6.1. Overview

This chapter collects various topics about the configuration of Nubus for Kubernetes.

6.1.1. Available configurations

• Nubus license

• Secrets in Nubus for Kubernetes

• Use external PostgreSQL database

• Use external S3-compatible object storage

• Use external NATS message queue

• Scalability

• Directory service high availability and scalability

• Large environments

• Keycloak configuration

• Federation with external IAM systems

• Keycloak Extensions

• Restrict users or groups from capabilities in End User Self Service

• 2FA Helpdesk

6.1.2. Apply configuration

In many sections you come to the point where you need to apply the changes to Nubus for Kubernetes. This step is the same for most of them. To reduce duplicate content, you find the needed steps here. The affected sections refer back here.

To apply the updated configuration from the values file, use the following steps:

1. Set environment variables for the Helm command. Use the commands in Listing 3.1.

2. To upgrade your Nubus deployment, run the command in Listing 6.1.

   Listing 6.1 Apply configuration changes from values file

   $ helm upgrade "$RELEASE_NAME" \
      --namespace "$NAMESPACE_FOR_NUBUS" \
      --values custom_values.yaml \
      --version "$VERSION" \
      oci://artifacts.software-univention.de/nubus/charts/nubus
   

6.1.3. Restart UMC Server pod

For some changes you need to restart the UMC Server pod. You usually come to this section, because the respective sections refer here to apply and complete the necessary steps.

Use the commands in Listing 6.2. They find out the name of the pod for the UMC Server and delete the pod. Kubernetes automatically recreates the pod with the updated configuration.

Listing 6.2 Restart pod for UMC Server

$ kubectl --namespace "$NAMESPACE_FOR_NUBUS" \
    get pods \
    | grep "umc-server-0"

nubus-umc-server-0      2/2      Running     0     4m33s
# Name of the pod is "nubus-umc-server-0"

$ kubectl --namespace "$NAMESPACE_FOR_NUBUS" \
    delete pod "$NAME_OF_YOUR_POD"

Caution

UMC Server instances generate and keep track of the user session. Only the generating instance knows about the user session. Any requests in the context of the user session need to use that UMC Server instance. Nubus for Kubernetes has proper configuration to ensure the communication.

However, if you restart individual UMC Server instances users whose session belongs to the affected UMC Server instances lose their user session.

For information about user sessions and the authentication flow, see Authentication flow in Univention Nubus for Kubernetes - Architecture Manual [2].