v0.2.0-cohere.5

Combined fixes on top of v0.2.0-cohere.3:

• ca-certificates in the CAA image (#42) — fixes x509: certificate signed by unknown authority on GCP STS / Workload Identity token exchange that blocked peer pod creation.
• Pin kata-deploy to 3.29.0 (#43) — replaces the floating 0.0.0-dev dependency. Restores a stable image (quay.io/kata-containers/kata-deploy:3.29.0) and drops priorityClassName: system-node-critical, fixing the stuck kata-deploy rollout (the 0.0.0-dev chart pulled the CI image + a shim set that broke on GKE).

Artifacts:

• ghcr.io/cohere-ai/cloud-api-adaptor/cloud-api-adaptor:v0.2.0-cohere.5
• ghcr.io/cohere-ai/cloud-api-adaptor/peerpod-ctrl:v0.2.0-cohere.5
• ghcr.io/cohere-ai/cloud-api-adaptor/charts/peerpods:0.2.0-cohere.5 (kata-deploy pinned to 3.29.0)

v0.2.0-cohere.4

Fix: install ca-certificates in the CAA image (#42).

v0.2.0-cohere.3 shipped without a CA trust bundle (upstream switched the
base image from Fedora to debian:trixie-slim), so all GCP compute.* calls
failed with x509: certificate signed by unknown authority during the
Workload Identity Federation token exchange with sts.googleapis.com,
blocking peer pod sandbox creation. This release restores TLS verification.

Artifacts:

• ghcr.io/cohere-ai/cloud-api-adaptor/cloud-api-adaptor:v0.2.0-cohere.4
• ghcr.io/cohere-ai/cloud-api-adaptor/peerpod-ctrl:v0.2.0-cohere.4
• ghcr.io/cohere-ai/cloud-api-adaptor/charts/peerpods:0.2.0-cohere.4

v0.2.0-cohere.3

Patched cohere release.

Changes since v0.2.0-cohere.2

• helm/webhook: set restricted-compliant securityContext (#41) — adds pod-level + per-container seccompProfile: RuntimeDefault and capabilities.drop: [ALL] on the manager container so the peer-pods webhook passes the restricted Pod Security Standard.

Artifacts

• ghcr.io/cohere-ai/cloud-api-adaptor/cloud-api-adaptor:v0.2.0-cohere.3
• ghcr.io/cohere-ai/cloud-api-adaptor/peerpod-ctrl:v0.2.0-cohere.3
• ghcr.io/cohere-ai/cloud-api-adaptor/charts/peerpods:0.2.0-cohere.3

v0.2.0-cohere.2

Patch release on the cohere fork.

• fix(podvm): wait for /dev/tdx_guest before skipping RTMR3 extension (27e1283)
• ci(podvm): GCP image smoke CI + multiarch manifest publishing
• refactor(permissions): drop SA annotations from permissions.yaml

Builds/pushes:

• ghcr.io/cohere-ai/cloud-api-adaptor/cloud-api-adaptor:v0.2.0-cohere.2
• ghcr.io/cohere-ai/cloud-api-adaptor/peerpod-ctrl:v0.2.0-cohere.2
• ghcr.io/cohere-ai/cloud-api-adaptor/charts/peerpods:0.2.0-cohere.2

v0.1.4-cohere.2

GCP provider: opt-in public IP on peer pod VMs (default off, set USE_PUBLIC_IP=true to restore previous behavior) and configurable network tags via GCP_NETWORK_TAGS.