Skip to content

fix: authpol remoteserviceaccount enablement#1415

Merged
chance-coleman merged 5 commits intomainfrom
authpol-remoteserviceaccount-enablement
Apr 4, 2025
Merged

fix: authpol remoteserviceaccount enablement#1415
chance-coleman merged 5 commits intomainfrom
authpol-remoteserviceaccount-enablement

Conversation

@chance-coleman
Copy link
Copy Markdown
Contributor

@chance-coleman chance-coleman commented Apr 3, 2025

Description

Went through and identified the service accounts for each application and added the remoteServiceAccount to the UDSPackage Spec.Allow rules for ingress rules.

This is in addition to the existing selectors, remoteNamespace, remoteSelector fields. In the ambient authpols operator implementation the remoteServiceAccount would take precedent for the from.source block of the authorizationpolicy.

Related Issue

Fixes #1399

Type of change

  • Bug fix (non-breaking change which fixes an issue)
  • New feature (non-breaking change which adds functionality)
  • Other (security config, docs update, etc)

Steps to Validate

  • Not much here other than deploying uds-core and checking the authorization policies that are generated utilize the new remoteServiceAccount to create the from.source block rather than existing selectors.
  • uds run test:uds-core-e2e
  • use k9s to search through the authorizationpolicies for the following policies:
policy name original from.source value new from.source value
protect-keycloak-ingress-uds-operator Namespace:pepr-system Principals:cluster.local/ns/pepr-system/sa/pepr-uds-core
protect-loki-ingress-grafana-log-queries Namespace:grafana Principals:cluster.local/ns/grafana/sa/grafana
protect-loki-ingress-prometheus-metrics Namespaces:monitoring Principals:cluster.local/ns/monitoring/sa/kube-prometheus-stack-prometheus
protect-loki-ingress-vector-log-storage Namespace:vector Principals:cluster.local/ns/vector/sa/vector
protect-prometheus-stack-ingress-grafana-alerts-queries Namespace:grafana Principals:cluster.local/ns/grafana/sa/grafana
protect-prometheus-stack-ingress-grafana-metrics-queries Namespaces:grafana Principals:cluster.local/ns/grafana/sa/grafana
protect-velero-ingress-prometheus-metrics Namespaces:monitoring Principals:cluster.local/ns/monitoring/sa/kube-prometheus-stack-prometheus
protect-vector-ingress-prometheus-metrics Namespaces:monitoring Principals:cluster.local/ns/monitoring/sa/kube-prometheus-stack-prometheus

Checklist before merging

@chance-coleman chance-coleman self-assigned this Apr 3, 2025
@chance-coleman chance-coleman requested a review from a team as a code owner April 3, 2025 13:14
@chance-coleman chance-coleman linked an issue Apr 3, 2025 that may be closed by this pull request
RemoteServiceAccount Enablement #1399
Closed
@chance-coleman chance-coleman merged commit c6ae565 into main Apr 4, 2025
24 checks passed
@chance-coleman chance-coleman deleted the authpol-remoteserviceaccount-enablement branch April 4, 2025 15:46
@github-actions github-actions Bot mentioned this pull request Apr 4, 2025
Merged
mjnagel pushed a commit that referenced this pull request Apr 14, 2025
@github-actions
chore(main): release 0.40.0 (#1407)
3423176 
🤖 I have created a release *beep* *boop*
---


