Unity Cloud Self-Hosted On-premises 0.13.0

Garage object storage replaces RustFS: The on-premises deployment now uses Garage as the S3-compatible object store, replacing RustFS. Garage runs as a 3-node distributed cluster ( `replicationFactor: 3` ) in all sizing profiles by default, and it stores Argo workflow artifacts and Percona MongoDB scheduled backups in its `argo-artifacts` and `psmdb-backups` buckets.

Garage object storage replaces RustFS: Use the new `configuration.infrastructure.components.garage` manifest field to configure Garage. The available settings are `resources` (standard CPU and memory requests and limits), `metaStorage` , `dataStorage` , `replicas` , and `replicationFactor` (capped at 3).

Garage object storage replaces RustFS: Requirements:

Garage object storage replaces RustFS: For the upgrade procedure and data preservation paths, refer to the Breaking change section that follows.

Customer-supplied CA bundle for internally-signed TLS: A new `configuration.networking.trustedCaSecretName` manifest field lets you mount your CA chain into the Argo workflow containers, the StorageTool, and all `asset-manager-*` Pixyz workflow templates. Use it when your Asset Manager ingress presents a TLS certificate signed by a private CA, such as a DoD PKI or an internal corporate CA, instead of a publicly trusted CA.

Customer-supplied CA bundle for internally-signed TLS: Reference a pre-existing Kubernetes Secret that holds a PEM-encoded CA bundle under the single key `ca-bundle.crt` :

Customer-supplied CA bundle for internally-signed TLS: The .NET workflow containers and the Pixyz workflow templates pick up the bundle when they start.

vpctl 0.10.0 or later.

At least 3 schedulable nodes in the general workloads pool. MongoDB and RabbitMQ already require this minimum because they spread their three replicas across distinct nodes by using `podAntiAffinity` . Garage uses the same model.

Larger default PostgreSQL storage. This release increases default PostgreSQL data and pgBackRest backup persistent volume sizes by sizing profile: 50 GiB data and 100 GiB backup ( `small` ), 400 GiB data and 800 GiB backup ( `medium` ), 800 GiB data and 1600 GiB backup ( `large` ). For existing clusters, ensure your StorageClass has `allowVolumeExpansion: true` so that the Percona PostgreSQL operator can resize the PVCs online; otherwise, resize the PVCs manually after upgrading.

Automation step logs stream again. The `automation-external-secrets` Secret now also includes `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` , mirrored from `s3-api-storage-credentials` , which the AutomationService needs to stream Argo step logs from object storage. After upgrading, rerun `vpctl secret generate` and `vpctl secret deploy` , then run `kubectl -n asset-solutions rollout restart deployment/automation` so that the AutomationService picks up the new environment variables.

RustFS replaced by Garage: This release removes the `configuration.infrastructure.components.rustfs` manifest field. The S3-compatible object store is now Garage and uses the new `configuration.infrastructure.components.garage` manifest field. You must use vpctl `0.10.0` or later to deploy this release.

RustFS replaced by Garage: Customer-visible side effects

Migration paths: Choose one of these paths before you run `vpctl release deploy` .

Migration paths: Path A — wipe and redeploy (recommended for staging environments). RustFS object data isn't preserved. Argo workflow artifacts are ephemeral, Percona MongoDB regenerates backups on the next scheduled run, and Asset Manager re-ingests content on demand.

Migration paths: Before you continue with the rest of the upgrade guide, drain the RustFS PVCs:

Migration paths: Then return to the upgrade guide and complete steps 4 (sync artifacts), 5 (regenerate and deploy secrets), and 6 (regenerate and deploy charts). When `vpctl release deploy` completes, Garage replaces RustFS in the same release, and the `garage-bucket-bootstrap` post-sync Job assigns the cluster layout, imports your `GARAGE_ACCESS_KEY` and `GARAGE_SECRET_KEY` into Garage, and creates the `argo-artifacts` and `psmdb-backups` buckets.

Migration paths: Path B — preserve data with `mc mirror` . Recommended if you want to keep existing PSMDB backup dumps. This release includes a helper script, `migrate-rustfs-to-garage.sh` , under `extracted-release/common/scripts/` .

Migration paths: Before you regenerate and deploy the new secrets (step 5 in the upgrade guide), run the backup phase from a workstation that can reach the cluster. At this point, the in-cluster `s3-api-storage-credentials` Secret still holds the old `RUSTFS_*` fields, so the script can mirror the `argo-artifacts` and `psmdb-backups` buckets from RustFS to a local directory:

Migration paths: Return to the upgrade guide and complete steps 5 (regenerate and deploy secrets) and 6 (regenerate and deploy charts). After `vpctl release deploy` finishes and both the Garage StatefulSet and the `garage-bucket-bootstrap` Job are complete, restore the buckets to Garage:

The `s3-api-storage-credentials` Kubernetes Secret keeps its name, but the field names changed: `RUSTFS_ACCESS_KEY` is now `GARAGE_ACCESS_KEY` , and `RUSTFS_SECRET_KEY` is now `GARAGE_SECRET_KEY` . The `AWS_ACCESS_KEY_ID` and `AWS_SECRET_ACCESS_KEY` aliases still mirror those values for the Percona MongoDB operator. After upgrading vpctl, rerun `vpctl secret generate` and `vpctl secret deploy` to pick up the new schema.

A new `garage-rpc-secret` Kubernetes Secret (single field `rpcSecret` , 64-character hex) holds the Garage cluster RPC secret. The Garage chart consumes it through `existingRpcSecret` . vpctl creates this Secret automatically as part of `vpctl secret generate` — no extra action is required beyond the standard first-time deploy flow.

Percona MongoDB scheduled backups now write to the Garage `psmdb-backups` bucket through `garage:3900` . There's no manifest-level change required.

The `/rustfs` Traefik debug ingress route is removed. To reach the S3 API directly, use `kubectl port-forward svc/garage 3900:3900` .