Version 1.22.x

Version 1.22.x#

Release notes for Nubus for Kubernetes 1.22.x:

Version 1.22.0 - 2026-08-28#

Upgrade path

For the upgrade to version 1.22.0, your deployment must run on version 1.21.x. For the general steps to upgrade an existing Nubus for Kubernetes deployment, see Upgrade in Univention Nubus for Kubernetes - Operation Manual [1].

Release highlights#

Keycloak metrics

Operators can now collect Keycloak metrics with Prometheus. The Keycloak Helm Chart exposes the management interface on port 9000 and can create a ServiceMonitor resource for the Prometheus Operator. Optional metric groups for user events and HTTP request durations are configurable through new Helm Chart values.

Stronger security defaults

Nubus for Kubernetes 1.22 ships two security hardening measures by default.

The Samba NT password hash (sambaNTPassword) is no longer written for new objects or password changes. Existing hashes are removed at the next password change. A cleanup script is available to purge them immediately.

Kerberos key generation is now restricted to strong AES encryption types. Weak types such as des3-cbc-sha1 and arcfour-hmac-md5 are no longer permitted. A cleanup script is available to remove weak keys from existing accounts.

Structured logging is now the default

As announced in 1.20 and 1.21, Nubus for Kubernetes 1.22 activates structured logging by default. Plain logging is deprecated and will be removed in a future release. For details, see Affected components in Univention Nubus - Nubus Manual [2].

Migration steps#

This section lists necessary migration steps that may apply to you. You need to run them before the upgrade.

  1. It’s necessary for operators to trigger the generation of the univentionObjectIdentifier for existing UDM objects and directory objects, because future releases of Nubus for Kubernetes rely on it.

    Recommendation:

    The Helm chart already creates a migration job in a suspended state. Run the migration job as shown in listing Listing 1 at a time with low system load on the cluster. It takes around 6 minutes per 100.000 LDAP objects.

    After a successful run, you can optionally deactivate the job by setting nubusUdmRestApi.ldapUpdateUniventionObjectIdentifier.enabled to false so that Kubernetes doesn’t create the job again. If you keep the job activated, it doesn’t have a negative impact.

    Listing 1 Run the migration job for univentionObjectIdentifier#
    $ kubectl patch job/<JOB_NAME> \
    --type=strategic \
    --patch '{"spec":{"suspend":false}}'

Changes#

This section lists the changes in 1.22.0 grouped by component in Nubus for Kubernetes.

UDM HTTP REST API#

The migration job for the generation of the univentionObjectIdentifier during the Nubus 1.10 upgrade did not necessarily run against the primary LDAP server. Therefor it has to be executed again. Additional error handling lets the job failing in case a LDAP entry could not be upgraded.

Nubus for Kubernetes is now secure by default with regard to the legacy Samba NT password hash (sambaNTPassword). The new setting password/samba/nthash controls whether UDM generates the sambaNTPassword attribute, mirroring the existing password/samba/lmhash mechanism. It is disabled by default: UDM no longer writes sambaNTPassword for new objects or password changes, and existing values are automatically removed from an account during its next password change. If your environment depends on the NT hash, you can activate it again by setting password/samba/nthash to true.

To purge legacy hashes from existing accounts immediately, without waiting for the next password change, two cleanup scripts are now shipped in the UDM HTTP REST API container image below /usr/share/univention-directory-manager-tools/:

remove_sambantpassword

Removes the sambaNTPassword attribute from all accounts.

remove_krb5key_keytypes

Strips the weak, deprecated Kerberos encryption types from the krb5Key attribute of all accounts, leaving modern AES keys intact.

Kerberos encryption types#

Nubus for Kubernetes now uses strong Kerberos encryption types exclusively when writing the krb5Key attribute.

Earlier versions shipped no Kerberos configuration file. The UDM HTTP REST API and the UMC server therefore used the built-in defaults of the Kerberos library, which included weak encryption types such as des3-cbc-sha1 and arcfour-hmac-md5. Both containers now render a minimal Kerberos configuration file at startup and use it through the KRB5_CONFIG environment variable.