##
[0.40.0](v0.39.0...v0.40.0)
(2025-04-14)


### ⚠ BREAKING CHANGES

* ServiceMonitors and PodMonitors no longer require TLS configuration
for Istio, and may fail to scrape metrics if TLS configuration is
present. The UDS Operator will handle removing this configuration from
monitors in most cases, but may not update your monitor if TLS
configuration was directly added separate from the Operator's mutations.
In addition, the `istio-certs` and `exempt` scrape classes are no longer
supplied as part of the Prometheus setup and should not be set on your
monitoring resources going forward.
* `Package` CR validation will now prevent creating multiple `Package`
CRs in the same namespace. Ensure that you only have a single `Package`
CR per namespace before this upgrade, otherwise you may be unable to
update them going forward.
* Istio Ambient workloads are now included by default with UDS Core.
These workloads are now part of the `istio-controlplane` component
(previously part of the optional `istio-ambient` component) - any
override values/configuration should target this component instead of
`istio-ambient`.
* Theming configuration for removing additional registration fields has
moved under the `themeCustomizations` values
(`settings.enableRegistrationFields`). If overriding
`DISABLE_REGISTRATION_FIELDS` under `realmInitEnv`, you will need to
switch to this new value.

### Features

* add serviceMesh.mode in Package CR
([#1386](#1386))
([7e50b5d](7e50b5d))
* escape slashes in Keycloak Group names
([#1433](#1433))
([6b6be2d](6b6be2d))
* make istio ambient components default in uds core
([#1428](#1428))
([32d2752](32d2752))
* only allow creation of one `UDSPackage` per namespace
([#1372](#1372))
([2f4dbac](2f4dbac))
* opt prometheus stack into ambient
([#1445](#1445))
([793ccb8](793ccb8))
* recovering lost Keycloak credentials
([#1410](#1410))
([0f3b536](0f3b536))
* task cleanup for Keycloak
([#1448](#1448))
([5af6f2b](5af6f2b))


### Bug Fixes

* authpol remoteserviceaccount enablement
([#1415](#1415))
([c6ae565](c6ae565))
* conditional pepr build in tasks
([#1414](#1414))
([ea75df2](ea75df2))
* make exemptions conditional for `dev-setup`
([#1442](#1442))
([4d7b471](4d7b471))
* move disable registration fields to theme values
([#1397](#1397))
([61c67f0](61c67f0))
* remove flavor from dev deploy of prom CRDs task
([#1419](#1419))
([10c9ff2](10c9ff2))


### Miscellaneous

* **ci:** add e2e tests for cloud distros
([#1259](#1259))
([b116a96](b116a96))
* **deps:** update istio to v1.25.1
([#1387](#1387))
([c538ef4](c538ef4))
* **deps:** update loki
([#1349](#1349))
([f087f55](f087f55))
* **deps:** update loki to v3.4.3
([#1426](#1426))
([cc7fbd1](cc7fbd1))
* **deps:** update neuvector to 5.4.3
([#1368](#1368))
([6c4b44e](6c4b44e))
* **deps:** update prometheus-stack
([#1402](#1402))
([707b07d](707b07d))
* **deps:** update support dependencies to v3.28.14
([#1435](#1435))
([d29d1b5](d29d1b5))
* **deps:** update support dependencies to v3.28.15
([#1441](#1441))
([1e7ebce](1e7ebce))
* **deps:** update support dependencies to v3.4.8
([#1450](#1450))
([598242b](598242b))
* **deps:** update support dependencies to v4.6.1
([#1451](#1451))
([efb22ab](efb22ab))
* **deps:** update support-deps
([#1409](#1409))
([d1ade16](d1ade16))
* **deps:** update support-deps
([#1418](#1418))
([0eecf5f](0eecf5f))
* **deps:** update support-deps
([#1425](#1425))
([9b6f681](9b6f681))
* **deps:** update support-deps
([#1443](#1443))
([05def89](05def89))
* **deps:** update support-deps
([#1455](#1455))
([ccd72cf](ccd72cf))
* **deps:** update vector
([#1444](#1444))
([d36014d](d36014d))
* **deps:** update velero to v8.7.1
([#1391](#1391))
([ea4ed0f](ea4ed0f))
* **docs:** fix order of authpols doc
([#1408](#1408))
([ee55ab1](ee55ab1))
* prefer `===` for comparisons
([#1412](#1412))
([6963633](6963633))
* reduce sidecar cpu/memory requests for CI single-layer testing
([#1459](#1459))
([cc8c405](cc8c405))
* remove watch and conditional logic around ambient component
([#1447](#1447))
([d519af3](d519af3))
* update changelog
([#1406](#1406))
([4239d95](4239d95))


