v0.21.1

• Updates to CI and builds scripts to resolve some podvm build and publishing issues

v0.21.0

Known issues

The s390x and arm64 podvm image build has problems, so they have not been published

Deprecation Notices

• The docker provider has deprecated since 0.20 and is planned to be removed in 0.22
• The fedora-based mkosi podvm image has been deprecated since 0.20 and is planned to be removed in 0.22
• The packer-built podvm image has been deprecated since 0.17 and is planned to be removed in 0.22
• The csi-wrapper approach is deprecated and is planned to be removed in 0.22

What's Changed

• peerpods/chart: expose podLabels and serviceAccount.annotations for both controllers by @david-long1 in #3025
• ci: fix duplicated arch suffix in CAA image tags by @wainersm in #3029
• Revert "workflows: disregard e2e_aws status" by @wainersm in #3026
• PodVM: fix awk not found when running setup-nat-for-imds.sh by @Qiang-Xu in #3030
• build: migrate from custom golang-fedora to official golang images by @stevenhorsman in #2995
• build(deps): bump the aws-sdk-go-v2 group across 2 directories with 8 updates by @dependabot[bot] in #3031
• ci: refactor release.yaml to call podvm_publish.yaml by @stevenhorsman in #3028
• build(deps): bump the aws-sdk-go-v2 group across 2 directories with 2 updates by @dependabot[bot] in #3036
• build(deps): bump the azure-sdk group across 2 directories with 1 update by @dependabot[bot] in #3019
• build(deps): bump the ibm-sdk group across 2 directories with 2 updates by @dependabot[bot] in #3015
• ci: add versions cli by @mkulke in #3032
• e2e-test: Improve test coverage for adaptor in CAA by @SantoshMadhukar-K in #3011
• libvirt: validate required provider configuration earlier by @ajaypvictor in #3038
• podvm-mkosi: Fix podvm Ubuntu image build on s390x by @BbolroC in #3023
• Refactor BYOM e2e by @Amulyam24 in #3006
• build(deps): bump github/codeql-action from 4.35.2 to 4.35.3 by @dependabot[bot] in #3044
• build(deps): bump the aws-sdk-go-v2 group across 2 directories with 8 updates by @dependabot[bot] in #3045
• build(deps): bump the google-cloud group across 2 directories with 2 updates by @dependabot[bot] in #3046
• Bump golang to 1.25.10 by @Amulyam24 in #3050
• GHA: add BYOM e2e workflows by @Amulyam24 in #3042
• ci: migrate peerpod-ctrl to native multi-arch builds by @stevenhorsman in #3041
• ci: fix peerpod-ctrl build to create single-arch images by @stevenhorsman in #3060
• Switch AWS CI to use mkosi podvm image by @wainersm in #3043
• build(deps): bump github.com/IBM/platform-services-go-sdk from 0.97.2 to 0.97.4 in /src/cloud-api-adaptor in the ibm-sdk group across 1 directory by @dependabot[bot] in #3047
• build(deps): bump github/codeql-action from 4.35.3 to 4.35.4 by @dependabot[bot] in #3066
• build(deps): bump aws-actions/configure-aws-credentials from 6.1.0 to 6.1.1 by @dependabot[bot] in #3067
• azure: disable e2e tests by @mkulke in #3072
• 0.20.0 post release by @stevenhorsman in #3040
• caa: add BYOM provider to release builds by @Amulyam24 in #3073
• libvirt: add cpuset support for CPU pinning by @ajaypvictor in #3065
• ci: build peerpod-ctrl and webhook images in nightly e2e by @wainersm in #3063
• azure: consolidate ci infra by @mkulke in #3080
• userdata: use IMDSv2 token for AWS metadata with IMDSv1 fallback by @Agrek11 in #3058
• podvm-mkosi: blacklist vmgenid driver init to fix AWS SEV-SNP boot hang by @Agrek11 in #3083
• e2e: move the cluster provisioning using kind to byom by @Amulyam24 in #3071
• e2e-test: Improve test coverage for libvirt in CAA by @chathuryaadapa in #3051
• e2e-test: Add comprehensive manager_test.go for libvirt provider by @chathuryaadapa in #3052
• build(deps): bump github.com/containerd/containerd from 1.7.29 to 1.7.32 in /src/cloud-api-adaptor by @dependabot[bot] in #3085
• Kata 3.31.0 release bump by @stevenhorsman in #3081
• build(deps): bump zizmorcore/zizmor-action from 0.5.3 to 0.5.6 by @dependabot[bot] in #3087
• Go x net 0.55 bump by @stevenhorsman in #3096
• 0.21.0 release pinning by @stevenhorsman in #3095

New Contributors

• @david-long1 made their first contribution in #3025
• @Qiang-Xu made their first contribution in #3030
• @SantoshMadhukar-K made their first contribution in #3011
• @Agrek11 made their first contribution in #3058

Full Changelog: v0.20.0...v0.21.0

v0.20.0

Notable security fix

• CVE-2026-41326 in our updated kata agent in the podvm images

Deprecation Notices

• The docker provider is deprecated and planned to be dropped in the next release
• The fedora-based mkosi podvm image is deprecated (replaced with a ubuntu image) and planned to be dropped in the next release

