Unity Cloud Self-Hosted On-premises 0.11.0

Helm chart sourcing (preview): The new `deployment.helmChartMode` manifest setting lets you choose how Helm charts are delivered:

Helm chart sourcing (preview): The `remote` mode and the matching `vpctl artifact sync charts` command are available as a preview in this release. Not all charts are published to the Unity OCI Helm registry yet, so a fully remote-only deployment isn't supported. For production deployments, continue to use the default `local` mode.

Default monitoring alerts: The Prometheus monitoring stack now ships with a curated set of cluster and workload alerting rules out of the box. You no longer need to assemble these rules manually before going to production.

Hardened container variant for the upc-job image: The `upc-job` image now ships in a hardened variant, which is built on a minimal base image with a reduced attack surface for stricter security baselines.

`local` (default): the process installs charts from the release package. This is the safest option for existing deployments and for air-gapped environments.

`remote` : the process pulls charts from an OCI Helm registry at deployment time.

Higher default resource allocations: MongoDB, mini-usf, and public-api now request more CPU and memory by default, which reduces the need for manual tuning to reach production-level performance.

Idempotent onboarding: the `upc-onboarding` job is now safe to rerun. The job no longer fails or duplicates resources if you retrigger it after a partial deployment.

More resilient RabbitMQ scheduling: RabbitMQ pods now schedule successfully on clusters that don't expose availability zone labels.

Reliable Keycloak tokens: Keycloak-issued tokens now include the `sub` and `auth_time` claims required by downstream services. This fixes a regression introduced by Keycloak 26's stricter scope handling.

Mini-usf routing fixes: legacy admin routes and the groups routes are now matched correctly, including the right middlewares and permissions for the global admin role.

Quieter object storage logs: RustFS no longer floods the log volume at default verbosity. The default log level is now `error` , which prevents disk pressure on the log PVC.

Organization management connectivity: the `organization-management` service now reads the correct RabbitMQ consumer queue setting and starts cleanly.