Unity Cloud Self-Hosted On-premises 0.15.0

You must use vpctl 0.12.0 or later to deploy this release. Upgrade vpctl before you pull and deploy the release.

Unity Licensing Server on-premises: The Unity Licensing Server is now deployed on-premises and is reachable at `/licensing` under your application domain. It runs as a stateful service backed by a 10 GiB persistent volume and authenticates against the in-cluster Keycloak. No manifest configuration is required.

Unity Licensing Server on-premises: The volume must be on block storage, because the embedded database doesn't support NFS-class storage. It provisions on your cluster's default storage class, or on `configuration.kubernetes.storage.defaultStorageClass` when set. If you later need to move it to a different storage class, no data backup is required: remove the licensing server and its volume, redeploy the release, then request and import a new license bundle. For more information about managing the licensing server, refer to Licensing.

Unity Licensing Server on-premises: On new deployments, the `unity-licensing-server` Keycloak client is created automatically with the ID-token mapper the licensing server requires, and `vpctl secret generate` auto-generates the matching `unity-licensing-server` Kubernetes Secret without operator input.

Unity Licensing Server on-premises: Action required for existing deployments: the Keycloak client isn't added on upgrade, because the `unity` realm already exists and Keycloak skips the realm import. To add the Keycloak client:

Identity synchronization and entitlements tracking: The platform now deploys scheduled jobs that:

Identity synchronization and entitlements tracking: No manifest configuration is required.

Single-stack IPv6 support: You can now deploy on an IPv6-only Kubernetes cluster. Set `configuration.networking.ipFamily: ipv6` in your manifest:

Single-stack IPv6 support: This requires vpctl 0.12.0 or later and Kubernetes 1.29 or later.

Single-stack IPv6 support: Deployments that omit the field keep the IPv4 defaults.

Single-stack IPv6 support: If you provision reference AWS infrastructure from the `baseline-example` Terraform included in the release package, set `enable_ipv6_only = true` to provision an IPv6-only EKS cluster with the required VPC, subnet, and DNS64/NAT64 configuration.

Restricted Pod Security Admission compliance: All Asset Manager workloads now render a security context that complies with the Kubernetes Restricted Pod Security Admission profile:

Restricted Pod Security Admission compliance: This means you can deploy the platform into namespaces that enforce the `restricted` profile.

Restricted Pod Security Admission compliance: UVCS now runs as a non-root user.

Restricted Pod Security Admission compliance: Istio CNI, ztunnel, and the host-metrics node exporter remain privileged by design and need their own namespace exemptions if you enable enforcement.

Use upc-cli to generate the client import file. The command requires `kubectl` access to the cluster:

In the Keycloak Admin console, select the unity realm.

Go to Clients > Import client.

Browse to `unity-licensing-server-client.json` .

Select Save.

Periodically pull new and updated users, projects, organizations, role mappings, and group roles from your identity provider into Asset Manager.

Take a daily entitlements snapshot.

A non-root user.

No privilege escalation.

All Linux capabilities dropped.

• Linux

Using the `RuntimeDefault` seccomp profile.

Pipeline automation upgraded to v0.0.72. This version adds a new secret: run `vpctl secret generate` (press Enter to auto-generate the value) and redeploy. The automation database migration runs automatically on deploy, so you need to snapshot your automation PostgreSQL database first. Leave the generated value unchanged on future upgrades.

Configurable in-cluster DNS service name. The new `configuration.kubernetes.dnsService` manifest field (default `kube-dns` ) overrides the in-cluster DNS service name that the Loki log-collection gateway resolves against. If the `loki-gateway` pod crash-loops with the error `host not found in resolver` , set the field to your Kubernetes distribution's CoreDNS service, for example `rke2-coredns-rke2-coredns` on RKE2. EKS, AKS, and k3s deployments keep the default.

Multiple deployments in one AWS account. The `baseline-example` Terraform now supports running several deployments in the same AWS account without ECR or IAM name collisions. Use a distinct `project_name` for each project within a region, and IAM role names are now region-qualified so the same project can also deploy across regions. ECR repositories are namespaced for each project through the new `ecr_repository_prefix` variable, which defaults to `project_name` ; set your manifest's `configuration.kubernetes.docker.namespace` to the same value.

Sign-on flows and OIDC discovery use your public domain. Fixed sign-on flows redirecting to an unreachable `http://keycloak` URL, and in-cluster services discovering unreachable Keycloak OIDC endpoints. The bundled Keycloak 26 ignores the deprecated hostname options the chart previously set, so OIDC URLs were built from the request host instead of your public domain. The chart now pins the public frontend URL; in-cluster requests keep resolving internally.

Project creation works. Fixed project creation failing with a 404 error. The bundled Traefik routes were missing the create-project endpoint, so creating a new project failed. This didn't impact management of existing projects.

Traefik installs without middleware conflicts. Fixed a Traefik installation failure ( `Middleware ... already exists` ) caused by duplicate data-streaming route definitions. The deprecated data-streaming `tiles` path ( `.../instances/tiles/{tileId}` ) is removed; instead, use the `groups` path ( `.../instances/groups/{groupId}` ), which returns the same backend response.

3D Data Streaming workflows use the correct image. The 3DDS storage-tool step previously had no container image configured, so the workflow failed at runtime.

Configuration changes restart UVCS and the licensing server. The Unity Version Control (UVCS) and Unity Licensing Server pods now restart automatically when their configuration changes on upgrade. Previously, a configuration change was applied but the running pod kept serving the old configuration until you restarted it manually.

Asset storage uses the in-cluster message broker. The `asset-storage` service now connects to the in-cluster RabbitMQ broker for its service message queue.