Version 1.23.x

Version 1.23.x#

Release notes for Nubus for Kubernetes 1.23.x:

Version 1.23.2 - 2026-10-13#

Upgrade path

For the upgrade to version 1.23.2, your deployment must run on version 1.22.x, 1.23.0 or 1.23.1. For the general steps to upgrade an existing Nubus for Kubernetes deployment, see Upgrade in Univention Nubus for Kubernetes - Operation Manual [1].

Migration steps#

This section lists necessary migration steps that may apply to you. You need to run them before the upgrade. Follow and apply the migration steps outlined in v1.23.1 - Migration steps.

Changes#

This section lists the changes in 1.23.2 grouped by component in Nubus for Kubernetes.

Keycloak service#

Keycloak 26.7.5 silently ignores OIDC audience mappers that use the Included Client Audience setting with a value that isn’t the client ID of an existing and enabled Keycloak client. Nubus for Kubernetes 1.23.2 still ships Keycloak 26.7.4 and prepares your deployment for this change.

This update fixes the OIDC audience mapper of the OIDC client for UMC.

After the update, you can check all OIDC clients for broken audience mappers with the following command. The command reads the Keycloak URL, realm, and administrator credentials from the most recent Keycloak bootstrap pod. Replace {NAMESPACE} with the namespace of your Nubus for Kubernetes deployment.

NS={NAMESPACE}
IMAGE=artifacts.software-univention.de/nubus/images/keycloak-bootstrap:26.7.4-nubus4@sha256:3e38cbff07f06905cd1bbf87390d9585d47ac6792e2608d46758787bc4d47f4f

POD=$(kubectl get pods -n "$NS" -l app.kubernetes.io/name=keycloak-bootstrap \
        --sort-by=.metadata.creationTimestamp -o name | tail -1)

kubectl debug -n "$NS" "$POD" --copy-to=keycloak-fix-audience --container=main \
  --set-image=main="$IMAGE" \
  -- sh -c '/usr/share/univention-keycloak/fix-audience-mappers \
      --realm "$KEYCLOAK_REALM" \
      --keycloak-url "$KEYCLOAK_URL" --binduser "$KEYCLOAK_USERNAME" \
      --bindpwdfile /credentials/keycloak.secret --dry-run'

kubectl wait -n "$NS" --for=jsonpath='{.status.phase}'=Succeeded \
  pod/keycloak-fix-audience --timeout=60s
kubectl logs -n "$NS" -f keycloak-fix-audience -c main
kubectl delete pod -n "$NS" keycloak-fix-audience

We recommend running this command after updating to version 1.23.2 without the --dry-run flag to repair the OIDC audience mapper configuration on all existing OIDC clients in preparation for the next Keycloak update.

For more information, see https://help.univention.com/t/25737.

2FA Helpdesk#

The performance of the Management UI of the 2FA Helpdesk has been improved.

Included errata updates#

The errata updates contain fixes for the following CVEs:

kotlin-stdlib

Version 1.23.1 - 2026-09-29#

Upgrade path

For the upgrade to version 1.23.1, your deployment must run on version 1.22.x or 1.23.0. For the general steps to upgrade an existing Nubus for Kubernetes deployment, see Upgrade in Univention Nubus for Kubernetes - Operation Manual [1].

Migration steps#

This section lists necessary migration steps that may apply to you. You need to run them before the upgrade. Follow and apply the migration steps outlined in v1.23.0 - Migration steps.

  1. Operators who override the container image of a Provisioning Service component must point all four overrides at the provisioning-server repository:

Changes#

This section lists the changes in 1.23.1 grouped by component in Nubus for Kubernetes.

Keycloak service#

Upgrade Keycloak to version 26.7.4. This includes fixes for the following security findings:

LDAP server#

The LDAP server container image contains fewer unused software packages. The BIND 9 DNS tools and krb5-config packages have been removed. This reduces the containers SBOM and removes false positives from CVE scans.

The Kerberos password overlay is not used or supported in Nubus for Kubernetes and now deactivated by default.

The init-dh init container uses the LDAP server image instead of alpine/openssl from Docker Hub. The values below nubusLdapServer.dhInitContainer.* are no longer evaluated.

Provisioning Service#

The Provisioning API, the Dispatcher, the Prefill service and the UDM Transformer now run from one container image named provisioning-server, instead of one image per service.