### Documentation

* fix Velero doc link path
([#1456](#1456))
([01cea57](01cea57))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
noahpb pushed a commit that referenced this pull request Apr 15, 2025
@github-actions @noahpb
chore(main): release 0.40.0 (#1407)
4d2e912 
🤖 I have created a release *beep* *boop*
---


##
[0.40.0](v0.39.0...v0.40.0)
(2025-04-14)


### ⚠ BREAKING CHANGES

* ServiceMonitors and PodMonitors no longer require TLS configuration
for Istio, and may fail to scrape metrics if TLS configuration is
present. The UDS Operator will handle removing this configuration from
monitors in most cases, but may not update your monitor if TLS
configuration was directly added separate from the Operator's mutations.
In addition, the `istio-certs` and `exempt` scrape classes are no longer
supplied as part of the Prometheus setup and should not be set on your
monitoring resources going forward.
* `Package` CR validation will now prevent creating multiple `Package`
CRs in the same namespace. Ensure that you only have a single `Package`
CR per namespace before this upgrade, otherwise you may be unable to
update them going forward.
* Istio Ambient workloads are now included by default with UDS Core.
These workloads are now part of the `istio-controlplane` component
(previously part of the optional `istio-ambient` component) - any
override values/configuration should target this component instead of
`istio-ambient`.
* Theming configuration for removing additional registration fields has
moved under the `themeCustomizations` values
(`settings.enableRegistrationFields`). If overriding
`DISABLE_REGISTRATION_FIELDS` under `realmInitEnv`, you will need to
switch to this new value.

### Features

* add serviceMesh.mode in Package CR
([#1386](#1386))
([7e50b5d](7e50b5d))
* escape slashes in Keycloak Group names
([#1433](#1433))
([6b6be2d](6b6be2d))
* make istio ambient components default in uds core
([#1428](#1428))
([32d2752](32d2752))
* only allow creation of one `UDSPackage` per namespace
([#1372](#1372))
([2f4dbac](2f4dbac))
* opt prometheus stack into ambient
([#1445](#1445))
([793ccb8](793ccb8))
* recovering lost Keycloak credentials
([#1410](#1410))
([0f3b536](0f3b536))
* task cleanup for Keycloak
([#1448](#1448))
([5af6f2b](5af6f2b))


### Bug Fixes

* authpol remoteserviceaccount enablement
([#1415](#1415))
([c6ae565](c6ae565))
* conditional pepr build in tasks
([#1414](#1414))
([ea75df2](ea75df2))
* make exemptions conditional for `dev-setup`
([#1442](#1442))
([4d7b471](4d7b471))
* move disable registration fields to theme values
([#1397](#1397))
([61c67f0](61c67f0))
* remove flavor from dev deploy of prom CRDs task
([#1419](#1419))
([10c9ff2](10c9ff2))


