Unity Cloud Self-Hosted On-premises 2.1.0

This release requires shdctl 1.1.0 or later. Before you upgrade, read the migration guide: it lists the manual steps this release needs, and which deployments each applies to.

Platform service pods restart once during the upgrade, and so do RabbitMQ, PostgreSQL, Elasticsearch, and Garage, one pod at a time.

GPU transformations from the manifest: Added a manifest setting for GPU transformations. On clusters with GPU nodes, set `configuration.transformations.gpu.enabled: true` to turn on GPU transformations and the GPU configuration profiles, so that transformation actions that can use a GPU request one.

If your manifest sets `env.vpcGpuAvailable` under `configuration.overrides.automation-manager` , replace it with this field: `shdctl release generate` refuses the manifest while it is set. Refer to Replace the automation-manager GPU override with the manifest field.

Organization feature flags in the manifest: Added support for declaring your organization's feature flags in the manifest, under `configuration.organization.featureFlags` , instead of setting them with upc-cli. Each flag is `true` or `false` , and the deployment sets the flags on its organization.

Alerting through Alertmanager: Added Alertmanager, which runs when you enable `configuration.monitoring.prometheus.enabled` . It uses the standard Kubernetes alerting rules, plus alerts for out-of-memory kills, containers near their memory limit, and pending transformations. Alertmanager sends nothing until you add an `AlertmanagerConfig` with your receiver in the deployment's namespace, and it adds a 1 GiB volume.

The four Grafana alerts in Grafana's Custom folder are removed. If you set up a contact point for them, route the new alerts instead: refer to Route alerts through Alertmanager.

Prometheus metrics from Asset Manager's services: Added Prometheus metrics to Asset Manager's backend services. When `configuration.monitoring.prometheus.enabled` or `installedInCluster` is set, each service serves its metrics at `/metrics` with a ServiceMonitor. Refer to Service metrics reference for the metrics that stay stable across releases.

A storage class for every block volume: Added the `configuration.kubernetes.storage.readWriteOnceStorageClass` manifest field, which names the block storage class that every ReadWriteOnce volume uses, so the cluster needs no default storage class. New deployments set the field, and `shdctl manifest init` writes it. Existing deployments keep `defaultStorageClass` unchanged.

Scoped deep links: Added two edge routes that scope deep links to an organization or a project: `POST /backend/app-linking/v1/organizations/{organizationId}/links` and `POST /backend/app-linking/v1/organizations/{organizationId}/projects/{projectId}/links` . The routes pass the caller's `Authorization` header to the link-sharing service, which checks organization and project access when it resolves a scoped link. Existing deep links keep working unchanged.

Requiring action

Upgraded Traefik to v3.7.16. Complete each step that applies to your deployment:

If you deploy with Helm, list `traefik` in the `deployment.helm.upgradeCrds` manifest field when you upgrade, so that Traefik's CRDs stay current. Refer to Upgrade Traefik's CRDs in Helm deployments.

If your manifest overrides Traefik values, move the values that the new chart renames. Refer to Move the Traefik settings that the new chart renames.

The new Traefik version doesn't install the Gateway API CRDs. If you deploy with ArgoCD and something else in your cluster uses the Gateway API, keep the Gateway API CRDs before you upgrade. Refer to Keep the Gateway API CRDs in ArgoCD deployments.

Made service accounts part of their Helm releases, so an upgrade doesn't re-create them. If you deploy without ArgoCD, hand the service accounts over to Helm once during the upgrade. Refer to Hand the service accounts over to Helm.

Upgraded Pipeline Automation to v0.0.81. Before you upgrade, snapshot the Pipeline Automation database. Refer to Automation 0.0.81: snapshot its database first.

Changed RabbitMQ to keep a replica of every queue on each of its nodes, so node upgrades and RabbitMQ restarts don't get stuck on a queue created while a node was starting. Unless you set `configuration.infrastructure.singleNode: true` , check for missing queue replicas before you upgrade. Refer to Add missing RabbitMQ queue replicas before you upgrade.

Changed PostgreSQL, Elasticsearch, and Garage replicas to always run on separate nodes, so losing one node takes down at most one replica of each. Unless you set `configuration.infrastructure.singleNode: true` , check before you upgrade whether any pods of these services share a node and must be moved. Refer to Check for PostgreSQL, Elasticsearch, and Garage pods that share a node before you upgrade.

