reference for Keycloak authentication flow configuration - [Configure the CA truststore](/how-to-guides/identity-and-authorization/configure-truststore/) - Configure the CA certificate bundle required for X.509/CAC authentication. - [Configure user accounts and security policies](/how-to-guides/identity-and-authorization/configure-user-account-settings/) - Set password complexity and email verification alongside auth flow configuration. ----- # Configure OAuth 2.0 device flow import { Steps } from '@astrojs/starlight/components'; ## What you'll accomplish You'll configure a UDS Package to use the [OAuth 2.0 Device Authorization Grant](https://oauth.net/2/device-flow/) so that CLI tools, automation scripts, or headless devices can obtain tokens without a browser redirect. Once configured, the application can initiate a device code flow and present users with a short code to enter on a separate device. ## Prerequisites - UDS Core deployed - [UDS CLI](https://github.com/defenseunicorns/uds-cli/releases) installed - A UDS `Package` CR for the application that needs device flow ## Before you begin The Device Authorization Grant is designed for applications that either have no browser or cannot handle redirect-based authentication (for example, CLI tools, IoT devices, or CI/CD pipelines where a browser redirect is impractical). This flow creates a **public client** (a client with no secret). Two important constraints apply to public clients in UDS Core: - `standardFlowEnabled` must be explicitly set to `false`. The UDS operator will reject the `Package` CR if it is not. Public clients in UDS Core are restricted to device flow only. - `publicClient: true` is incompatible with `serviceAccountsEnabled: true` > [!NOTE] > If your application needs **both** device flow and a standard browser redirect flow, create two separate SSO clients in the same `Package` CR, one for each flow. They cannot be combined in a single client. ## Steps
By logging in you agree to the following:
- Authorized use only
- Activity may be monitored