├── meta-data.yaml
├── .gitignore
├── examples
    ├── simple
    │   ├── meta-data.yaml
    │   └── user-data.yaml
    ├── static-ip
    │   ├── meta-data.yaml
    │   ├── network-config.yaml
    │   └── user-data.yaml
    └── k3s-cluster
    │   ├── raspberry-0
    │       ├── meta-data.yaml
    │       ├── network-config.yaml
    │       └── user-data.yaml
    │   └── raspberry-1
    │       ├── meta-data.yaml
    │       ├── network-config.yaml
    │       └── user-data.yaml
├── network-config.yaml
├── bootstrap.sh
├── Vagrantfile
├── user-data.yaml
├── README.md
└── LICENSE


/meta-data.yaml:
--------------------------------------------------------------------------------
1 | instance-id: raspberry-0
2 | 


--------------------------------------------------------------------------------
/.gitignore:
--------------------------------------------------------------------------------
1 | *.img
2 | *.zip
3 | /.vagrant
4 | .idea
5 | 


--------------------------------------------------------------------------------
/examples/simple/meta-data.yaml:
--------------------------------------------------------------------------------
1 | instance-id: raspberry-0
2 | 


--------------------------------------------------------------------------------
/examples/static-ip/meta-data.yaml:
--------------------------------------------------------------------------------
1 | instance-id: raspberry-0
2 | 


--------------------------------------------------------------------------------
/examples/k3s-cluster/raspberry-0/meta-data.yaml:
--------------------------------------------------------------------------------
1 | instance-id: raspberry-0
2 | 


--------------------------------------------------------------------------------
/examples/k3s-cluster/raspberry-1/meta-data.yaml:
--------------------------------------------------------------------------------
1 | instance-id: raspberry-1
2 | 


--------------------------------------------------------------------------------
/examples/static-ip/network-config.yaml:
--------------------------------------------------------------------------------
 1 | version: 2
 2 | ethernets:
 3 |   eth0:
 4 |     dhcp4: false
 5 |     dhcp6: false
 6 |     addresses:
 7 |       - 192.168.0.20/24
 8 |     gateway4: 192.168.0.1
 9 |     nameservers:
10 |       search: [home]
11 |       addresses: [8.8.8.8, 8.8.4.4]
12 | 


--------------------------------------------------------------------------------
/examples/k3s-cluster/raspberry-0/network-config.yaml:
--------------------------------------------------------------------------------
 1 | version: 2
 2 | ethernets:
 3 |   eth0:
 4 |     dhcp4: false
 5 |     dhcp6: false
 6 |     addresses:
 7 |     - 192.168.0.20/24
 8 |     gateway4: 192.168.0.1
 9 |     nameservers:
10 |       search: [home]
11 |       addresses: [8.8.8.8, 8.8.4.4]
12 | 


--------------------------------------------------------------------------------
/examples/k3s-cluster/raspberry-1/network-config.yaml:
--------------------------------------------------------------------------------
 1 | version: 2
 2 | ethernets:
 3 |   eth0:
 4 |     dhcp4: false
 5 |     dhcp6: false
 6 |     addresses:
 7 |     - 192.168.0.21/24
 8 |     gateway4: 192.168.0.1
 9 |     nameservers:
10 |       search: [home]
11 |       addresses: [8.8.8.8, 8.8.4.4]
12 | 


--------------------------------------------------------------------------------
/network-config.yaml:
--------------------------------------------------------------------------------
 1 | version: 2
 2 | ethernets:
 3 |   eth0:
 4 |     dhcp4: false
 5 |     dhcp6: false
 6 |     addresses:
 7 |       - 192.168.0.20/24
 8 |       # - 2001:1::1/64
 9 |     gateway4: 192.168.0.1
10 |     # gateway6: 2001:1::2
11 |     nameservers:
12 |       search: [home]
13 |       addresses: [8.8.8.8, 8.8.4.4]
14 | 


--------------------------------------------------------------------------------
/bootstrap.sh:
--------------------------------------------------------------------------------
 1 | #!/bin/bash -ex
 2 | 
 3 | ARCH="${ARCH:-armhf}"
 4 | 
 5 | if [ "$ARCH" = armhf ] ; then
 6 |   # workaround for building on 64-bit host (https://github.com/RPi-Distro/pi-gen/issues/271),
 7 |   # also see https://github.com/RPi-Distro/pi-gen/pull/307
 8 |   dpkg --add-architecture i386
 9 | fi
10 | 
11 | # Bring system current
12 | apt-get update
13 | 
14 | # Install required pi-gen dependencies
15 | qemu_package=qemu-user-static:i386
16 | if [ "$ARCH" = aarch64 ] ; then
17 |   qemu_package=qemu-user-static
18 | fi
19 | 
20 | apt-get install -y coreutils quilt parted $qemu_package debootstrap zerofree zip \
21 |   dosfstools libarchive-tools libcap2-bin grep rsync xz-utils file git curl bc \
22 |   qemu-utils kpartx
23 | 
24 | mkdir -p /home/vagrant/pi-cloud-init
25 | 


--------------------------------------------------------------------------------
/Vagrantfile:
--------------------------------------------------------------------------------
 1 | VM_NAME = "raspios-builder"
 2 | 
 3 | $set_environment_variables = <<SCRIPT
 4 | cat > /etc/profile.d/envvars.sh <<EOF
 5 | export ARCH=#{ENV['ARCH']}
 6 | export LANGUAGE=en_US.UTF-8 
 7 | export LANG=en_US.UTF-8
 8 | export LC_ALL=en_US.UTF-8
 9 | EOF
10 | SCRIPT
11 | 
12 | Vagrant.configure("2") do |config|
13 |   config.vm.box = "debian/buster64"
14 |   
15 |   config.vm.define VM_NAME
16 |   config.vm.hostname = VM_NAME
17 | 
18 |   config.vm.provider "virtualbox" do |v|
19 |     v.cpus = 8
20 |     v.memory = 16000
21 |     v.name = VM_NAME
22 |   end
23 | 
24 |   config.vm.provision "shell", privileged: true, inline: <<-SCRIPT
25 |   #!/bin/bash
26 |   echo "en_US.UTF-8 UTF-8" >> /etc/locale.gen
27 |   locale-gen en_US.UTF-8
28 |   SCRIPT
29 |   config.vm.provision "shell", inline: $set_environment_variables
30 |   config.vm.provision "shell", path: "bootstrap.sh"
31 | 
32 |   config.vm.synced_folder ".", "/vagrant", disabled: true
33 |   config.vm.synced_folder ".", "/home/vagrant/pi-cloud-init", type: "rsync", rsync__auto: true, rsync__exclude: ['*.zip', '*.img']
34 | end
35 | 


