Release notes for Self-Hosted Deployment in Amazon Web Services 1.4

Learn about new features, improvements, and fixed issues.

읽는 시간 8분

최근 업데이트: 8일 전

Version 1.4.0 — August 12, 2026

Breaking changes

Elasticsearch migration to the ECK operator (staged)

We are deprecating the

elasticsearch

StatefulSet chart and will remove it in a future release.

For migration instructions, refer to Migrate Elasticsearch to the ECK operator.

Unity Licensing Server storage moves to EBS

The Unity Licensing Server data volume (

licserver-data

) doesn't provision to EFS anymore. It now provisions on EBS block storage:

kubernetes_ebs_storage_class_name

, which defaults to

gp3

For instructions, refer to Move Unity Licensing Server storage to EBS.

Feature flag permissions changed for the Read-only Global Admin role

Mini-USF admin routes are now in sync with the upstream Unity Services Gateway definitions. The feature flag read and write endpoints now authorize against the organization's

unity.organizations.update

permission instead of the

vpc.organizations.featureflags.*

permissions.

Global Admins and organization Owners keep access. The built-in Read-only Global Admin role can no longer read feature flags. If you rely on that role for feature flag visibility, grant those users a role that carries

unity.organizations.update

New features

Built-in Optimize and Convert 3D Asset pipeline

Deployment now installs an Optimize and Convert 3D Asset transformation pipeline, certifies it, and publishes it to every organization, so it's available in Asset Manager without a manual setup.

The pipeline runs the Unity Asset Manager and Unity Asset Transformer (Pixyz) app versions that your deployment already installs, so the pipeline always matches the apps present on the cluster.

The post-deployment

automation-manager

job reconciles the pipeline on every upgrade and fills in only what's missing, so a pipeline version that's already installed is left untouched. If the installation fails, the job reports it in its log without blocking the rest of the deployment.

To skip installing the pipeline, set the

automation-manager

value

env.pipelinesList

to an empty string.

PostgreSQL for the asset collaboration service

The asset collaboration service now connects to PostgreSQL, in the

collaboration

database. Applying this release adds the connection string to AWS Secrets Manager automatically and redeploys the service, so no manual action beyond the normal apply is required.

Automation administration routes

The Mini-USF global admin role now carries the

vpc.roles.automation-admin

permission, which the Automation Unity Services Gateway v2 admin routes require.

Pinned Terraform CLI version

The release package now includes

aws/terraform/.terraform-version

, which records the exact Terraform CLI version this release is validated with. Version-manager tools such as tfenv and tenv pick it up automatically. The

Terraform >= 1.12.0

requirement is unchanged.

Improvements

Kubernetes 1.34

The EKS cluster now runs Kubernetes 1.34, previously 1.33. Applying this release upgrades the control plane in place in about 10 minutes, and the Kubernetes API stays available throughout. The same apply moves the EKS-managed add-ons to the versions that match 1.34, as described in Automatic EKS add-on upgrades in this release.

The apply doesn't change worker nodes. After upgrading, update the node groups to 1.34, for example from the EKS console or with

aws eks update-nodegroup-version

. Existing 1.33 nodes keep working in the meantime, because Kubernetes supports nodes up to three minor versions behind the control plane.

경고

Kubernetes control-plane upgrades can't be rolled back.

Automatic EKS add-on upgrades

The EKS managed add-ons

kube-proxy

eks-pod-identity-agent

, the EBS CSI driver, and the EFS CSI driver now upgrade automatically to the latest version compatible with the cluster's Kubernetes version on every

terraform apply

. Manual add-on version bumps are no longer needed, including after an EKS cluster-version upgrade. The first apply after this change upgrades all four add-ons in place through a rolling update, with no expected downtime.

Larger Elasticsearch nodes for org-wide search

The legacy Elasticsearch cluster is now sized for org-wide asset search instead of the upstream chart defaults it previously ran at. Each of the 3 nodes requests 2 CPU and 8 GiB of memory with a 4 CPU and 8 GiB limit, previously 1 CPU and 2 GiB, which left searches queueing on a 2-thread search pool for each node. Search on asset-heavy projects and organizations gets faster without waiting for the ECK migration.

Applying the release restarts the Elasticsearch pods one at a time, so search stays available. Plan for 3 more CPU and 18 GiB more of requested cluster capacity, which also applies during the parallel ECK run until you retire the legacy cluster.

Pipeline automation upgraded to v0.0.73

Job-queue concurrency limits are now set explicitly: at most 2000 concurrent automation jobs across the platform and 10 for each organization. Previously, the service's built-in limits applied.

