# Release notes for Self-Hosted Deployment in Amazon Web Services > Learn about new features, improvements, and fixed issues. ## Version 1.3.2 — July 13, 2026 ### New features #### Automatic solution onboarding The `upc-onboarding` post-deployment job now runs on AWS. On a new deployment, it creates the default organization and grants the solution administrator the Owner and Global Admin roles, so the platform is usable immediately after installation. The `upc-onboarding` job is idempotent and is therefore safe to run on every deployment. On an environment that already has an organization and an administrator, for example one migrated from an earlier release, it detects the existing state and exits without making changes. ## Version 1.3.1 — July 7, 2026 ### New features #### Keycloak client for the License server New deployments now automatically create the `unity-licensing-server` Keycloak client through the realm import when Keycloak starts. This client is required for the License server. For an existing deployment, create the client manually. Use `upc-cli` to generate the import file, and then upload it through the Keycloak Admin console: 1. Fetch the client secret from the cluster: ```sh SECRET=$(kubectl get secret license-server -n asset-solutions \ -o jsonpath='{.data.LicensingServer_Keycloak__ClientSecret}' | base64 -d) ``` 2. Generate the import file with the `upc-cli` image from the Unity registry: ```sh docker run --rm uccmpprivatecloud.azurecr.io/docker/upc-cli:1.1.143 \ --fqdn --no-auth keycloak generate-client-json \ --client-secret-value "$SECRET" \ > unity-licensing-server-client.json ``` 3. In the Keycloak Admin console: 1. Select the **unity** realm. 2. Select **Clients** > **Import client**. 3. Browse to `unity-licensing-server-client.json`. 4. Select **Save**. For more information about managing the License server, refer to [Licensing](/cloud/virtual-private-cloud/admin/licensing.md). #### Pin Traefik node ports To pin the Kubernetes node ports that Traefik uses, use the optional Terraform variable `traefik_node_ports`. This variable is a `map(number)` and defaults to `{}`. The supported keys are `web` and `websecure`, and each value must be within the range 30000 to 32767. For example: `traefik_node_ports = { web = 32080, websecure = 32443 }`. Keys that you don't set are assigned by Kubernetes. By default, Traefik node ports are now assigned by Kubernetes. Previously, the `web` entrypoint was pinned to node port `32080`. Existing clusters keep their currently allocated node port during the next ArgoCD sync, because Kubernetes doesn't reassign a node port when Helm stops requesting one. If your Network Load Balancer (NLB) target group or a firewall rule depends on a stable port, pin it with the `traefik_node_ports` variable. ### Improvements #### Restricted Pod Security Admission compliance All Helm workloads now render a security context that complies with the Kubernetes Restricted Pod Security Admission (PSA) standard by default. As part of this change, UVCS now runs as a non-root user (UID 1000) instead of as the root user. > **Warning:** > > If you have an existing UVCS deployment (`enable_uvcs=true`), plan a maintenance window before you upgrade. On the first UVCS pod restart after the upgrade, Kubernetes recursively changes the ownership of the UVCS persistent volume (mounted at `/jet`) to group ID 1000. For a large repository on block storage, such as gp3, this operation can take several minutes, during which the UVCS pod is unavailable. Before you upgrade, confirm that your CSI driver applies `fsGroup` correctly. After the upgrade, verify that the UVCS pod restarted with the expected ownership: ```sh kubectl exec uvcs-0 -c uvcs -n asset-solutions -- id kubectl exec uvcs-0 -c uvcs -n asset-solutions -- ls -ld /jet ``` The `id` command must report `uid=1000 gid=1000`, and the `/jet` directory must belong to group `1000` with no permission errors. #### AWS Terraform provider upgrade Upgraded the AWS Terraform provider to `~> 6.49`. This upgrade clears a persistent `terraform plan` difference on the Amazon S3 server-side encryption resources that appeared after AWS began disabling server-side encryption with customer-provided keys (SSE-C) by default in April 2026. This upgrade doesn't change any infrastructure. #### Automatic restart of stateful workloads on configuration changes StatefulSet workloads, such as `uvcs` and `license-server`, now restart automatically when their ConfigMap, Secret, or ExternalSecret values change. This behavior matches Deployment workloads. Previously, a configuration change didn't affect the running pod until you manually restarted it. ### Fixed issues #### Project creation Fixed an issue where creating a project returned a 404 error. The Mini-USF Traefik routes were missing the create-project endpoint, so you could manage existing projects but couldn't create a project. The route is now generated and served. #### Traefik installation failure Fixed a Traefik installation failure (`Middleware ... already exists`) that stale 3D Data Streaming route templates caused. The data-streaming routes now match the upstream