# mvirt 0.14.3

migrations: no
wire: unchanged
rev: d08ca6974e57507a72e6239c51892e384dcc8194

v0.14.3 — first-run setup converges once, a template import can reach the network, a rebooted ex-leader stays up

Fixes from finishing the fresh mvirt-1/2/3 bring-up on 0.14.2.

- cplane: the manifest pass runs one at a time — the ladder tick and the
  synchronous REST converge (PUT manifest / initialize) ran the same document
  side by side and doubled the IP pools; the manifest's orgName now replaces
  the boot seed's placeholder org name ('Platform') instead of leaving it.
- cplane: an import Task pod runs under the platform-managed 'task-egress'
  security group (outbound allow-all, zero inbound) and the imports network is
  minted with a NAT gateway — a NIC with no group is default-deny and the
  network had no way out, so every import failed before its container
  started (ADR-0080 D1; narrowing to the pins is #173).
- cplane boot: a leader that lost its term while rebooting logs and skips the
  idempotent startup seeds instead of exiting on NotLeader (one crash +
  systemd restart on every reboot as a follower).

Upgrade: control-plane host first, then nodes one at a time; a node rolls back
by booting the previous generation.


## Upgrading

Point your flake's `mvirt` input at this release and redeploy the control-plane
host first, then each node in turn:

```
nix run .#colmena -- apply boot --reboot --on <control-plane host>
nix run .#colmena -- apply boot --reboot --on <node>   # one at a time
```

This release adds no migrations, so the control-plane host rolls back the same way
a node does: boot the previous NixOS generation.