Version 1.21.x

Version 1.21.x#

Release notes for Nubus for Kubernetes 1.21.x:

Version 1.21.0 - 2026-07-20#

This is the thirty-second production release of Nubus for Kubernetes.

Upgrade path

For the upgrade to version 1.21.0, your deployment must run on version 1.20.x. For the general steps to upgrade an existing Nubus for Kubernetes deployment, see Upgrade in Univention Nubus for Kubernetes - Operation Manual [1].

Changes#

This section lists the changes in 1.21.0 grouped by component in Nubus for Kubernetes.

Keycloak service#

  • Fix a regression introduced in 1.19.1 where the Keycloak LDAP user federation bound the service account again for every operation instead of reusing the pooled connection. Under load, this flooded the LDAP server with BIND requests. The service account now binds once and reuses the connection.

  • Fix sign-in failures with HTTP 401 in Portal and UMC after a username changes only in letter case, for example from FOO to foo. Keycloak kept serving the cached uid until its imported user cache expired. The LDAP user federation no longer caches imported users and always reads the uid from the LDAP server so that a renamed user can sign in immediately. The upgrade immediately applies the setting.

  • Upgrade Keycloak to version 26.7.0. This includes fixes for the following security findings:

  • These changes don’t require operator action.

Keycloak Extensions#

Align the securityContext.enabled setting of Keycloak Extensions with the other Nubus for Kubernetes Helm Charts:

The rendered template output now always omits the enabled key. Setting the value to false deactivates the security context.

UDM HTTP REST API#

Improve probes for the UDM HTTP REST API. The liveness and readiness probes now send HTTP requests to the service through the probe script /usr/local/bin/univention-probe-udm.py shipped in the container image.

The probes now behave as follows:

  • The readiness probe fails when the LDAP server is unreachable, so Kubernetes routes traffic away from pods that can’t serve requests.

  • The liveness probe only fails when the service doesn’t answer at all, so an LDAP outage doesn’t cause pod restarts.

UMC server#

  • Improve UMC server probes. Previously, the probes only checked whether the service port accepted TCP connections. The liveness and readiness probes of the UMC server container now verify that the service answers requests.

  • Replace the placeholder probes of the SSSD sidecar container, which unconditionally reported success. The liveness probe now queries the SSSD NSS responder without depending on the LDAP server, so a hung responder restarts the container while an LDAP outage doesn’t. The readiness probe verifies the whole lookup path from NSS through SSSD to the LDAP server.

  • The UMC gateway probes now verify that the web server answers requests.

Provisioning Service#

  • Fix an issue where the Provisioning Service could delay redelivery of an unacknowledged event by up to 30 seconds. If a consumer received an event but didn’t confirm it, for example because it restarted or was temporarily unavailable, the service redelivered the event only after a long, fixed wait. As a result, downstream services could receive directory updates with a noticeable delay. The service now redelivers such events within about one second, so consumers catch up quickly after a disruption.

  • Improve the durability of queued events. The message store flushes events to disk shortly after receiving them, which reduces the risk of losing events if a node or pod stops unexpectedly. This change slightly increases per-event latency. The flush interval is configurable through the Helm Chart value nubusProvisioning.nats.config.jetstream.fileStore.sync_interval, which defaults to 10ms.

  • These changes also upgrade the embedded NATS message broker to version 2.14.3.

Portal#

Fix a data exposure on portals that require sign-in. The Portal rendered tiles to anonymous visitors and included them in the portal data before redirecting anonymous visitors to the sign-in page.

When a portal has the Users are required to login option enabled, the Portal now redirects anonymous visitors to the sign-in page before it renders or serves any categories, tiles, folders, or menu entries. Tiles without a group restriction appear for all users, so anonymous visitors could see them.

Guardian#

Nubus for Kubernetes removes the Guardian component and its container images from the umbrella chart. This removal prepares an upcoming change and doesn’t alter the behavior of your deployment. If you set any nubusGuardian.* values in your custom Helm Chart values, you can remove them because they no longer have any effect.

Structured logging#

Despite prior announcements, Nubus for Kubernetes 1.21 doesn’t enable structured logging by default. Plain logging remains the default.

Nubus for Kubernetes 1.22 changes the default to structured logging.

To keep plain logging in your deployment, Univention recommends setting all structured-logging configuration options to false. Univention will mark plain logging as deprecated and remove it in a future release. For details, see Logging in Univention Nubus for Kubernetes - Operation Manual [1].

Included errata updates#

The errata updates contain fixes for the following CVEs:

Authlib
Pillow
bind9-dnsutils
bind9-host
bind9-libs
brace-expansion
cryptography
dulwich
github.com/containerd/containerd/v2
go.opentelemetry.io/otel
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp
golang.org/x/crypto
golang.org/x/net
golang.org/x/sys
golang.org/x/text
keycloak-services
libc-ares2
libfreetype6
libglib2.0-0
libgnutls30
libgssapi-krb5-2
libk5crypto3
libkrb5-3
libkrb5support0
libopenjp2-7
libpq5
libssh2-1
netty-codec-haproxy
netty-codec-http
netty-codec-http2
netty-handler
netty-resolver-dns
netty-transport-native-epoll
nginx
nginx-common
oras.land/oras-go/v2
poetry
postcss
postgresql-client-15
pytest
python3-m2crypto
serialize-javascript
stdlib
urllib3
uuid
On this page