### Miscellaneous

* **ci:** add e2e tests for cloud distros
([#1259](#1259))
([b116a96](b116a96))
* **deps:** update istio to v1.25.1
([#1387](#1387))
([c538ef4](c538ef4))
* **deps:** update loki
([#1349](#1349))
([f087f55](f087f55))
* **deps:** update loki to v3.4.3
([#1426](#1426))
([cc7fbd1](cc7fbd1))
* **deps:** update neuvector to 5.4.3
([#1368](#1368))
([6c4b44e](6c4b44e))
* **deps:** update prometheus-stack
([#1402](#1402))
([707b07d](707b07d))
* **deps:** update support dependencies to v3.28.14
([#1435](#1435))
([d29d1b5](d29d1b5))
* **deps:** update support dependencies to v3.28.15
([#1441](#1441))
([1e7ebce](1e7ebce))
* **deps:** update support dependencies to v3.4.8
([#1450](#1450))
([598242b](598242b))
* **deps:** update support dependencies to v4.6.1
([#1451](#1451))
([efb22ab](efb22ab))
* **deps:** update support-deps
([#1409](#1409))
([d1ade16](d1ade16))
* **deps:** update support-deps
([#1418](#1418))
([0eecf5f](0eecf5f))
* **deps:** update support-deps
([#1425](#1425))
([9b6f681](9b6f681))
* **deps:** update support-deps
([#1443](#1443))
([05def89](05def89))
* **deps:** update support-deps
([#1455](#1455))
([ccd72cf](ccd72cf))
* **deps:** update vector
([#1444](#1444))
([d36014d](d36014d))
* **deps:** update velero to v8.7.1
([#1391](#1391))
([ea4ed0f](ea4ed0f))
* **docs:** fix order of authpols doc
([#1408](#1408))
([ee55ab1](ee55ab1))
* prefer `===` for comparisons
([#1412](#1412))
([6963633](6963633))
* reduce sidecar cpu/memory requests for CI single-layer testing
([#1459](#1459))
([cc8c405](cc8c405))
* remove watch and conditional logic around ambient component
([#1447](#1447))
([d519af3](d519af3))
* update changelog
([#1406](#1406))
([4239d95](4239d95))


### Documentation

* fix Velero doc link path
([#1456](#1456))
([01cea57](01cea57))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
noahpb pushed a commit that referenced this pull request Apr 17, 2025
@chance-coleman @noahpb
fix: authpol remoteserviceaccount enablement (#1415)
c5c9dd8 
## Description
Went through and identified the service accounts for each application
and added the `remoteServiceAccount` to the UDSPackage Spec.Allow rules
for ingress rules.

This is in addition to the existing `selectors`, `remoteNamespace`,
`remoteSelector` fields. In the ambient authpols operator implementation
the `remoteServiceAccount` would take precedent for the from.source
block of the authorizationpolicy.

## Related Issue

Fixes #1399

## Type of change

- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Other (security config, docs update, etc)

## Steps to Validate
- Not much here other than deploying uds-core and checking the
authorization policies that are generated utilize the new
remoteServiceAccount to create the `from.source` block rather than
existing selectors.
- `uds run test:uds-core-e2e`
- use `k9s` to search through the `authorizationpolicies` for the
following policies:

| policy name | original `from.source` value | new `from.source` value |
|---|---|---|
| `protect-keycloak-ingress-uds-operator` | `Namespace:pepr-system` |
`Principals:cluster.local/ns/pepr-system/sa/pepr-uds-core` |
| `protect-loki-ingress-grafana-log-queries` | `Namespace:grafana` |
`Principals:cluster.local/ns/grafana/sa/grafana` |
| `protect-loki-ingress-prometheus-metrics` | `Namespaces:monitoring` |
`Principals:cluster.local/ns/monitoring/sa/kube-prometheus-stack-prometheus`
|
| `protect-loki-ingress-vector-log-storage` | `Namespace:vector` |
`Principals:cluster.local/ns/vector/sa/vector` |
| `protect-prometheus-stack-ingress-grafana-alerts-queries` |
`Namespace:grafana` | `Principals:cluster.local/ns/grafana/sa/grafana` |
| `protect-prometheus-stack-ingress-grafana-metrics-queries` |
`Namespaces:grafana` | `Principals:cluster.local/ns/grafana/sa/grafana`
|
| `protect-velero-ingress-prometheus-metrics` | `Namespaces:monitoring`
|
`Principals:cluster.local/ns/monitoring/sa/kube-prometheus-stack-prometheus`
|
| `protect-vector-ingress-prometheus-metrics` | `Namespaces:monitoring`
|
`Principals:cluster.local/ns/monitoring/sa/kube-prometheus-stack-prometheus`
|