The following encryption types are permitted by default:

  • aes256-cts-hmac-sha1-96

  • aes128-cts-hmac-sha1-96

  • aes256-cts-hmac-sha384-192

  • aes128-cts-hmac-sha256-128

The following UCR variables define the secure defaults:

global.configUcr.kerberos.defaults.enctypes.permitted

The encryption types that Nubus uses to generate Kerberos keys.

global.configUcr.kerberos.defaults.enctypes.tgs

The encryption types for ticket-granting service requests.

global.configUcr.kerberos.defaults.enctypes.tkt

The encryption types for ticket requests.

global.configUcr.kerberos.allow.weak.crypto

Weak cryptography. The default value is false.

Existing accounts keep their Kerberos keys until their next password change. To remove the weak keys from all accounts at once, use the remove_krb5key_keytypes script in the UDM HTTP REST API.

Listing 2 Dry run command to remove existing weak keys#
$ kubectl exec -n <ns> deploy/<release>-udm-rest-api -- \
    /usr/share/univention-directory-manager-tools/remove_krb5key_keytypes --dry-run

Provisioning Service#

This release fixes an issue where the Provisioning Service could stop delivering directory updates to some consumers. When subscriptions were registered or removed in quick succession, the service could read an incomplete list of subscriptions and then skip the missing consumers until it refreshed the list. The service now always reads the complete list of subscriptions.

Portal Frontend#

The Portal Frontend pod no longer crash loops on slow hardware or after an import. The portal asset loader sidecar container exited when its initial synchronization against a slow or cold UDM HTTP REST API or LDAP Server timed out. It now retries the initial synchronization instead of exiting, and the request timeout is configurable and defaults to 120 seconds.

Added Helm Chart value:

Keycloak service#

Operators can now collect metrics from Keycloak with Prometheus. Keycloak serves its metrics endpoint on a separate management interface on port 9000. The Keycloak Helm Chart now exposes this port on the container and on the service, so that Prometheus can reach the /metrics endpoint.

The chart can also create a ServiceMonitor resource for the Prometheus Operator. The chart doesn’t create the resource by default. To create it, set keycloak.serviceMonitor.enabled to true. Use keycloak.serviceMonitor.labels to match the selector of your Prometheus installation.

Added Helm Chart values:

Two groups of optional metrics are now configurable. Nubus for Kubernetes deactivates both groups by default:

The setting keycloak.config.enableMetrics now works as documented. Earlier versions always activated the metrics endpoint, even after you set the value to false. The metrics endpoint stays active by default.

Keycloak Extensions#

The Keycloak Extensions proxy no longer writes its logs to a log file in addition to standard output. Older versions tried to write a log file to a read-only location, which failed and kept the log data in memory, leading to a memory leak and an eventual OOMKilled event.

The default log level of the Keycloak Extensions changes from debug to info.

Structured logging#

Nubus for Kubernetes now activates structured logging by default. Plain logging is deprecated and will be removed in a future Nubus release. For details, see Affected components in Univention Nubus - Nubus Manual [2].

Included errata updates#

The errata updates contain fixes for the following CVEs:

Mako
PyJWT
aiohttp
apache2-bin
axios
bind9-dnsutils
bind9-host
bind9-libs
brace-expansion
cryptography
dmsetup
form-data
immutable
jackson-databind
js-yaml
libasound2
libasound2-data
libavahi-client3
libavahi-common-data
libavahi-common3
libc-bin
libc6
libcups2
libdevmapper1.02.1
libgcrypt20
libgnutls30
libnss3
libpython3.11-minimal
libpython3.11-stdlib
libssl3
libssl3t64
libsystemd0
libudev1
libxml2
micrometer-core
nanoid
net-tools
netty-codec
netty-codec-dns
netty-codec-haproxy
netty-codec-http
netty-codec-http2
openjdk-17-jre-headless
openssh-client
openssl
openssl-provider-legacy
postcss
postgresql
python-multipart
python3.11
python3.11-minimal
rsyslog
sed
starlette
tornado
On this page