--------------------------------------------------------------------------------
/examples/static-ip/user-data.yaml:
--------------------------------------------------------------------------------
 1 | #cloud-config
 2 | 
 3 | hostname: raspberry-0
 4 | # update /etc/hosts according to hostname (otherwise sudo will complain)
 5 | manage_etc_hosts: true
 6 | locale: en_US.UTF-8
 7 | timezone: Europe/Berlin
 8 | 
 9 | users:
10 | - default # pi user
11 | - name: tim
12 |   gecos: Tim Ebert
13 |   groups: sudo
14 |   sudo: "ALL=(ALL) NOPASSWD:ALL"
15 |   # set to false to allow password login for this user
16 |   # only for verifying with dockerpi, passwd auth over SSH should be disabled
17 |   lock_passwd: false
18 |   shell: /bin/bash
19 |   # salt + hashed password, generate with `mkpasswd` or `openssl passwd -6`
20 |   passwd: $6$U3.pM4pSkWuWC/AV$c/GZctLhbySMEKPF2wIgMrQB4jM7lPToi4oFlI9b53XSvcT/C8KM.HYnsQdXJI9ICmqXbVOwIhzovXk8JAbMc1
21 |   ssh_authorized_keys:
22 |   - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDzEE4Z7wZXrO6HZF5XjSeF0qIBLLbaJiI5w3TDnzh6k+Mcg17ahBYLyA+CFkZOpU668hh3AbY+ess2iVkPQ9JvurnKEVUO7Q2kyU8YaXbX+eSsaaw7Y9eNb140br9K8/4DwE2q4cXlSTkhsHu9XJJads6ByXhVo2RZIsY07BWGdAAwv4nThVTMehxjzstCMWnfSEa1oHgd59R09hAqHHqJ1Al8RfgKzFevRv+zFj2bftZRH6bjLlRIj2izkIPjdgrwME9/2tJ5CwBelxnVa9KPtd0ndu0E3GfBwEmw0De3bGD1rTST3l29klBTJL0HXZrFMBKPcoE/CiBk8ZINOdjxutmr6FegLdsrIEQqyjC9KNaG8wPKXGGqfmtXX4dpqxf7z5W730D3BeNlT51a/NHFw+uTBOe+CmwKKRmBvUS/CHEUIo5di4bs342ZaTUrRdoIKz1kde3TSIcC7Q0T3X0GIFGaHcxqWWIz9PxFm1YKQ/WvIQXdVtk/rui82wWyGCrBRfsMivwmVkS05C6E1lsyKAFK6w2jX1P49ZuzP/gfd6oF7u0K/17MEmF/Lqg2ea5KwtN3djUhnR9njxR1iy0UNDPYzoOwqbNi8ENO9CO8If6rgJdTCwH3u2no5fL2bJwyuVQF2kser4DDDgCBIzegB4BpY7gs9yNEJqcS4bUTqQ==
23 |   - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJsGtuJYWgCwGHznLg8A2Iqm124z4vvoZmC0cIwr1D6V
24 | 
25 | # set to true to allow ssh password authentication (disabled by default)
26 | ssh_pwauth: false
27 | 
28 | bootcmd:
29 | # disable ipv6 on all interfaces
30 | - sysctl net.ipv6.conf.all.disable_ipv6=1
31 | 


--------------------------------------------------------------------------------
/examples/simple/user-data.yaml:
--------------------------------------------------------------------------------
 1 | #cloud-config
 2 | 
 3 | hostname: raspberry-0
 4 | # update /etc/hosts according to hostname (otherwise sudo will complain)
 5 | manage_etc_hosts: true
 6 | locale: en_US.UTF-8
 7 | timezone: Europe/Berlin
 8 | 
 9 | users:
10 | - default # pi user
11 | - name: tim
12 |   gecos: Tim Ebert
13 |   groups: sudo
14 |   sudo: "ALL=(ALL) NOPASSWD:ALL"
15 |   # set to false to allow password login for this user
16 |   # only for verifying with dockerpi, passwd auth over SSH should be disabled
17 |   lock_passwd: false
18 |   shell: /bin/bash
19 |   # salt + hashed password, generate with `mkpasswd` or `openssl passwd -6`
20 |   passwd: $6$U3.pM4pSkWuWC/AV$c/GZctLhbySMEKPF2wIgMrQB4jM7lPToi4oFlI9b53XSvcT/C8KM.HYnsQdXJI9ICmqXbVOwIhzovXk8JAbMc1
21 |   ssh_authorized_keys:
22 |   - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDzEE4Z7wZXrO6HZF5XjSeF0qIBLLbaJiI5w3TDnzh6k+Mcg17ahBYLyA+CFkZOpU668hh3AbY+ess2iVkPQ9JvurnKEVUO7Q2kyU8YaXbX+eSsaaw7Y9eNb140br9K8/4DwE2q4cXlSTkhsHu9XJJads6ByXhVo2RZIsY07BWGdAAwv4nThVTMehxjzstCMWnfSEa1oHgd59R09hAqHHqJ1Al8RfgKzFevRv+zFj2bftZRH6bjLlRIj2izkIPjdgrwME9/2tJ5CwBelxnVa9KPtd0ndu0E3GfBwEmw0De3bGD1rTST3l29klBTJL0HXZrFMBKPcoE/CiBk8ZINOdjxutmr6FegLdsrIEQqyjC9KNaG8wPKXGGqfmtXX4dpqxf7z5W730D3BeNlT51a/NHFw+uTBOe+CmwKKRmBvUS/CHEUIo5di4bs342ZaTUrRdoIKz1kde3TSIcC7Q0T3X0GIFGaHcxqWWIz9PxFm1YKQ/WvIQXdVtk/rui82wWyGCrBRfsMivwmVkS05C6E1lsyKAFK6w2jX1P49ZuzP/gfd6oF7u0K/17MEmF/Lqg2ea5KwtN3djUhnR9njxR1iy0UNDPYzoOwqbNi8ENO9CO8If6rgJdTCwH3u2no5fL2bJwyuVQF2kser4DDDgCBIzegB4BpY7gs9yNEJqcS4bUTqQ==
23 |   - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJsGtuJYWgCwGHznLg8A2Iqm124z4vvoZmC0cIwr1D6V
24 | 
25 | # # authorized ssh keys for default user (pi)
26 | # ssh_authorized_keys:
27 | # - ssh-rsa AAAA...
28 | 
29 | # set to true to allow ssh password authentication (disabled by default)
30 | ssh_pwauth: false
31 | 
32 | # write_files:
33 | # - path: /var/lib/cloud/scripts/per-boot/01-hello-world.sh
34 | #   permissions: "0744"
35 | #   content: |
36 | #     #!/bin/bash
37 | #     echo "Hello cloud-init on Raspberry Pi!"
38 | #     date > /tmp/per-boot-was-here
39 | # - path: /var/lib/cloud/scripts/per-once/01-hello-world.sh
40 | #   permissions: "0744"
41 | #   content: |
42 | #     #!/bin/bash
43 | #     echo "Hello cloud-init on Raspberry Pi!"
44 | #     date > /tmp/per-once-was-here
45 | 


