Version 1.15.x

Version 1.15.x#

This page shows the changelog for Nubus for Kubernetes 1.15.x:

Version 1.15.1 - 2025-11-13#

This is the twenty-second production release of Nubus for Kubernetes.

Upgrade path

For the upgrade to version 1.15.1, your deployment must run on version 1.14.0 to 1.15.0. For the general steps to upgrade an existing Nubus for Kubernetes deployment, see Upgrade in Univention Nubus for Kubernetes - Operation Manual [1].

Migration steps#

There are no necessary migration steps for this release.

Changes#

This section lists the changes in 1.15.1 grouped by component in Nubus for Kubernetes.

Keycloak Extensions#

  • Fix invalid probe syntax in the deployment configuration.

Version 1.15.0 - 2025-11-11#

This is the twenty-first production release of Nubus for Kubernetes.

Upgrade path

For the upgrade to version 1.15.0, your deployment must run on version 1.14.0. For the general steps to upgrade an existing Nubus for Kubernetes deployment, see Upgrade in Univention Nubus for Kubernetes - Operation Manual [1].

Release highlights#

OIDC back-channel logout in the Portal

The portal immediately ends active sessions of a user when the Identity Provider sends a back-channel logout request.

OIDC back-channel logout with federated Identity Provider

Scenarios that use federation with an upstream identity provider (IdP), back-channel logout requests from the upstream IdP trigger back-channel logout requests to clients relying on Keycloak, the local IdP.

Simplified configuration of dependencies

The Helm Chart provides examples for the installation of Nubus for Kubernetes. The examples include bundled dependencies for test and demonstration purposes, and externally provided dependencies for production scenarios.

Portal accessibility improvements

Improve UMC tiles and groups accessibility in the Portal, especially when using screen readers.

Migration steps#

This section lists necessary migration steps that may apply to you. You need to run them before the upgrade.

  1. Operators who customize the resources in the Self Service Consumer need to move the configuration of resource dependencies to the following property:

    • Move nubusSelfServiceConsumer.resourcesWaitForDependency.* to nubusSelfServiceConsumer.initResources.*.

  2. Operators who customize the resources in the Portal Consumer need to move the configuration of resource dependencies to the following property:

    • Move nubusPortalConsumer.resourcesWaitForDependency.* to nubusPortalConsumer.initResources.*.

  3. Operators who configure the username of the NATS user for the components in the Provisioning Service need to adapt their configuration.

    For each component provisioningApi, dispatcher, udmTransformer, prefill, udmListener you need to adapt the existing secrets:

    • Move nubusProvisioning.nats.config.createUsers.<component>.user to nubusProvisioning.nats.config.createUsers.<component>.auth.username.

  4. Operators who use existing secrets to configure NATS passwords in the Provisioning Service need to adapt their configuration.

    • In the previous configuration, nubusProvisioning.nats.config.createUsers.<component>.password contained a template string referencing an environment variable. Find the corresponding entry in nubusProvisioning.nats.extraEnvVars where the name field matches the environment variable.

    • Move valueFrom.secretKeyRef.name from that extraEnvVars entry to nubusProvisioning.nats.config.createUsers.<component>.auth.existingSecret.name.

    • Move valueFrom.secretKeyRef.key from that extraEnvVars entry to nubusProvisioning.nats.config.createUsers.<component>.auth.existingSecret.keyMapping.password.

    • Remove the entry from nubusProvisioning.nats.extraEnvVars.

    For detailed examples, see Provisioning Service secrets in Univention Nubus for Kubernetes - Operation Manual [1].

  5. Operators who use a provided secret value for the NATS administrator password need to adapt their configuration:

  6. Operators who use existing secrets for the NATS administrator password need to adapt their configuration.

  7. Operators who configure any imagePullPolicy need to rename the key to pullPolicy. You can use the global configuration through global.imagePullPolicy.

  8. Operators who configure additionalAnnotations or additionalLabels need to move the configuration to the root of the respective component.

  9. Operators who configure any image.imagePullSecrets need to move the imagePullSecrets to the root of the respective component. You can use the global configuration through global.imagePullSecrets.

  10. Operators who configure an OIDC relying party client secret for the UMC Server in Keycloak Bootstrap need to adjust the following variables:

    • Move node nubusKeycloakBootstrap.oidc.rp.umcserver.* to nubusKeycloakBootstrap.oidc.relyingParty.umcServer.*.

  11. If you are still using SAML authentication you need to re-enable the SAML endpoint of the UMC Server. Nubus for Kubernetes deactivates it by default for security reasons. To enable it, change the ingress paths of the UMC Server, as shown in the example in Listing 1.

    Listing 1 Re-enable UMC Server SAML endpoint#
    nubusUmcServer:
  ingress:
    paths:
      - path: /(univention)/(auth|logout|saml|oidc|get|set|command|upload)(.*)$
        pathType: ImplementationSpecific

  12. If you have configured your existing Nubus installation to use a federated upstream Identity Provider, you need to manually enable the Import Users option in the Keycloak Admin Console. Installations of Nubus for Kubernetes starting with version 1.15.0 enable this setting by default.

    This setting ensures proper support for back-channel logout when federating with an external identity provider and aligns your installation with the supported configuration.

    Warning

    Enabling this setting in existing installations, that use Nubus Keycloak for two-factor authentication, requires users to re-enroll their two-factor authentication.

    To enable the import users option, use the following steps:

    1. Sign in to the Keycloak Admin Console.

    2. Select Manage realms in the left sidebar.

    3. Select the realm nubus.

    4. Select User federation in the left sidebar.

    5. Select the ldap-provider entry.

    6. In the Synchronization settings, enable Import users.

    7. Click Save.

Changes#

This section lists the changes in 1.15.0 grouped by component in Nubus for Kubernetes.

Keycloak#

Keycloak Extensions#

Keycloak Bootstrap#

2FA Helpdesk#

Add nubusTwofaHelpdesk.keycloak.auth.password to allow configuring the plain secret value directly.

Guardian#

Portal Service#

  • Add automatic sign-out of portal sessions across all open tabs when Keycloak detects a sign-out. Nubus for Kubernetes activates automatic sign-out by default. For configuration options and performance considerations, see Automatic sign-out from the Portal.

  • Improve performance when using the user enrichment endpoint.

  • Improve accessibility for UMC folder dialogs.

Portal Consumer#

  • Move nubusPortalConsumer.resourcesWaitForDependency.* to nubusPortalConsumer.initResources.*.

UDM HTTP REST API#

  • Several performance improvements during user searches.

Self Service Consumer#

  • Move nubusSelfServiceConsumer.resourcesWaitForDependency.* to nubusSelfServiceConsumer.initResources.*.

Provisioning Service#

  • Improve secret configuration for the bundled NATS. The NATS user passwords follow the general secrets structure outlined in Listing 9.

  • The bundled NATS respects the global image pull policy configured through global.imagePullPolicy.

  • The natsBox debug container of the bundled NATS isn’t deployed by default. To explicitly activate the debug container, set nubusProvisioning.nats.natsBox.enabled to true.

Included errata updates#

Update all components in Nubus for Kubernetes to use the UCS 5.2-3 base image and include bug fixes up to UCS 5.2 erratum 270. For UCS errata updates, see Security and bugfix errata for UCS 5.2. Reference date is 30. October 2025.

The errata updates contain fixes for the following CVEs:

libxslt
curl
expat
glibc
imagemagick
krb5
libarchive
openjpeg
openssl
sqlite3
openjdk-17
apache2
On this page