Prepare to release v0.11.0

Bump pymdown-extensions from 10.7 to 10.7.1
Bumps [pymdown-extensions](https://github.com/facelessuser/pymdown-extensions) from 10.7 to 10.7.1. - [Release notes](https://github.com/facelessuser/pymdown-extensions/releases) - [Commits](https://github.com/facelessuser/pymdown-extensions/compare/10.7...10.7.1) --- updated-dependencies: - dependency-name: pymdown-extensions dependency-type: direct:production update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com>
2026-03-02 22:58:55 +00:00 · 2024-03-23 19:44:33 -07:00 · 2024-03-18 15:26:04 -07:00 · 2024-03-18 14:58:15 -07:00 · 2024-03-07 09:16:42 -08:00 · 2024-03-07 09:10:33 -08:00
58 changed files with 613 additions and 608 deletions
--- a/.github/dependabot.yaml
+++ b/.github/dependabot.yaml
@@ -1,23 +1,18 @@
 version: 2
 updates:
+- package-ecosystem: "github-actions"
+  directory: "/"
+  schedule:
+    interval: "daily"
 - package-ecosystem: gomod
  directory: "/"
  schedule:
    interval: daily
-  pull-request-branch-name:
-    separator: "-"
-  open-pull-requests-limit: 3
 - package-ecosystem: docker
  directory: "/"
  schedule:
    interval: daily
-  pull-request-branch-name:
-    separator: "-"
-  open-pull-requests-limit: 3
 - package-ecosystem: pip
  directory: "/"
  schedule:
    interval: weekly
-  pull-request-branch-name:
-    separator: "-"
-  open-pull-requests-limit: 3
--- a/.github/release.yaml
+++ b/.github/release.yaml
@@ -0,0 +1,12 @@
+changelog:
+  categories:
+    - title: Contributions
+      labels:
+        - '*'
+      exclude:
+        labels:
+          - dependencies
+          - no-release-note
+    - title: Dependencies
+      labels:
+        - dependencies
--- a/.github/workflows/build.yaml
+++ b/.github/workflows/build.yaml
@@ -0,0 +1,15 @@
+name: build
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+jobs:
+  go:
+    uses: poseidon/.github/.github/workflows/golang-library.yaml@main
+  multiarch:
+    uses: poseidon/fleetlock/.github/workflows/multiarch.yaml@main
+    secrets:
+      QUAY_TOKEN: ${{ secrets.QUAY_TOKEN }}
--- a/.github/workflows/mkdocs-pages.yaml
+++ b/.github/workflows/mkdocs-pages.yaml
@@ -0,0 +1,26 @@
+name: mkdocs-pages
+on:
+  workflow_call:
+jobs:
+  publish:
+    name: publish
+    runs-on: ubuntu-latest
+    steps:
+      # Checkout repo to GitHub Actions runner
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      # Install Python
+      - name: Setup Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: 3.x
+
+      # Install PyPI packages
+      - name: Dependencies
+        run: pip install -r requirements.txt
+
+      # Push to GitHub Pages
+      - name: Push Docs
+        run: |
+          mkdocs gh-deploy --force
--- a/.github/workflows/publish.yaml
+++ b/.github/workflows/publish.yaml
@@ -0,0 +1,13 @@
+name: publish
+on:
+  push:
+    branches:
+      - release-docs
+jobs:
+  mkdocs:
+    name: mkdocs
+    uses: ./.github/workflows/mkdocs-pages.yaml
+    # Add content write for GitHub Pages
+    permissions:
+      contents: write
+
--- a/.github/workflows/test.yaml
+++ b/.github/workflows/test.yaml
@@ -1,26 +0,0 @@
-name: test
-on:
-  push:
-jobs:
-  build:
-    name: go
-    runs-on: ubuntu-latest
-    strategy:
-      fail-fast: false
-      matrix:
-        go: ['1.17', '1.18']
-    steps:
-      - name: setup
-        uses: actions/setup-go@v3
-        with:
-          go-version: ${{matrix.go}}
-
-      - name: checkout
-        uses: actions/checkout@v3
-
-      - name: tools
-        run: go install golang.org/x/lint/golint@latest
-
-      - name: test
-        run: make
-
--- a/CHANGES.md
+++ b/CHANGES.md
@@ -4,6 +4,36 @@ Notable changes between releases.

