Release notes for Self-Hosted Deployment in Amazon Web Services 1.3

Learn about new features, improvements, and fixed issues.

읽는 시간 5분

최근 업데이트: 8일 전

Version 1.3.2 — July 13, 2026

New features

Automatic solution onboarding

The

upc-onboarding

post-deployment job now runs on AWS. On a new deployment, it creates the default organization and grants the solution administrator the Owner and Global Admin roles, so the platform is usable immediately after installation.

The

upc-onboarding

job is idempotent and is therefore safe to run on every deployment. On an environment that already has an organization and an administrator, for example one migrated from an earlier release, it detects the existing state and exits without making changes.

Version 1.3.1 — July 7, 2026

New features

Keycloak client for the License server

New deployments now automatically create the

unity-licensing-server

Keycloak client through the realm import when Keycloak starts. This client is required for the License server.

For an existing deployment, create the client manually. Use

upc-cli

to generate the import file, and then upload it through the Keycloak Admin console:

Fetch the client secret from the cluster:


SECRET=$(kubectl get secret license-server -n asset-solutions \  -o jsonpath='{.data.LicensingServer_Keycloak__ClientSecret}' | base64 -d)

Generate the import file with the

upc-cli

image from the Unity registry:


docker run --rm uccmpprivatecloud.azurecr.io/docker/upc-cli:1.1.143 \  --fqdn <your-domain> --no-auth keycloak generate-client-json \  --client-secret-value "$SECRET" \  > unity-licensing-server-client.json

In the Keycloak Admin console:
1. Select the unity realm.
2. Select Clients > Import client.
3. Browse to
```
unity-licensing-server-client.json
```
  .
4. Select Save.

For more information about managing the License server, refer to Licensing.

Pin Traefik node ports

To pin the Kubernetes node ports that Traefik uses, use the optional Terraform variable

traefik_node_ports

This variable is a

map(number)

and defaults to

{}

. The supported keys are

web

and

websecure

, and each value must be within the range 30000 to 32767.

For example:

traefik_node_ports = { web = 32080, websecure = 32443 }

Keys that you don't set are assigned by Kubernetes.

By default, Traefik node ports are now assigned by Kubernetes. Previously, the

web

entrypoint was pinned to node port

. Existing clusters keep their currently allocated node port during the next ArgoCD sync, because Kubernetes doesn't reassign a node port when Helm stops requesting one. If your Network Load Balancer (NLB) target group or a firewall rule depends on a stable port, pin it with the

traefik_node_ports

variable.

Improvements

Restricted Pod Security Admission compliance

All Helm workloads now render a security context that complies with the Kubernetes Restricted Pod Security Admission (PSA) standard by default. As part of this change, UVCS now runs as a non-root user (UID 1000) instead of as the root user.

경고

If you have an existing UVCS deployment (

enable_uvcs=true

), plan a maintenance window before you upgrade. On the first UVCS pod restart after the upgrade, Kubernetes recursively changes the ownership of the UVCS persistent volume (mounted at

/jet

) to group ID 1000. For a large repository on block storage, such as gp3, this operation can take several minutes, during which the UVCS pod is unavailable.

Before you upgrade, confirm that your CSI driver applies

fsGroup

correctly. After the upgrade, verify that the UVCS pod restarted with the expected ownership:


kubectl exec uvcs-0 -c uvcs -n asset-solutions -- idkubectl exec uvcs-0 -c uvcs -n asset-solutions -- ls -ld /jet

The

id

command must report

uid=1000 gid=1000

, and the

/jet

directory must belong to group

with no permission errors.

AWS Terraform provider upgrade

Upgraded the AWS Terraform provider to

~> 6.49

. This upgrade clears a persistent

terraform plan

difference on the Amazon S3 server-side encryption resources that appeared after AWS began disabling server-side encryption with customer-provided keys (SSE-C) by default in April 2026. This upgrade doesn't change any infrastructure.

Automatic restart of stateful workloads on configuration changes

StatefulSet workloads, such as

uvcs

and

license-server

, now restart automatically when their ConfigMap, Secret, or ExternalSecret values change. This behavior matches Deployment workloads. Previously, a configuration change didn't affect the running pod until you manually restarted it.

Fixed issues

Project creation

Fixed an issue where creating a project returned a 404 error. The Mini-USF Traefik routes were missing the create-project endpoint, so you could manage existing projects but couldn't create a project. The route is now generated and served.

Traefik installation failure

Fixed a Traefik installation failure (

Middleware ... already exists

) that stale 3D Data Streaming route templates caused. The data-streaming routes now match the upstream gateway, and the retired

tiles

path is removed because the

groups

path replaced it.

Asset storage message queue

Fixed the

asset-storage

service so that it connects to the in-cluster RabbitMQ broker (

rabbitmq-asset-solutions

) for its service message queue.

Version 1.3.0 — June 8, 2026

Breaking changes

Mini-USF version 2 upgrade

Upgraded Mini-USF to version 2 to decouple Keycloak from entities, such as projects. Before you upgrade, you must migrate your existing Mini-USF v1 setup. For detailed instructions, refer to Migrate Mini-USF from version 1 to version 2.

Configure Pixyz licenses using Terraform variables

Provided Pixyz workflows with static licenses via the Terraform variables

pixyz_license

and

pixyz_license_3dds

, instead of manually creating the Kubernetes secret. Set each variable to the base64‑encoded license content.

