v1.23.0

What's Changed

🛠 Breaking changes

• coordinator: domain-separate transit engine keys from workload secrets by @sespiros in #2500
• kata.runtime: 3.32.0 -> 4.0.0 by @charludo in #2538

🎁 New features

• coordinator: allow multiple coordinator variants by @burgerdev in #2519
• coordinator: keep serving if the k8s API is down by @burgerdev in #2546

🐛 Bug fixes

• coordinator: fix anti-affinity by moving pod-role to label by @burgerdev in #2504
• kuberesource: fix mysql demo by @burgerdev in #2513
• cli/generate: normalize image ref before accessing layers cache by @davidweisse in #2516
• imagepuller: retry dial timeouts by @burgerdev in #2558

🔧 Other changes

• collateral-proxy: use in set/verify/recover/SDK, use per-getter config instead of global by @charludo in #2482
• kuberesource: use common labeling strategy by @burgerdev in #2514
• coordinator: remove ownerreference from configmaps by @burgerdev in #2515
• treewide: implement fully CRA-compliant, largely BSI-TR-03183-2 compliant SBOMs by @charludo in #2508
• attestation: improve error messages on failed validation by @burgerdev in #2521
• nixos/kata: set maximum size of /run tmpfs to 100% by @davidweisse in #2527
• nodeinstaller: support containerd config v4 by @burgerdev in #2542
• deps: bump go-sev-guest to ensure that received CRLs are within their validity windows by @charludo in #2553

📖 Documentation

• docs: document collateral-proxy by @charludo in #2479

Full Changelog: v1.22.0...v1.23.0