What's Changed

• build(deps): bump github.com/IBM-Cloud/power-go-client from 1.14.4 to 1.15.0 in /src/cloud-api-adaptor in the ibm-sdk group across 1 directory by @dependabot[bot] in #2968
• build(deps): bump azure/login from 2.3.0 to 3.0.0 by @dependabot[bot] in #2965
• build(deps): bump nick-fields/retry from 3.0.2 to 4.0.0 by @dependabot[bot] in #2966
• libvirt: use domain names for cleanup of crashed VMs by @ajaypvictor in #2964
• deps: update docker/docker to v28.5.2 by @ajaypvictor in #2972
• charts: remove latest tags for some images by @beraldoleal in #2970
• 0.19 post release tasks by @stevenhorsman in #2961
• ci: add artifact-metadata:write permission to attestation workflows by @stevenhorsman in #2973
• ci: add artifact-metadata to e2e_run_all by @ldoktor in #2974
• ci: add artifact-metadata:write permission to e2e workflows by @BbolroC in #2975
• ci: add artifact-metadata:write to missing workflows by @BbolroC in #2976
• webhook: Avoid running webhook on update by @ldoktor in #2971
• build(deps): bump actions/setup-go from 6.3.0 to 6.4.0 by @dependabot[bot] in #2977
• build(deps): bump github/codeql-action from 4.32.4 to 4.35.1 by @dependabot[bot] in #2978
• build(deps): bump github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream from 1.7.7 to 1.7.8 in /src/cloud-api-adaptor by @dependabot[bot] in #2982
• build(deps): bump docker/login-action from 4.0.0 to 4.1.0 by @dependabot[bot] in #2988
• versions: bump golang to 1.25.9 by @stevenhorsman in #2985
• podvm-mkosi: fix CDH image pull failures due to missing DNS and TLS packages by @bpradipt in #2990
• build(deps): bump the google-cloud group across 2 directories with 2 updates by @dependabot[bot] in #2987
• version: Bump go to 1.25.9 cont. by @stevenhorsman in #2992
• e2e-test: Improve test coverage for agent-protocol-forwarder in CAA by @ANJANA-A-R-K in #2986
• podvm: fix kata-agent startup race with CDH on Ubuntu by @bpradipt in #2994
• build(deps): bump github.com/moby/spdystream from 0.5.0 to 0.5.1 in /src/cloud-api-adaptor by @dependabot[bot] in #2997
• build(deps): bump go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp from 1.21.0 to 1.43.0 in /src/cloud-providers by @dependabot[bot] in #2984
• build(deps): bump docker/build-push-action from 7.0.0 to 7.1.0 by @dependabot[bot] in #3002
• build(deps): bump actions/upload-artifact from 7.0.0 to 7.0.1 by @dependabot[bot] in #3001
• build(deps): bump oras-project/setup-oras from 1.2.4 to 2.0.0 by @dependabot[bot] in #3000
• build(deps): bump aws-actions/configure-aws-credentials from 6.0.0 to 6.1.0 by @dependabot[bot] in #2999
• build(deps): bump the google-cloud group across 2 directories with 3 updates by @dependabot[bot] in #3004
• workflows: disregard e2e_aws status by @wainersm in #3010
• podvm: Run iptables-wrapper directly by @BbolroC in #3007
• Simplify caa multi arch build by @stevenhorsman in #2777
• workflows: correctly publish mkosi images by @wainersm in #3012
• ci: Add mkosi, ubuntu-based podvm image tests by @stevenhorsman in #2924
• Kata 3.29.0 bump by @stevenhorsman in #3013
• Enhance test coverage in interceptor_test.go and forwarder_test.go by @ANJANA-A-R-K in #2996
• build(deps): bump github/codeql-action from 4.35.1 to 4.35.2 by @dependabot[bot] in #3016
• build(deps): bump zizmorcore/zizmor-action from 0.5.2 to 0.5.3 by @dependabot[bot] in #3017
• libvirt: make podvm deletion robust to disk XML variations by @ajaypvictor in #3009
• podvm: fix IMDS timeout counter by @HernanGatta in #3020
• release: 0.20 release updates by @stevenhorsman in #3022

