# mvirt 0.28.0 migrations: yes wire: unchanged rev: 574fe0b003c0860da5002c1642dc8d948d8c6c5b mvirt 0.28.0 Rebooting one host no longer takes the whole fleet's routes with it, a leased block's tunnel endpoint stops moving on failover, the repository GC no longer shares the converger, and LB/VIP traffic from the fabric works and stays isolated. - ebpf: the route mesh dials every control-plane reflector (read from the node's control-plane.json), not only the seed. Before, every node held its only session to mvirt-1's reflector; rebooting mvirt-1 emptied every node's routing table including 0.0.0.0/0 and cut pod egress fleet-wide for ~2 min. New roll gate: `mvirt-ebpf fib-status --gate` (#400). ROLL THIS RELEASE WITH mvirt-1 REBOOTED LAST. - cplane, node, ebpf: a leased block's tunnel endpoint can be PINNED to an address another block carries, so its failover needs no provider call at all (ADR-0067 D11-D14, migration 0142). An externally-routed block is re-pointed at the provider on every failover today, and noez then forwards what the new anchor sends only after 60 s to 83 min, unpredictably (#357). A `carried` block's endpoint never moves, so there is no re-point to be slow about: its anchor follows the carrier's announcement, both ends of a switch hold the address, and only the announced end carries the tunnel. - ebpf: an LB reply to an on-fabric client goes back to where the request came from (return stamp in the inner MACs); a public LB backend sees a client from another network (or a host) as the frontend address, like an internet client, never as a private tenant address (#333, refs #284). The backend LB DNAT and the 1:1 VIP ingress are split into two stages: on the prod kernel 6.18.6 they drop from 86.5% / 68.3% of the verifier limit to 35.0% / 35.5%. New pre-release check `make verifier-budget` (#402). - cplane: the repository GC runs as its own leader task behind a write gate (no new backup job or import while a sweep runs; failed backups are sealed first; each manifest read once), instead of inside the converger ladder. After every election no backup or import starts for 120 s (refs #389, closes #182). - cplane: the converger no longer loses a spec write that lands while it compiles (such a write waited for the 30 s resync) (refs #337); a pod report older than the pod's last reset is not applied (#401); a leader that provably cannot serve abdicates (refs #292). - vk, cplane, one: ConfigMap/Secret volumes stay converged in running serverless pods (atomic ..data swap, like kubelet); subPath mounts and env vars keep create-time values, as in Kubernetes. Deploy the cplane before the new VK image (refs #44, migration 0143). - ebpf, one: the router advertisement routes the network prefix via fe80::1, and mvirt-one installs it. kaas: the VK companion pod rolls when its image drifts from the settings. - logquery: every SQL result renders as its value, never its type name. meta: revoking a capability that was never granted is idempotently off. - tests: route-mesh tests run the production keepalive (refs #337); the stor-agent real-store suites serialize on the E2E lock (closes #339). Pins are deliberately unchanged this release (#405): nixpkgs has not moved since January, and an eight-month bump is a new guest kernel, sshd/TLS stack and Rust toolchain — that belongs in a release of its own, not in one that also migrates the store and re-homes public ingress. ## Upgrading Point your flake's `mvirt` input at this release and redeploy the control-plane host first, then each node in turn: ``` nix run .#colmena -- apply boot --reboot --on nix run .#colmena -- apply boot --reboot --on # one at a time ``` **This release migrates the store.** Once the control plane has started, the previous version will refuse to run against it — migrations are forward-only, so rolling the control-plane host back means restoring a backup, with data loss back to the backup point. The control plane writes a backup immediately before it applies migrations; nodes roll back freely by booting the previous generation.