# mvirt 0.29.1

migrations: no
wire: unchanged
rev: bcc2630f8f965315d217d733ffe111787aa5826a

mvirt 0.29.1

The platform reaches its own public names again, pods reach another
network's floating IP, and node reports stop waking the whole fleet.

- ebpf: a client from another network (or the host itself) of a load
  balancer is presented to the backend as 169.254.0.3 with a per-flow
  port, not as the frontend VIP. The Envoy fleet binds every frontend VIP
  on lo, so the old SNAT source was dropped as martian: host -> own
  ingress VIP answered 0/36 on prod, and any pod calling an app's public
  URL from another network got no answer; the ACME self-check only
  worked through its bypass (refs #284).
- ebpf: a pod (or the host) reaches a floating IP of another network,
  isolated behind the VIP like an internet client (refs #260).
- cplane: seven node-report writers no longer write and emit fleet-wide
  on a no-op report (closes #37).
- cplane: a changed virtual-kubelet image rolls one cluster at a time;
  status.virtualKubelet and the settings summary show the rollout
  (refs #47).
- gw-agent: the ACME HTTP-01 challenge is answered for a Host no route
  claims (catch-all vhost next to the routed ones; reaches prod with the
  next gw-agent image pin) (closes #61).
- tests: #44 and #52 regression coverage.

Post-roll check: 12x `curl -m 3 -H 'Host: console.mvirt.io'
http://5.230.227.194/` from each host, expect 36/36.


## Upgrading

Point your flake's `mvirt` input at this release and redeploy the control-plane
host first, then each node in turn:

```
nix run .#colmena -- apply boot --reboot --on <control-plane host>
nix run .#colmena -- apply boot --reboot --on <node>   # one at a time
```

This release adds no migrations, so the control-plane host rolls back the same way
a node does: boot the previous NixOS generation.