The provisioning-server container image is the first distroless (minified) Nubus container image. It now contains only the minimal set of software packages, required by the four Provisioning services at runtime.

Compared to the 4 previously used container images, the provisioning-server image is 90% smaller, the total SBOM components are reduced by 85% and the unique SBOM components are reduced by 50%.

The UDM Listener image no longer contains the BIND 9 DNS tools.

NATS has been updated to version 2.15.0, and the nats-server-config-reloader to version 0.24.0.

Nubus now pulls the NATS images from artifacts.software-univention.de, to ensure that all Nubus container images come from the same registry.

Stack Data#

The Stack Data Helm Chart now supports the extraVolumes pattern with:

Use them to mount additional files, such as certificates or secrets, into the job that loads the domain data.

Included errata updates#

The errata updates contain fixes for the following CVEs:

bind9-dnsutils
bind9-host
bind9-libs

Version 1.23.0 - 2026-09-15#

Upgrade path

For the upgrade to version 1.23.0, your deployment must run on version 1.22.x or 1.21.x. For the general steps to upgrade an existing Nubus for Kubernetes deployment, see Upgrade in Univention Nubus for Kubernetes - Operation Manual [1].

Release highlights#

Guardian returns, based on Cerbos

The Guardian component is back in the Nubus umbrella chart. The new implementation uses Cerbos as its policy decision point. It lays the foundation for fine-grained authorization in future Nubus releases.

Keycloak container hardened

The Keycloak main container now mounts most volumes read-only. This reduces the attack surface by limiting the paths in the container that are writable at runtime.

SCIM client improvements

The SCIM client receives several improvements in this release, including object-type specific search endpoints and experimental support for group provisioning.

Migration steps#

This section lists necessary migration steps that may apply to you. You need to run them before the upgrade.

  1. Operators who configured the Notifications API can remove all Helm Chart values under nubusNotificationsApi from their custom values files. Nubus no longer provisions the PostgreSQL database notificationsapi and its database user. After the upgrade, operators can drop the database and the database user from their PostgreSQL instance.

Changes#

This section lists the changes in 1.23.0 grouped by component in Nubus for Kubernetes.

Guardian#

Nubus for Kubernetes adds the Guardian component to the umbrella chart again. The new Guardian builds on Cerbos as its policy decision point. It provides no functionality yet and is deactivated by default with the value false in the Helm Chart value nubusGuardian.enabled. Activating it doesn’t alter the behavior of your deployment.

Kerberos encryption types#

Nubus for Kubernetes 1.22 announced that the UDM HTTP REST API only writes strong Kerberos encryption types. The change didn’t take effect, and the component kept writing the weak types as well. Version 1.23 fixes this. The UMC server wasn’t affected.

Accounts keep their Kerberos keys until their next password change. Therefore accounts from 1.22, or from an earlier version, still have weak keys after the upgrade. To remove them, run the remove_krb5key_keytypes script in the UDM HTTP REST API as described in Dry run command to remove existing weak keys.

Notifications API#

Nubus for Kubernetes removes the Notifications API from the umbrella Helm Chart. The component is deprecated and no longer part of a Nubus deployment. The Portal Server feature toggle nubusPortalServer.portalServer.featureToggles.notifications_api is deactivated by default with the value false.

Portal Frontend#

The right sidebar of the portal now shows the display name of the signed-in user and falls back to the username if no display name is set. Earlier versions only showed the username.

Included errata updates#

The errata updates contain fixes for the following CVEs:

binutils
binutils-common
binutils-x86-64-linux-gnu
bsdutils
curl
libbinutils
libblkid1
libctf-nobfd0
libctf0
libcurl4
libexpat1
libexpat1-dev
libgprofng0
liblastlog2-2
liblzma5
libmount1
libpam-modules
libpam-modules-bin
libpam-runtime
libpam0g
libpq5
libpython3.11-minimal
libpython3.11-stdlib
libpython3.13-minimal
libpython3.13-stdlib
libsmartcols1
libuuid1
login
mount
nginx
nginx-common
openjdk-21-jre-headless
openssh-client
postgresql-client-15
python-dotenv
python3-ecdsa
python3-jose
python3-jwcrypto
python3-rsa
python3.11
python3.11-minimal
python3.11-venv
python3.13
python3.13-minimal
starlette
util-linux
On this page