# mvirt 0.27.1

migrations: no
wire: unchanged
rev: b7c6afb8e652344d36d704f6930ce459a09f007d

mvirt 0.27.1

A network can be created with its NAT gateway in one call, the console's
Kubernetes wizard creates a network a cluster can actually use, and a
sustained Envoy NACK surfaces on the load balancer even when the config
keeps changing.

- cplane, smoke: POST …/networks accepts spec.natGateway with the
  PATCH's validation, applied in the same transaction as the insert;
  unknown create spec fields (and unknown natGateway fields) are refused
  with a 400 naming the field — clients sending the retired `isPublic`
  now get a 400 (#381). Found by mvirt-smoke against the ADR-0087 lab.
- console: the Kubernetes wizard's "new network" sends an IPv4 prefix
  and a NAT gateway in the one create, and on a failed launch deletes
  only what it created (#385).
- cplane: the unconfirmed-proxy-config clock survives generation
  changes, so a NACK that outlives config churn raises the LB condition
  after 5 min; an agent credential can only report its own LB's
  instances (#237).
- ci: every nix/checks/*.nix runs in CI, all as assertions (#253); the
  assistant egress tests skip where the jail or cgroup BPF cannot run
  (refs #142).


## Upgrading

Point your flake's `mvirt` input at this release and redeploy the control-plane
host first, then each node in turn:

```
nix run .#colmena -- apply boot --reboot --on <control-plane host>
nix run .#colmena -- apply boot --reboot --on <node>   # one at a time
```

This release adds no migrations, so the control-plane host rolls back the same way
a node does: boot the previous NixOS generation.