gateway, and the retired `tiles` path is removed because the `groups` path replaced it. #### Asset storage message queue Fixed the `asset-storage` service so that it connects to the in-cluster RabbitMQ broker (`rabbitmq-asset-solutions`) for its service message queue. ## Version 1.3.0 — June 8, 2026 ### Breaking changes #### Mini-USF version 2 upgrade Upgraded Mini-USF to version 2 to decouple Keycloak from entities, such as projects. Before you upgrade, you must migrate your existing Mini-USF v1 setup. For detailed instructions, refer to [Migrate Mini-USF from version 1 to version 2](./maintenance/migrate-mini-usf-to-v2.md). #### Configure Pixyz licenses using Terraform variables Provided Pixyz workflows with static licenses via the Terraform variables `pixyz_license` and `pixyz_license_3dds`, instead of manually creating the Kubernetes secret. Set each variable to the base64‑encoded license content. ### Improvements #### Kubernetes 1.33 Upgraded the EKS cluster to Kubernetes 1.33. Updated EKS‑managed add‑ons to the matching AWS default versions. No node recycling was required. #### Distributed object storage by default Enabled RustFS to run in distributed mode by default for improved resilience. Fixed an out‑of‑memory issue that affected RustFS. #### Default monitoring alerts Added a set of default alerts to the kube-prometheus-stack. #### Larger default storage sizes Increased the default PostgreSQL data volume from 200 GiB to 400 GiB and the pgBackRest backup repository from 400 GiB to 800 GiB. On clusters that use gp3 storage, these volumes resize online during the next ArgoCD sync with no downtime. ### Fixed issues #### Automation Manager post-install job Fixed the `automation-manager` post‑install job failing with a permission error when it authenticated to the container registry as a non‑root user. ## Version 1.2.3 — May 20, 2026 ### Fixed issues #### Workspace service with an external UVCS server Modified the `workspace-service` to honor the `uvcs_repository_guid` variable when `enable_uvcs=false`. The workspace pod skips in-cluster UVCS discovery and connects to your pre-existing UVCS repository, so it starts successfully when pointed at an external UVCS server. ## Version 1.2.2 — May 12, 2026 ### Fixed issues #### 3D Data Streaming workflow retries Fixed 3D Data Streaming (3DDS) workflows so they increase memory allocation correctly on retry after an out-of-memory failure. Previously, the memory request didn't increase on retries, which could cause repeated failures. ## Version 1.2.1 — February 23, 2026 ### Improvements ### Upgraded services These services have been upgraded: * Asset Manager 1.1.5 with improved timeout issue handling when downloading assets ## Version 1.2.0 — February 13, 2026 ### New features #### UVCS deployment through Helm chart Unity Version Control Server (UVCS) can now be deployed through a Helm chart. To enable this feature, set the Terraform variable `enable_uvcs` to `true` in your Terraform configuration. ## Version 1.1.8 — February 17, 2026 ### Improvements #### RabbitMQ operator monitoring By default, the RabbitMQ operator no longer creates Prometheus `ServiceMonitor` and `PodMonitor` resources. This prevents errors on clusters that don't have the Prometheus Operator custom resource definitions (CRDs) installed. ## Version 1.1.7 — February 16, 2026 ### Breaking change #### Static license file required for Pixyz workflows Removed support for the FlexLM license server in workflows. You must have a static license file. ## Version 1.1.6 — February 12, 2026 ### Improvements #### Valkey deployment command Added a target for deploying Valkey in the Makefile. ## Version 1.1.5 — February 10, 2026 ### Fixed issues #### MinIO operator permissions Reverted the MinIO operator to use cluster-scoped `ClusterRole` and `ClusterRoleBinding` resources, restoring the previous configuration and undoing the namespaced roles change. ## Version 1.1.4 — February 6, 2026 ### Improvements #### RDS PostgreSQL performance defaults Changed the default RDS PostgreSQL instance type to `db.m6g.xlarge` for more consistent performance, and changed RDS PostgreSQL to use `gp3` storage with 3000 IOPS. You can override these defaults in your Terraform configuration. ## Version 1.1.3 — February 4, 2026 ### Improvements #### RDS PostgreSQL and backup defaults Several defaults were updated: * The default RDS PostgreSQL instance type is now `db.t3.xlarge`. * The default value of `rds_postgres_random_page_cost` is now `2`. * The default value of `rds_postgres_allocated_storage` is now `100`. * Default volume mounts were added to the Percona Server for MongoDB (PSMDB) backup configuration. ## Version 1.1.2 — December 09, 2025 The version 1.1.2 corresponds to the internal version code v2025.49.267 of Self-Hosted Deployment. ### Breaking change Valkey replaces AWS Elasticache: a new Valkey Helm chart replaces AWS Elasticache for Redis OSS. After deploying the latest Helm charts, run the following command to ensure that all services connect to Valkey instead of Elasticache: ```bash kubectl rollout restart deployment -l creator-services-app=asset-solutions --namespace=asset-solutions ``` if you modified the default namespace, update it in the command accordingly. ### New features #### Service versions Unity Dashboard now displays the versions of Self-Hosted Deployment, Asset Manager, and Pipeline Automation. To view the version of a service, select your profile picture, and then locate the version from the menu. #### Bulk edit of assets You can now [edit assets in bulk](/cloud/asset-manager/bulk-metadata-editing.md). #### Exploration of complex assembly data in 3D Data Streaming models Using the new scene hierarchy feature in 3D Data Streaming (3DDS) models, browse through complex engineering assembly data, from 3DDS previews. #### Event-based automations You can now create [automations that trigger pipelines based on specific events](/cloud/asset-manager/automation-integration/create-event-automation-asset-manager.md). #### Automation apps These new automation apps are available: * HTTP Client 0.0.5 * Python 0.0.1 * Linux Shell 0.0.1 #### Custom apps Custom apps are available as a beta feature. To learn how to create a custom app, [contact Unity Support](https://support.unity.com/hc/en-us/requests/new?ticket_form_id=36798331373844). ### Improvements #### Upgraded services These services have been upgraded: * Asset Manager 1.1.4 * Asset Transformer 1.1.3 ## Version 1.1.0 — November 4, 2025 ### New features #### Terraform variables for FlexLM licensing These new Terraform variables are available: * `flexlm_host`: an IP address or the hostname. * `flexlm_port`. To use these variables, complete these steps: 1. Add the variables to your Terraform configuration. 2. Delete the values from their previous location where you previously managed them manually, that is, the `flexlm` section in the file `aws/applications/builtins/values.yaml`. 3. To update the generated Helm charts with the correct values, run the command `make apply-`. ### Improvements #### Automated cluster bootstrap You can now install a cluster-bootstrap Helm chart that automatically creates the required cluster resources, such as storage classes. This feature is enabled by default. However, if you use an existing cluster, this feature is automatically disabled: `enable_eks=false`. > **Warning:** > > If you have installed a cluster-bootstrap Helm chart but have an existing `efs-sc` storage class that you have manually created, you must update the existing storage classes as follows before you upgrade. To update the existing storage classes before you upgrade, run these commands: ```sh # If you have deployed the solution through Helm, add the Helm management labels to the existing efs-sc storage class. This step isn\'t necessary for ArgoCD. kubectl patch storageclass efs-sc --type='merge' -p='{"metadata":{"labels":{"app.kubernetes.io/managed-by":"Helm"},"annotations":{"meta.helm.sh/release-name":"cluster-bootstrap","meta.helm.sh/release-namespace":"asset-solutions"}}}' # Remove the default flag from the gp2 storage class, because the gp3 storage class becomes the default storage class. kubectl patch storageclass gp2 -p '{"metadata": {"annotations":{"storageclass.kubernetes.io/is-default-class":"false"}}}' ``` #### Migration from MongoDB to Percona Server for MongoDB We're migrating away from the MongoDB virtual machine (VM) to Percona Server for MongoDB (PSMDB). PSMDB is based on MongoDB Community Edition but extends it to an Enterprise Edition. Read more about [differences between PSMDB and MongoDB](https://docs.percona.com/percona-server-for-mongodb/7.0/comparison.html) in Percona documentation. The new Terraform variable `enable_percona_mongo` is for the deployment of the PSMDB operator and database in your Kubernetes cluster as a parallel setup. This variable is disabled by default. However, to ensure zero downtime, all services initially continue using your current MongoDB instance. The connection string logic follows this priority order: 1. The custom URI, if provided 2. The existing MongoDB VM 3. The new PSMDB cluster Migrate data at your own pace with this staged approach. Read more about [migrating your data to PSMDB](./installation/migrate-to-psmdb.md). #### Monitoring for PSMDB The new Terraform variable `enable_percona_monitoring` is for the deployment of Percona Monitoring and Management (PMM) for PSMDB monitoring. This variable is disabled by default. To access PMM from outside the Kubernetes cluster, follow these steps: 1. Expose PMM under a new subdomain. 2. Generate an API key in PMM for PSMDB to report metrics. 3. Update the Terraform variable `psmdb_pmm_server_token`. ### Known issues #### Asset Manager for Self-Hosted Deployment * You can manually create tags for assets, but you can't automatically generate tags. Self-Hosted Deployment doesn't support this feature. If you select **Generate Tags** in the asset properties in edit mode, Asset Manager doesn't suggest any tag and displays an error message. This behavior is expected. This button will be removed in a future version. * If you try to move assets between collections, Asset Manager might not move all assets, but informs you that the operation was successful. This issue is scheduled to be fixed in the next release.