--------------------------------------------------------------------------------
/user-data.yaml:
--------------------------------------------------------------------------------
 1 | #cloud-config
 2 | 
 3 | hostname: raspberry-0
 4 | # update /etc/hosts according to hostname (otherwise sudo will complain)
 5 | manage_etc_hosts: true
 6 | locale: en_US.UTF-8
 7 | timezone: Europe/Berlin
 8 | 
 9 | users:
10 | - default # pi user
11 | - name: tim
12 |   gecos: Tim Ebert
13 |   groups: sudo
14 |   sudo: "ALL=(ALL) NOPASSWD:ALL"
15 |   # set to false to allow password login for this user
16 |   # only for verifying with dockerpi, passwd auth over SSH should be disabled
17 |   lock_passwd: false
18 |   shell: /bin/bash
19 |   # salt + hashed password, generate with `mkpasswd` or `openssl passwd -6`
20 |   passwd: $6$U3.pM4pSkWuWC/AV$c/GZctLhbySMEKPF2wIgMrQB4jM7lPToi4oFlI9b53XSvcT/C8KM.HYnsQdXJI9ICmqXbVOwIhzovXk8JAbMc1
21 |   ssh_authorized_keys:
22 |   - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDzEE4Z7wZXrO6HZF5XjSeF0qIBLLbaJiI5w3TDnzh6k+Mcg17ahBYLyA+CFkZOpU668hh3AbY+ess2iVkPQ9JvurnKEVUO7Q2kyU8YaXbX+eSsaaw7Y9eNb140br9K8/4DwE2q4cXlSTkhsHu9XJJads6ByXhVo2RZIsY07BWGdAAwv4nThVTMehxjzstCMWnfSEa1oHgd59R09hAqHHqJ1Al8RfgKzFevRv+zFj2bftZRH6bjLlRIj2izkIPjdgrwME9/2tJ5CwBelxnVa9KPtd0ndu0E3GfBwEmw0De3bGD1rTST3l29klBTJL0HXZrFMBKPcoE/CiBk8ZINOdjxutmr6FegLdsrIEQqyjC9KNaG8wPKXGGqfmtXX4dpqxf7z5W730D3BeNlT51a/NHFw+uTBOe+CmwKKRmBvUS/CHEUIo5di4bs342ZaTUrRdoIKz1kde3TSIcC7Q0T3X0GIFGaHcxqWWIz9PxFm1YKQ/WvIQXdVtk/rui82wWyGCrBRfsMivwmVkS05C6E1lsyKAFK6w2jX1P49ZuzP/gfd6oF7u0K/17MEmF/Lqg2ea5KwtN3djUhnR9njxR1iy0UNDPYzoOwqbNi8ENO9CO8If6rgJdTCwH3u2no5fL2bJwyuVQF2kser4DDDgCBIzegB4BpY7gs9yNEJqcS4bUTqQ==
23 |   - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJsGtuJYWgCwGHznLg8A2Iqm124z4vvoZmC0cIwr1D6V
24 | 
25 | # # authorized ssh keys for default user (pi)
26 | # ssh_authorized_keys:
27 | # - ssh-rsa AAAA...
28 | 
29 | # set to true to allow ssh password authentication (disabled by default)
30 | ssh_pwauth: false
31 | 
32 | bootcmd:
33 | # disable ipv6 on all interfaces
34 | - sysctl net.ipv6.conf.all.disable_ipv6=1
35 | 
36 | write_files:
37 | - path: /var/lib/cloud/scripts/per-boot/01-hello-world.sh
38 |   permissions: "0744"
39 |   content: |
40 |     #!/bin/bash
41 |     echo "Hello cloud-init on Raspberry Pi!"
42 |     date > /tmp/per-boot-was-here
43 | - path: /var/lib/cloud/scripts/per-once/01-hello-world.sh
44 |   permissions: "0744"
45 |   content: |
46 |     #!/bin/bash
47 |     echo "Hello cloud-init on Raspberry Pi!"
48 |     date > /tmp/per-once-was-here
49 | 