## Checklist before merging

- [x] Test, docs, adr added or updated as needed
- [x] [Contributor
Guide](https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md)
followed
noahpb pushed a commit that referenced this pull request Apr 17, 2025
@github-actions @noahpb
chore(main): release 0.40.0 (#1407)
8f345bf 
🤖 I have created a release *beep* *boop*
---


##
[0.40.0](v0.39.0...v0.40.0)
(2025-04-14)


### ⚠ BREAKING CHANGES

* ServiceMonitors and PodMonitors no longer require TLS configuration
for Istio, and may fail to scrape metrics if TLS configuration is
present. The UDS Operator will handle removing this configuration from
monitors in most cases, but may not update your monitor if TLS
configuration was directly added separate from the Operator's mutations.
In addition, the `istio-certs` and `exempt` scrape classes are no longer
supplied as part of the Prometheus setup and should not be set on your
monitoring resources going forward.
* `Package` CR validation will now prevent creating multiple `Package`
CRs in the same namespace. Ensure that you only have a single `Package`
CR per namespace before this upgrade, otherwise you may be unable to
update them going forward.
* Istio Ambient workloads are now included by default with UDS Core.
These workloads are now part of the `istio-controlplane` component
(previously part of the optional `istio-ambient` component) - any
override values/configuration should target this component instead of
`istio-ambient`.
* Theming configuration for removing additional registration fields has
moved under the `themeCustomizations` values
(`settings.enableRegistrationFields`). If overriding
`DISABLE_REGISTRATION_FIELDS` under `realmInitEnv`, you will need to
switch to this new value.

### Features

* add serviceMesh.mode in Package CR
([#1386](#1386))
([7e50b5d](7e50b5d))
* escape slashes in Keycloak Group names
([#1433](#1433))
([6b6be2d](6b6be2d))
* make istio ambient components default in uds core
([#1428](#1428))
([32d2752](32d2752))
* only allow creation of one `UDSPackage` per namespace
([#1372](#1372))
([2f4dbac](2f4dbac))
* opt prometheus stack into ambient
([#1445](#1445))
([793ccb8](793ccb8))
* recovering lost Keycloak credentials
([#1410](#1410))
([0f3b536](0f3b536))
* task cleanup for Keycloak
([#1448](#1448))
([5af6f2b](5af6f2b))


### Bug Fixes

* authpol remoteserviceaccount enablement
([#1415](#1415))
([c6ae565](c6ae565))
* conditional pepr build in tasks
([#1414](#1414))
([ea75df2](ea75df2))
* make exemptions conditional for `dev-setup`
([#1442](#1442))
([4d7b471](4d7b471))
* move disable registration fields to theme values
([#1397](#1397))
([61c67f0](61c67f0))
* remove flavor from dev deploy of prom CRDs task
([#1419](#1419))
([10c9ff2](10c9ff2))


