# mvirt 0.10.0

migrations: no
wire: unchanged
rev: ff804a0a149f424db48b0adec11707bccec27775

v0.10.0 — the fixes a real fleet found

0.9.0 shipped the highly-available control plane. Putting it on our own
production fleet found five defects in the growth path, four of which only a
real deployment could have surfaced. This release is those fixes.

Upgrade from 0.9.0 or 0.8.0 directly. No migrations.

* A member joining an existing group was told it was the bootstrap voter,
  because the flag was derived from a membership that already contained it. It
  ran the seed writes, and died on the refusal those writes correctly returned.
* The compiled peer list named an existing member by a derived id rather than
  the id that member is already known by.
* The control plane's default tunnel and route-reflector ports collided with the
  storage Downstairs on any host that runs both — which, since 0.9.0 placed
  control planes by node group, is any storage host. They are now 50156/50157,
  the pair the bootstrap host has used since that collision was first hit.
* A joining member exited on a missing internal CA before the replication that
  supplies it could land. It now waits, bounded, and comes up degraded rather
  than not at all.
* The underlay REST bind is opt-in (MVIRT_CPLANE_UNDERLAY_REST=1) until its edge
  health check is proven end to end.

**Known limitation.** Growing an *existing* single-voter deployment to three
voters does not complete yet: a follower brought up from a snapshot does not
record its purged-log boundary, so it never catches up. A fresh three-voter
deployment is unaffected, as is every single-voter one. The growth reconciler
declines to take its first step while a member's raft bind is still on loopback,
which is the default — so no deployment starts down this path by upgrading.
docs/runbooks/control-plane-ha.md has the detail.


## Upgrading

Point your flake's `mvirt` input at this release and redeploy the control-plane
host first, then each node in turn:

```
nix run .#colmena -- apply boot --reboot --on <control-plane host>
nix run .#colmena -- apply boot --reboot --on <node>   # one at a time
```

This release adds no migrations, so the control-plane host rolls back the same way
a node does: boot the previous NixOS generation.