--------------------------------------------------------------------------------
/examples/k3s-cluster/raspberry-1/user-data.yaml:
--------------------------------------------------------------------------------
  1 | #cloud-config
  2 | 
  3 | hostname: raspberry-1
  4 | # update /etc/hosts according to hostname (otherwise sudo will complain)
  5 | manage_etc_hosts: true
  6 | locale: en_US.UTF-8
  7 | timezone: Europe/Berlin
  8 | 
  9 | users:
 10 | - default # pi user
 11 | - name: tim
 12 |   gecos: Tim Ebert
 13 |   groups: sudo
 14 |   sudo: "ALL=(ALL) NOPASSWD:ALL"
 15 |   # set to false to allow password login for this user
 16 |   # only for verifying with dockerpi, passwd auth over SSH should be disabled
 17 |   lock_passwd: true
 18 |   shell: /bin/bash
 19 |   ssh_authorized_keys:
 20 |   - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDzEE4Z7wZXrO6HZF5XjSeF0qIBLLbaJiI5w3TDnzh6k+Mcg17ahBYLyA+CFkZOpU668hh3AbY+ess2iVkPQ9JvurnKEVUO7Q2kyU8YaXbX+eSsaaw7Y9eNb140br9K8/4DwE2q4cXlSTkhsHu9XJJads6ByXhVo2RZIsY07BWGdAAwv4nThVTMehxjzstCMWnfSEa1oHgd59R09hAqHHqJ1Al8RfgKzFevRv+zFj2bftZRH6bjLlRIj2izkIPjdgrwME9/2tJ5CwBelxnVa9KPtd0ndu0E3GfBwEmw0De3bGD1rTST3l29klBTJL0HXZrFMBKPcoE/CiBk8ZINOdjxutmr6FegLdsrIEQqyjC9KNaG8wPKXGGqfmtXX4dpqxf7z5W730D3BeNlT51a/NHFw+uTBOe+CmwKKRmBvUS/CHEUIo5di4bs342ZaTUrRdoIKz1kde3TSIcC7Q0T3X0GIFGaHcxqWWIz9PxFm1YKQ/WvIQXdVtk/rui82wWyGCrBRfsMivwmVkS05C6E1lsyKAFK6w2jX1P49ZuzP/gfd6oF7u0K/17MEmF/Lqg2ea5KwtN3djUhnR9njxR1iy0UNDPYzoOwqbNi8ENO9CO8If6rgJdTCwH3u2no5fL2bJwyuVQF2kser4DDDgCBIzegB4BpY7gs9yNEJqcS4bUTqQ==
 21 |   - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJsGtuJYWgCwGHznLg8A2Iqm124z4vvoZmC0cIwr1D6V
 22 | 
 23 | # set to true to allow ssh password authentication (disabled by default)
 24 | ssh_pwauth: false
 25 | 
 26 | bootcmd:
 27 | # disable ipv6 on all interfaces
 28 | - sysctl net.ipv6.conf.all.disable_ipv6=1
 29 | 
 30 | write_files:
 31 | - path: /var/lib/rancher/k3s/server/token
 32 |   permissions: "0600"
 33 |   content: |
 34 |     some-random-string
 35 | - path: /etc/rancher/k3s/config.yaml
 36 |   permissions: "0600"
 37 |   content: |
 38 |     server: "https://192.168.0.30:6443"
 39 |     token-file: /var/lib/rancher/k3s/server/token
 40 |     disable:
 41 |     - servicelb
 42 |     node-label:
 43 |     - node.kubernetes.io/instance-type=pi-4b-4
 44 |     - beta.kubernetes.io/instance-type=pi-4b-4
 45 | - path: /var/lib/cloud/scripts/per-once/00-install-k3s.sh
 46 |   permissions: "0700"
 47 |   content: |
 48 |     #!/bin/bash
 49 |     echo "Installing k3s (server)"
 50 | 
 51 |     curl -sfL https://get.k3s.io | INSTALL_K3S_CHANNEL="v1.20" sh -s - server
 52 | - path: /var/lib/rancher/k3s/server/manifests/kube-vip.yaml
 53 |   permissions: "0700"
 54 |   content: |
 55 |     apiVersion: v1
 56 |     kind: ServiceAccount
 57 |     metadata:
 58 |       name: kube-vip
 59 |       namespace: kube-system
 60 |     ---
 61 |     apiVersion: rbac.authorization.k8s.io/v1
 62 |     kind: ClusterRole
 63 |     metadata:
 64 |       annotations:
 65 |         rbac.authorization.kubernetes.io/autoupdate: "true"
 66 |       name: system:kube-vip-role
 67 |     rules:
 68 |     - apiGroups: [""]
 69 |       resources: ["services", "services/status", "nodes"]
 70 |       verbs: ["list","get","watch", "update"]
 71 |     - apiGroups: ["coordination.k8s.io"]
 72 |       resources: ["leases"]
 73 |       verbs: ["list", "get", "watch", "update", "create"]
 74 |     ---
 75 |     kind: ClusterRoleBinding
 76 |     apiVersion: rbac.authorization.k8s.io/v1
 77 |     metadata:
 78 |       name: system:kube-vip-binding
 79 |     roleRef:
 80 |       apiGroup: rbac.authorization.k8s.io
 81 |       kind: ClusterRole
 82 |       name: system:kube-vip-role
 83 |     subjects:
 84 |     - kind: ServiceAccount
 85 |       name: kube-vip
 86 |       namespace: kube-system
 87 |     ---
 88 |     apiVersion: apps/v1
 89 |     kind: DaemonSet
 90 |     metadata:
 91 |       name: kube-vip
 92 |       namespace: kube-system
 93 |     spec:
 94 |       selector:
 95 |         matchLabels:
 96 |           name: kube-vip
 97 |       template:
 98 |         metadata:
 99 |           labels:
100 |             name: kube-vip
101 |         spec:
102 |           containers:
103 |           - args:
104 |             - manager
105 |             - --controlplane
106 |             - --arp
107 |             - --address=192.168.0.30
108 |             - --port=6443
109 |             - --interface=eth0
110 |             - --leaderElection
111 |             - --leaseDuration=15
112 |             - --leaseRenewDuration=10
113 |             - --leaseRetry=2
114 |             - --namespace=kube-system
115 |             image: plndr/kube-vip:0.3.2
116 |             name: kube-vip
117 |             securityContext:
118 |               capabilities:
119 |                 add:
120 |                 - NET_ADMIN
121 |                 - NET_RAW
122 |                 - SYS_TIME
123 |           hostNetwork: true
124 |           serviceAccountName: kube-vip
125 |           nodeSelector:
126 |             kubernetes.io/os: linux
127 |             kubernetes.io/arch: arm64
128 |             node-role.kubernetes.io/master: "true"
129 |           tolerations:
130 |           - effect: NoSchedule
131 |             key: node-role.kubernetes.io/master
132 | - path: /var/lib/rancher/k3s/server/manifests/metallb.yaml
133 |   permissions: "0700"
134 |   content: |
135 |     apiVersion: v1
136 |     kind: Namespace
137 |     metadata:
138 |       name: metallb-system
139 |       labels:
140 |         app: metallb
141 |     ---
142 |     apiVersion: helm.cattle.io/v1
143 |     kind: HelmChart
144 |     metadata:
145 |       name: metallb
146 |       namespace: metallb-system
147 |     spec:
148 |       repo: https://charts.bitnami.com/bitnami
149 |       chart: metallb
150 |       version: 2.3.4
151 |       valuesContent: |-
152 |         configInline: |
153 |           address-pools:
154 |           - name: default
155 |             protocol: layer2
156 |             addresses:
157 |             - 192.168.0.31-192.168.0.59
158 |         controller:
159 |           image:
160 |             repository: metallb/controller
161 |             tag: v0.9.5
162 |         speaker:
163 |           image:
164 |             repository: metallb/speaker
165 |             tag: v0.9.5
166 | 