 ## Latest

+## v0.11.0
+
+* Update butane from v0.17.0 to v0.18.0 ([#1079](https://github.com/poseidon/matchbox/pull/1079))
+  * Add support for `fcos` [v1.5.0](https://coreos.github.io/butane/config-fcos-v1_5/) Butane Configs
+  * Add support for `flatcar` [v1.1.0](https://coreos.github.io/butane/config-flatcar-v1_1/) Butane Configs
+  * Render Ignition as Ignition spec [v3.4.0](https://coreos.github.io/ignition/configuration-v3_4/)
+
+## v0.10.0
+
+* Remove support for Ignition v0.35.0 (Ignition spec v2.x)
+* Remove support for Container Linux Configs (**action required**)
+  * Container Linux Configs were a YAML format that rendered to Ignition (spec v2.x)
+  * Flatcar Linux now supports Ignition v2 (spec v3.x)
+  * Butane is a suitable YAML format that renders Ignition v2 (spec v3.x)
+* Upgrade Ignition from v0.35.0 (spec v2.x) to v2.14.0 (spec v3.x)
+* Update Go version (v1.20.2) and alpine base image (v3.17.3)
+* Add limited support for Matchbox rendering Butane configs ([#997](https://github.com/poseidon/matchbox/pull/997)) ([docs](https://matchbox.psdn.io/ignition/#matchbox-rendering))
+* Recommend writing Butane via external tools (**action required**)
+  * For Terraform, use [poseidon/terraform-provider-ct](https://github.com/poseidon/terraform-provider-ct)
+  * For a CLI, use [`butane`](https://github.com/coreos/butane)
+* Parse Ignition and render forward to Ignition v2 (spec v3.3)
+  * Ignition is [forward](https://github.com/coreos/ignition/blob/main/config/v3_3/config.go#L61) compatible (e.g. a `v3.1` spec can be rendered as `v3.3` safely)
+
+If you still template Container Linux Configs via Matchbox, [migrate](https://www.flatcar.org/docs/latest/provisioning/config-transpiler/) to Butane by prepending:
+
+```yaml
+variant: flatcar
+version: 1.0.0
+```
+
 ## v0.9.1

 * Add dependabot Go module update automation ([#833](https://github.com/poseidon/matchbox/pull/833))
--- a/8
+++ b/8
@@ -1,9 +1,13 @@
-FROM docker.io/golang:1.18.4 AS builder
+FROM docker.io/golang:1.22.1 AS builder
 COPY . src
 RUN cd src && make build

-FROM docker.io/alpine:3.16.1
+FROM docker.io/alpine:3.19.1
 LABEL maintainer="Dalton Hubble <dghubble@gmail.com>"
+LABEL org.opencontainers.image.title="Matchbox",
+LABEL org.opencontainers.image.source="https://github.com/poseidon/matchbox"
+LABEL org.opencontainers.image.documentation="https://matchbox.psdn.io"
+LABEL org.opencontainers.image.vendor="Poseidon Labs"
 COPY --from=builder /go/src/bin/matchbox /matchbox
 EXPOSE 8080
 ENTRYPOINT ["/matchbox"]
--- a/50
+++ b/50
@@ -1,5 +1,4 @@
 export CGO_ENABLED:=0
-export GO111MODULE=on

 DIR := $(abspath $(dir $(lastword $(MAKEFILE_LIST))))
 VERSION=$(shell git describe --tags --match=v* --always --dirty)
@@ -10,13 +9,11 @@ LOCAL_REPO=poseidon/matchbox
 IMAGE_REPO=quay.io/poseidon/matchbox

