docs(release-notes): clarify reset password links - #2947
Conversation
Signed-off-by: Sebastian Łaskawiec <sebastian.laskawiec@defenseunicorns.com>
There was a problem hiding this comment.
🟡 Changes recommended
The updated release-note bullet is still ambiguous and slightly inconsistent with established docs style, and should explicitly name the public vs admin hostnames to match the PR’s stated clarification goal.
Once you've addressed the issues Copilot identified, you can request another Copilot review.
Pull request overview
Updates the UDS Core 1.12 release notes to reflect the CORE-672 outcome by clarifying how locked-out Registry users should use the reset-password flow without impacting Keycloak admin access.
Changes:
- Replaces the “separate Keycloak public and admin hostnames” notable-feature bullet with a “Reset Password links” bullet tied to #2898.
File summaries
| File | Description |
|---|---|
| docs/operations/release-notes/1-12.mdx | Adjusts the 1.12 “Notable features” list to call out the reset-password link behavior for locked-out Registry users. |
Review details
- Files reviewed: 1/1 changed files
- Comments generated: 1
- Review effort level: Lite
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
 The PR is generally safe to merge, but restoring the concrete public and administrative hostname guidance would prevent a non-blocking documentation regression. Findings
|
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
|
|
||
| - **Envoy Gateway network access:** Set `additionalNetworkAllow` to add `network.allow` entries to the Envoy Gateway `Package`, enabling integrations such as Envoy AI Gateway. See [Configure Core network access](/how-to-guides/networking/configure-core-network-access/) ([#2891](https://github.com/defenseunicorns/uds-core/pull/2891)). | ||
| - **Separate Keycloak public and admin hostnames:** Keycloak now serves public frontend URLs from `sso.<domain>` and administrative frontend URLs from `keycloak.<admin_domain>`. UDS Core defaults the admin domain to `admin.<domain>`, and you can configure it explicitly ([#2898](https://github.com/defenseunicorns/uds-core/pull/2898)). | ||
| - **Reset Password links:** Registry users who are locked out can now reset their password through the public SSO URL without disrupting Realm administration through the admin URL ([#2898](https://github.com/defenseunicorns/uds-core/pull/2898)). |
There was a problem hiding this comment.
I think Registry is a typo? assuming you meant Registered users..
joelmccoy
left a comment
joelmccoy
left a comment
There was a problem hiding this comment.
If we make this change on main, we will want to also make this change on the release branch (release-1.12)
|
|
||
| - **Envoy Gateway network access:** Set `additionalNetworkAllow` to add `network.allow` entries to the Envoy Gateway `Package`, enabling integrations such as Envoy AI Gateway. See [Configure Core network access](/how-to-guides/networking/configure-core-network-access/) ([#2891](https://github.com/defenseunicorns/uds-core/pull/2891)). | ||
| - **Separate Keycloak public and admin hostnames:** Keycloak now serves public frontend URLs from `sso.<domain>` and administrative frontend URLs from `keycloak.<admin_domain>`. UDS Core defaults the admin domain to `admin.<domain>`, and you can configure it explicitly ([#2898](https://github.com/defenseunicorns/uds-core/pull/2898)). | ||
| - **Reset Password links:** Registry users who are locked out can now reset their password through the public SSO URL without disrupting Realm administration through the admin URL ([#2898](https://github.com/defenseunicorns/uds-core/pull/2898)). |
There was a problem hiding this comment.
I'm not sure this is specific to "registry users"... And wasn't this change more than just reset password links? This was to route and template things better based on whether you were accessing keycloak from tenant vs admin path. cc: @chance-coleman can you confirm?
There was a problem hiding this comment.
Yeah. The reset password link was the symptom that led to this, but the actual change is broader request-aware hostname routing for the frontend URLs. Keycloak now determines which gateway the request came through and uses the corresponding public or admin hostname when generating links, instead of applying one hostname to every request.
Description
Clarifies the UDS Core 1.12 release note with the CORE-672 outcome: locked-out Registry users can reset passwords through the public SSO URL without disrupting Realm administration through the admin URL.
Related Issue
Relates to CORE-672
Type of change
Steps to Validate
git diff --checkand confirmdocs/operations/release-notes/1-12.mdxdescribes the Reset Password link use case.Checklist before merging