Version 1.21.x

Version 1.21.x#

Release notes for Nubus for Kubernetes 1.21.x:

Version 1.21.0 - 2026-07-20#

This is the thirty-second production release of Nubus for Kubernetes.

Upgrade path

For the upgrade to version 1.21.0, your deployment must run on version 1.20.x. For the general steps to upgrade an existing Nubus for Kubernetes deployment, see Upgrade in Univention Nubus for Kubernetes - Operation Manual [1].

Changes#

This section lists the changes in 1.21.0 grouped by component in Nubus for Kubernetes.

Keycloak service#

  • Fix a regression since 1.19.1 where the Keycloak LDAP user federation re-bound the service account on every operation instead of reusing the pooled connection, flooding the LDAP server with BIND requests under load. The service account now binds once and reuses the connection.

  • Fix Portal and UMC login failing with HTTP 401 after a username is changed in case only, for example FOO to foo. Keycloak kept serving the cached uid until its imported-user cache expired. The LDAP user federation no longer caches imported users and always reads the uid from the LDAP server, so a renamed user can sign in immediately. The setting is applied immediately on upgrade.

Upgrade Keycloak to version 26.7.0. This includes fixes for the following security findings:

Neither change requires operator action.

Keycloak Extensions#

UDM HTTP REST API#

  • Improve probes of the UDM HTTP REST API. The liveness and readiness probes now send an HTTP request to the service through the probe script /usr/local/bin/univention-probe-udm.py shipped in the container image.

    The readiness probe fails when the LDAP server is unreachable, so Kubernetes routes traffic away from pods that can’t serve requests. The liveness probe only fails when the service doesn’t answer at all, so an LDAP outage doesn’t cause pod restarts.

UMC server#

  • Improve UMC server probes, which previously only checked that the service port accepts TCP connections. The liveness and readiness probes of the UMC server container now verify that the service answers requests.

  • Replace the placeholder probes of the SSSD sidecar container, which unconditionally reported success. The liveness probe now queries the SSSD NSS responder without depending on the LDAP server, so a hung responder restarts the container while an LDAP outage doesn’t. The readiness probe verifies the whole lookup path from NSS through SSSD to the LDAP server.

  • The UMC gateway probes now verify that the web server answers requests.

Provisioning Service#

This release fixes an issue where the Provisioning Service could delay the redelivery of an unacknowledged event by up to 30 seconds. When a consumer received an event but didn’t confirm it, for example because it restarted or was temporarily unavailable, the event was only redelivered after a long, fixed wait. Downstream services therefore appeared to receive directory updates with a noticeable delay. The service now redelivers such events within about one second, so consumers catch up quickly after a disruption.

This release also improves the durability of queued events. The message store now flushes events to disk shortly after receiving them, which reduces the risk of losing events if a node or pod stops unexpectedly. This durability comes at the cost of a small increase in per-event latency. The flush interval is configurable through the Helm value nubusProvisioning.nats.config.jetstream.fileStore.sync_interval, which defaults to 10ms.

As part of these changes, the embedded NATS message broker is upgraded to version 2.14.3.

Portal#

  • Fix a data exposure on portals that require login, where the Portal rendered tiles to anonymous visitors and included them in the portal data before redirecting the visitor to the login page. When a portal has the Users are required to login option enabled, anonymous visitors are now redirected to the login page without the Portal rendering or serving any categories, tiles, folders, or menu entries. This affected tiles without a group restriction, which are shown to all users and were therefore exposed to anonymous visitors.

Guardian#

The Guardian component and its container images have been removed from the Nubus for Kubernetes umbrella chart. This removal is in preparation for an upcoming change and does not change the behavior of your deployment. If you set any nubusGuardian.* values in your custom Helm values, you can remove them as they no longer have any effect.

Structured logging#

Despite prior announcements, structured logging is not yet enabled by default in Nubus for Kubernetes 1.21. The “old-style” plain logging remains the default. Nubus for Kubernetes 1.22 changes the default to structured logging. To keep plain logging in your deployment, Univention recommends setting all structured-logging configuration options to false. Univention will mark “old-style” plain logging as deprecated and remove it in a future release. For details, see Logging in Univention Nubus for Kubernetes - Operation Manual [1].

Included errata updates#

The errata updates contain fixes for the following CVEs:

Authlib
Pillow
bind9-dnsutils
bind9-host
bind9-libs
brace-expansion
cryptography
dulwich
github.com/containerd/containerd/v2
go.opentelemetry.io/otel
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
golang.org/x/crypto
golang.org/x/net
golang.org/x/sys
golang.org/x/text
keycloak-services
libc-ares2
libfreetype6
libglib2.0-0
libgnutls30
libgssapi-krb5-2
libk5crypto3
libkrb5-3
libkrb5support0
libopenjp2-7
libpq5
libssh2-1
netty-codec-haproxy
netty-codec-http
netty-codec-http2
netty-handler
netty-resolver-dns
netty-transport-native-epoll
nginx
nginx-common
oras.land/oras-go/v2
poetry
postcss
postgresql-client-15
pytest
python3-m2crypto
serialize-javascript
stdlib
urllib3
uuid
On this page