# Release notes for Self-Hosted Deployment in Amazon Web Services 1.3 > Learn about new features, improvements, and fixed issues. ## Version 1.3.2 — July 13, 2026 ### New features #### Automatic solution onboarding The `upc-onboarding` post-deployment job now runs on AWS. On a new deployment, it creates the default organization and grants the solution administrator the Owner and Global Admin roles, so the platform is usable immediately after installation. The `upc-onboarding` job is idempotent and is therefore safe to run on every deployment. On an environment that already has an organization and an administrator, for example one migrated from an earlier release, it detects the existing state and exits without making changes. ## Version 1.3.1 — July 7, 2026 ### New features #### Keycloak client for the License server New deployments now automatically create the `unity-licensing-server` Keycloak client through the realm import when Keycloak starts. This client is required for the License server. For an existing deployment, create the client manually. Use `upc-cli` to generate the import file, and then upload it through the Keycloak Admin console: 1. Fetch the client secret from the cluster: ```sh SECRET=$(kubectl get secret license-server -n asset-solutions \ -o jsonpath='{.data.LicensingServer_Keycloak__ClientSecret}' | base64 -d) ``` 2. Generate the import file with the `upc-cli` image from the Unity registry: ```sh docker run --rm uccmpprivatecloud.azurecr.io/docker/upc-cli:1.1.143 \ --fqdn --no-auth keycloak generate-client-json \ --client-secret-value "$SECRET" \ > unity-licensing-server-client.json ``` 3. In the Keycloak Admin console: 1. Select the **unity** realm. 2. Select **Clients** > **Import client**. 3. Browse to `unity-licensing-server-client.json`. 4. Select **Save**. For more information about managing the License server, refer to [Licensing](/self-hosted-deployment/admin/licensing.md). #### Pin Traefik node ports To pin the Kubernetes node ports that Traefik uses, use the optional Terraform variable `traefik_node_ports`. This variable is a `map(number)` and defaults to `{}`. The supported keys are `web` and `websecure`, and each value must be within the range 30000 to 32767. For example: `traefik_node_ports = { web = 32080, websecure = 32443 }`. Keys that you don't set are assigned by Kubernetes. By default, Traefik node ports are now assigned by Kubernetes. Previously, the `web` entrypoint was pinned to node port `32080`. Existing clusters keep their currently allocated node port during the next ArgoCD sync, because Kubernetes doesn't reassign a node port when Helm stops requesting one. If your Network Load Balancer (NLB) target group or a firewall rule depends on a stable port, pin it with the `traefik_node_ports` variable. ### Improvements #### Restricted Pod Security Admission compliance All Helm workloads now render a security context that complies with the Kubernetes Restricted Pod Security Admission (PSA) standard by default. As part of this change, UVCS now runs as a non-root user (UID 1000) instead of as the root user. > **Warning:** > > If you have an existing UVCS deployment (`enable_uvcs=true`), plan a maintenance window before you upgrade. On the first UVCS pod restart after the upgrade, Kubernetes recursively changes the ownership of the UVCS persistent volume (mounted at `/jet`) to group ID 1000. For a large repository on block storage, such as gp3, this operation can take several minutes, during which the UVCS pod is unavailable. Before you upgrade, confirm that your CSI driver applies `fsGroup` correctly. After the upgrade, verify that the UVCS pod restarted with the expected ownership: ```sh kubectl exec uvcs-0 -c uvcs -n asset-solutions -- id kubectl exec uvcs-0 -c uvcs -n asset-solutions -- ls -ld /jet ``` The `id` command must report `uid=1000 gid=1000`, and the `/jet` directory must belong to group `1000` with no permission errors. #### AWS Terraform provider upgrade Upgraded the AWS Terraform provider to `~> 6.49`. This upgrade clears a persistent `terraform plan` difference on the Amazon S3 server-side encryption resources that appeared after AWS began disabling server-side encryption with customer-provided keys (SSE-C) by default in April 2026. This upgrade doesn't change any infrastructure. #### Automatic restart of stateful workloads on configuration changes StatefulSet workloads, such as `uvcs` and `license-server`, now restart automatically when their ConfigMap, Secret, or ExternalSecret values change. This behavior matches Deployment workloads. Previously, a configuration change didn't affect the running pod until you manually restarted it. ### Fixed issues #### Project creation Fixed an issue where creating a project returned a 404 error. The Mini-USF Traefik routes were missing the create-project endpoint, so you could manage existing projects but couldn't create a project. The route is now generated and served. #### Traefik installation failure Fixed a Traefik installation failure (`Middleware ... already exists`) that stale 3D Data Streaming route templates caused. The data-streaming routes now match the upstream gateway, and the retired `tiles` path is removed because the `groups` path replaced it. #### Asset storage message queue Fixed the `asset-storage` service so that it connects to the in-cluster RabbitMQ broker (`rabbitmq-asset-solutions`) for its service message queue. ## Version 1.3.0 — June 8, 2026 ### Breaking changes #### Mini-USF version 2 upgrade Upgraded Mini-USF to version 2 to decouple Keycloak from entities, such as projects. Before you upgrade, you must migrate your existing Mini-USF v1 setup. For detailed instructions, refer to [Migrate Mini-USF from version 1 to version 2](./maintenance/migrate-mini-usf-to-v2.md). #### Configure Pixyz licenses using Terraform variables Provided Pixyz workflows with static licenses via the Terraform variables `pixyz_license` and `pixyz_license_3dds`, instead of manually creating the Kubernetes secret. Set each variable to the base64‑encoded license content. ### Improvements #### Kubernetes 1.33 Upgraded the EKS cluster to Kubernetes 1.33. Updated EKS‑managed add‑ons to the matching AWS default versions. No node recycling was required. #### Distributed object storage by default Enabled RustFS to run in distributed mode by default for improved resilience. Fixed an out‑of‑memory issue that affected RustFS. #### Default monitoring alerts Added a set of default alerts to the kube-prometheus-stack. #### Larger default storage sizes Increased the default PostgreSQL data volume from 200 GiB to 400 GiB and the pgBackRest backup repository from 400 GiB to 800 GiB. On clusters that use gp3 storage, these volumes resize online during the next ArgoCD sync with no downtime. ### Fixed issues #### Automation Manager post-install job Fixed the `automation-manager` post‑install job failing with a permission error when it authenticated to the container registry as a non‑root user.