Unity Cloud Self-Hosted On-premises 0.16.0

Upgrade vpctl to 0.13.0 or newer before you pull and deploy this release.

Validate your cluster before you deploy: vpctl 0.13.0 adds the `cluster check` command, which verifies that the cluster your current kubeconfig context points at meets the deployment prerequisites:

Validate your cluster before you deploy: Run it before you pull the release, after any cluster change, and before every upgrade. For the full list of checks and options, refer to vpctl cluster command.

Built-in Optimize and Convert 3D Asset pipeline: Deployment now installs, certifies, and publishes an Optimize and Convert 3D Asset transformation pipeline to the Asset Manager for all organizations without manual setup.

Built-in Optimize and Convert 3D Asset pipeline: The pipeline's steps run the Unity Asset Manager and Unity Asset Transformer (Pixyz) app versions that your deployment already installs, so the pipeline always matches the apps present on the cluster.

Built-in Optimize and Convert 3D Asset pipeline: The post-deployment `automation-manager` job reconciles the pipeline on every upgrade and fills in only what's missing, so a pipeline version that's already installed is left untouched.

Built-in Optimize and Convert 3D Asset pipeline: If the installation fails, the job reports it in its log without blocking the rest of the deployment.

Built-in Optimize and Convert 3D Asset pipeline: If you don't want to install the pipeline, set the `automation-manager` value `env.pipelinesList` to an empty string.

Asset collaboration service uses PostgreSQL: The asset collaboration service now connects to PostgreSQL, in the `collaboration` database.

Asset collaboration service uses PostgreSQL: Action required: this adds a new secret field. Regenerate your secrets and redeploy so that the service picks up its PostgreSQL connection string:

Repair script for Unity Version Control data volumes: The release package now includes a repair script for Unity Version Control (UVCS) data volumes at `common/scripts/fix-uvcs-jet-ownership.sh` .

Repair script for Unity Version Control data volumes: A volume that an older UVCS version created holds files owned by `root` . Now that the server runs as a non-root user, every write to those files logs `Unable to update timestamp of file '/jet/...': Access to the path ... is denied` . UVCS keeps serving requests, but the errors fill its logs.

Repair script for Unity Version Control data volumes: From the extracted release, run the read-only check to find out whether your deployment is affected:

Repair script for Unity Version Control data volumes: If it is, correct the ownership:

Repair script for Unity Version Control data volumes: The repair runs a short-lived job and briefly restarts UVCS. Deployments whose volume was created by a recent release aren't affected and need no action.

Built-in automation apps updated. Unity Asset Transformer (Pixyz) and Unity Asset Manager are both updated to 1.2.1. The updated versions are registered alongside the existing ones at deployment time. Automations you already created stay on the app version they were created with and keep working, because the images those versions need remain in the registry mirror. To use the updated app in an existing automation, recreate the automation against the new app version.

Quieter Unity Version Control logs. The UVCS server now logs at `INFO` level by default instead of `DEBUG` , which sharply reduces its log output and its disk and log-ingestion footprint. For a support investigation, you can temporarily restore verbose logging by setting the environment variable `UVCS_LOG_LEVEL=DEBUG` on the UVCS container.

Collaboration and automation API routes regenerated. Both sets of routes are now generated from Unity Services Gateway v2 definitions. Redeploy to pick up the regenerated Traefik routes.

EKS add-ons upgrade automatically. The `baseline-example` Terraform now installs and upgrades EKS add-ons to the latest version compatible with the cluster's Kubernetes version on every `terraform apply` , so add-on versions no longer need manual bumping. The `addon_*_version` Terraform variables are removed: delete any such entries from tfvars files that you copied from an earlier baseline, to avoid an undeclared-variable warning. The first apply after you update upgrades all add-ons in place through a rolling update, with no expected downtime.

Kubernetes 1.34 in the reference infrastructure. The `baseline-example` Terraform now provisions Kubernetes 1.34 EKS clusters. To upgrade an existing cluster built from an earlier baseline, apply the updated configuration. EKS upgrades one minor version at a time, so a cluster more than one minor version behind needs intermediate `eks_cluster_version` steps, with one apply for each. EKS Auto Mode replaces nodes automatically after each control-plane upgrade. The unused `addon_pod_identity_agent_version` setting is removed, because EKS Auto Mode has the pod-identity agent built in; delete it from tfvars files copied from an earlier baseline.

Hardened ArgoCD installation values. The `baseline-example` now ships hardened ArgoCD installation values at `common/argocd/values.yaml` . Without a PodDisruptionBudget, a node drain that evicted two of ArgoCD's three Redis replicas at once left ArgoCD unable to elect a new master, and every application then reported the sync status `Unknown` with `EOF` errors. The values add PodDisruptionBudgets, `podManagementPolicy: Parallel` on the Redis StatefulSet, and CPU and memory requests on Redis (plus its sentinel and HAProxy) and on the ArgoCD controller, server, repo-server, and applicationset containers. The last four previously ran with no requests at all, so a cluster autoscaler could remove the node running ArgoCD's only repo server, which broke manifest generation for every application until the pod was rescheduled. Action required if you installed ArgoCD by following this example: re-run `helm upgrade --install` with the updated file. Because `podManagementPolicy` is immutable, that setting also requires you to delete the Redis StatefulSet once, which makes ArgoCD unavailable for about a minute. Redis is an in-memory cache here, so there's nothing to back up: `kubectl delete sts argocd-redis-ha-server`

Longer node consolidation grace period. The `baseline-example` NodePools now wait 15 minutes of node underutilization before consolidating a node, instead of 60 seconds. The short grace period made Karpenter repack nodes moments after every deployment rollout and between transformation steps, which evicted application services and in-flight transformation pods while they were in use. If you use these NodePools, re-apply them on existing clusters with `kubectl apply -f custom-nodepool.yaml` . Underutilized nodes now linger up to 15 minutes longer before scale-down.

