vpctl 0.10.0

Rebuilt with Go 1.26.3 (previously 1.25.x) to pick up four standard-library CVE fixes that were reachable from vpctl: two `html/template` escaper bypasses used by CUE schema validation, a `net.Dialer` NUL-byte panic on Windows used by OCI registry pulls, and an HTTP/2 `SETTINGS_MAX_FRAME_SIZE` infinite loop used by every outbound HTTP call. The `golang.org/x/net` dependency is bumped to v0.53.0.

• Windows

New optional `configuration.networking.trustedCaSecretName` manifest field. Reference a pre-existing Kubernetes Secret (single key `ca-bundle.crt` , PEM-encoded CA chain) to make the .NET workflow containers (StorageTool) trust an internally-signed ingress certificate. Required for environments where the ingress TLS isn't chained to a publicly-trusted CA. The CA bundle is also mounted into the Pixyz Argo workflow templates ( `asset-manager-glb-preview` , `asset-manager-metadata-extraction` , `asset-manager-optimize-and-convert` , `asset-manager-thumbnail-generator` ) for defensive coverage of any future outbound HTTPS calls from those containers.

`release deploy --timeout` flag (default `10m` ): per-release timeout passed to `helm` when waiting.

`release deploy --retries` flag (default `0` ): number of additional attempts after a failed `helm upgrade --install` or `helm template | kubectl apply` . Helps with the "CRDs not yet visible on first attempt" race that sometimes resolves on a second attempt.

`release deploy --retry-delay` flag (default `5s` ): sleep between retry attempts.

`keyType: hex` support in the secret schema: generates `length` hex characters (lowercase `a` – `f` / `0` – `9` ) from `crypto/rand` for cryptographic secrets that require pure hex (for example, the Garage `rpc_secret` ). The `length` field is required and must be even.

Breaking: `release deploy --wait` now defaults to `true` (was `false` ). Each Helm release is waited on before vpctl moves to the next chart, with the new default 10-minute per-release timeout. Pass `--wait=false` to restore the previous fire-and-forget behavior.

Breaking: the `rustfs:` manifest field under `configuration.infrastructure.components` is replaced by `garage:` , which exposes `resources` (standard CPU and memory requests and limits), `metaStorage` , `dataStorage` , `replicas` , and `replicationFactor` (capped at 3). The on-premises release package's `compatibility.yaml` `minVpctlVersion` is bumped to `0.10.0` in the same release, so you must upgrade vpctl to `0.10.0` before you can deploy on-premises release `0.13.0` or later.

Remote Helm charts now resolve their source registry from `manifest.yaml` `artifactSync.sourceRepository` , the same way Docker images and ORAS artifacts already do, instead of a per-chart URL.

The `_arrayMerge` helper in chart values now recurses through nested map levels, so paths like `_arrayMerge.backups.pgbackrest.repos.0.X` merge into `backups.pgbackrest.repos[0].X` . Top-level array behavior is unchanged.