### Miscellaneous

* **ci:** add e2e tests for cloud distros
([#1259](#1259))
([b116a96](b116a96))
* **deps:** update istio to v1.25.1
([#1387](#1387))
([c538ef4](c538ef4))
* **deps:** update loki
([#1349](#1349))
([f087f55](f087f55))
* **deps:** update loki to v3.4.3
([#1426](#1426))
([cc7fbd1](cc7fbd1))
* **deps:** update neuvector to 5.4.3
([#1368](#1368))
([6c4b44e](6c4b44e))
* **deps:** update prometheus-stack
([#1402](#1402))
([707b07d](707b07d))
* **deps:** update support dependencies to v3.28.14
([#1435](#1435))
([d29d1b5](d29d1b5))
* **deps:** update support dependencies to v3.28.15
([#1441](#1441))
([1e7ebce](1e7ebce))
* **deps:** update support dependencies to v3.4.8
([#1450](#1450))
([598242b](598242b))
* **deps:** update support dependencies to v4.6.1
([#1451](#1451))
([efb22ab](efb22ab))
* **deps:** update support-deps
([#1409](#1409))
([d1ade16](d1ade16))
* **deps:** update support-deps
([#1418](#1418))
([0eecf5f](0eecf5f))
* **deps:** update support-deps
([#1425](#1425))
([9b6f681](9b6f681))
* **deps:** update support-deps
([#1443](#1443))
([05def89](05def89))
* **deps:** update support-deps
([#1455](#1455))
([ccd72cf](ccd72cf))
* **deps:** update vector
([#1444](#1444))
([d36014d](d36014d))
* **deps:** update velero to v8.7.1
([#1391](#1391))
([ea4ed0f](ea4ed0f))
* **docs:** fix order of authpols doc
([#1408](#1408))
([ee55ab1](ee55ab1))
* prefer `===` for comparisons
([#1412](#1412))
([6963633](6963633))
* reduce sidecar cpu/memory requests for CI single-layer testing
([#1459](#1459))
([cc8c405](cc8c405))
* remove watch and conditional logic around ambient component
([#1447](#1447))
([d519af3](d519af3))
* update changelog
([#1406](#1406))
([4239d95](4239d95))


### Documentation

* fix Velero doc link path
([#1456](#1456))
([01cea57](01cea57))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
mjnagel pushed a commit to BagelLab/uds-core that referenced this pull request Nov 14, 2025
@chance-coleman @mjnagel
fix: authpol remoteserviceaccount enablement (defenseunicorns#1415)
25b6d9a 
## Description
Went through and identified the service accounts for each application
and added the `remoteServiceAccount` to the UDSPackage Spec.Allow rules
for ingress rules.

This is in addition to the existing `selectors`, `remoteNamespace`,
`remoteSelector` fields. In the ambient authpols operator implementation
the `remoteServiceAccount` would take precedent for the from.source
block of the authorizationpolicy.

## Related Issue

Fixes defenseunicorns#1399

## Type of change

- [x] Bug fix (non-breaking change which fixes an issue)
- [ ] New feature (non-breaking change which adds functionality)
- [ ] Other (security config, docs update, etc)

## Steps to Validate
- Not much here other than deploying uds-core and checking the
authorization policies that are generated utilize the new
remoteServiceAccount to create the `from.source` block rather than
existing selectors.
- `uds run test:uds-core-e2e`
- use `k9s` to search through the `authorizationpolicies` for the
following policies:

| policy name | original `from.source` value | new `from.source` value |
|---|---|---|
| `protect-keycloak-ingress-uds-operator` | `Namespace:pepr-system` |
`Principals:cluster.local/ns/pepr-system/sa/pepr-uds-core` |
| `protect-loki-ingress-grafana-log-queries` | `Namespace:grafana` |
`Principals:cluster.local/ns/grafana/sa/grafana` |
| `protect-loki-ingress-prometheus-metrics` | `Namespaces:monitoring` |
`Principals:cluster.local/ns/monitoring/sa/kube-prometheus-stack-prometheus`
|
| `protect-loki-ingress-vector-log-storage` | `Namespace:vector` |
`Principals:cluster.local/ns/vector/sa/vector` |
| `protect-prometheus-stack-ingress-grafana-alerts-queries` |
`Namespace:grafana` | `Principals:cluster.local/ns/grafana/sa/grafana` |
| `protect-prometheus-stack-ingress-grafana-metrics-queries` |
`Namespaces:grafana` | `Principals:cluster.local/ns/grafana/sa/grafana`
|
| `protect-velero-ingress-prometheus-metrics` | `Namespaces:monitoring`
|
`Principals:cluster.local/ns/monitoring/sa/kube-prometheus-stack-prometheus`
|
| `protect-vector-ingress-prometheus-metrics` | `Namespaces:monitoring`
|
`Principals:cluster.local/ns/monitoring/sa/kube-prometheus-stack-prometheus`
|