 .PHONY: all
-all: build test vet lint fmt
+all: build test vet fmt

 .PHONY: build
-build: clean bin/matchbox
-
-bin/%:
-	@go build -o bin/$* -ldflags $(LD_FLAGS) $(REPO)/cmd/$*
+build:
+	@go build -o bin/matchbox -ldflags $(LD_FLAGS) $(REPO)/cmd/matchbox

 .PHONY: test
 test:
@@ -26,14 +23,14 @@ test:
 vet:
 	@go vet -all ./...

-.PHONY: lint
-lint:
-	@golint -set_exit_status `go list ./... | grep -v pb`
-
 .PHONY: fmt
 fmt:
 	@test -z $$(go fmt ./...)

+.PHONY: lint
+lint:
+	@golangci-lint run ./...
+
 .PHONY: image
 image: \
 	image-amd64 \
@@ -45,6 +42,21 @@ image-%:
 	--arch $* --override-arch $* \
 	--format=docker .

+push: \
+	push-amd64
+	push-arm64
+
+push-%:
+	buildah tag $(LOCAL_REPO):$(VERSION)-$* $(IMAGE_REPO):$(VERSION)-$*
+	buildah push --format v2s2 $(IMAGE_REPO):$(VERSION)-$*
+
+manifest:
+	buildah manifest create $(IMAGE_REPO):$(VERSION)
+	buildah manifest add $(IMAGE_REPO):$(VERSION) docker://$(IMAGE_REPO):$(VERSION)-amd64
+	buildah manifest add --variant v8 $(IMAGE_REPO):$(VERSION) docker://$(IMAGE_REPO):$(VERSION)-arm64
+	buildah manifest inspect $(IMAGE_REPO):$(VERSION)
+	buildah manifest push -f v2s2 $(IMAGE_REPO):$(VERSION) docker://$(IMAGE_REPO):$(VERSION)
+
 protoc/%:
 	podman run --security-opt label=disable \
 		-u root \
@@ -69,12 +81,14 @@ release: \
 	_output/matchbox-linux-amd64.tar.gz \
 	_output/matchbox-linux-arm.tar.gz \
 	_output/matchbox-linux-arm64.tar.gz \
-	_output/matchbox-darwin-amd64.tar.gz
+	_output/matchbox-darwin-amd64.tar.gz \
+	_output/matchbox-darwin-arm64.tar.gz

 bin/linux-amd64/matchbox: GOARGS = GOOS=linux GOARCH=amd64
 bin/linux-arm/matchbox: GOARGS = GOOS=linux GOARCH=arm GOARM=6
 bin/linux-arm64/matchbox: GOARGS = GOOS=linux GOARCH=arm64
 bin/darwin-amd64/matchbox: GOARGS = GOOS=darwin GOARCH=amd64
+bin/darwin-arm64/matchbox: GOARGS = GOOS=darwin GOARCH=arm64
 bin/linux-ppc64le/matchbox: GOARGS = GOOS=linux GOARCH=ppc64le

 bin/%/matchbox:
@@ -91,3 +105,17 @@ _output/matchbox-%.tar.gz: bin/%/matchbox
 .PHONY: all build clean test release
 .SECONDARY: _output/matchbox-linux-amd64 _output/matchbox-darwin-amd64

