This is a configuration and documentation release. Keep your existing 14.12.1 application images and compose tags. There is no new recording-solution branch or image tag for 14.12.2.
Follow these steps in order only for the hardening options you need.
Before you start
-
You are already on VRS 14.12.1 (images/tags unchanged for this release)
-
You can open Keycloak Admin for the realm used by VRS login
-
Optional PostgreSQL HA: you have read VRS PostgreSQL HA Deployment Guide
Step 1 — Confirm You Stay on 14.12.1 Images
Do not clone a new branch or bump compose image tags for 14.12.2. Verify your running stack still uses 14.12.1 tags for the services that shipped in that patch (and mixer still on 14.12.0 if that was your 14.12.1 composition).
Step 2 — Password Policy (Keycloak)
Enforce minimum length, complexity, and password history on the realm used for VRS login. Follow Password policy (Keycloak).
Existing users keep their current passwords until the next password change or admin reset.
Step 3 — Session Timeout (Keycloak)
Set SSO Session Idle and SSO Session Max to match your organization policy. Follow Session timeout (Keycloak SSO Session Idle / Max).
Step 4 — Login Account Lockout (If Not Already Configured)
Login lockout messaging shipped with 14.12.1. If Brute Force Detection is not enabled yet, configure it now using Login account lockout (Keycloak Brute Force Detection).
Step 5 — PostgreSQL HA (Optional)
If you need metadata database HA for vrs / keycloak_vrs, follow:
-
VRS PostgreSQL HA Deployment Guide — deploy steps
This is PostgreSQL metadata HA only. It does not by itself certify full product HA (SIP dual-recorder, media-file replication, or production cutover).
Step 6 — Verify
-
Weak password rejected; strong password accepted (password policy)
-
Idle session forces re-login after SSO Session Idle (session timeout)
-
If BFD is enabled: lock snackbar after max failures; unlock works in Keycloak
-
If PG HA is deployed: write via HAProxy
:5000, failover, and call metadata visible on standbys
What This Release Gives You
-
Keycloak password policy runbook
-
Keycloak SSO session idle / max runbook
-
Continued lockout guidance (from 14.12.1)
-
Optional PostgreSQL metadata HA deployment guide
Rollback
Keycloak settings can be reverted in Realm settings / Authentication policies. Application images do not change for 14.12.2, so there is no image rollback for this release.
See also: Release Notes.