--------------------------------------------------------------------------------
/examples/k3s-cluster/raspberry-0/user-data.yaml:
--------------------------------------------------------------------------------
  1 | #cloud-config
  2 | 
  3 | hostname: raspberry-0
  4 | # update /etc/hosts according to hostname (otherwise sudo will complain)
  5 | manage_etc_hosts: true
  6 | locale: en_US.UTF-8
  7 | timezone: Europe/Berlin
  8 | 
  9 | users:
 10 | - default # pi user
 11 | - name: tim
 12 |   gecos: Tim Ebert
 13 |   groups: sudo
 14 |   sudo: "ALL=(ALL) NOPASSWD:ALL"
 15 |   # set to false to allow password login for this user
 16 |   # only for verifying with dockerpi, passwd auth over SSH should be disabled
 17 |   lock_passwd: true
 18 |   shell: /bin/bash
 19 |   ssh_authorized_keys:
 20 |   - ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDzEE4Z7wZXrO6HZF5XjSeF0qIBLLbaJiI5w3TDnzh6k+Mcg17ahBYLyA+CFkZOpU668hh3AbY+ess2iVkPQ9JvurnKEVUO7Q2kyU8YaXbX+eSsaaw7Y9eNb140br9K8/4DwE2q4cXlSTkhsHu9XJJads6ByXhVo2RZIsY07BWGdAAwv4nThVTMehxjzstCMWnfSEa1oHgd59R09hAqHHqJ1Al8RfgKzFevRv+zFj2bftZRH6bjLlRIj2izkIPjdgrwME9/2tJ5CwBelxnVa9KPtd0ndu0E3GfBwEmw0De3bGD1rTST3l29klBTJL0HXZrFMBKPcoE/CiBk8ZINOdjxutmr6FegLdsrIEQqyjC9KNaG8wPKXGGqfmtXX4dpqxf7z5W730D3BeNlT51a/NHFw+uTBOe+CmwKKRmBvUS/CHEUIo5di4bs342ZaTUrRdoIKz1kde3TSIcC7Q0T3X0GIFGaHcxqWWIz9PxFm1YKQ/WvIQXdVtk/rui82wWyGCrBRfsMivwmVkS05C6E1lsyKAFK6w2jX1P49ZuzP/gfd6oF7u0K/17MEmF/Lqg2ea5KwtN3djUhnR9njxR1iy0UNDPYzoOwqbNi8ENO9CO8If6rgJdTCwH3u2no5fL2bJwyuVQF2kser4DDDgCBIzegB4BpY7gs9yNEJqcS4bUTqQ==
 21 |   - ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJsGtuJYWgCwGHznLg8A2Iqm124z4vvoZmC0cIwr1D6V
 22 | 
 23 | # set to true to allow ssh password authentication (disabled by default)
 24 | ssh_pwauth: false
 25 | 
 26 | bootcmd:
 27 | # disable ipv6 on all interfaces
 28 | - sysctl net.ipv6.conf.all.disable_ipv6=1
 29 | 
 30 | write_files:
 31 | - path: /var/lib/rancher/k3s/server/token
 32 |   permissions: "0600"
 33 |   content: |
 34 |     some-random-string
 35 | - path: /etc/rancher/k3s/config.yaml
 36 |   permissions: "0600"
 37 |   content: |
 38 |     cluster-init: true
 39 |     tls-san:
 40 |     - 192.168.0.20
 41 |     - 192.168.0.30
 42 |     token-file: /var/lib/rancher/k3s/server/token
 43 |     disable:
 44 |     - servicelb
 45 |     node-label:
 46 |     - node.kubernetes.io/instance-type=pi-4b-4
 47 |     - beta.kubernetes.io/instance-type=pi-4b-4
 48 | - path: /var/lib/cloud/scripts/per-once/00-install-k3s.sh
 49 |   permissions: "0700"
 50 |   content: |
 51 |     #!/bin/bash
 52 |     echo "Installing k3s (server)"
 53 | 
 54 |     curl -sfL https://get.k3s.io | INSTALL_K3S_CHANNEL="v1.20" sh -s - server
 55 | - path: /var/lib/rancher/k3s/server/manifests/kube-vip.yaml
 56 |   permissions: "0700"
 57 |   content: |
 58 |     apiVersion: v1
 59 |     kind: ServiceAccount
 60 |     metadata:
 61 |       name: kube-vip
 62 |       namespace: kube-system
 63 |     ---
 64 |     apiVersion: rbac.authorization.k8s.io/v1
 65 |     kind: ClusterRole
 66 |     metadata:
 67 |       annotations:
 68 |         rbac.authorization.kubernetes.io/autoupdate: "true"
 69 |       name: system:kube-vip-role
 70 |     rules:
 71 |     - apiGroups: [""]
 72 |       resources: ["services", "services/status", "nodes"]
 73 |       verbs: ["list","get","watch", "update"]
 74 |     - apiGroups: ["coordination.k8s.io"]
 75 |       resources: ["leases"]
 76 |       verbs: ["list", "get", "watch", "update", "create"]
 77 |     ---
 78 |     kind: ClusterRoleBinding
 79 |     apiVersion: rbac.authorization.k8s.io/v1
 80 |     metadata:
 81 |       name: system:kube-vip-binding
 82 |     roleRef:
 83 |       apiGroup: rbac.authorization.k8s.io
 84 |       kind: ClusterRole
 85 |       name: system:kube-vip-role
 86 |     subjects:
 87 |     - kind: ServiceAccount
 88 |       name: kube-vip
 89 |       namespace: kube-system
 90 |     ---
 91 |     apiVersion: apps/v1
 92 |     kind: DaemonSet
 93 |     metadata:
 94 |       name: kube-vip
 95 |       namespace: kube-system
 96 |     spec:
 97 |       selector:
 98 |         matchLabels:
 99 |           name: kube-vip
100 |       template:
101 |         metadata:
102 |           labels:
103 |             name: kube-vip
104 |         spec:
105 |           containers:
106 |           - args:
107 |             - manager
108 |             - --controlplane
109 |             - --arp
110 |             - --address=192.168.0.30
111 |             - --port=6443
112 |             - --interface=eth0
113 |             - --leaderElection
114 |             - --leaseDuration=15
115 |             - --leaseRenewDuration=10
116 |             - --leaseRetry=2
117 |             - --namespace=kube-system
118 |             image: plndr/kube-vip:0.3.2
119 |             name: kube-vip
120 |             securityContext:
121 |               capabilities:
122 |                 add:
123 |                 - NET_ADMIN
124 |                 - NET_RAW
125 |                 - SYS_TIME
126 |           hostNetwork: true
127 |           serviceAccountName: kube-vip
128 |           nodeSelector:
129 |             kubernetes.io/os: linux
130 |             kubernetes.io/arch: arm64
131 |             node-role.kubernetes.io/master: "true"
132 |           tolerations:
133 |           - effect: NoSchedule
134 |             key: node-role.kubernetes.io/master
135 | - path: /var/lib/rancher/k3s/server/manifests/metallb.yaml
136 |   permissions: "0700"
137 |   content: |
138 |     apiVersion: v1
139 |     kind: Namespace
140 |     metadata:
141 |       name: metallb-system
142 |       labels:
143 |         app: metallb
144 |     ---
145 |     apiVersion: helm.cattle.io/v1
146 |     kind: HelmChart
147 |     metadata:
148 |       name: metallb
149 |       namespace: metallb-system
150 |     spec:
151 |       repo: https://charts.bitnami.com/bitnami
152 |       chart: metallb
153 |       version: 2.3.4
154 |       valuesContent: |-
155 |         configInline: |
156 |           address-pools:
157 |           - name: default
158 |             protocol: layer2
159 |             addresses:
160 |             - 192.168.0.31-192.168.0.59
161 |         controller:
162 |           image:
163 |             repository: metallb/controller
164 |             tag: v0.9.5
165 |         speaker:
166 |           image:
167 |             repository: metallb/speaker
168 |             tag: v0.9.5
169 | 