S3-native Terraform state locking. The `baseline-example` now locks Terraform state with the S3-native lock file instead of a DynamoDB table, whose backend setting Terraform has deprecated. `just init` no longer reads `TF_LOCK_TABLE` . On an already-initialized checkout, run `terraform init -reconfigure` once to switch. An existing lock table is no longer used and you can delete it.

Keycloak runs with multiple replicas on IPv6. Keycloak now works with more than one replica on IPv6 single-stack clusters. Previously the replicas couldn't reach each other, so additional pods never became ready and blocked the deployment. If extra Keycloak replicas are already stuck unready when you upgrade, delete the remaining old pod once with `kubectl delete pod keycloak-0` so that all instances restart with the fix.

3D Data Streaming transformations schedule correctly. Fixed 3D Data Streaming transformations stalling with pods stuck `Pending` forever. This affects only clusters provisioned with the `baseline-example` custom NodePools: the `transformations` NodePool carried an `argo-workflows=cpu` taint that the workflow's memory-escalation retry steps don't tolerate, so no node could be provisioned for them. The taint is removed. If you use those NodePools, re-apply them on existing clusters with `kubectl apply -f custom-nodepool.yaml` . Clusters with their own node pool setup aren't affected.

Automation apps register on clusters that use the baseline ECR registry. Pulls made with a token refreshed by the ECR token-refresher CronJob were denied ( `not authorized to perform: ecr:BatchGetImage` ), because the refresher's IAM role could mint tokens but couldn't pull with them. The role now carries the ECR pull permissions: apply the updated `baseline-example` Terraform on existing clusters. The `SETUP.md` command that deploys the CronJob is also fixed to substitute the ArgoCD Helm credentials variable. A CronJob deployed with the previous command crashed with `unbound variable` after refreshing only two of the three secrets, so re-apply the CronJob with the updated command.

Pipeline automation upgraded to v0.0.73. Job-queue concurrency limits are now set explicitly: at most 2,000 concurrent automation jobs across the platform and ten for each organization. Previously, the service's built-in limits applied. No manifest or secret changes are required.

Bounded Valkey cache memory. The Valkey cache now runs with CPU and memory requests and limits, and with a memory budget of 1 GiB. Previously it had no resource requests, which made it the first pod evicted under node memory pressure. When the budget is exhausted, Valkey refuses new writes instead of evicting data, so nothing — cache entries, queues, or locks — is silently dropped. Services report write errors until memory is freed.

Valkey upgraded to 9.1.1. This upgrade contains security fixes. Valkey storage is ephemeral in this deployment, so the upgrade needs no data preparation. Cached data and queued notifications rebuild when the pod is replaced.

Pinned Terraform CLI version. The `baseline-example` now includes a `.terraform-version` file that records the exact Terraform CLI version the example is validated with. Version-manager tools such as tfenv and tenv pick it up automatically. The `Terraform >= 1.12.0` requirement is unchanged.

Faster asset search under load. Reduced the `public-api` Redis timeout errors ( `Timeout performing HMGET (5000ms)` in the service logs) that slowed asset search and aggregation responses under concurrent load. The service now starts with a larger .NET thread pool and can use up to 2 CPUs instead of 1, so cache responses are processed promptly during request bursts.

Interrupted transformations report as failed. Transformations interrupted by a node disruption, such as a spot reclaim, a node upgrade, or a drain, no longer stay `Pending` in Asset Manager forever. They now report as failed and you can retry them.

Transformation data transfers retry. Transformation steps that download and upload asset data, including the 3D Data Streaming import-validation step, now retry up to three times instead of failing the whole transformation on a single transient error.

Node consolidation no longer interrupts transformations. Running transformation pods are annotated `karpenter.sh/do-not-disrupt: "true"` , so Karpenter node consolidation no longer evicts them mid-run. This has no effect on clusters that don't run Karpenter.

Download links use your external domain. Dataset and artifact download links returned by the workspace service now use the deployment's external domain. Previously these links pointed at an in-cluster address ( `http://uvcs:8000/...` ) that is unreachable from outside the cluster, so those downloads failed for external clients. In-cluster consumers aren't affected.

Transformation actions pull all required images. Transformation actions could fail with image pull errors on deployments that use a private registry, because several container images required by the built-in automation apps were missing from the registry mirror. All images used by the automation apps are now mirrored by the artifact sync.

Air-gapped mirror includes the deployed Istio proxy image. The registry mirror now includes the Istio proxy image tag that the cluster actually deploys. Previously the mirrored and deployed tags differed.

In the Keycloak Admin console, select the unity realm.

Go to Clients and open the sdk client.

Go to Client scopes > Add client scope, select basic, and add it as Default.

Repeat for the dashboard and mini-usf clients.