New Contributors

• @HernanGatta made their first contribution in #3020

Full Changelog: v0.19.0...v0.20.0

v0.19.0

What's Changed

• ci: readd repo variables to Makefile.inc by @mkulke in #2876
• build(deps): bump github/codeql-action from 4.32.0 to 4.32.4 by @dependabot[bot] in #2872
• 0.18 post release tasks by @stevenhorsman in #2874
• build(deps): bump the aws-sdk-go-v2 group across 2 directories with 3 updates by @dependabot[bot] in #2873
• ibmcloud: s390x removal by @stevenhorsman in #2878
• Remove kustomize ci by @stevenhorsman in #2877
• ci: add artifact-metadata to azure release gh wf by @mkulke in #2881
• Golangci lint enablement by @stevenhorsman in #2875
• ci: exempt copilot agent from commit msg check by @mkulke in #2883
• workflow: Add option to run daily tests against non-main branch by @stevenhorsman in #2887
• ci: exempt bots from commit-body check by @mkulke in #2890
• ci: verify provenance in mkosi podvm builds by @mkulke in #2891
• build(deps): bump the azure-sdk group across 2 directories with 5 updates by @dependabot[bot] in #2783
• build(deps): bump the google-cloud group across 2 directories with 1 update by @dependabot[bot] in #2832
• test: remove kustomize-based CAA install from e2e by @wainersm in #2879
• ibmcloud: Remove podvm_image_arch parameter by @stevenhorsman in #2886
• build(deps): bump the k8s group across 5 directories with 10 updates by @dependabot[bot] in #2821
• webhook: update the kube-rbac image from gcr.io to registry.k8s.io by @Amulyam24 in #2906
• versions: bump golang to 1.25.8 by @stevenhorsman in #2904
• build(deps): bump the aws-sdk-go-v2 group across 2 directories with 8 updates by @dependabot[bot] in #2899
• Bump go 1.25.8 part 2 by @stevenhorsman in #2905
• workflows: Use IBM Actions Z runners for s390x CI jobs by @BbolroC in #2903
• build(deps): bump actions/setup-go from 6.2.0 to 6.3.0 by @dependabot[bot] in #2896
• build(deps): bump actions/download-artifact from 7.0.0 to 8.0.0 by @dependabot[bot] in #2895
• build(deps): bump actions/upload-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in #2897
• build(deps): bump the ibm-sdk group across 2 directories with 3 updates by @dependabot[bot] in #2901
• build(deps): bump actions/attest-build-provenance from 3.2.0 to 4.1.0 by @dependabot[bot] in #2898
• workflows: Build pod VM images on VM-based runners for s390x by @BbolroC in #2913
• mkosi: Bump to Fedora 43 by @BbolroC in #2914
• Remove kustomize install from webhook and peerpod-ctrl by @wainersm in #2912
• workflow: Fix stalebot permissions by @stevenhorsman in #2915
• build(deps): bump the k8s group across 5 directories with 4 updates by @dependabot[bot] in #2902
• podvm: Locking Kernel Version with iptables installation for rhel s390x by @Rohit-Singh43-1 in #2920
• helm: handle error if release is not found by @Amulyam24 in #2919
• build(deps): bump the aws-sdk-go-v2 group across 2 directories with 8 updates by @dependabot[bot] in #2932
• build(deps): bump raven-actions/actionlint from 2.1.1 to 2.1.2 by @dependabot[bot] in #2931
• workflow: publish peerpods-chart image on push and releases by @wainersm in #2918
• Remove kustomize install from CAA by @stevenhorsman in #2894
• build(deps): bump docker/build-push-action from 6.19.2 to 7.0.0 by @dependabot[bot] in #2926
• build(deps): bump docker/login-action from 3.7.0 to 4.0.0 by @dependabot[bot] in #2929
• build(deps): bump docker/setup-qemu-action from 3.7.0 to 4.0.0 by @dependabot[bot] in #2927
• peerpods: bump chart version to 0.1.2 by @beraldoleal in #2922
• build(deps): bump docker/setup-buildx-action from 3.12.0 to 4.0.0 by @dependabot[bot] in #2930
• install: add secrets configuration for BYOM provider by @Amulyam24 in #2884
• charts: pin CAA image and kata-deploy for 0.1.2 by @beraldoleal in #2937
• ci: don't run smoke tests as part of the PR suite by @mkulke in #2942
• Revert "charts: pin CAA image and kata-deploy for 0.1.2" by @beraldoleal in #2940
• deps: pin Dockerfile base images to SHA256 digests by @Copilot in #2936
• version: Bump to sync with Kata 3.28.0 release versions by @stevenhorsman in #2938
• workflows: align peerpods-chart concurrency group with parent workflow by @wainersm in #2935
• build(deps): bump zizmorcore/zizmor-action from 0.5.0 to 0.5.2 by @dependabot[bot] in #2951
• build(deps): bump actions/download-artifact from 8.0.0 to 8.0.1 by @dependabot[bot] in #2949
• provisioner: remove PCCS/QCNL options for trustee by @mkulke in #2954
• build(deps): bump the ibm-sdk group across 2 directories with 2 updates by @dependabot[bot] in #2953
• ibmcloud: get cluster ID from IKS cluster by @squarti in #2948
• ibmcloudpowervs: VM build times out frequently by @squarti in #2946
• ibmcloud-powervs: Fix provider path in README by @Amulyam24 in #2956
• build(deps): bump the aws-sdk-go-v2 group across 2 directories with 8 updates by @dependabot[bot] in #2952
• alibabacloud: fix helm chart deployment by @Xynnn007 in #2955
• podvm.hack: Add serial console output on failure by @ldoktor in #2933
• ci: do not run azure e2e initdata measurement test by @mkulke in #2958
• 0.19 release updates by @stevenhorsman in #2960

Full Changelog: v0.18.0...v0.19.0

v0.18.0

Important notes

• This is the first release of peer pods using the helm chart as an install method
• Due to the CoCo operator being archived, the peer pods kustomize install method is deprecated and will be removed in the next release.

