Cohere release

[yousef-cohere]

This PR introduces new workflows for publishing Cohere-fork artifacts to GHCR on every push to the cohere branch and GitHub Releases targeting the cohere branch. It also updates the peerpods-chart_image.yaml workflow to use a pinned version of yq with SHA256 verification. Additionally, the PR removes GCP authentication steps and modifies Helm chart dependencies.

• New Workflows:
  • publish-cohere-release.yaml: Publishes semver-tagged Cohere-fork release artifacts to GHCR.
  • publish-cohere.yaml: Publishes Cohere-fork artifacts to GHCR on every push to the cohere branch.
• Workflow Updates:
  • peerpods-chart_image.yaml: Installs yq using a pinned version with SHA256 verification.
• Removed Steps:
  • GCP authentication and Helm authentication with Artifact Registry.
• Helm Chart Changes:
  • Added tolerations support in daemonset.yaml and fix-gke-node-config.yaml.
  • Updated default image tags and nodeSelector/tolerations in values.yaml.
  • Modified daemonset update strategy in values.yaml.
  • Removed snapshotter setup in kata-deploy.
• Image and Chart Publishing:
  • Builds and publishes CAA and peerpod-ctrl images to GHCR.
  • Publishes peerpods Helm chart with version tagging and OCI registry support.

---

Note

Medium Risk
Introduces new CI publishing pipelines and changes Helm chart deployment defaults (image registries, scheduling constraints, rolling update behavior), which can affect release automation and cluster rollouts if misconfigured.

Overview
Adds two new GitHub Actions workflows to publish Cohere-fork artifacts to GHCR: one for every push to cohere (publishing latest-cohere + short-SHA image tags and a floating 0.0.0-dev.cohere chart tag), and one for GitHub Releases on cohere that republishes immutable semver-tagged images/charts and generates an OCI chart attestation.

Updates the reusable peerpods-chart_image.yaml workflow to pin and checksum-verify yq and to drop the Artifact Registry (GCP) auth path, standardizing chart publishing on GHCR.

Modifies the peerpods Helm chart to default to Cohere GHCR image repositories/tags, add configurable tolerations (alongside nodeSelector) for the CAA and GKE-fix DaemonSets, adjust DaemonSet rolling update defaults to avoid hostNetwork port conflicts (maxSurge: 0), and tweak kata-deploy defaults to disable snapshotter setup and configure kata-remote containerd settings (overlayfs fallback + force guest image pulls).

^{Reviewed by Cursor Bugbot for commit f3711c3. Bugbot is set up for automated code reviews on this repo. Configure here.}

[alhassankhedr-cohere]

fix-gke-node-config loses universal toleration

The old template hardcoded tolerations: [{operator: Exists}], meaning this DaemonSet scheduled on every node regardless of taints. This PR replaces it with {{- with .Values.tolerations }}, which defaults to []. On upgrade, the DaemonSet will be evicted from any tainted nodes — and since CAA worker nodes likely have taints (that's why we use nodeSelector fencing), the node-fix silently stops running. New nodes won't get the containerd/kubelet patches, causing hard-to-debug runtime failures.

Two options:

A) Default tolerations to the old behavior:

# values.yaml
tolerations:
- operator: Exists

Simple, backward-compatible. Both DaemonSets share the same toleration.

B) Give fix-gke-node-config its own tolerations field (recommended):

# values.yaml
gkeNodeFix:
  tolerations:
  - operator: Exists

# fix-gke-node-config.yaml
tolerations:
  {{- toYaml .Values.gkeNodeFix.tolerations | nindent 8 }}

These two DaemonSets have different scheduling needs. The node-fix is infrastructure prep — it should tolerate everything on target nodes. CAA is the workload — it should only run where configured. Coupling them to the same tolerations value means either the node-fix is too restrictive or CAA is too permissive.

[alhassankhedr-cohere]

Made few comments for your review

[cursor]

Cursor Bugbot has reviewed your changes and found 2 potential issues.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit f3711c3. Configure here.}

[cursor]

Unpinned yq install in jobs with registry write

Medium Severity

The caa jobs in both new workflows install yq via sudo snap install yq with no version pin or integrity check, while running with packages: write permission (GHCR push access). The same PR correctly demonstrates the pinned+checksummed pattern for yq in peerpods-chart_image.yaml and the chart job of publish-cohere-release.yaml. A compromised snap package could execute arbitrary code with registry write access.

Additional Locations (1)

• .github/workflows/publish-cohere-release.yaml#L91-L92

 

^{Reviewed by Cursor Bugbot for commit f3711c3. Configure here.}

[cursor]

DaemonSet loses universal toleration, breaking tainted nodes

High Severity

The fix-gke-node-config DaemonSet previously hardcoded tolerations: [{operator: Exists}], allowing it to schedule on every node regardless of taints. This PR replaces it with {{- with .Values.tolerations }} which defaults to tolerations: []. On upgrade, the DaemonSet silently stops scheduling on any tainted nodes — and CAA worker nodes typically carry taints like kata.peerpods.io/vm:NoSchedule. New nodes won't receive the required containerd/kubelet patches.

Additional Locations (1)

• src/cloud-api-adaptor/install/charts/peerpods/values.yaml#L99-L100

 

^{Reviewed by Cursor Bugbot for commit f3711c3. Configure here.}