Nubus for Kubernetes 1.21: Faster Provisioning, More Robust Health Checks, and a More User-Friendly Portal

The latest release of Nubus for Kubernetes puts operational stability front and center: The Provisioning Service now delivers changes from the directory service to downstream systems significantly faster. Many liveness and readiness probes have been reworked so that Kubernetes can assess the state of components more accurately. Additionally, the portal now prevents content from being visible before login. Rounding out the release is a comprehensive set of security updates – most notably an upgrade to Keycloak 26.7.0.

The Provisioning Service distributes changes from the directory service as events to all connected consumers. If a consumer did not acknowledge an event – for example because it was restarting or temporarily unreachable – redelivery previously had to wait up to 30 seconds. In practice, this led to noticeable delays before downstream services saw the current state of the directory.

With Nubus 1.21, unacknowledged events are redelivered within approximately one second. After an interruption, consumers are therefore back up to date much faster. As part of these changes, the embedded NATS message broker has also been updated to version 2.14.3.

A major focus of this release is on security updates. Keycloak is upgraded to version 26.7.0, closing a significant number of CVEs. In addition to the version upgrade, two functional bugs in the Keycloak service were fixed that are also security-relevant:

• LDAP connection was unnecessarily re-established: A regression bug caused Keycloak to open a new LDAP connection for every operation instead of reusing the existing one. Under load, this resulted in a flood of BIND requests against the LDAP server. Keycloak now binds once and continues to use the established connection. The required patch was developed by Univention and contributed upstream to the Keycloak project.
• Login failures after username case changes: After changing the capitalization of a username – for example from FOO to foo – login to the portal and UMC sometimes failed with HTTP 401. The cause was that Keycloak continued to use the cached value until the internal user cache expired. The LDAP User Federation no longer caches imported users and instead reads the UID directly from the LDAP server on every login. As a result, renamed users can log in again immediately. This setting takes effect automatically with the upgrade.

Beyond that, this release includes an extensive set of errata updates for numerous libraries and components contained in the container images – including critical and high-severity CVEs in golang.org/x/crypto, golang.org/x/net, containerd, cryptography, and several Netty modules. The complete list of all resolved CVEs can be found in the release notes.

This continuous maintenance of the container base is part of the strategy to identify and close security vulnerabilities in upstream components as quickly as possible.

Kubernetes relies on liveness and readiness probes to decide whether a pod should receive traffic or needs to be restarted. In several Nubus for Kubernetes components, these probes previously provided limited insight.

With version 1.21, the probes for the UDM REST API containers (for API-based administration) and the UMC Server (for graphical administration) have been significantly reworked. They now also detect runtime issues within the containers, providing more reliable feedback on the health of the services.

For operators, this means: Kubernetes detects unhealthy components more reliably while cleanly distinguishing between a truly non-functional pod and a temporary disruption of a backend such as LDAP – thereby avoiding unnecessary restarts of healthy pods.

When the Users are required to login option is enabled for a portal, anonymous visitors should only see the login page. Previously, however, the portal briefly displayed content that was available to anonymous visitors before redirecting to the login page. This affected tiles without group restrictions that are visible to all users by default and were therefore also shown to anonymous visitors.

With Nubus 1.21, this behavior is corrected: When login is enforced, anonymous visitors are redirected directly to the login page without the portal rendering or delivering categories, tiles, folders, or menu entries beforehand. For all deployments that intend to make portal content accessible exclusively to authenticated users, this update improves the end-user experience and closes a potential data exposure gap.

In addition to the highlights above, Nubus 1.21 includes several smaller adjustments. Notably, the Guardian component, including its container images, has been temporarily removed from the Nubus umbrella chart. This step prepares for an upcoming backend change and has no impact on the behavior of existing deployments.

As always, the Release Notes contain all the details, and the installation is described in the Nubus Operations Manual.