ERS Helm release notes

Rebuild generated Java truststores whenever their init containers run, including after a node restart. Fail initialization if a configured certificate cannot be imported.

Pass the PEM trust bundle directly to Keycloak setup instead of generating a Java keystore for it.

Use x-ssl-client-cert consistently for forwarded client certificates. Strip client-supplied certificate headers on public HAProxy listeners and translate nginx ingress’s verified header.

Supply default CPU requests and memory budgets for CLM, CARA, Keycloak and HAProxy, plus resource budgets for dependency waits and setup containers. Render resource requests and limits independently. KMS application budgets remain unset by default.

Correct CARA and KMS Prometheus endpoint access settings and enable KMS health probe endpoints. Add KMIP proxy probes on its dedicated health listener.

Pipeline: validate and scan a KMS-enabled configuration, require KMIP key lifecycle and PKCS#11 session and authentication checks, and collect container statuses and release events alongside logs.

Wait for dependency Service readiness when starting CARA WS, CLM server and CLM clients, so surviving replicas can satisfy startup dependencies after a node reboot.

Allow additional environment variables in the CARA setup Job.

Enable CARA JDBC pool metrics and make CARA Prometheus metrics follow the chart’s metrics setting.

Write HAProxy traffic logs and CLM audit console logs as ECS JSON.

Remove the UI startup wrappers previously used for SIGTERM handling.

Support a separate Spring Actuator management port, optional Prometheus metrics and a release-wide ServiceMonitor, including HAProxy and Keycloak metrics.

Support Deployment and DaemonSet workloads with component-specific rollout strategies. Keep schema-owning components on coordinated replacement strategies.

Give HAProxy per-pod backends through companion headless Services and retry failed requests on a sibling backend.

Watch workload rollouts for startup dependencies, use distroless kubectl for those waits, and use BusyBox for database probes.

Update Flyway integration and database locking for MariaDB Galera, including update-based Quartz locks.

Configure application audit and console logging, and send HAProxy access logs to OpenSearch through syslog.

Make ACME configuration stable across renders and expose its configuration options.

Run the RIS integration test in a later pipeline stage so the SCEP server is available.

Update the Trivy version used by the pipeline.

Refresh image defaults, including Keycloak, for a release prompted by a Keycloak vulnerability update.

Keep CARA WS initialization on version 3.5.0.3 after an incompatible change in 3.5.0.4.

Update the CycloneDX CLI and SBOM utility used for Dependency-Track uploads.

Update ECS logging environment configuration across ERS workloads.

Add source-repository metadata to the chart.

Correct the curl-jq image tag used by the pipeline.

Add instructions and example values for assembling an HSM Cryptoki library from in-cluster chunks and mounting it into CARA WS.

Add service names and environment identity to ECS logging.

Add the KMS PKCS#11 server and correct its deployment configuration.

Correct EST health checks and workload resource kinds.

Add comments explaining PQC algorithm configuration in the values files.

Extend ACME validation and correct EST integration tests.

Correct application-picker URLs between the CLM, KMS and CARA user interfaces.

Adapt RIS integration tests to an OpenSSL update.

Add configurable DNS settings to ERS pods.

Correct the reference-system pipeline Job timeout.

Update the chart for CARA 3 and add CARA PQC template examples.

Allow cert-manager to use the ACME endpoint.

Correct HAProxy configuration generation for an empty final line.