## Checklist before merging

- [x] Test, docs, adr added or updated as needed
- [x] [Contributor
Guide](https://github.com/defenseunicorns/uds-template-capability/blob/main/CONTRIBUTING.md)
followed
mjnagel pushed a commit to BagelLab/uds-core that referenced this pull request Nov 14, 2025
@github-actions @mjnagel
chore(main): release 0.40.0 (defenseunicorns#1407)
ef1be22 
🤖 I have created a release *beep* *boop*
---


##
[0.40.0](defenseunicorns/uds-core@v0.39.0...v0.40.0)
(2025-04-14)


### ⚠ BREAKING CHANGES

* ServiceMonitors and PodMonitors no longer require TLS configuration
for Istio, and may fail to scrape metrics if TLS configuration is
present. The UDS Operator will handle removing this configuration from
monitors in most cases, but may not update your monitor if TLS
configuration was directly added separate from the Operator's mutations.
In addition, the `istio-certs` and `exempt` scrape classes are no longer
supplied as part of the Prometheus setup and should not be set on your
monitoring resources going forward.
* `Package` CR validation will now prevent creating multiple `Package`
CRs in the same namespace. Ensure that you only have a single `Package`
CR per namespace before this upgrade, otherwise you may be unable to
update them going forward.
* Istio Ambient workloads are now included by default with UDS Core.
These workloads are now part of the `istio-controlplane` component
(previously part of the optional `istio-ambient` component) - any
override values/configuration should target this component instead of
`istio-ambient`.
* Theming configuration for removing additional registration fields has
moved under the `themeCustomizations` values
(`settings.enableRegistrationFields`). If overriding
`DISABLE_REGISTRATION_FIELDS` under `realmInitEnv`, you will need to
switch to this new value.

### Features

* add serviceMesh.mode in Package CR
([defenseunicorns#1386](defenseunicorns#1386))
([7e50b5d](defenseunicorns@7e50b5d))
* escape slashes in Keycloak Group names
([defenseunicorns#1433](defenseunicorns#1433))
([6b6be2d](defenseunicorns@6b6be2d))
* make istio ambient components default in uds core
([defenseunicorns#1428](defenseunicorns#1428))
([32d2752](defenseunicorns@32d2752))
* only allow creation of one `UDSPackage` per namespace
([defenseunicorns#1372](defenseunicorns#1372))
([2f4dbac](defenseunicorns@2f4dbac))
* opt prometheus stack into ambient
([defenseunicorns#1445](defenseunicorns#1445))
([793ccb8](defenseunicorns@793ccb8))
* recovering lost Keycloak credentials
([defenseunicorns#1410](defenseunicorns#1410))
([0f3b536](defenseunicorns@0f3b536))
* task cleanup for Keycloak
([defenseunicorns#1448](defenseunicorns#1448))
([5af6f2b](defenseunicorns@5af6f2b))


### Bug Fixes

* authpol remoteserviceaccount enablement
([defenseunicorns#1415](defenseunicorns#1415))
([c6ae565](defenseunicorns@c6ae565))
* conditional pepr build in tasks
([defenseunicorns#1414](defenseunicorns#1414))
([ea75df2](defenseunicorns@ea75df2))
* make exemptions conditional for `dev-setup`
([defenseunicorns#1442](defenseunicorns#1442))
([4d7b471](defenseunicorns@4d7b471))
* move disable registration fields to theme values
([defenseunicorns#1397](defenseunicorns#1397))
([61c67f0](defenseunicorns@61c67f0))
* remove flavor from dev deploy of prom CRDs task
([defenseunicorns#1419](defenseunicorns#1419))
([10c9ff2](defenseunicorns@10c9ff2))