+release-sign:
+	gpg2 --armor --detach-sign _output/matchbox-$(VERSION)-linux-amd64.tar.gz
+	gpg2 --armor --detach-sign _output/matchbox-$(VERSION)-linux-arm.tar.gz
+	gpg2 --armor --detach-sign _output/matchbox-$(VERSION)-linux-arm64.tar.gz
+	gpg2 --armor --detach-sign _output/matchbox-$(VERSION)-darwin-amd64.tar.gz
+	gpg2 --armor --detach-sign _output/matchbox-$(VERSION)-darwin-arm64.tar.gz
+
+release-verify: NAME=_output/matchbox
+release-verify:
+	gpg2 --verify $(NAME)-$(VERSION)-linux-amd64.tar.gz.asc $(NAME)-$(VERSION)-linux-amd64.tar.gz
+	gpg2 --verify $(NAME)-$(VERSION)-linux-arm.tar.gz.asc $(NAME)-$(VERSION)-linux-arm.tar.gz
+	gpg2 --verify $(NAME)-$(VERSION)-linux-arm64.tar.gz.asc $(NAME)-$(VERSION)-linux-arm64.tar.gz
+	gpg2 --verify $(NAME)-$(VERSION)-darwin-amd64.tar.gz.asc $(NAME)-$(VERSION)-darwin-amd64.tar.gz
+	gpg2 --verify $(NAME)-$(VERSION)-darwin-arm64.tar.gz.asc $(NAME)-$(VERSION)-darwin-arm64.tar.gz
--- a/README.md
+++ b/README.md
@@ -1,6 +1,10 @@
 # matchbox
-
-[![GoDoc](https://pkg.go.dev/badge/github.com/poseidon/matchbox.svg)](https://pkg.go.dev/github.com/poseidon/matchbox) [![Quay](https://img.shields.io/badge/container-quay-green)](https://quay.io/repository/poseidon/matchbox) [![Workflow](https://github.com/poseidon/matchbox/actions/workflows/test.yaml/badge.svg)](https://github.com/poseidon/matchbox/actions/workflows/test.yaml?query=branch%3Amain) ![Downloads](https://img.shields.io/github/downloads/poseidon/matchbox/total) [![Sponsors](https://img.shields.io/github/sponsors/poseidon?logo=github)](https://github.com/sponsors/poseidon) [![Twitter](https://img.shields.io/badge/follow-news-1da1f2?logo=twitter)](https://twitter.com/poseidonlabs)
+[![GoDoc](https://pkg.go.dev/badge/github.com/poseidon/matchbox.svg)](https://pkg.go.dev/github.com/poseidon/matchbox)
+[![Quay](https://img.shields.io/badge/container-quay-green)](https://quay.io/repository/poseidon/matchbox)
+[![Workflow](https://github.com/poseidon/matchbox/actions/workflows/build.yaml/badge.svg)](https://github.com/poseidon/matchbox/actions/workflows/build.yaml?query=branch%3Amain)
+![Downloads](https://img.shields.io/github/downloads/poseidon/matchbox/total)
+[![Sponsors](https://img.shields.io/github/sponsors/poseidon?logo=github)](https://github.com/sponsors/poseidon)
+[![Mastodon](https://img.shields.io/badge/follow-news-6364ff?logo=mastodon)](https://fosstodon.org/@poseidon)

 `matchbox` is a service that matches bare-metal machines to profiles that PXE boot and provision clusters. Machines are matched by labels like MAC or UUID during PXE and profiles specify a kernel/initrd, iPXE config, and Ignition config.

--- a/contrib/k8s/deployment.yaml
+++ b/contrib/k8s/deployment.yaml
@@ -20,7 +20,7 @@ spec:
          type: RuntimeDefault
      containers:
        - name: matchbox
-          image: quay.io/poseidon/matchbox:v0.9.1
+          image: quay.io/poseidon/matchbox:v0.10.0
          env:
            - name: MATCHBOX_ADDRESS
              value: "0.0.0.0:8080"
--- a/docs/api-http.md
+++ b/docs/api-http.md
@@ -101,9 +101,9 @@ coreos:
      command: start
 ```

-## Container Linux Config / Ignition Config
+## Ignition Config

-Finds the profile matching the machine and renders the corresponding Ignition Config with group metadata, selectors, and query params.
+Finds the profile matching the machine and renders the corresponding Ignition for machine consumption.