What's Changed

• build(deps): bump github/codeql-action from 4.31.3 to 4.31.4 by @dependabot[bot] in #2695
• build(deps): bump actions/checkout from 5.0.0 to 6.0.0 by @dependabot[bot] in #2696
• 0.17.0 post release by @stevenhorsman in #2697
• parser: fix env variable precedence by @beraldoleal in #2670
• GHA: Install yq when the package is not installed by @BbolroC in #2698
• podvm(aws): add missing extra kernel module for Ubuntu 24.04 by @EmmEff in #2590
• parser: ignore empty environment variables by @beraldoleal in #2699
• build(deps): bump zizmorcore/zizmor-action from 0.2.0 to 0.3.0 by @dependabot[bot] in #2703
• build(deps): bump github/codeql-action from 4.31.4 to 4.31.5 by @dependabot[bot] in #2701
• build(deps): bump aws-actions/configure-aws-credentials from 5.1.0 to 5.1.1 by @dependabot[bot] in #2702
• GCP: support for using internal instance ips by @EmmEff in #2688
• versions: Bump golang to 1.24.11 by @stevenhorsman in #2706
• config-extractor: an utility to get the provider variables by @beraldoleal in #2676
• gcp: use the new registration method for public ip by @beraldoleal in #2711
• build(deps): bump github/codeql-action from 4.31.5 to 4.31.7 by @dependabot[bot] in #2715
• build(deps): bump actions/stale from 10.1.0 to 10.1.1 by @dependabot[bot] in #2713
• build(deps): bump actions/checkout from 6.0.0 to 6.0.1 by @dependabot[bot] in #2714
• version: Complete the bump to go 1.24.11 by @stevenhorsman in #2707
• build(deps): bump the aws-sdk-go-v2 group across 2 directories with 8 updates by @dependabot[bot] in #2666
• podvm: increase robustness of provenance checks by @mkulke in #2716
• podvm: Upgrade RHEL base images to ubi10.1 by @Rohit-Singh43-1 in #2710
• byom: enable using exisitng VMs as BYOM pool VM by @Amulyam24 in #2689
• build(deps): bump github/codeql-action from 4.31.7 to 4.31.8 by @dependabot[bot] in #2721
• build(deps): bump actions/cache from 4.3.0 to 5.0.1 by @dependabot[bot] in #2718
• build(deps): bump actions/download-artifact from 6.0.0 to 7.0.0 by @dependabot[bot] in #2720
• build(deps): bump actions/upload-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in #2719
• Reapply "versions: Pin operator version" by @stevenhorsman in #2728
• golang: Bump up base Fedora version by @bpradipt in #2730
• build(deps): bump the aws-sdk-go-v2 group across 2 directories with 8 updates by @dependabot[bot] in #2723
• config-extractor: adding flag options by @beraldoleal in #2712
• build(deps): bump docker/setup-buildx-action from 3.11.1 to 3.12.0 by @dependabot[bot] in #2733
• build(deps): bump github/codeql-action from 4.31.8 to 4.31.9 by @dependabot[bot] in #2732
• build(deps): bump actions/attest-build-provenance from 3.0.0 to 3.1.0 by @dependabot[bot] in #2731
• build(deps): bump the azcore group across 2 directories with 1 update by @dependabot[bot] in #2739
• build(deps): bump the protobuf group across 2 directories with 1 update by @dependabot[bot] in #2740
• ci: group shared dependencies in dependabot to prevent failures by @tak-ka3 in #2751
• ibmcloud: remove VpcServiceURL default value by @Pacho20 in #2726
• build(deps): bump the aws-sdk-go-v2 group across 2 directories with 4 updates by @dependabot[bot] in #2741
• Remove vsphere cloud provider by @stevenhorsman in #2756
• e2e-test: workaround for remote-attestation test by @mkulke in #2758
• e2e-test: collect KBS and CAA logs on Azure test failure by @tak-ka3 in #2745
• build(deps): bump the libvirt group across 2 directories with 2 updates by @dependabot[bot] in #2753
• Update IBM powervs dependencies by @Amulyam24 in #2760
• secure_comms: Remove ci by @stevenhorsman in #2757
• secure_comms: Remove references by @stevenhorsman in #2766
• cloud-providers: cleanup orphaned instances on CreateInstance failure by @tak-ka3 in #2743
• ibmcloud: Align environment variable naming by @Pacho20 in #2708
• ibmcloud: remove required option used for zone by @Pacho20 in #2762
• alibabacloud: Fix DeleteInstance always failing on success by @tak-ka3 in #2774
• build(deps): bump the aws-sdk-go-v2 group across 2 directories with 8 updates by @dependabot[bot] in #2770
• build(deps): bump the google-cloud group across 2 directories with 2 updates by @dependabot[bot] in #2769
• alibabacloud: Fix race condition on eips map by @tak-ka3 in #2772
• RFC: install: charts for peerpods by @beraldoleal in #2656
• GCP: missing piece for GPU support for the GCP by @snir911 in #2742
• build(deps): bump github/codeql-action from 4.31.9 to 4.31.10 by @dependabot[bot] in #2782
• CI: preparing docker and aws workflows to test the new CAA helm charts by @wainersm in #2778
• build(deps): bump the aws-sdk-go-v2 group across 2 directories with 2 updates by @dependabot[bot] in #2784
• build(deps): bump actions/cache from 5.0.1 to 5.0.2 by @dependabot[bot] in #2780
• workflows: Remove check links by @stevenhorsman in #2787
• helm/docker: adding socket mounts by @beraldoleal in #2788
• install/charts: set defaultShim to "remote" by @wainersm in #2789
• ci: Create images for arm64 by @seungukshin in #2767
• helm: introducing peerpods-ctrl and webhook charts by @beraldoleal in #2779
• podvm-mkosi: Use Ubuntu 24.04 as the base by @bpradipt in #2663
• helm: configure DS updateStrategy for --wait by @beraldoleal in #2790
• helm: add cert-manager prerequisite to README by @beraldoleal in #2792
• workflows: Disable go cache by @stevenhorsman in https://github.c...

v0.17.0

Deprecation Notices

• We plan to drop support for the experimental Secure Comms mode in the next release.
• We plan to drop support for the vSphere provider in the next release.
• We are moving away from building guest images with packer in favor of mkosi. Support for packer images will be dropped in some future release.

If you require any of these features, please let the upstream community know immediately.