Renamed the transformations' shared scratch volume from `azurefile-sync-share-default` to `sync-share-default` , and removed the unused `efs-claim` . Upgrade while no transformation is running. Refer to Let running transformations finish before you deploy. If you create volumes by hand, create a volume for the renamed claim before you deploy. Refer to Create a volume for the renamed transformation workspace.

Changed Grafana's admin password so that it's generated for each deployment instead of using a shared default. `shdctl secret generate` creates the password in the `grafana-credentials` secret. If Prometheus monitoring is enabled, set the password during the upgrade. Refer to Set Grafana's admin password.

Changed Keycloak's admin password so that it's generated for each new deployment. `shdctl secret generate` creates the password in the `keycloak-admin` secret. An upgraded deployment keeps its admin password. If the password is still the old default, change it in the Keycloak console, and then set the new password under `keycloak-admin` in your secrets file.

Removed Istio, which was an optional component, so the release ignores `configuration.networking.serviceMesh` . Delete that setting from your manifest.

Changed collection sharing to keep its grants in an `asset-manager` PostgreSQL database that the next deploy creates. The release doesn't use the `collectionsharing` database, so you can drop it after you upgrade.

No action required

Added resource requests and limits to every component. Monitoring, logging, database, and workflow components, and the setup jobs and init containers that run during a deploy, request CPU and memory and set memory limits (PMM sets no limit). To raise a value, use `configuration.overrides..values` . With all monitoring turned on, the general pool needs about 3.5 more vCPUs and 12 GiB.

Increased Traefik's CPU request to 0.5 CPU per replica, up from 0.1, so Traefik doesn't scale to its maximum replica count under ordinary traffic. The two minimum replicas reserve 0.8 CPU more on the general pool.

Changed per-node agents so that they always schedule. Log collection, node metrics, and the Loki canary schedule ahead of application pods through their own PriorityClasses ( `asset-solutions-*` ), so they run on every node. On a full node, an agent evicts an application pod, and the pod is rescheduled.

Changed node drains and autoscaler scale-downs to take down at most one RabbitMQ pod and one Garage pod at a time, unless you set `configuration.infrastructure.singleNode: true` .

Changed 3D uploads to run the Prepare for Asset Manager pipeline, which generates the file's thumbnail, 3D preview, and metadata. The pipeline runs as the uploader, and its runs show in Pipeline Automation. Video previews are unchanged.

Removed Loki's memcached caches, which together reserved 10.8 GiB of memory and 1 CPU, so `shdctl artifact sync images` doesn't copy their images.

Removed the daily entitlements snapshot job and the entitlements export endpoint. The licensing server manages seat usage.

Changed the ingress to reject requests with a `404` when the request path has extra segments before `/backend` or after the end of an API route.

Updated the Linux Shell, Python, HTTP Client, Asset Transformer, and Data Streaming automation apps to run images fixed for CVE-2026-111497 (Brotli). The images' trust stores don't trust the compromised eMudhra certificate authorities.

• Linux

No action required

Fixed ArgoCD-managed deployments so that they install a release's new automation apps and pipelines on upgrade, even when the release changes only those.

Fixed Elasticsearch masters with `sizing: small` crash-looping out of memory, which made asset search fail. The masters request and are limited to 2 GiB of memory.

Fixed an issue where automation jobs on clusters with strict admission policies got stuck. The progress-report pod that follows each step sets CPU and memory requests and limits.

Reduced dropped log lines. Loki accepts up to 10 MiB/s of logs, with bursts of up to 20 MiB.

Fixed log collection on IPv6-only clusters, where Loki crash-looped at startup with `configuration.networking.ipFamily: ipv6` .

Fixed metadata extraction so that it stays off GPU nodes tainted `nvidia.com/gpu` , where it took the nodes' capacity or caused a GPU node to be added for it.

Fixed `workflow-engine` crash-looping out of memory on large nodes with 32 or more vCPUs.

Fixed nightly PostgreSQL backups reporting `Failed` when a node autoscaler scales down.

Fixed on-demand PostgreSQL backups on ArgoCD being deleted about a second after they succeeded.

Fixed Elasticsearch with `singleNode: true` not starting in namespaces that enforce the Restricted Pod Security Standard.