 ```
 GET http://matchbox.foo/ignition?label=value
@@ -121,11 +121,11 @@ GET http://matchbox.foo/ignition?label=value

 ```json
 {
-  "ignition": { "version": "2.0.0" },
+  "ignition": { "version": "3.3.0" },
  "systemd": {
    "units": [{
      "name": "example.service",
-      "enable": true,
+      "enabled": true,
      "contents": "[Service]\nType=oneshot\nExecStart=/usr/bin/echo Hello World\n\n[Install]\nWantedBy=multi-user.target"
    }]
  }
--- a/docs/cloud-config.md
+++ b/docs/cloud-config.md
@@ -1,7 +1,7 @@
 # Cloud Config

 !!! warning
-    Migrate to [Container Linux Configs](container-linux-config.md). Cloud-Config support will be removed in the future.
+    Migrate to [Ignition configs](ignition.md). Cloud-Config support will be removed in the future.

 CoreOS Cloud-Config is a system for configuring machines with a Cloud-Config file or executable script from user-data. Cloud-Config runs in userspace on each boot and implements a subset of the [cloud-init spec](http://cloudinit.readthedocs.org/en/latest/topics/format.html#cloud-config-data). See the cloud-config [docs](https://coreos.com/os/docs/latest/cloud-config.html) for details.

--- a/docs/container-linux-config.md
+++ b/docs/container-linux-config.md
@@ -1,144 +0,0 @@
-# Container Linux Configs
-
-A Container Linux Config is a YAML document which declares how Container Linux instances' disks should be provisioned on network boot and first-boot from disk. Configs can declare disk partitions, write files (regular files, systemd units, networkd units, etc.), and configure users. See the Container Linux Config [spec](https://coreos.com/os/docs/latest/configuration.html).
-
-### Ignition
-
-Container Linux Configs are validated and converted to *machine-friendly* Ignition configs (JSON) by matchbox when serving to booting machines. [Ignition](https://coreos.com/ignition/docs/latest/), the provisioning utility shipped in Container Linux, will parse and execute the Ignition config to realize the desired configuration. Matchbox users usually only need to write Container Linux Configs.
-
-*Note: Container Linux directory names are still named "ignition" for historical reasons as outlined below. A future breaking change will rename to "container-linux-config".*
-
-## Adding Container Linux Configs
-
-Container Linux Config templates can be added to the `/var/lib/matchbox/ignition` directory or in an `ignition` subdirectory of a custom `-data-path`. Template files may contain [Go template](https://golang.org/pkg/text/template/) elements which will be evaluated with group metadata, selectors, and query params.
-
-```
-/var/lib/matchbox
- ├── cloud
- ├── ignition
- │   └── k8s-controller.yaml
- │   └── etcd.yaml
- │   └── k8s-worker.yaml
- │   └── raw.ign
- └── profiles
-```
-
-## Referencing in Profiles
-
-Profiles can include a Container Linux Config for provisioning machines. Specify the Container Linux Config in a [Profile](matchbox.md#profiles) with `ignition_id`. When PXE booting, use the kernel option `coreos.first_boot=1` and `coreos.config.url` to point to the `matchbox` [Ignition endpoint](api-http.md#ignition-config).
-
-## Examples
-
-Here is an example Container Linux Config template. Variables will be interpreted using group metadata, selectors, and query params. Matchbox will convert the config to Ignition to serve Container Linux machines.
-
-ignition/format-disk.yaml.tmpl:
-
-<!-- {% raw %} -->
-```yaml
-
---
-storage:
-  disks:
-    - device: /dev/sda
-      wipe_table: true
-      partitions:
-        - label: ROOT
-  filesystems:
-    - name: root
-      mount:
-        device: "/dev/sda1"
-        format: "ext4"
-        create:
-          force: true
-          options:
-            - "-LROOT"
-  files:
-    - filesystem: root
-      path: /home/core/foo
-      mode: 0644
-      user:
-        id: 500
-      group:
-        id: 500
-      contents:
-        inline: |
-          {{.example_contents}}
-{{ if index . "ssh_authorized_keys" }}
-passwd:
-  users:
-    - name: core
-      ssh_authorized_keys:
-        {{ range $element := .ssh_authorized_keys }}
-        - {{$element}}
-        {{end}}
-{{end}}
-```
-<!-- {% endraw %} -->
-
-The Ignition config response (formatted) to a query `/ignition?label=value` for a Container Linux instance supporting Ignition 2.0.0 would be:
-
-```json
-{
-  "ignition": {
-    "version": "2.0.0",
-    "config": {}
-  },
-  "storage": {
-    "disks": [
-      {
-        "device": "/dev/sda",
-        "wipeTable": true,
-        "partitions": [
-          {
-            "label": "ROOT",
-            "number": 0,
-            "size": 0,
-            "start": 0
-          }
-        ]
-      }
-    ],
-    "filesystems": [
-      {
-        "name": "root",
-        "mount": {
-          "device": "/dev/sda1",
-          "format": "ext4",
-          "create": {
-            "force": true,
-            "options": [
-              "-LROOT"
-            ]
-          }
-        }
-      }
-    ],
-    "files": [
-      {
-        "filesystem": "root",
-        "path": "/home/core/foo",
-        "contents": {
-          "source": "data:,Example%20file%20contents%0A",
-          "verification": {}
-        },
-        "mode": 420,
-        "user": {
-          "id": 500
-        },
-        "group": {
-          "id": 500
-        }
-      }
-    ]
-  },
-  "systemd": {},
-  "networkd": {},
-  "passwd": {}
-}
-```
-
-See [examples/ignition](../examples/ignition) for numerous Container Linux Config template examples.
-
-### Raw Ignition
-
-If you prefer to design your own templating solution, raw Ignition files (suffixed with `.ign` or `.ignition`) are served directly.
--- a/docs/deployment.md
+++ b/docs/deployment.md
@@ -17,23 +17,23 @@ Choose one of the supported installation options:
 Download the latest Matchbox [release](https://github.com/poseidon/matchbox/releases).