--------------------------------------------------------------------------------
/README.md:
--------------------------------------------------------------------------------
  1 | # Minimal Raspberry Pi OS including cloud-init
  2 | 
  3 | This repo features a custom [Raspberry Pi OS Lite](https://www.raspberrypi.org/software/operating-systems/) image including [cloud-init](https://cloud-init.io/) built with [pi-gen](https://github.com/RPi-Distro/pi-gen).
  4 | 
  5 | ## TL;DR: How to use the image :gear:
  6 | 
  7 | 1. Download the image from GitHub:
  8 |     ```bash
  9 |     ARCH=armhf # either armhf or aarch64 (experimental)
 10 |     curl -sSL -o 2021-05-10-raspios-buster-$ARCH-lite-cloud-init.zip https://github.com/timebertt/pi-cloud-init/releases/download/2021-05-10/2021-05-10-raspios-buster-$ARCH-lite-cloud-init.zip && \
 11 |     unzip -o 2021-05-10-raspios-buster-$ARCH-lite-cloud-init.zip
 12 |     ```
 13 | 
 14 | 2. Mount the `boot` partition (of the `.img` file) to add `user-data`, `meta-data` and optionally `network-config` files to the root of it. Unmount it again, once added.
 15 | 3. Flash image to SD card using [balena etcher](https://www.balena.io/etcher/), [Raspberry Pi Imager](https://www.raspberrypi.org/software/) or similar.
 16 | 4. Insert SD card into Pi and power up! :rocket:
 17 | 
 18 | ## Rationale :bulb:
 19 | 
 20 | [Raspberry Pi OS](https://www.raspberrypi.org/software/operating-systems/) is fairly easy to setup. Though, if you want to setup a Raspberry Pi cluster like Alex Ellis and the community [have been doing for five years+](https://alexellisuk.medium.com/five-years-of-raspberry-pi-clusters-77e56e547875), you will have to repeat some manual configuration steps like copying SSH keys, networking setup and so on for each Pi.
 21 | 
 22 | [cloud-init](https://cloud-init.io/) is the de-facto standard for solving the same problem on cloud instances. It's baked into most cloud images, which makes cloud instances discover initialization and configuration data from the cloud provider's [metadata service](https://cloudinit.readthedocs.io/en/latest/topics/datasources.html).
 23 | 
 24 | cloud-init can be used for bootstrapping Raspberry Pis as well, making it easy to configure networking, packages and remote access consistently across a fleet of Pis. Unfortunately, Raspberry Pi OS doesn't ship with cloud-init out of the box and thus requires [manual installation and configuration](https://gist.github.com/RichardBronosky/fa7d4db13bab3fbb8d9e0fff7ea88aa2).
 25 | 
 26 | This repo features a custom image based on Raspberry Pi OS Lite built with [pi-gen](https://github.com/RPi-Distro/pi-gen) with cloud-init preinstalled, which allows to pass initialization and configuration data (in form of `meta-data`, `user-data` and `network-config` files) to Pis via the boot image flashed to an SD card. This makes it easy to bootstrap multiple Pis in a plug-and-play fashion without attaching a monitor or manually SSHing into each one of them.
 27 | 
 28 | **Why not simply use Ubuntu Server?** :question:
 29 | 
 30 | [Ubuntu Server](https://ubuntu.com/download/raspberry-pi) comes with cloud-init preinstalled and also features a Raspberry Pi Image. It can be leveraged in a [similar fashion](https://gitlab.com/Bjorn_Samuelsson/raspberry-pi-cloud-init-wifi) to the image built by this project to bootstrap Pis. Though, in my tests Ubuntu Server already consumed more than `300MB` of precious memory on my Pis without anything installed. Therefore I started building a custom image based on Raspberry Pi OS Lite, which consumes only roughly `60MB` of memory out of the box.
 31 | 
 32 | **Why not use k3os?** :question:
 33 | 
 34 | [k3os](https://github.com/rancher/k3os) is a minimal OS designed to run [k3s](https://github.com/k3s-io/k3s) and be managed by `kubectl`. It also features a `cloud-init`-like configuration file, which can be used to easily configure hosts. Unfortunately, there are currently [no official RPi images](https://github.com/rancher/k3os/issues/309), but you can build one on your own by leveraging [this project](https://github.com/rancher/k3os/issues/309).
 35 | In my tests, `k3os` performed quite well with some additional overhead in CPU and Memory usage. I chose to build my own images based on Raspberry Pi OS, because of the lower resource usage, the familiarity with Debian-based distros, flexibility in bootstrapping my clusters (not tied to k3s) and the endless resources on Raspberry Pi OS.
 36 | 
 37 | ## How to build the image :construction:
 38 | 
 39 | You can build the image yourself and customize the build along the way by following these steps.
 40 | 
 41 | 1. Setup a Debian VM using [vagrant](https://www.vagrantup.com/) which will build the image. This provides a clean build environment and additionally works on a Linux as well as macOS.
 42 |     ```bash
 43 |     # what image to build: either amrhf (default) or aarch64 (experimental)
 44 |     export ARCH=armhf
 45 |     vagrant up --provision
 46 |     ```
 47 | 
 48 | 2. Start pi-gen build in the VM. This is going to take some time...
 49 |     ```bash
 50 |     vagrant ssh
 51 |     ./pi-cloud-init/build.sh
 52 |     ```
 53 |     When you want to rebuild from scratch (e.g. because you want to build for another arch), you can run
 54 |     ```bash
 55 |     vagrant ssh
 56 |     CLEAN=1 ./pi-cloud-init/build.sh
 57 |     ```
 58 | 
 59 | 3. Transfer produced image to the host machine and unzip.
 60 |     This requires the `vagrant-scp` plugin, install it first by running:
 61 |     ```bash
 62 |     vagrant plugin install vagrant-scp
 63 |     ```
 64 |     ```bash
 65 |     zip_file=$(date +%Y-%m-%d)-raspios-buster-$ARCH-lite-cloud-init.zip && \