### Miscellaneous

* **ci:** add e2e tests for cloud distros
([defenseunicorns#1259](defenseunicorns#1259))
([b116a96](defenseunicorns@b116a96))
* **deps:** update istio to v1.25.1
([defenseunicorns#1387](defenseunicorns#1387))
([c538ef4](defenseunicorns@c538ef4))
* **deps:** update loki
([defenseunicorns#1349](defenseunicorns#1349))
([f087f55](defenseunicorns@f087f55))
* **deps:** update loki to v3.4.3
([defenseunicorns#1426](defenseunicorns#1426))
([cc7fbd1](defenseunicorns@cc7fbd1))
* **deps:** update neuvector to 5.4.3
([defenseunicorns#1368](defenseunicorns#1368))
([6c4b44e](defenseunicorns@6c4b44e))
* **deps:** update prometheus-stack
([defenseunicorns#1402](defenseunicorns#1402))
([707b07d](defenseunicorns@707b07d))
* **deps:** update support dependencies to v3.28.14
([defenseunicorns#1435](defenseunicorns#1435))
([d29d1b5](defenseunicorns@d29d1b5))
* **deps:** update support dependencies to v3.28.15
([defenseunicorns#1441](defenseunicorns#1441))
([1e7ebce](defenseunicorns@1e7ebce))
* **deps:** update support dependencies to v3.4.8
([defenseunicorns#1450](defenseunicorns#1450))
([598242b](defenseunicorns@598242b))
* **deps:** update support dependencies to v4.6.1
([defenseunicorns#1451](defenseunicorns#1451))
([efb22ab](defenseunicorns@efb22ab))
* **deps:** update support-deps
([defenseunicorns#1409](defenseunicorns#1409))
([d1ade16](defenseunicorns@d1ade16))
* **deps:** update support-deps
([defenseunicorns#1418](defenseunicorns#1418))
([0eecf5f](defenseunicorns@0eecf5f))
* **deps:** update support-deps
([defenseunicorns#1425](defenseunicorns#1425))
([9b6f681](defenseunicorns@9b6f681))
* **deps:** update support-deps
([defenseunicorns#1443](defenseunicorns#1443))
([05def89](defenseunicorns@05def89))
* **deps:** update support-deps
([defenseunicorns#1455](defenseunicorns#1455))
([ccd72cf](defenseunicorns@ccd72cf))
* **deps:** update vector
([defenseunicorns#1444](defenseunicorns#1444))
([d36014d](defenseunicorns@d36014d))
* **deps:** update velero to v8.7.1
([defenseunicorns#1391](defenseunicorns#1391))
([ea4ed0f](defenseunicorns@ea4ed0f))
* **docs:** fix order of authpols doc
([defenseunicorns#1408](defenseunicorns#1408))
([ee55ab1](defenseunicorns@ee55ab1))
* prefer `===` for comparisons
([defenseunicorns#1412](defenseunicorns#1412))
([6963633](defenseunicorns@6963633))
* reduce sidecar cpu/memory requests for CI single-layer testing
([defenseunicorns#1459](defenseunicorns#1459))
([cc8c405](defenseunicorns@cc8c405))
* remove watch and conditional logic around ambient component
([defenseunicorns#1447](defenseunicorns#1447))
([d519af3](defenseunicorns@d519af3))
* update changelog
([defenseunicorns#1406](defenseunicorns#1406))
([4239d95](defenseunicorns@4239d95))


### Documentation

* fix Velero doc link path
([defenseunicorns#1456](defenseunicorns#1456))
([01cea57](defenseunicorns@01cea57))

---
This PR was generated with [Release
Please](https://github.com/googleapis/release-please). See
[documentation](https://github.com/googleapis/release-please#release-please).

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@mjnagel mjnagel mjnagel approved these changes

Assignees

@chance-coleman chance-coleman

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

RemoteServiceAccount Enablement

2 participants

@chance-coleman @mjnagel