Unity Cloud Self-Hosted AWS 1.4.0

Elasticsearch migration to the ECK operator (staged): We are deprecating the `elasticsearch` StatefulSet chart and will remove it in a future release.

Elasticsearch migration to the ECK operator (staged): For migration instructions, refer to Migrate Elasticsearch to the ECK operator.

Unity Licensing Server storage moves to EBS: The Unity Licensing Server data volume ( `licserver-data` ) doesn't provision to EFS anymore. It now provisions on EBS block storage: `kubernetes_ebs_storage_class_name` , which defaults to `gp3` .

Unity Licensing Server storage moves to EBS: For instructions, refer to Move Unity Licensing Server storage to EBS.

Feature flag permissions changed for the Read-only Global Admin role: Mini-USF admin routes are now in sync with the upstream Unity Services Gateway definitions. The feature flag read and write endpoints now authorize against the organization's `unity.organizations.update` permission instead of the `vpc.organizations.featureflags.*` permissions.

Feature flag permissions changed for the Read-only Global Admin role: Global Admins and organization Owners keep access. The built-in Read-only Global Admin role can no longer read feature flags. If you rely on that role for feature flag visibility, grant those users a role that carries `unity.organizations.update` .

Built-in Optimize and Convert 3D Asset pipeline: Deployment now installs an Optimize and Convert 3D Asset transformation pipeline, certifies it, and publishes it to every organization, so it's available in Asset Manager without a manual setup.

Built-in Optimize and Convert 3D Asset pipeline: The pipeline runs the Unity Asset Manager and Unity Asset Transformer (Pixyz) app versions that your deployment already installs, so the pipeline always matches the apps present on the cluster.

Built-in Optimize and Convert 3D Asset pipeline: The post-deployment `automation-manager` job reconciles the pipeline on every upgrade and fills in only what's missing, so a pipeline version that's already installed is left untouched. If the installation fails, the job reports it in its log without blocking the rest of the deployment.

Built-in Optimize and Convert 3D Asset pipeline: To skip installing the pipeline, set the `automation-manager` value `env.pipelinesList` to an empty string.

PostgreSQL for the asset collaboration service: The asset collaboration service now connects to PostgreSQL, in the `collaboration` database. Applying this release adds the connection string to AWS Secrets Manager automatically and redeploys the service, so no manual action beyond the normal apply is required.

Automation administration routes: The Mini-USF global admin role now carries the `vpc.roles.automation-admin` permission, which the Automation Unity Services Gateway v2 admin routes require.

Pinned Terraform CLI version: The release package now includes `aws/terraform/.terraform-version` , which records the exact Terraform CLI version this release is validated with. Version-manager tools such as tfenv and tenv pick it up automatically. The `Terraform >= 1.12.0` requirement is unchanged.

Kubernetes 1.34: The EKS cluster now runs Kubernetes 1.34, previously 1.33. Applying this release upgrades the control plane in place in about 10 minutes, and the Kubernetes API stays available throughout. The same apply moves the EKS-managed add-ons to the versions that match 1.34, as described in Automatic EKS add-on upgrades in this release.

Kubernetes 1.34: The apply doesn't change worker nodes. After upgrading, update the node groups to 1.34, for example from the EKS console or with `aws eks update-nodegroup-version` . Existing 1.33 nodes keep working in the meantime, because Kubernetes supports nodes up to three minor versions behind the control plane.

Automatic EKS add-on upgrades: The EKS managed add-ons `kube-proxy` , `eks-pod-identity-agent` , the EBS CSI driver, and the EFS CSI driver now upgrade automatically to the latest version compatible with the cluster's Kubernetes version on every `terraform apply` . Manual add-on version bumps are no longer needed, including after an EKS cluster-version upgrade. The first apply after this change upgrades all four add-ons in place through a rolling update, with no expected downtime.

Larger Elasticsearch nodes for org-wide search: The legacy Elasticsearch cluster is now sized for org-wide asset search instead of the upstream chart defaults it previously ran at. Each of the 3 nodes requests 2 CPU and 8 GiB of memory with a 4 CPU and 8 GiB limit, previously 1 CPU and 2 GiB, which left searches queueing on a 2-thread search pool for each node. Search on asset-heavy projects and organizations gets faster without waiting for the ECK migration.

Larger Elasticsearch nodes for org-wide search: Applying the release restarts the Elasticsearch pods one at a time, so search stays available. Plan for 3 more CPU and 18 GiB more of requested cluster capacity, which also applies during the parallel ECK run until you retire the legacy cluster.

Pipeline automation upgraded to v0.0.73: Job-queue concurrency limits are now set explicitly: at most 2000 concurrent automation jobs across the platform and 10 for each organization. Previously, the service's built-in limits applied.

