This release delivers tangible improvements for operations and security. Nubus for Kubernetes 1.22 makes the stored password hashes configurable, enables the metrics of the Keycloak identity provider, and switches log output to structured logging. This gives operators a better view of their environment while raising the level of security at the same time.
Table of Contents
Password Hashes: More Control and a More Secure Default
Nubus never stores passwords in plain text; instead, it protects them with current hashing methods. Even someone who gains access to the stored values cannot read passwords from them. Because Nubus supports various authentication methods over protocols such as LDAP, Kerberos, and OIDC, along with a wide range of clients, it stores several of these hashes in parallel – since not every method and not every client can process every hash algorithm.
Sometimes this requires balancing security against functionality. Until now, Nubus has also stored hashes from older methods, such as those needed for Wi-Fi authentication via MS-CHAPv2. For many school environments, this Wi-Fi authentication is a functional must. In security-critical environments, however, the “old” hashes required for it pose a risk.
With Nubus for Kubernetes 1.22, operators gain significantly more influence over which hashing methods are used through the system configuration. At the same time, we have adjusted the default configuration under Kubernetes: only hashes that are considered secure even for critical environments according to BSI TR-02102 are now shipped. In addition, Nubus allows you to remove hashes from older methods.
Incidentally, the configurability of the stored hashes has also been available for Nubus on UCS since Erratum 533. Because significantly more different hashes are used under UCS through the available integrations, we are not changing the default configuration here. Operators of UCS should decide together with Univention Support whether adjustments make sense.
Metrics for Authentication: More Insight into Keycloak
In this release, we not only updated Keycloak but also enabled the metrics that Keycloak supports. This makes it easy to analyze key indicators such as the number of authentications, response times, and errors that have occurred. As a result, operators can assess the state of their environment more quickly and prevent problems.
The metrics are provided in a way that is compatible with the widely used tools Prometheus and Grafana. In addition, ready-made Grafana dashboards already exist – both from the Keycloak project and from the Grafana community. They can be used directly or serve as a template for your own dashboards.
Switching to Structured Logging: Analyze Logs More Easily
As announced with earlier releases of Nubus for Kubernetes, we are now switching log output to the structured logging format. It has been available as an option since Nubus for Kubernetes 1.17 – and from now on it is the new standard. In solutions such as Elasticsearch, the events documented in log entries can now be analyzed automatically and much more easily.
For now, operators can still use the configuration to fall back to the previous, unstructured log format. A future version of Nubus will no longer support this old format, and new extensions no longer offer it either. We therefore recommend switching to the new format early on.
Comprehensively Updated
As with every release, we have updated numerous components to benefit from improvements and security updates in the open source software we use. For some of the container images shipped with Nubus for Kubernetes, we have switched from Debian 12 (UCS 5.2) to Debian 13 (UCS 5.3) as the source for the software versions. This transition is taking place gradually across the coming releases for all container images.
Nubus for Kubernetes 1.22 is available for download via our container registry as usual. You will find a complete overview of the improvements in the release notes, and the installation steps in the Operation Manual.
