Nubus for Kubernetes - Release Notes for 1.x

Version 1.9.x

Version 1.9.x#

This page shows the changelog for Nubus for Kubernetes 1.9.x:

Version 1.9.2 - 2025-05-14#

This is the ninth production release of Nubus for Kubernetes.

Upgrade path

For the upgrade to version 1.9.2, your deployment must run on version 1.8.0. For the general steps to upgrade an existing Nubus for Kubernetes deployment, see Upgrade in Univention Nubus for Kubernetes - Operation Manual [1].

Migration-steps#

This section lists necessary migration steps that may apply to you. You need to run them before the upgrade.

Follow and apply the migration steps outlined in v1.9.1 - Migration steps and in v1.9.0 - Migration steps.

Changes#

  • Fix an issue for handling existing custom secrets from nubusPortalConsumer.objectStorage.auth.accessKeyId and nubusPortalConsumer.objectStorage.auth.secretAccessKey in the Portal Consumer. Affected installation specified those secrets in the custom values. Because of wrong keys, Nubus generated secrets itself instead of using the existing secret values.

  • Fix icons in the Portal displaying icons of Management UI with question mark (?) instead of the icon. The UMC Gateway has the icons for UMC in the correct location.

Version 1.9.1 - 2025-05-07#

This is the eight production release of Nubus for Kubernetes.

Upgrade path

For the upgrade to version 1.9.1, your deployment must run on version 1.8.0. For the general steps to upgrade an existing Nubus for Kubernetes deployment, see Upgrade in Univention Nubus for Kubernetes - Operation Manual [1].

Migration steps#

This section lists necessary migration steps that may apply to you. You need to run them before the upgrade.

  1. If you defined custom values for security contexts nubusGuardian.*.securityContext.enabled in the Guardian apply the renames listed in the v1.9.1 - Changes.

  2. Follow and apply the migration steps outlined in v1.9.0 - Migration steps.

Changes#

Version 1.9.0 - 2025-05-04#

This is the seventh production release of Nubus for Kubernetes.

Upgrade path

For the upgrade to version 1.9.0, your deployment must run on version 1.8.0. For the general steps to upgrade an existing Nubus for Kubernetes deployment, see Upgrade in Univention Nubus for Kubernetes - Operation Manual [1].

Release highlights#

Nubus for Kubernetes 1.9.0 provides the following highlights:

  1. Preview feature: News feed integration into the Portal Service supporting the Rich Site Summary (RSS) and Atom specification.

  2. In the Management UI, the UMC Server container and its sidecar container with SSSD run as non-root.

  3. Update Keycloak in the Identity Provider from version 25 to version 26.

Important

With version 1.9.0, Nubus for Kubernetes enforces licenses. If operators already had a license installed, Nubus didn’t enforce the license before. For information about how to add a license to Nubus for Kubernetes, see Nubus license.

To validate if a license is already present, run the command in Listing 4.

Listing 4 Command to validate for a license present in Nubus#
$ export NAMESPACE_FOR_NUBUS="Set to your Kubernetes namespace"
$ kubectl exec \
    --namespace "$NAMESPACE_FOR_NUBUS" \
    -it \
    nubus-ldap-server-primary-0 \
    -- bash -c "slapcat | sed -nr '/dn:.*?,cn=license/,/^\s*$/p'"

The result looks similar to the output in Listing 5. In case for a paid-support license, the field univentionLicenseUsers has an integer number. Nubus now enforces the given univentionLicenseUsers in the Management UI.

Listing 5 Example output for a license in a un-paid and no support scenario#
...
univentionLicenseBaseDN: UCS Core Edition
...
univentionLicenseUsers: unlimited
...

Migration steps#

This section lists necessary migration steps that may apply to you. You need to run them before the upgrade.

  1. You need to provide PostgreSQL at least in version 15 or later, because of Keycloak 26.

  2. Operators that use their own secrets in the Portal Consumer, need to adjust to the existingSecret settings. For more information, see the documented Helm Chart variable renames in the Portal Consumer section.

  3. Operators that use their own secrets for the Guardian, need to adjust to the existingSecret settings. For more information, see the documented Helm Chart variable renames in the Guardian Helm chart section.

  4. Adjust your branding for the favicon. Nubus supports additional favicons with higher resolution to support, for example, browser preferences and shortcuts on home screens in Android and iOS mobile devices.

    Besides nubusPortalFrontend.portalFrontend.branding.favicon, add the Helm Chart values as outlined the changes for the Portal Frontend.

Changes#

Portal Consumer#

Refactor the Portal Consumer Helm Chart to follow the strategy for using Kubernetes secrets in Nubus for Kubernetes. The Portal Consumer allows using existingSecret Helm Chart values for the following items:

  • LDAP authentication credentials

  • S3-compatible object storage authentication credentials

  • Provisioning API authentication credentials

Add the following Helm Chart values:

Rename the following Helm Chart values:

Remove the following Helm Chart values:

  • nubusPortalConsumer.objectStorage.bucketName

  • nubusPortalConsumer.portalConsumer.objectStorageAccessKeyId

  • nubusPortalConsumer.portalConsumer.objectStorageCredentialSecret.accessKeyKey

  • nubusPortalConsumer.portalConsumer.objectStorageCredentialSecret.name

  • nubusPortalConsumer.portalConsumer.objectStorageCredentialSecret.secretKeyKey

  • nubusPortalConsumer.portalConsumer.objectStorageSecretAccessKey

  • nubusPortalConsumer.provisioningApi.auth.existingSecret.name

Guardian Helm chart#

Refactor the Guardian Helm Chart to follow the strategy for using Kubernetes secrets in Nubus for Kubernetes. Fix issues with the security context in the Guardian Helm Chart.

Add the following Helm Chart values:

Rename the following Helm Chart values:

Remove the following Helm Chart values:

  • nubusGuardian.authorizationApi.config.udmDataAdapterUsername

  • nubusGuardian.authorizationApi.config.udmDataAdapterPassword

  • nubusGuardian.authorizationApi.config.secretRef

    • Reason for removal: Changed to the existingSecret strategy in Nubus for Kubernetes.

    • Alternative configuration: See Added helm values

  • nubusGuardian.managementApi.config.oauthAdapterM2mSecret

  • nubusGuardian.managementApi.config.secretRef

    • Reason for removal: Changed to the existingSecret strategy in Nubus for Kubernetes.

    • Alternative configuration: See Added helm values

  • nubusGuardian.provisioning.config.managementApi.clientSecret

  • nubusGuardian.provisioning.config.managementApi.credentialSecret.key

    • Reason for removal: Not used anymore, used the values from nubusGuardian.managementApi.oauth.auth

    • Alternative configuration: See Added helm values

  • nubusGuardian.postgresql.nameOverride

  • nubusGuardian.postgresql.bundled:

    • Reason for removal: The bundled psql deployment is no longer supported

    • Alternative configuration: Configure the connection to your psql database using the values of the chart.

Portal Frontend#

Add the following features and fixes to the Portal Frontend:

On this page