 66 |     vagrant scp raspios-builder:/home/vagrant/pi-cloud-init/$zip_file $zip_file && \
 67 |     unzip -o "$zip_file"
 68 |     ```
 69 | 
 70 | 4. Customize `user-data.yaml`, `meta-data.yaml` and `network-config.yaml` for the instance you're setting up.
 71 | 
 72 | 5. Mount boot partition to inject `user-data`, `meta-data` and `network-config`.
 73 |     (It's assuming a macOS machine, but you should be able to accomplish the same using `mount` and `umount` on Linux.)
 74 |     ```bash
 75 |     img_file="${zip_file%.zip}.img" && \
 76 |     volume="$(hdiutil mount "$img_file" | egrep -o '/Volumes/.+')" && \
 77 |     cp meta-data.yaml "$volume"/meta-data && \
 78 |     cp user-data.yaml "$volume"/user-data && \
 79 |     cp network-config.yaml "$volume"/network-config && \
 80 |     device="$(mount | grep "$volume" | cut -f1 -d' ' | egrep -o '/dev/disk.')" && \
 81 |     diskutil umountDisk "$device" && \
 82 |     diskutil eject "$device"
 83 |     ```
 84 | 
 85 | 6. Optionally, you can verify the image and cloud-init functionality using [dockerpi](https://github.com/lukechilds/dockerpi) (only works with `armhf` images). It start a Docker container with QEMU in it emulating a Pi. This way you can already verify, that the image and the provided `user-data` is working without flashing a new SD card everytime.
 86 |     ```bash
 87 |     docker run -it -v $PWD/$img_file:/sdcard/filesystem.img lukechilds/dockerpi:vm
 88 |     ...
 89 |     cloud-init[96]: Cloud-init v. 20.2 running 'init-local' at Mon, 08 Mar 2021 19:54:02 +0000. Up 53.20 seconds.
 90 |     ...
 91 |     cloud-init[380]: Cloud-init v. 20.2 running 'init' at Mon, 08 Mar 2021 19:54:42 +0000. Up 93.34 seconds.
 92 |     ...
 93 |     cloud-init[568]: Cloud-init v. 20.2 running 'modules:config' at Mon, 08 Mar 2021 19:55:48 +0000. Up 159.10 seconds.
 94 |     ...
 95 |     cloud-init[620]: Cloud-init v. 20.2 running 'modules:final' at Mon, 08 Mar 2021 19:56:05 +0000. Up 175.50 seconds.
 96 |     cloud-init[620]: Cloud-init v. 20.2 finished at Mon, 08 Mar 2021 19:56:08 +0000. Datasource DataSourceNoCloud [seed=/dev/sda1][dsmode=net].  Up 179.17 seconds
 97 |     ```
 98 | 
 99 | 7. Now, flash the image including cloud-init data to SD card, using [balena etcher](https://www.balena.io/etcher/), [Raspberry Pi Imager](https://www.raspberrypi.org/software/) or similar.
100 | 
101 | 8. Finally, SSH into your Pi and verify cloud-init functionality. By default, the `pi` user is locked and SSH password authentication is disabled, so make sure to add a custom user with `ssh_authorized_keys` to your `user-data`.
102 |     ```bash
103 |     ssh your-user@your-pi
104 |     less /var/log/cloud-init-output.log
105 |     ```
106 | 
107 | ## Next steps :running:
108 | 
109 | ### Play around with user-data :video_game:
110 | 
111 | Find some more user-data examples under [examples](./examples):
112 | 
113 | - [Simple user-data](./examples/simple)
114 | - [Static IPv4](./examples/static-ip)
115 | 
116 | ## More fun :tada:
117 | 
118 | ### Spin up a Kubernetes cluster :nerd_face:
119 | 
120 | [examples/k3s-cluster](./examples/k3s-cluster) contains some user-data files for spinning up a Kubernetes cluster using [k3s](https://github.com/k3s-io/k3s). Use the set of user-data files in `raspberry-0` for bootstrapping your cluster (i.e. for the first Pi). After that, join any number of servers and agents using the user-data files in `raspberry-1`.
121 | 
122 | The examples already include configuration for:
123 | 
124 | - [kube-vip](https://kube-vip.io/) in layer 2 mode (ARP) for API server load balancing
125 |   - provides an HA control plane endpoint to perform rolling updates on k3s servers (drain, install, reboot one by one)
126 |   - only used for control plane load balancing
127 | - [MetalLB](https://metallb.universe.tf/) in layer 2 mode (ARP) for LoadBalancer Services
128 |   - also includes LoadBalancer IP allocation address ranges specified in configuration ConfigMap (built-in and easier to configure than kube-vip)
129 |   - not used for control plane load balancing (not supported, ref [metallb/metallb#168](https://github.com/metallb/metallb/issues/168))
130 |   - [klipper-lb](https://github.com/k3s-io/klipper-lb) is disabled, as it can't provide a dedicated LoadBalancer IP on your local network (just uses host ports to make LoadBalancer services accessible)
131 | 
132 | Get the kubeconfig from `raspberry-0` and modify it to use the API server LoadBalancer IP:
133 | 
134 | ```bash
135 | mkdir -p $HOME/.kube/configs/home && \
136 | ssh tim@192.168.0.20 sudo cat /etc/rancher/k3s/k3s.yaml > $HOME/.kube/configs/home/pi-cluster.yaml && \
137 | export KUBECONFIG=$HOME/.kube/configs/home/pi-cluster.yaml && \
138 | kubectl config rename-context default pi-cluster && \
139 | kubectl config set clusters.default.server https://192.168.0.30:6443
140 | ```
141 | 
142 | Check if all Nodes were bootstrapped and got ready:
143 | 
144 | ```bash
145 | $ kubectl get no -owide
146 | NAME          STATUS   ROLES                       AGE     VERSION        INTERNAL-IP    EXTERNAL-IP   OS-IMAGE                       KERNEL-VERSION   CONTAINER-RUNTIME
147 | raspberry-0   Ready    control-plane,etcd,master   18m     v1.20.5+k3s1   192.168.0.20   <none>        Debian GNU/Linux 10 (buster)   5.10.17-v8+      containerd://1.4.4-k3s1
148 | raspberry-1   Ready    control-plane,etcd,master   11m     v1.20.5+k3s1   192.168.0.21   <none>        Debian GNU/Linux 10 (buster)   5.10.17-v8+      containerd://1.4.4-k3s1
149 | raspberry-2   Ready    control-plane,etcd,master   9m13s   v1.20.5+k3s1   192.168.0.22   <none>        Debian GNU/Linux 10 (buster)   5.10.17-v8+      containerd://1.4.4-k3s1
150 | ```
151 | 