What's Changed

• release: 0.16.0 post release tasks by @stevenhorsman in #2605
• build(deps): bump github/codeql-action from 3.30.3 to 3.30.5 by @dependabot[bot] in #2591
• build(deps): bump actions/cache from 4.2.4 to 4.3.0 by @dependabot[bot] in #2592
• workflows: trigger AWS on 'schedule' event by @wainersm in #2603
• build(deps): bump github.com/klauspost/cpuid/v2 from 2.2.9 to 2.3.0 in /src/cloud-api-adaptor by @dependabot[bot] in #2595
• build(deps): bump actions/stale from 10.0.0 to 10.1.0 by @dependabot[bot] in #2612
• build(deps): bump docker/login-action from 3.5.0 to 3.6.0 by @dependabot[bot] in #2611
• build(deps): bump github/codeql-action from 3.30.5 to 3.30.6 by @dependabot[bot] in #2610
• build(deps): bump ossf/scorecard-action from 2.4.2 to 2.4.3 by @dependabot[bot] in #2613
• build(deps): bump github.com/vishvananda/netlink from 1.3.1-0.20250303224720-0e7078ed04c8 to 1.3.1 in /src/cloud-api-adaptor by @dependabot[bot] in #2614
• Bump protobuf 1.36.9 by @stevenhorsman in #2601
• build(deps): bump aws-actions/configure-aws-credentials from 4.2.1 to 5.1.0 by @dependabot[bot] in #2623
• build(deps): bump github/codeql-action from 3.30.6 to 4.30.7 by @dependabot[bot] in #2622
• build(deps): bump the protobuf group across 2 directories with 1 update by @dependabot[bot] in #2624
• build(deps): bump github.com/Azure/go-autorest/autorest from 0.11.27 to 0.11.30 in /src/cloud-api-adaptor by @dependabot[bot] in #2615
• build(deps): bump github/codeql-action from 4.30.7 to 4.30.8 by @dependabot[bot] in #2626
• azure: automatically generate ssh keys if missing by @esposem in #2621
• versions: Pin setup-envtest to last release by @stevenhorsman in #2632
• azure: clean SSHKeyPath only if it isn't empty by @esposem in #2630
• e2e: readd tdx to azure e2e tests by @mkulke in #2633
• e2e: remove ssh key from azure e2e-test provisioner by @mkulke in #2631
• build(deps): bump the x-crypto group across 2 directories with 1 update by @dependabot[bot] in #2627
• CI: promote libvirt CRI-O jobs to stable but secure_comms unstable by @wainersm in #2636
• byom: extend VM_POOL_IPS to handle range of IPs by @Amulyam24 in #2620
• build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.18.2 to 1.19.1 in /src/cloud-api-adaptor by @dependabot[bot] in #2638
• e2e-test: get podvm name from CAA pod by @PrakashMuddana in #2629
• Introduce CI for AWS - part 3 by @wainersm in #2607
• build(deps): bump github/codeql-action from 4.30.8 to 4.30.9 by @dependabot[bot] in #2642
• azure: use Standard SSD for CVM storage by @snir911 in #2646
• Introduce CI for AWS - part 4 by @wainersm in #2645
• workflows: do not persist credentials on checkout by @wainersm in #2643
• e2e-test: address zizmor complaints in azure workflows by @mkulke in #2644
• build(deps): bump the x-extensions group across 2 directories with 2 updates by @dependabot[bot] in #2637
• test/e2e: fix panic in getCaaPodLogForPod() by @wainersm in #2647
• build(deps): bump actions/download-artifact from 5.0.0 to 6.0.0 by @dependabot[bot] in #2650
• build(deps): bump github/codeql-action from 4.30.9 to 4.31.0 by @dependabot[bot] in #2649
• build(deps): bump actions/upload-artifact from 4.6.2 to 5.0.0 by @ldoktor in #2655
• fix(gcp): Parse project ID from image path for cross-project support by @mateo-moon in #2654
• build(deps): bump the aws-sdk-go-v2 group across 2 directories with 8 updates by @dependabot[bot] in #2617
• build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azcore from 1.18.2 to 1.19.1 in /src/cloud-providers by @dependabot[bot] in #2639
• versions: Bump golang to 1.24.9 by @gkurz in #2667
• build(deps): bump github/codeql-action from 4.31.0 to 4.31.2 by @dependabot[bot] in #2665
• versions: Use new golang 1.24.9 image by @gkurz in #2671
• build(deps): bump lycheeverse/lychee-action from 2.6.1 to 2.7.0 by @dependabot[bot] in #2660
• CI: fix latest unstability on AWS job by @wainersm in #2664
• workflows: Switch CAA arch build to use ibm cloud runners by @stevenhorsman in #2673
• Use local go modules by @gkurz in #2659
• docs: SEV deprecation by @arvindskumar99 in #2606
• workflows: Set the ppc64le arch explicitly in setup-go by @stevenhorsman in #2677
• build(deps): bump docker/setup-qemu-action from 3.6.0 to 3.7.0 by @dependabot[bot] in #2679
• podvm-mkosi: Add mention of TEE_PLATFORM env variable by @bpradipt in #2678
• build(deps): bump github/codeql-action from 4.31.2 to 4.31.3 by @dependabot[bot] in #2683
• podvm: fix IMDS setup timeout by @snir911 in #2685
• ibmcloud: introduce custom tag list for peer pods by @Pacho20 in #2618
• Add GCP subnetwork support with flexible format handling by @mateo-moon in #2672
• versions: Bump kata runtime to 3.23.0 ~pre-~release by @stevenhorsman in #2682
• build(deps): bump golang.org/x/crypto from 0.43.0 to 0.45.0 in /src/cloud-providers by @dependabot[bot] in #2690
• Operator pin 0.17.0 by @stevenhorsman in #2692
• Release/0.17.0 by @stevenhorsman in #2693

New Contributors

• @mateo-moon made their first contribution in #2654
• @gkurz made their first contribution in #2667
• @arvindskumar99 made their first contribution in #2606

