vpctl 0.11.0

Rebuilt with Go 1.26.4 (previously 1.26.3) to address two standard library CVEs that affect `vpctl` :

Fixed a `net/textproto` vulnerability that could include unescaped input in error messages during CUE and YAML manifest parsing.

Fixed a `crypto/x509` issue that could cause inefficient hostname parsing during TLS verification for Helm and OCI registry operations.

Updated `golang.org/x/net` to version `0.55.0` to fix an `idna` Punycode validation vulnerability during manifest validation.

These updates improve the toolchain and dependencies without changing `vpctl` behavior.

The `configuration.imageVariant` manifest field lets you select an image variant, such as `hardened` , during chart generation. If an image doesn't support the requested variant, `vpctl release generate` now fails instead of generating incorrect image tags.

The `configuration.infrastructure.singleNode` manifest field lets you deploy Garage, PostgreSQL (Percona), MongoDB (Percona), Elasticsearch (ECK), and RabbitMQ as single-replica deployments. Set this Boolean value to `true` to disable PodDisruptionBudgets and remove hard anti-affinity rules. Use this option only for test or evaluation clusters, not for production.

The `release deploy --concurrency` flag lets you deploy independent charts within the same deployment wave in parallel. The default value is `1` , which preserves sequential deployment. You can set `deployment.helm.concurrency` in the manifest to change the default, and the command-line flag overrides the manifest value. If the concurrency value is greater than `1` , `vpctl` buffers each chart's Helm output and displays it after the chart finishes.

Per-wave and end-of-deploy summary lines, for example, `Wave N complete: X total, Y succeeded, Z failed` are now emitted on every non-dry-run deploy, regardless of the concurrency setting.

The `configuration.networking.ingress.traefik.nodePorts` manifest field lets you assign fixed Kubernetes node ports for the `web` and `websecure` Traefik entry points. Each port must be within the `30000-32767` range. Omit this field to let Kubernetes assign node ports automatically.

The `vpctl configure set --password-stdin` option reads the registry password from standard input. This is the recommended authentication method for automation.

The `VPCTL_USERNAME` and `VPCTL_PASSWORD` environment variables provide non-interactive credentials to `vpctl configure set` . Credential precedence is command-line flag, environment variable, then interactive prompt.

The `minLength` secret schema field enforces a minimum secret length. `vpctl secret generate` now prompts for a longer value in interactive mode or exits with an error in non-interactive mode if the value is too short. You can't combine `minLength` with `default` , and generated secrets must use a `length` value that is at least equal to `minLength` .

`secret generate --persist` now requires a file path. The `--persist` shortcut no longer defaults to `secrets.import.yaml` . To preserve the previous behavior, use `--persist secrets.import.yaml` .

`vpctl configure set` now displays a warning if you use the `--password` command-line option because the password is visible in your shell history and the process list. The option remains available for backward compatibility. Use `--password-stdin` or `VPCTL_PASSWORD` instead. If you don't provide credentials and standard input isn't connected to a terminal, the command exits with an error instead of waiting indefinitely.

`vpctl artifact sync` now applies the `configuration.imageVariant` value when it mirrors Docker images, which matches the behavior of `vpctl release generate` . Previously, `artifact sync` mirrored the base image tags while chart generation referenced variant-specific tags, such as `asset-front-end:1.0.342-hardened` . This mismatch could cause `ImagePullBackOff` errors when you set `imageVariant: hardened` .

`secret generate --persist ` now correctly writes secrets to the specified file. Previously, the command ignored the provided file path and always wrote to `secrets.import.yaml` , which could overwrite the existing import file.