 ```sh
-$ wget https://github.com/poseidon/matchbox/releases/download/v0.9.1/matchbox-v0.9.1-linux-amd64.tar.gz
-$ wget https://github.com/poseidon/matchbox/releases/download/v0.9.1/matchbox-v0.9.1-linux-amd64.tar.gz.asc
+$ wget https://github.com/poseidon/matchbox/releases/download/v0.10.0/matchbox-v0.10.0-linux-amd64.tar.gz
+$ wget https://github.com/poseidon/matchbox/releases/download/v0.10.0/matchbox-v0.10.0-linux-amd64.tar.gz.asc
 ```

 Verify the release has been signed by Dalton Hubble's GPG [Key](https://keyserver.ubuntu.com/pks/lookup?search=0x8F515AD1602065C8&op=vindex)'s signing subkey.

 ```sh
 $ gpg --keyserver keyserver.ubuntu.com --recv-key 2E3D92BF07D9DDCCB3BAE4A48F515AD1602065C8
-$ gpg --verify matchbox-v0.9.1-linux-amd64.tar.gz.asc matchbox-v0.9.1-linux-amd64.tar.gz
+$ gpg --verify matchbox-v0.10.0-linux-amd64.tar.gz.asc matchbox-v0.10.0-linux-amd64.tar.gz
 gpg: Good signature from "Dalton Hubble <dghubble@gmail.com>"
 ```

 Untar the release.