Full Changelog: v0.16.0...v0.17.0

v0.16.0

What's Changed

• workflows: Add scorecard workflow by @stevenhorsman in #2530
• cloud: Prioritise instance type annotation for selection by @bpradipt in #2536
• podvm_mkosi: Update s390x run_mkosi_in_container by @stevenhorsman in #2500
• scratch-space: Update old references by @stevenhorsman in #2541
• Post 0.15.0 tasks by @stevenhorsman in #2538
• test/e2e: Add DoTestPodWithInitContainer to libvirt by @ajaypvictor in #2543
• test/e2e: Run cloud-provider unit tests in CI by @chathuryaadapa in #2544
• aws: add support to use temporary credentials by @wainersm in #2551
• build(deps): bump github/codeql-action from 3.24.9 to 3.30.1 by @dependabot[bot] in #2556
• build(deps): bump actions/download-artifact from 4.3.0 to 5.0.0 by @dependabot[bot] in #2522
• build(deps): bump actions/cache from 4.2.3 to 4.2.4 by @dependabot[bot] in #2521
• build(deps): bump actions/upload-artifact from 4.6.1 to 4.6.2 by @dependabot[bot] in #2545
• build(deps): bump ossf/scorecard-action from 2.4.1 to 2.4.2 by @dependabot[bot] in #2546
• webhook: Increase cert deployment timeout by @ldoktor in #2553
• test/e2e: fix undefined types.ContainerListOptions error in docker_common.go by @wainersm in #2557
• cloud-providers: fix AWS and docker unit tests by @wainersm in #2558
• build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.6.0 to 1.11.0 in /src/cloud-providers by @dependabot[bot] in #2526
• e2e: disable tdx e2e tests on azure temporarily by @mkulke in #2559
• Alibaba: add peerpodctrl support by @Xynnn007 in #2560
• entrypoint: ensure that comma-separate options don't have spaces by @esposem in #2529
• e2e: disable remaining tdx e2e jobs in az e2e test by @mkulke in #2562
• build(deps): bump github/codeql-action from 3.30.1 to 3.30.3 by @dependabot[bot] in #2566
• build(deps): bump oras-project/setup-oras from 1.2.3 to 1.2.4 by @dependabot[bot] in #2567
• Actions: Use x.y.z version string for gh actions by @ldoktor in #2571
• versions: Bump golang to 1.24.7 by @stevenhorsman in #2534
• build(deps): bump github.com/avast/retry-go/v4 from 4.5.1 to 4.6.1 in /src/cloud-providers by @dependabot[bot] in #2462
• build(deps): bump actions/stale from 9.1.0 to 10.0.0 by @dependabot[bot] in #2564
• build(deps): bump lycheeverse/lychee-action from 2.5.0 to 2.6.1 by @dependabot[bot] in #2572
• build(deps): bump actions/attest-build-provenance from 2.4.0 to 3.0.0 by @dependabot[bot] in #2573
• build(deps): bump actions/setup-go from 5.5.0 to 6.0.0 by @dependabot[bot] in #2568
• versions: Bump the builder image by @stevenhorsman in #2535
• build(deps): bump golang.org/x/oauth2 from 0.29.0 to 0.31.0 in /src/cloud-providers by @dependabot[bot] in #2569
• test/e2e: adding pvc options and refactoring pvc/secret binding by @ramachandrach in #2555
• build(deps): bump golang.org/x/net from 0.42.0 to 0.44.0 in /src/cloud-api-adaptor in the x-net group across 1 directory by @dependabot[bot] in #2576
• podvm: place scratch-space condition correctly by @mkulke in #2580
• ci: update terraform spec for nvme images on azure by @mkulke in #2582
• Daily e2e test name clarifications by @stevenhorsman in #2583
• test/e2e: Increase memory limit by @stevenhorsman in #2579
• ci(zizmor):adding GHA scan targets for PR events by @eshantatIBM in #2570
• ide: add DevContainer profiles to simplify onboarding by @nmwael in #2574
• build(deps): bump github.com/vishvananda/netlink from 1.2.1-beta.2 to 1.3.1 in /src/cloud-api-adaptor by @dependabot[bot] in #2460
• ci: add azure workflow + infra for podvm release by @mkulke in #2584
• Kata 3.21.0 bump by @stevenhorsman in #2586
• workflows: e2e_docker: Clean up space by @stevenhorsman in #2587
• ci: Check for AGENT_TOOLSDIRECTORY being set by @stevenhorsman in #2589
• Introduce Bring-Your-Own-Machine (BYOM) provider by @bpradipt in #2554
• build(deps): bump zizmorcore/zizmor-action from 0.1.2 to 0.2.0 by @dependabot[bot] in #2593
• ci: Introduce retry mechanism for yq parsing flakiness by @BbolroC in #2588
• Introduce CI for AWS - part 2 by @wainersm in #2552
• e2e-test: fix azure community gallery name by @mkulke in #2598
• versions: Pin operator version by @stevenhorsman in #2599
• release: 0.16.0 release pins & bumps by @stevenhorsman in #2602

New Contributors

• @ramachandrach made their first contribution in #2555
• @eshantatIBM made their first contribution in #2570
• @nmwael made their first contribution in #2574

Full Changelog: v0.15.0...v0.16.0

v0.15.0

What's Changed

• aws: Update sdk to fix imds issue on EKS by @bpradipt in #2438
• bump the x-net group across 5 directories with 1 update by @dependabot[bot] in #2428
• workflows: Pin action hashes by @stevenhorsman in #2445
• podvm: fix Makefile not working by @frankbu in #2444
• V0.14.0 post release tasks by @stevenhorsman in #2440
• workflows: Remove docker hub support by @stevenhorsman in #2452
• caa: handle unavailable VM IPs by @squarti in #2454
• workflows: Delete daily ibmcloud results by @stevenhorsman in #2451
• podvm: Wait for net ready before setup-nat-for-imds by @ldoktor in #2450
• azure: implement root-volume-size support by @snir911 in #2465
• gcp: adding ability to bind tags to instances by @beraldoleal in #2422
• caa: allow docker image pull secrets with username/password only by @squarti in #2456
• workflows: Remove inherit secrets by @stevenhorsman in #2457
• build(deps): bump the x-net group across 5 directories with 1 update by @dependabot[bot] in #2459
• Golang 1.23.10 part 1 by @stevenhorsman in #2467
• Golang 1.23.10 part2 by @stevenhorsman in #2468
• ibmcloud-powervs: install iptables during podvm image build by @Amulyam24 in #2470
• build(deps): bump actions/attest-build-provenance from 2.3.0 to 2.4.0 by @dependabot[bot] in #2472
• build(deps): bump github/codeql-action from 3.28.19 to 3.29.0 by @dependabot[bot] in #2473
• build(deps): bump the aws-sdk-go-v2 group across 1 directory with 6 updates by @dependabot[bot] in #2476
• build(deps): bump github.com/moby/sys/mountinfo from 0.7.1 to 0.7.2 in /src/cloud-api-adaptor by @dependabot[bot] in #2475
• workflows: Add default permissions by @stevenhorsman in #2443
• aws: deprecate centos image by @msalman-abid in #2449
• tests/e2e : to verify caa logs with expected string by @PrakashMuddana in #2389
• podvm: Extract podvm smoke test into shell script by @ldoktor in #2376
• e2e-test: add id-token: write when invoking wf's by @mkulke in #2477
• build(deps): bump github.com/vishvananda/netns from 0.0.4 to 0.0.5 in /src/cloud-api-adaptor by @dependabot[bot] in #2474
• build(deps): bump docker/setup-buildx-action from 3.10.0 to 3.11.1 by @dependabot[bot] in #2484
• build(deps): bump github.com/Azure/azure-sdk-for-go/sdk/azidentity from 1.6.0 to 1.10.1 in /src/cloud-api-adaptor by @dependabot[bot] in #2482
• ibmcloud: add VPE gateway SG rule to ROKS setup doc by @frankbu in #2478
• azure: add az-copy-image tool by @mkulke in #2469
• podvm: add OCICRYPT CONFIG for image pulling by @Xynnn007 in #2489
• aws: Use dmi data for detecting AWS by @bpradipt in #2491
• ibmcloud-powervs: remove trailing zeros while printing instance details by @Amulyam24 in #2490
• build(deps): bump github/codeql-action from 3.29.0 to 3.29.1 by @dependabot[bot] in #2487
• Add disk storage support for container image store by @bpradipt in #2480
• agent-protocol-forwarder: daemon.json => apf.json by @mkulke in #2494
• scratch-space: only allow encrypted scratch space by @mkulke in #2495
• build(deps): bump github/codeql-action from 3.29.1 to 3.29.2 by @dependabot[bot] in #2497
• ibmcloud: add tip to use Trusted Profile to ROKS setup doc by @Pacho20 in #2499
• gcp: avoid printing credentials to log by @snir911 in #2498
• versions: Bump umoci to 0.5.0 by @ajaypvictor in #2507
• versions: Bump to kata 3.18.0 by @stevenhorsman in #2479
• versions: Bump kcli by @stevenhorsman in #2511
• ibmcloud: modify SG rule setup in ROKS setup doc by @Pacho20 in #2504
• build(deps): bump github/codeql-action from 3.29.2 to 3.29.4 by @dependabot[bot] in #2513
• build(deps): bump github/codeql-action from 3.29.4 to 3.29.5 by @dependabot[bot] in #2517
• podvm: backport setup-nat-for-imds.service configuration by @snir911 in #2518
• Readme: add openssf badge by @mkulke in #2519
• build(deps): bump github/codeql-action from 3.29.7 to 3.29.8 by @dependabot[bot] in #2524
• tests/e2e: libvirt: Attempts to stablise the libvirt e2e tests and resolve the webhook install issues by @stevenhorsman in #2515
• build(deps): bump golang.org/x/oauth2 from 0.12.0 to 0.27.0 in /src/webhook by @dependabot[bot] in #2508
• Kata 3.19.1 bump by @stevenhorsman in #2510
• versions: Bump github.com/docker/docker by @stevenhorsman in #2531
• build(deps): bump github/codeql-action from 3.29.8 to 3.29.9 by @dependabot[bot] in #2532
• build(deps): bump lycheeverse/lychee-action from 2.4.1 to 2.5.0 by @dependabot[bot] in #2523
• build(deps): bump docker/login-action from 3.4.0 to 3.5.0 by @dependabot[bot] in #2520
• 0.15.0 release by @stevenhorsman in #2533