Pipeline automation upgraded to v0.0.73: This release also carries the v0.0.72 changes. Before rollout, set a per-environment `automation_encryption_key` in your tfvars (generate one with `openssl rand -base64 32` ) and snapshot the automation PostgreSQL database, because a database migration runs automatically on deploy. Keep the key stable: rotating it makes previously encrypted automation data unreadable. The dedicated automation token issuer is no longer deployed.

Bounded Valkey cache memory: The Valkey cache now runs with CPU and memory requests and limits, and with a memory budget of 1 GiB. Previously it had no resource requests, which made it the first pod evicted under node memory pressure. When the budget is exhausted, Valkey refuses new writes instead of evicting data, so nothing — cache entries, queues, or locks — is silently dropped, and services report write errors until memory is freed.

Quieter Unity Version Control logs: The uvcs server now logs at `INFO` level by default instead of `DEBUG` , which sharply reduces its log volume in `kubectl logs` and CloudWatch, and reduces on-node disk churn. To temporarily restore verbose logging for a support case, set the environment variable `UVCS_LOG_LEVEL=DEBUG` on the uvcs container in the uvcs chart values and redeploy.

Unity Version Control content URLs served through the public API: When `enable_uvcs=true` , the in-cluster uvcs emits in-cluster content URLs ( `http://uvcs:8000` ), and `public-api` rewrites them to the external domain at the edge, which keeps the uvcs storage surface behind the API. Deployments that use an external uvcs ( `enable_uvcs=false` ) aren't affected, and their own content URLs are used as-is.

S3-native Terraform state locking: Terraform state locking now uses the S3-native lock file ( `use_lockfile = true` in `backends/*.tfvars` ) instead of a DynamoDB table, whose backend setting Terraform has deprecated. Plans and applies need no extra steps. The `terraform-state-lock*` DynamoDB tables are no longer used and you can delete them. `setup-terraform-backend.sh` no longer creates a lock table for new backends.

Built-in automation apps updated: The Unity Asset Manager app and the Unity Asset Transformer (Pixyz) app are both updated to 1.2.1.

Collaboration and automation API routes regenerated: Both sets of routes are now served from the Unity Services Gateway v2 route definitions. No operator action is required, because routes are regenerated and deployed automatically.

Licensing server Keycloak secret renamed: The Kubernetes secret that holds the Unity Licensing Server's Keycloak client secret is now named `unity-licensing-server` , previously `license-server` . This matches the Keycloak client ID and the on-premises and Azure deployments.

Licensing server Keycloak secret renamed: Clusters upgrading from 1.3.1 pick up the rename automatically on the next ArgoCD sync. The value is unchanged and still sourced from the same AWS Secrets Manager entry, so no Keycloak reconfiguration is needed. Operator tooling that referenced `kubectl get secret license-server` must now use `unity-licensing-server` .

Faster asset search under load: Reduced the `public-api` Redis timeout errors ( `Timeout performing HMGET (5000ms)` in the service logs) that slowed asset search and aggregation responses under concurrent load. The service now starts with a larger .NET thread pool and can use up to 2 CPUs instead of 1, so cache responses are processed promptly during request bursts.

Interrupted transformations report as failed: Transformations interrupted by a node disruption, such as a spot reclaim, a node upgrade, or a drain, no longer stay `Pending` in Asset Manager forever. They now report as failed and you can retry them.

Transformation data transfers retry: Transformation steps that download and upload asset data, including the 3D Data Streaming import-validation step, now retry up to 3 times instead of failing the whole transformation on a single transient error.

Node consolidation no longer interrupts transformations: Running transformation pods are annotated `karpenter.sh/do-not-disrupt: "true"` , so Karpenter node consolidation no longer evicts them mid-run. This has no effect on clusters that don't run Karpenter.

Download links use your external domain: Dataset and artifact download links returned by the workspace service now use the environment's external domain when the in-cluster uvcs is enabled ( `enable_uvcs=true` ). Previously they pointed at an in-cluster address that is unreachable from outside the cluster. The workspace service is updated to 0.0.139, which this fix requires. Deployments that use an external uvcs ( `enable_uvcs=false` ) aren't affected by the URL change.

Unused licensing server volume removed: Removed an unused standalone `licserver-data` PersistentVolumeClaim that the `license-server` chart created but nothing mounts, because the StatefulSet provisions its storage through its own volume claim template. On AWS it bound on `efs-sc` and silently wasted a 10 GiB volume. ArgoCD prunes it on sync.

Group-based project role management no longer fails at the edge. Two Mini-USF endpoints that the Admin Dashboard uses for user groups were missing from the generated Traefik routes and returned 404: assigning a user group a role on a project, and the project member and group picker. Both are now generated and served.