This release also carries the v0.0.72 changes. Before rollout, set a per-environment

automation_encryption_key

in your tfvars (generate one with

openssl rand -base64 32

) and snapshot the automation PostgreSQL database, because a database migration runs automatically on deploy. Keep the key stable: rotating it makes previously encrypted automation data unreadable. The dedicated automation token issuer is no longer deployed.

Bounded Valkey cache memory

The Valkey cache now runs with CPU and memory requests and limits, and with a memory budget of 1 GiB. Previously it had no resource requests, which made it the first pod evicted under node memory pressure. When the budget is exhausted, Valkey refuses new writes instead of evicting data, so nothing — cache entries, queues, or locks — is silently dropped, and services report write errors until memory is freed.

Quieter Unity Version Control logs

The uvcs server now logs at

INFO

level by default instead of

DEBUG

, which sharply reduces its log volume in

kubectl logs

and CloudWatch, and reduces on-node disk churn. To temporarily restore verbose logging for a support case, set the environment variable

UVCS_LOG_LEVEL=DEBUG

on the uvcs container in the uvcs chart values and redeploy.

Unity Version Control content URLs served through the public API

When

enable_uvcs=true

, the in-cluster uvcs emits in-cluster content URLs (

http://uvcs:8000

), and

public-api

rewrites them to the external domain at the edge, which keeps the uvcs storage surface behind the API. Deployments that use an external uvcs (

enable_uvcs=false

) aren't affected, and their own content URLs are used as-is.

S3-native Terraform state locking

Terraform state locking now uses the S3-native lock file (

use_lockfile = true

backends/*.tfvars

) instead of a DynamoDB table, whose backend setting Terraform has deprecated. Plans and applies need no extra steps. The

terraform-state-lock*

DynamoDB tables are no longer used and you can delete them.

setup-terraform-backend.sh

no longer creates a lock table for new backends.

Built-in automation apps updated

The Unity Asset Manager app and the Unity Asset Transformer (Pixyz) app are both updated to 1.2.1.

Collaboration and automation API routes regenerated

Both sets of routes are now served from the Unity Services Gateway v2 route definitions. No operator action is required, because routes are regenerated and deployed automatically.

Licensing server Keycloak secret renamed

The Kubernetes secret that holds the Unity Licensing Server's Keycloak client secret is now named

unity-licensing-server

, previously

license-server

. This matches the Keycloak client ID and the on-premises and Azure deployments.

Clusters upgrading from 1.3.1 pick up the rename automatically on the next ArgoCD sync. The value is unchanged and still sourced from the same AWS Secrets Manager entry, so no Keycloak reconfiguration is needed. Operator tooling that referenced

kubectl get secret license-server

must now use

unity-licensing-server

Fixed issues

Faster asset search under load

Reduced the

public-api

Redis timeout errors (

Timeout performing HMGET (5000ms)

in the service logs) that slowed asset search and aggregation responses under concurrent load. The service now starts with a larger .NET thread pool and can use up to 2 CPUs instead of 1, so cache responses are processed promptly during request bursts.

Interrupted transformations report as failed

Transformations interrupted by a node disruption, such as a spot reclaim, a node upgrade, or a drain, no longer stay

Pending

in Asset Manager forever. They now report as failed and you can retry them.

Transformation data transfers retry

Transformation steps that download and upload asset data, including the 3D Data Streaming import-validation step, now retry up to 3 times instead of failing the whole transformation on a single transient error.

Node consolidation no longer interrupts transformations

Running transformation pods are annotated

karpenter.sh/do-not-disrupt: "true"

, so Karpenter node consolidation no longer evicts them mid-run. This has no effect on clusters that don't run Karpenter.

Download links use your external domain

Dataset and artifact download links returned by the workspace service now use the environment's external domain when the in-cluster uvcs is enabled (

enable_uvcs=true

). Previously they pointed at an in-cluster address that is unreachable from outside the cluster. The workspace service is updated to 0.0.139, which this fix requires. Deployments that use an external uvcs (

enable_uvcs=false

) aren't affected by the URL change.

Unused licensing server volume removed

Removed an unused standalone

licserver-data

PersistentVolumeClaim that the

license-server

chart created but nothing mounts, because the StatefulSet provisions its storage through its own volume claim template. On AWS it bound on

efs-sc

and silently wasted a 10 GiB volume. ArgoCD prunes it on sync.

Group-based project role management

Group-based project role management no longer fails at the edge. Two Mini-USF endpoints that the Admin Dashboard uses for user groups were missing from the generated Traefik routes and returned 404: assigning a user group a role on a project, and the project member and group picker. Both are now generated and served.