New Contributors

• @msalman-abid made their first contribution in #2449
• @Pacho20 made their first contribution in #2499

Full Changelog: v0.14.0...v0.15.0

v0.14.0

What's Changed

• V0.13.0 post release tasks by @stevenhorsman in #2359
• workflow: podvm_mkosi: Fix docker image registry by @stevenhorsman in #2358
• tests/e2e: Add option to override CAA namespace by @stevenhorsman in #2329
• ibmcloud: add INITDATA to CLI peerpod properties by @frankbu in #2364
• ibmcloud: update vpc-go-sdk to v0.66.0 release by @frankbu in #2362
• podvm: support aarch64/ARM64 build by @xutao323 in #2357
• versions: Bump kcli to 99.0.202504041449 by @BbolroC in #2321
• ibmcloud-powervs: pass instance ID instead of instance while fetching VM IP by @Amulyam24 in #2368
• podvm: provide attested measurements in OCI by @mkulke in #2363
• version: Bump golang version in builder by @stevenhorsman in #2370
• Golang bump 1.23.8 by @stevenhorsman in #2371
• nvidia: set Nvidia's CDI annotation based on default_gpus by @snir911 in #2302
• Doc changes by @bpradipt in #2369
• tests/e2e : Add initdata related test cases, invalied initdata by @rafsalr in #2337
• podvm: Remove libtdx library install by @stevenhorsman in #2374
• build(deps): bump actions/attest-build-provenance from 1 to 2 by @dependabot in #2375
• caa: Enable running without Kubernetes by @spotlesstofu in #2301
• versions: Bump golang.org/x/net to v0.38.0 by @stevenhorsman in #2383
• ibmcloud: add Trustee instructions to ROKS demo doc by @frankbu in #2379
• ibmcloud: pod annotation to override image id by @frankbu in #2380
• ibmcloud: improve image selection logging by @frankbu in #2390
• podvm: remove --no-verify by @ANJANA-A-R-K in #2352
• ibmcloud: use SDK constant for TDX confidential compute mode. by @frankbu in #2391
• podvm-mkosi: Add a few useful remarks to README by @ldoktor in #2377
• ibmcloud: add instructions to deploy a sample Trustee. by @frankbu in #2394
• initdata: gunzip body by @mkulke in #2388
• azure-e2e: fix truncated digest test by @mkulke in #2398
• ibmcloud: gzip INITDATA in ROKS setup instructions. by @frankbu in #2399
• podvm: fix GO_ARCH env by @Xynnn007 in #2401
• podvm: add dependency and default images to rhel Dockerfiles by @frankbu in #2403
• ci: Skip checklinks job by @stevenhorsman in #2407
• ibmcloud-powervs: install oras and modify copy-files.sh for image build by @Amulyam24 in #2366
• caa: Refactor DISABLECVM setting by @stevenhorsman in #2360
• Bump: golang.org/x/oauth2 to address CVE by @chathuryaadapa in #2404
• gcp: improved image source format detection by @pawelpros in #2393
• ibmcloud: update ROKS demo doc image instructions by @frankbu in #2408
• Revert "ci: add yq shim for v3/v4 support" by @stevenhorsman in #2411
• docs: added gzip + base64 encoding info by @pawelpros in #2413
• caa: publish the cloud-api-adaptor image with ibmcloud_powervs provider by @Amulyam24 in #2410
• caa: update versions for IBM go dependencies by @Amulyam24 in #2418
• podvm-mkosi: update podvm image to fedora 41 by @mkulke in #2419
• 3.17.0 dependency bump by @stevenhorsman in #2421
• Add support for Alibaba Cloud by @Xynnn007 in #2396
• Dependabot go configuration by @stevenhorsman in #2402
• libvirt: Add podvm instance cpu and mem size support for libvirt by @savitrilh in #2116
• workflows: dependabot commit check skip by @stevenhorsman in #2432
• caa: Fix typo in initdata documentation by @c3d in #2417
• docker: bump fedora image to 41 by @spotlesstofu in #2330
• alibaba: update Community image id by @Xynnn007 in #2433
• tests/e2e:running all testcommands, erroring if pod not found by @PrakashMuddana in #2361
• caa: add map mutex in PeerPodService by @squarti in #2431
• peerpod-ctrl: Support multiple providers in peerpod-ctrl by @squarti in #2381
• AlibabaCloud: document and kustomization update by @Xynnn007 in #2434
• 0.14.0 release by @stevenhorsman in #2435

