vpctl 1.1.0

Added a log message to `shdctl release pull` that shows where the release notes are in the extracted release. Added links to the public documentation to `shdctl --help` , `shdctl version` , and the minimum shdctl version error.

Added the manifest field `configuration.transformations.gpu.enabled` , which Self-Hosted Deployment 2.1 and later read. On clusters with GPU nodes, transformation actions that can use a GPU request one. `shdctl cluster check` warns when the field is set and the check finds no GPU node or GPU NodePool.

Added the manifest field `configuration.organization.featureFlags` , which Self-Hosted Deployment 2.1 and later read. It holds the organization feature flags (each `true` or `false` ) that the deploy's onboarding job sets on the deployment's organization.

Added the manifest field `configuration.kubernetes.storage.readWriteOnceStorageClass` , which Self-Hosted Deployment 2.1 and later read. It names the storage class of every ReadWriteOnce volume, so `shdctl cluster check` requires no cluster default storage class.

`shdctl manifest init` writes this field, or `defaultStorageClass` for a release before Self-Hosted Deployment 2.1.

A deployment created with `defaultStorageClass` keeps that field. A manifest names only one of the two fields.

Added the `volume templates` check to `shdctl cluster check` . It fails when the field your manifest names disagrees with the volumes a deployment already has. Renamed the `default storage class` check to `rwo storage class` .

Added the manifest field `deployment.helm.upgradeCrds` . For each chart this field lists, `shdctl release deploy --format helm` applies the chart's CRDs before it upgrades the chart. Helm never does this. Refer to Keep chart CRDs up to date.

Added the `--context` flag to `shdctl release deploy` . It names a Kubernetes context other than the current one to deploy to, and applies to both the `helm upgrade` and `kubectl` commands that the deploy runs.

BREAKING Made `configuration.kubernetes.storage` required. Every command that reads the manifest, including `shdctl manifest validate` and `shdctl cluster check` , refuses a manifest without it and names `readWriteManyStorageClass` and `readWriteOnceStorageClass` . A manifest that already deploys has this field.

Changed commands that fail after accepting their flags and arguments so that the output ends on the error and doesn't include the command's full usage and flags block. A mistyped flag, a missing required flag, or an unexpected argument still prints the usage.

Changed `shdctl artifact sync verify` to retry a throttled or failing registry. When the registry can't answer for an image, `verify` lists the image under "could not be checked" with the registry's error, instead of as missing. Both cases still exit non-zero.

Changed `shdctl release generate` so that it doesn't write charts that your manifest turns off, such as `loki` when log collection is off. It deletes the directories that earlier runs left for those charts, and it refuses those charts when you name them with `--name` . Commit the deletions to your GitOps repository.

Changed `shdctl release deploy` , `release uninstall` , and `release generate --format argocd` to name the charts they leave out at the default log level, for example `Skipping 6 chart(s) turned off by the release or your manifest ...: alloy, common-chart, ...` . Before this change, only the count showed unless you ran with `--log-level debug` .

Deprecated `configuration.networking.serviceMesh` . Self-Hosted Deployment 2.1 and later ignore it, and shdctl logs a notice when your manifest sets it. Delete it after you upgrade to Self-Hosted Deployment 2.1, because Self-Hosted Deployment 2.0.0 still uses it to deploy Istio. shdctl 2.0.0 will reject a manifest that sets it.

BREAKING Removed support for `{{index (index .Secrets "name") "key"}}` in a value you give `shdctl secret generate` , through an import file or a prompt. Write `{{secret "name" "key"}}` instead. A value that still uses the old form fails with an error that names the field and the expression.

Fixed an issue where a mistyped subcommand, such as `shdctl release genrate` , didn't fail. A mistyped subcommand fails with `unknown command` and a non-zero exit, so a pipeline step that contains the typo stops instead of passing.

Fixed an issue where `shdctl release generate --format argocd` wrote applications that ArgoCD rejects when `deployment.argocd.pathPrefix` and `--argocd-path-prefix` are both empty. The command fails in that case. `shdctl manifest init` asks for the path prefix, with a default of `generated-charts` .

Fixed an issue where `shdctl manifest init` enabled a second Prometheus stack when you answered that Prometheus is already installed. The command writes `prometheus.enabled: false` together with `installedInCluster: true` in that case.

Built shdctl with Go 1.26.10. This patches twelve standard-library CVEs that `govulncheck` flagged and that are reachable from shdctl's registry, Helm, and manifest handling. Most affect HTTP/2 in `net/http` , and the others affect `crypto/tls` , `crypto/x509` , `mime/multipart` , and `html/template` . No behavior change.