# mvirt 0.26.2

migrations: no
wire: unchanged
rev: a79edd41b38d5e3295178ddbe514bd41d57edc5c

mvirt 0.26.2

A vNIC with no security-group config is now deny-all instead of
allow-all, anti-spoofing included, and the node bootstrap listener is
rate-limited per client address.

- ebpf: tc_egress/tc_ingress treat a missing, disabled or unknown
  NIC_SECURITY entry as deny-all; only NIC_SEC_ENFORCE runs the rules.
  The border gateway veth (mvbr-e) is marked NIC_SEC_INFRA_PASSTHROUGH
  by SetupBorderGateway before attach. New SG_UNCONFIGURED_DROPS counter,
  a WARN for a managed vNIC unconfigured past 60 s, and a section in
  `mvirt-ebpf fib-status`. Checked read-only on this fleet before the
  change: every managed tap already had an enforced entry (#153).
  After an mvirt-ebpf restart taps drop until the node's next pass
  (<= 30 s by default, read from the code) instead of passing.
- cplane: per-IP token bucket on the bootstrap listener (:50055, all
  routes), burst 128, refill 1/s (MVIRT_BOOTSTRAP_RATE_BURST /
  MVIRT_BOOTSTRAP_RATE_REFILL_SECS); only 4xx responses keep the token;
  request bodies capped at 64 KiB (#129).


## Upgrading

Point your flake's `mvirt` input at this release and redeploy the control-plane
host first, then each node in turn:

```
nix run .#colmena -- apply boot --reboot --on <control-plane host>
nix run .#colmena -- apply boot --reboot --on <node>   # one at a time
```

This release adds no migrations, so the control-plane host rolls back the same way
a node does: boot the previous NixOS generation.