# mvirt 0.27.0

migrations: yes
wire: unchanged
rev: 9fa692c86ea7c6a3cffa5f0d456cd5d21bd450c5

mvirt 0.27.0

The VXLAN receive path accepts only fleet VTEPs, platform images are
pulled by a digest whose bytes are verified, the API and console send
the missing browser security headers, and the assistant's jailed CLI
can only connect to the API.

- ebpf, node, cplane: tc_ingress drops VXLAN whose outer source is not
  in VTEP_ALLOW (own underlay IP ∪ every HostNode's underlay address,
  carried in NodeAssignment.fabric_vteps and pushed via the new
  NetService.SetFabricVteps ∪ route-mesh next hops); persisted and
  re-seeded before attach on restart; UNKNOWN_VTEP_DROPS counter and a
  fib-status section. Checked read-only on this fleet: only the three
  hosts (and each host's own address over lo) send VXLAN (#152).
  Additive proto fields; node and daemon ship together.
- one, cplane: images.toml requires a digest on every entry incl.
  upstream (envoy v1.39.1, registry 3.1.1, k3s); every accessor returns
  repo:tag@sha256; the mvirt-one puller verifies manifest, index child,
  config and every layer against their digests (#139). On this fleet
  only the provider controllers app-postgres-0 and app-valkey-0 restart
  once (their compiled-in image env changes).
- cplane: nosniff, Referrer-Policy, frame-ancestors 'none' and
  X-Frame-Options on every API/console response, platform- and
  per-listener opt-out; the gw-agent side needs a new gw-agent image
  (refs #193). Migration 0141_security_headers.
- cplane: the assistant CLI jail runs in a per-call cgroup with
  cgroup-eBPF sock_create/connect4/connect6 filters — TCP to the
  resolved API only; no filter, no CLI tool (refs #142).

Rolling: migrations yes — with the #334 rail, leader last.


## Upgrading

Point your flake's `mvirt` input at this release and redeploy the control-plane
host first, then each node in turn:

```
nix run .#colmena -- apply boot --reboot --on <control-plane host>
nix run .#colmena -- apply boot --reboot --on <node>   # one at a time
```

**This release migrates the store.** Once the control plane has started, the
previous version will refuse to run against it — migrations are forward-only, so
rolling the control-plane host back means restoring a backup, with data loss back
to the backup point. The control plane writes a backup immediately before it
applies migrations; nodes roll back freely by booting the previous generation.