Unity Cloud Self-Hosted On-premises 0.14.0

Deploy charts in parallel: `vpctl release deploy` can now deploy independent charts within the same deployment wave in parallel, which reduces total deployment time. Pass `--concurrency N` on the command line, or set a default value for your environment in the manifest:

Deploy charts in parallel: The default value is `1` , which deploys charts sequentially. Existing behavior remains unchanged unless you enable parallel deployment. If you set a concurrency value greater than `1` , `vpctl` buffers each chart's output and displays it after that chart finishes. As a result, the output order differs from sequential deployments. At the end of each deployment wave and after the deployment completes, `vpctl` displays a summary of successful and failed deployments.

Select hardened images in the manifest: You can now select the container image variant in your manifest with the new `configuration.imageVariant` field. Set the value to `hardened` to receive the hardened image builds:

Select hardened images in the manifest: Previously, release packaging automatically applied the hardened image suffix. You now select either the base or hardened images directly in the manifest, which lets you deploy both image variants from the same release.

Select hardened images in the manifest: Action required: If you use hardened images, set `configuration.imageVariant: hardened` in your manifest before you upgrade. Otherwise, the deployment uses the base images.

Deploy in single-node infrastructure mode: Use the new `configuration.infrastructure.singleNode` option to collapse the stateful infrastructure components Garage, PostgreSQL (Percona), MongoDB (Percona), Elasticsearch (ECK), and RabbitMQ to a single replica each. This option also disables PodDisruptionBudgets and removes hard anti-affinity:

Deploy in single-node infrastructure mode: Use this option for single-node or constrained clusters that you use for ephemeral testing and evaluation environments. Don't use it in production environments. Resource sizing, monitoring, backups, and component-specific overrides continue to work as before.

Configurable Traefik node ports: Kubernetes now assigns Traefik node ports for the `web` and `websecure` entry points by default instead of using the previously hardcoded `32080` port for `web` . Existing deployments keep their current node ports after you upgrade because Kubernetes doesn't reassign a node port when the chart no longer requests a specific value.

Configurable Traefik node ports: If your firewall or external load balancer requires a fixed port, set the new `configuration.networking.ingress.traefik.nodePorts` field. Each value must be within the `30000-32767` range:

Configurable Traefik node ports: This field requires `vpctl` 0.11.0 or later. Earlier versions reject the manifest during validation with the error `nodePorts: field not allowed` .

Keycloak supports upstream TLS termination. If an upstream load balancer terminates TLS, such as an NLB with an ACM certificate, and `configuration.networking.ingress.traefik.tls.enabled` is set to `false` , Traefik now forwards the correct HTTPS headers on the secure entry point. Previously, the Keycloak admin console redirected users to an unreachable `http://` URL and rejected sign-ins.

Garage starts successfully on the first deployment. On a new installation, Garage pods could remain in a not-ready state because their health probes checked a cluster-level endpoint that remained unavailable until the bootstrap job completed. At the same time, the bootstrap job waited for the pods to become ready, which created a deadlock. The health probes have been removed to resolve this issue.

Monitoring resources deploy only when Prometheus is enabled. The `secret-manager` and `argo-workflows` charts previously created `ServiceMonitor` resources even when Prometheus was disabled. Deployments without the Prometheus Operator failed with the error `no matches for kind "ServiceMonitor"` . These resources are now gated on `configuration.monitoring.prometheus.enabled` .

Traefik installs correctly in custom namespaces. Two issues that could prevent Traefik from installing have been fixed. The CORS-preflight middlewares on the public data-streaming routes now use distinct names, and the API path rewrite middleware now deploys to your installation namespace instead of a hardcoded namespace. As a result, installations in custom namespaces no longer fail because of namespace conflicts or duplicate middleware resources.

Automation app registration succeeds. The `automation-manager` post-install job previously entered a crash loop with the error `mkdir /.docker: permission denied` because the non-root container didn't have a writable home directory for registry credentials. The job now authenticates successfully with your container registry. No action is required other than redeploying the release.

Updated UVCS server and stronger password validation. Updated the UVCS server to version `11.0.16.10181` . UVCS user and administrator passwords must now contain at least 32 characters. If you provide or import your own passwords, `vpctl secret generate` rejects shorter passwords before deployment instead of allowing the deployment to fail later with an authorization error. Automatically generated passwords already meet this requirement.

Use one private CA for ingress TLS and client authentication. The certificate generation helper script can now issue the Traefik ingress certificate from the same private CA that it uses for X.509 client certificates. This change makes it easier to configure a fully private CA deployment, such as an internal or government PKI.