--------------------------------------------------------------------------------
/LICENSE:
--------------------------------------------------------------------------------
  1 |                                  Apache License
  2 |                            Version 2.0, January 2004
  3 |                         http://www.apache.org/licenses/
  4 | 
  5 |    TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
  6 | 
  7 |    1. Definitions.
  8 | 
  9 |       "License" shall mean the terms and conditions for use, reproduction,
 10 |       and distribution as defined by Sections 1 through 9 of this document.
 11 | 
 12 |       "Licensor" shall mean the copyright owner or entity authorized by
 13 |       the copyright owner that is granting the License.
 14 | 
 15 |       "Legal Entity" shall mean the union of the acting entity and all
 16 |       other entities that control, are controlled by, or are under common
 17 |       control with that entity. For the purposes of this definition,
 18 |       "control" means (i) the power, direct or indirect, to cause the
 19 |       direction or management of such entity, whether by contract or
 20 |       otherwise, or (ii) ownership of fifty percent (50%) or more of the
 21 |       outstanding shares, or (iii) beneficial ownership of such entity.
 22 | 
 23 |       "You" (or "Your") shall mean an individual or Legal Entity
 24 |       exercising permissions granted by this License.
 25 | 
 26 |       "Source" form shall mean the preferred form for making modifications,
 27 |       including but not limited to software source code, documentation
 28 |       source, and configuration files.
 29 | 
 30 |       "Object" form shall mean any form resulting from mechanical
 31 |       transformation or translation of a Source form, including but
 32 |       not limited to compiled object code, generated documentation,
 33 |       and conversions to other media types.
 34 | 
 35 |       "Work" shall mean the work of authorship, whether in Source or
 36 |       Object form, made available under the License, as indicated by a
 37 |       copyright notice that is included in or attached to the work
 38 |       (an example is provided in the Appendix below).
 39 | 
 40 |       "Derivative Works" shall mean any work, whether in Source or Object
 41 |       form, that is based on (or derived from) the Work and for which the
 42 |       editorial revisions, annotations, elaborations, or other modifications
 43 |       represent, as a whole, an original work of authorship. For the purposes
 44 |       of this License, Derivative Works shall not include works that remain
 45 |       separable from, or merely link (or bind by name) to the interfaces of,
 46 |       the Work and Derivative Works thereof.
 47 | 
 48 |       "Contribution" shall mean any work of authorship, including
 49 |       the original version of the Work and any modifications or additions
 50 |       to that Work or Derivative Works thereof, that is intentionally
 51 |       submitted to Licensor for inclusion in the Work by the copyright owner
 52 |       or by an individual or Legal Entity authorized to submit on behalf of
 53 |       the copyright owner. For the purposes of this definition, "submitted"
 54 |       means any form of electronic, verbal, or written communication sent
 55 |       to the Licensor or its representatives, including but not limited to
 56 |       communication on electronic mailing lists, source code control systems,
 57 |       and issue tracking systems that are managed by, or on behalf of, the
 58 |       Licensor for the purpose of discussing and improving the Work, but
 59 |       excluding communication that is conspicuously marked or otherwise
 60 |       designated in writing by the copyright owner as "Not a Contribution."
 61 | 
 62 |       "Contributor" shall mean Licensor and any individual or Legal Entity
 63 |       on behalf of whom a Contribution has been received by Licensor and
 64 |       subsequently incorporated within the Work.
 65 | 
 66 |    2. Grant of Copyright License. Subject to the terms and conditions of
 67 |       this License, each Contributor hereby grants to You a perpetual,
 68 |       worldwide, non-exclusive, no-charge, royalty-free, irrevocable
 69 |       copyright license to reproduce, prepare Derivative Works of,
 70 |       publicly display, publicly perform, sublicense, and distribute the
 71 |       Work and such Derivative Works in Source or Object form.
 72 | 
 73 |    3. Grant of Patent License. Subject to the terms and conditions of
 74 |       this License, each Contributor hereby grants to You a perpetual,
 75 |       worldwide, non-exclusive, no-charge, royalty-free, irrevocable
 76 |       (except as stated in this section) patent license to make, have made,
 77 |       use, offer to sell, sell, import, and otherwise transfer the Work,
 78 |       where such license applies only to those patent claims licensable
 79 |       by such Contributor that are necessarily infringed by their
 80 |       Contribution(s) alone or by combination of their Contribution(s)
 81 |       with the Work to which such Contribution(s) was submitted. If You
 82 |       institute patent litigation against any entity (including a
 83 |       cross-claim or counterclaim in a lawsuit) alleging that the Work
 84 |       or a Contribution incorporated within the Work constitutes direct
 85 |       or contributory patent infringement, then any patent licenses
 86 |       granted to You under this License for that Work shall terminate
 87 |       as of the date such litigation is filed.
 88 | 
 89 |    4. Redistribution. You may reproduce and distribute copies of the
 90 |       Work or Derivative Works thereof in any medium, with or without
 91 |       modifications, and in Source or Object form, provided that You
 92 |       meet the following conditions:
 93 | 
 94 |       (a) You must give any other recipients of the Work or
 95 |           Derivative Works a copy of this License; and
 96 | 
 97 |       (b) You must cause any modified files to carry prominent notices
 98 |           stating that You changed the files; and
 99 | 
100 |       (c) You must retain, in the Source form of any Derivative Works
101 |           that You distribute, all copyright, patent, trademark, and
102 |           attribution notices from the Source form of the Work,
103 |           excluding those notices that do not pertain to any part of
104 |           the Derivative Works; and
105 | 
106 |       (d) If the Work includes a "NOTICE" text file as part of its
107 |           distribution, then any Derivative Works that You distribute must
108 |           include a readable copy of the attribution notices contained
109 |           within such NOTICE file, excluding those notices that do not
110 |           pertain to any part of the Derivative Works, in at least one
111 |           of the following places: within a NOTICE text file distributed
112 |           as part of the Derivative Works; within the Source form or
113 |           documentation, if provided along with the Derivative Works; or,
114 |           within a display generated by the Derivative Works, if and
115 |           wherever such third-party notices normally appear. The contents
116 |           of the NOTICE file are for informational purposes only and
117 |           do not modify the License. You may add Your own attribution
118 |           notices within Derivative Works that You distribute, alongside
119 |           or as an addendum to the NOTICE text from the Work, provided
120 |           that such additional attribution notices cannot be construed
121 |           as modifying the License.
122 | 
123 |       You may add Your own copyright statement to Your modifications and
124 |       may provide additional or different license terms and conditions
125 |       for use, reproduction, or distribution of Your modifications, or
126 |       for any such Derivative Works as a whole, provided Your use,
127 |       reproduction, and distribution of the Work otherwise complies with
128 |       the conditions stated in this License.
129 | 
130 |    5. Submission of Contributions. Unless You explicitly state otherwise,
131 |       any Contribution intentionally submitted for inclusion in the Work
132 |       by You to the Licensor shall be under the terms and conditions of
133 |       this License, without any additional terms or conditions.
134 |       Notwithstanding the above, nothing herein shall supersede or modify
135 |       the terms of any separate license agreement you may have executed
136 |       with Licensor regarding such Contributions.
137 | 
138 |    6. Trademarks. This License does not grant permission to use the trade
139 |       names, trademarks, service marks, or product names of the Licensor,
140 |       except as required for reasonable and customary use in describing the
141 |       origin of the Work and reproducing the content of the NOTICE file.
142 | 
143 |    7. Disclaimer of Warranty. Unless required by applicable law or
144 |       agreed to in writing, Licensor provides the Work (and each
145 |       Contributor provides its Contributions) on an "AS IS" BASIS,
146 |       WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
147 |       implied, including, without limitation, any warranties or conditions
148 |       of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
149 |       PARTICULAR PURPOSE. You are solely responsible for determining the
150 |       appropriateness of using or redistributing the Work and assume any
151 |       risks associated with Your exercise of permissions under this License.
152 | 
153 |    8. Limitation of Liability. In no event and under no legal theory,
154 |       whether in tort (including negligence), contract, or otherwise,
155 |       unless required by applicable law (such as deliberate and grossly
156 |       negligent acts) or agreed to in writing, shall any Contributor be
157 |       liable to You for damages, including any direct, indirect, special,
158 |       incidental, or consequential damages of any character arising as a
159 |       result of this License or out of the use or inability to use the
160 |       Work (including but not limited to damages for loss of goodwill,
161 |       work stoppage, computer failure or malfunction, or any and all
162 |       other commercial damages or losses), even if such Contributor
163 |       has been advised of the possibility of such damages.
164 | 
165 |    9. Accepting Warranty or Additional Liability. While redistributing
166 |       the Work or Derivative Works thereof, You may choose to offer,
167 |       and charge a fee for, acceptance of support, warranty, indemnity,
168 |       or other liability obligations and/or rights consistent with this
169 |       License. However, in accepting such obligations, You may act only
170 |       on Your own behalf and on Your sole responsibility, not on behalf
171 |       of any other Contributor, and only if You agree to indemnify,
172 |       defend, and hold each Contributor harmless for any liability
173 |       incurred by, or claims asserted against, such Contributor by reason
174 |       of your accepting any such warranty or additional liability.
175 | 
176 |    END OF TERMS AND CONDITIONS
177 | 
178 |    APPENDIX: How to apply the Apache License to your work.
179 | 
180 |       To apply the Apache License to your work, attach the following
181 |       boilerplate notice, with the fields enclosed by brackets "[]"
182 |       replaced with your own identifying information. (Don't include
183 |       the brackets!)  The text should be enclosed in the appropriate
184 |       comment syntax for the file format. We also recommend that a
185 |       file or class name and description of purpose be included on the
186 |       same "printed page" as the copyright notice for easier
187 |       identification within third-party archives.
188 | 
189 |    Copyright [yyyy] [name of copyright owner]
190 | 
191 |    Licensed under the Apache License, Version 2.0 (the "License");
192 |    you may not use this file except in compliance with the License.
193 |    You may obtain a copy of the License at
194 | 
195 |        http://www.apache.org/licenses/LICENSE-2.0
196 | 
197 |    Unless required by applicable law or agreed to in writing, software
198 |    distributed under the License is distributed on an "AS IS" BASIS,
199 |    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
200 |    See the License for the specific language governing permissions and
201 |    limitations under the License.
202 | 


--------------------------------------------------------------------------------