Unity Cloud Self-Hosted AWS 1.3.1

Keycloak client for the License server: New deployments now automatically create the `unity-licensing-server` Keycloak client through the realm import when Keycloak starts. This client is required for the License server.

Keycloak client for the License server: For an existing deployment, create the client manually. Use `upc-cli` to generate the import file, and then upload it through the Keycloak Admin console:

Keycloak client for the License server: For more information about managing the License server, refer to Licensing.

Pin Traefik node ports: To pin the Kubernetes node ports that Traefik uses, use the optional Terraform variable `traefik_node_ports` .

Pin Traefik node ports: This variable is a `map(number)` and defaults to `{}` . The supported keys are `web` and `websecure` , and each value must be within the range 30000 to 32767.

Pin Traefik node ports: For example: `traefik_node_ports = { web = 32080, websecure = 32443 }` .

Pin Traefik node ports: Keys that you don't set are assigned by Kubernetes.

Pin Traefik node ports: By default, Traefik node ports are now assigned by Kubernetes. Previously, the `web` entrypoint was pinned to node port `32080` . Existing clusters keep their currently allocated node port during the next ArgoCD sync, because Kubernetes doesn't reassign a node port when Helm stops requesting one. If your Network Load Balancer (NLB) target group or a firewall rule depends on a stable port, pin it with the `traefik_node_ports` variable.

Fetch the client secret from the cluster: SECRET=$(kubectl get secret license-server -n asset-solutions \ -o jsonpath='{.data.LicensingServer_Keycloak__ClientSecret}' | base64 -d)

Generate the import file with the `upc-cli` image from the Unity registry: docker run --rm uccmpprivatecloud.azurecr.io/docker/upc-cli:1.1.143 \ --fqdn <your-domain> --no-auth keycloak generate-client-json \ --client-secret-value "$SECRET" \ > unity-licensing-server-client.json

In the Keycloak Admin console:

Select the unity realm.

Select Clients > Import client.

Browse to `unity-licensing-server-client.json` .

Select Save.

Restricted Pod Security Admission compliance: All Helm workloads now render a security context that complies with the Kubernetes Restricted Pod Security Admission (PSA) standard by default. As part of this change, UVCS now runs as a non-root user (UID 1000) instead of as the root user.

Restricted Pod Security Admission compliance: Before you upgrade, confirm that your CSI driver applies `fsGroup` correctly. After the upgrade, verify that the UVCS pod restarted with the expected ownership:

Restricted Pod Security Admission compliance: The `id` command must report `uid=1000 gid=1000` , and the `/jet` directory must belong to group `1000` with no permission errors.

AWS Terraform provider upgrade: Upgraded the AWS Terraform provider to `~> 6.49` . This upgrade clears a persistent `terraform plan` difference on the Amazon S3 server-side encryption resources that appeared after AWS began disabling server-side encryption with customer-provided keys (SSE-C) by default in April 2026. This upgrade doesn't change any infrastructure.

Automatic restart of stateful workloads on configuration changes: StatefulSet workloads, such as `uvcs` and `license-server` , now restart automatically when their ConfigMap, Secret, or ExternalSecret values change. This behavior matches Deployment workloads. Previously, a configuration change didn't affect the running pod until you manually restarted it.

Project creation: Fixed an issue where creating a project returned a 404 error. The Mini-USF Traefik routes were missing the create-project endpoint, so you could manage existing projects but couldn't create a project. The route is now generated and served.

Traefik installation failure: Fixed a Traefik installation failure ( `Middleware ... already exists` ) that stale 3D Data Streaming route templates caused. The data-streaming routes now match the upstream gateway, and the retired `tiles` path is removed because the `groups` path replaced it.

Asset storage message queue: Fixed the `asset-storage` service so that it connects to the in-cluster RabbitMQ broker ( `rabbitmq-asset-solutions` ) for its service message queue.