Improvements

Kubernetes 1.33

Upgraded the EKS cluster to Kubernetes 1.33. Updated EKS‑managed add‑ons to the matching AWS default versions. No node recycling was required.

Distributed object storage by default

Enabled RustFS to run in distributed mode by default for improved resilience. Fixed an out‑of‑memory issue that affected RustFS.

Default monitoring alerts

Added a set of default alerts to the kube-prometheus-stack.

Larger default storage sizes

Increased the default PostgreSQL data volume from 200 GiB to 400 GiB and the pgBackRest backup repository from 400 GiB to 800 GiB. On clusters that use gp3 storage, these volumes resize online during the next ArgoCD sync with no downtime.

Fixed issues

Automation Manager post-install job

Fixed the

automation-manager

post‑install job failing with a permission error when it authenticated to the container registry as a non‑root user.

Release notes for Self-Hosted Deployment in Amazon Web Services 1.3

Learn about new features, improvements, and fixed issues.

읽는 시간 5분

최근 업데이트: 8일 전

Version 1.3.2 — July 13, 2026

New features

Automatic solution onboarding

The

upc-onboarding

The

upc-onboarding

Version 1.3.1 — July 7, 2026

New features

Keycloak client for the License server

New deployments now automatically create the

unity-licensing-server

Keycloak client through the realm import when Keycloak starts. This client is required for the License server.

For an existing deployment, create the client manually. Use

upc-cli

to generate the import file, and then upload it through the Keycloak Admin console:

Fetch the client secret from the cluster:


SECRET=$(kubectl get secret license-server -n asset-solutions \  -o jsonpath='{.data.LicensingServer_Keycloak__ClientSecret}' | base64 -d)

Generate the import file with the

upc-cli

image from the Unity registry:


docker run --rm uccmpprivatecloud.azurecr.io/docker/upc-cli:1.1.143 \  --fqdn <your-domain> --no-auth keycloak generate-client-json \  --client-secret-value "$SECRET" \  > unity-licensing-server-client.json

In the Keycloak Admin console:
1. Select the unity realm.
2. Select Clients > Import client.
3. Browse to
```
unity-licensing-server-client.json
```
  .
4. Select Save.

For more information about managing the License server, refer to Licensing.

Pin Traefik node ports

To pin the Kubernetes node ports that Traefik uses, use the optional Terraform variable

traefik_node_ports

This variable is a

map(number)

and defaults to

{}

. The supported keys are

web

and

websecure

, and each value must be within the range 30000 to 32767.

For example:

traefik_node_ports = { web = 32080, websecure = 32443 }

Keys that you don't set are assigned by Kubernetes.

By default, Traefik node ports are now assigned by Kubernetes. Previously, the

web

entrypoint was pinned to node port

traefik_node_ports

variable.

Improvements

Restricted Pod Security Admission compliance

경고

If you have an existing UVCS deployment (

enable_uvcs=true

), plan a maintenance window before you upgrade. On the first UVCS pod restart after the upgrade, Kubernetes recursively changes the ownership of the UVCS persistent volume (mounted at

/jet

) to group ID 1000. For a large repository on block storage, such as gp3, this operation can take several minutes, during which the UVCS pod is unavailable.

Before you upgrade, confirm that your CSI driver applies

fsGroup

correctly. After the upgrade, verify that the UVCS pod restarted with the expected ownership:


kubectl exec uvcs-0 -c uvcs -n asset-solutions -- idkubectl exec uvcs-0 -c uvcs -n asset-solutions -- ls -ld /jet

The

id

command must report

uid=1000 gid=1000

, and the

/jet

directory must belong to group

with no permission errors.

AWS Terraform provider upgrade

Upgraded the AWS Terraform provider to

~> 6.49

. This upgrade clears a persistent

terraform plan

Automatic restart of stateful workloads on configuration changes

StatefulSet workloads, such as

uvcs

and

license-server

Fixed issues

Project creation

Traefik installation failure

Fixed a Traefik installation failure (

Middleware ... already exists

) that stale 3D Data Streaming route templates caused. The data-streaming routes now match the upstream gateway, and the retired

tiles

path is removed because the

groups

path replaced it.

Asset storage message queue

Fixed the

asset-storage

service so that it connects to the in-cluster RabbitMQ broker (

rabbitmq-asset-solutions

) for its service message queue.

Version 1.3.0 — June 8, 2026

Breaking changes

Mini-USF version 2 upgrade

Configure Pixyz licenses using Terraform variables

Provided Pixyz workflows with static licenses via the Terraform variables

pixyz_license

and

pixyz_license_3dds

, instead of manually creating the Kubernetes secret. Set each variable to the base64‑encoded license content.

Improvements

Kubernetes 1.33

Upgraded the EKS cluster to Kubernetes 1.33. Updated EKS‑managed add‑ons to the matching AWS default versions. No node recycling was required.

Distributed object storage by default

Enabled RustFS to run in distributed mode by default for improved resilience. Fixed an out‑of‑memory issue that affected RustFS.

Default monitoring alerts

Added a set of default alerts to the kube-prometheus-stack.

Larger default storage sizes

Fixed issues

Automation Manager post-install job

Fixed the

automation-manager

post‑install job failing with a permission error when it authenticated to the container registry as a non‑root user.