New Contributors

• @rafsalr made their first contribution in #2337
• @spotlesstofu made their first contribution in #2301
• @Xynnn007 made their first contribution in #2401
• @pawelpros made their first contribution in #2393
• @savitrilh made their first contribution in #2116
• @c3d made their first contribution in #2417
• @PrakashMuddana made their first contribution in #2361

Full Changelog: v0.13.0...v0.14.0

v0.13.0

What's Changed

• test/aws: disable, enable and fix tests by @wainersm in #2262
• gcp: add note on discard_unpacked_layers for GKE by @beraldoleal in #2257
• Docker provider e2e test by @stevenhorsman in #2188
• workflow: podvm_mkosi: Update registry by @stevenhorsman in #2271
• podvm: Add --pull option to import.sh and download-image.sh by @frankbu in #2268
• V0.12.0 post release tasks by @stevenhorsman in #2270
• gcp: handle image in two formats by @beraldoleal in #2282
• gcp: allow users to set podvm disk-type and align CLI options by @beraldoleal in #2281
• workflow: Add test_e2e_docker trigger by @stevenhorsman in #2277
• docker: Use iptables-wrapper in pod VM container image by @yoheiueda in #2275
• version: Bump golang to 1.22.12 by @stevenhorsman in #2286
• versions: Bump golang-fedora image version by @stevenhorsman in #2287
• Fix incorrect assignment of Image ID by @bpradipt in #2291
• ibmcloud: update vpc-go-sdk to v0.64.0 release by @frankbu in #2289
• ibmcloud: fix import.sh bucket selection by @frankbu in #2280
• Paremetrise peerpods socket and pods dir param by @bpradipt in #2292
• ibmcloud: add option to enable/disable confidential VM by @frankbu in #2295
• AWS: improve logging for clarity by @EmmEff in #2288
• ibmcloud: disable confidential VM in ROKS demo doc by @frankbu in #2298
• ibmcloud: Improvements to ROKS demo instructions by @gcoon151 in #2253
• libvirt: Remove SEV code by @stevenhorsman in #2299
• GCP: introducing provisioning code and tests by @beraldoleal in #2290
• version: Bump golang version in builder by @stevenhorsman in #2308
• Introduce CI for AWS - part 1 by @wainersm in #2274
• versions: Bump golang.org/x/crypto by @stevenhorsman in #2307
• workflow: e2e_libvirt running out of space by @stevenhorsman in #2309
• mkosi: fix Fedora GPG key issue in mkosi build by @beraldoleal in #2303
• ibmcloud: Use beta go vpc sdk to enable TDX configuration by @frankbu in #2306
• ci: add delay on podvm smoke-test by @mkulke in #2269
• test/e2e: Update testcases for HTTPS KBS by @chathuryaadapa in #2285
• workflow:e2e_run_all: Switch s390x image build runner by @stevenhorsman in #2312
• workflow: podvm_mkosi: Switch s390x image build runner by @stevenhorsman in #2313
• Update CLOUD_PROVIDER for iptables installation by @ajaypvictor in #2305
• adaptor: log error causing agent proxy connection failure by @frankbu in #2315
• podvm_mkosi: Use container to run mkosi on s390x by @BbolroC in #2317
• ibmcloud: add confidential mode instructions to ROKS demo doc by @frankbu in #2318
• ibmcloud: add another security group in ROKS demo instructions by @frankbu in #2319
• ibmcloud-powervs: fix processors config by @squarti in #2324
• GHA: Use 390x runners again for building libvirt test artifacts by @BbolroC in #2322
• Fixes for RHEL/s390x PODVM builds by @ifireball in #2320
• versions: Attempt to use Ubuntu 24.04 in packer by @stevenhorsman in #2293
• podvm: Set PROTOC_ARCH for s390x to s390_64 by @BbolroC in #2328
• ibmcloud: Move away from Ubuntu 20.04 by @stevenhorsman in #2326
• e2e: fix initdata templating by @mkulke in #2332
• ibmcloud-powervs: Set PodVM name maximum length to 47 by @squarti in #2334
• gcp: implement DISABLECVM logic by @beraldoleal in #2327
• CAA: add support to look up imagePullSecrets for pods by @squarti in #2232
• Misc fixes by @bpradipt in #2351
• ibmcloud-powervs: fix podvm image build by @Amulyam24 in #2339
• gcp: fetch disk image size dynamically and avoid using node's metadata service creds by @beraldoleal in #2345
• Support external network connectivity for the pod via pod VM network by @bpradipt in #2273
• ibmcloud-powervs: add powervs adaptor to peerpod controller by @squarti in #2347
• 3.15.0 dependency bump by @stevenhorsman in #2340
• ibmcloud-powervs: adjust systemType/processors/memory from annotations by @squarti in #2343
• ibmcloud: remove unneeded ns delete from ROKS doc by @frankbu in #2344
• provisioner: fix caa-provisioner-cli uninstall failures by @frankbu in #2341
• Go mod security bumps pre 0.13.0 by @stevenhorsman in #2355
• 0.13.0 release by @stevenhorsman in #2356

New Contributors

• @gcoon151 made their first contribution in #2253
• @ifireball made their first contribution in #2320

Full Changelog: v0.12.0...v0.13.0