 ```sh
-$ tar xzvf matchbox-v0.9.1-linux-amd64.tar.gz
-$ cd matchbox-v0.9.1-linux-amd64
+$ tar xzvf matchbox-v0.10.0-linux-amd64.tar.gz
+$ cd matchbox-v0.10.0-linux-amd64
 ```

 ## Install
@@ -110,14 +110,14 @@ Run the container image with Podman,

 ```
 mkdir -p /var/lib/matchbox/assets
-podman run --net=host --rm -v /var/lib/matchbox:/var/lib/matchbox:Z -v /etc/matchbox:/etc/matchbox:Z,ro quay.io/poseidon/matchbox:v0.9.1 -address=0.0.0.0:8080 -rpc-address=0.0.0.0:8081 -log-level=debug
+podman run --net=host --rm -v /var/lib/matchbox:/var/lib/matchbox:Z -v /etc/matchbox:/etc/matchbox:Z,ro quay.io/poseidon/matchbox:v0.10.0 -address=0.0.0.0:8080 -rpc-address=0.0.0.0:8081 -log-level=debug
 ```

 Or with Docker,

 ```
 mkdir -p /var/lib/matchbox/assets
-sudo docker run --net=host --rm -v /var/lib/matchbox:/var/lib/matchbox:Z -v /etc/matchbox:/etc/matchbox:Z,ro quay.io/poseidon/matchbox:v0.9.1 -address=0.0.0.0:8080 -rpc-address=0.0.0.0:8081 -log-level=debug
+sudo docker run --net=host --rm -v /var/lib/matchbox:/var/lib/matchbox:Z -v /etc/matchbox:/etc/matchbox:Z,ro quay.io/poseidon/matchbox:v0.10.0 -address=0.0.0.0:8080 -rpc-address=0.0.0.0:8081 -log-level=debug
 ```

 Create machine profiles, groups, or Ignition configs by adding files to `/var/lib/matchbox`.
@@ -247,7 +247,7 @@ Matchbox can serve OS images in development or lab environments to reduce bandwi
 Download a recent Fedora CoreOS or Flatcar Linux release.

 ```
-$ ./scripts/get-fedora-coreos stable 36.20220618.3.1 .
+$ ./scripts/get-fedora-coreos stable 36.20220906.3.2 .
 $ ./scripts/get-flatcar stable 3227.2.0 .
 ```

@@ -255,9 +255,9 @@ Move the images to `/var/lib/matchbox/assets`,

 ```
 /var/lib/matchbox/assets/fedora-coreos/
-├── fedora-coreos-36.20220618.3.1-live-initramfs.x86_64.img
-├── fedora-coreos-36.20220618.3.1-live-kernel-x86_64
-├── fedora-coreos-36.20220618.3.1-live-rootfs.x86_64.img
+├── fedora-coreos-36.20220906.3.2-live-initramfs.x86_64.img
+├── fedora-coreos-36.20220906.3.2-live-kernel-x86_64
+├── fedora-coreos-36.20220906.3.2-live-rootfs.x86_64.img

 /var/lib/matchbox/assets/flatcar/
 └── 3227.2.0
--- a/docs/dev/release.md
+++ b/docs/dev/release.md
@@ -8,7 +8,7 @@ This guide covers releasing new versions of matchbox.
 Create a release commit which updates old version references.

 ```sh
-$ export VERSION=v0.9.1
+$ export VERSION=v0.10.0
 ```

 ## Tag
@@ -18,7 +18,7 @@ Tag, sign the release version, and push it to Github.
 ```sh
 $ git tag -s vX.Y.Z -m 'vX.Y.Z'
 $ git push origin --tags
-$ git push origin master
+$ git push origin main
 ```

 ## Images
@@ -44,7 +44,7 @@ $ make release
 Verify the reported version.

 ```
-./_output/matchbox-v0.9.1-linux-amd64/matchbox -version
+./_output/matchbox-v0.10.0-linux-amd64/matchbox -version
 ```

 ## Signing
@@ -52,20 +52,13 @@ Verify the reported version.
 Release tarballs are signed by Dalton Hubble's GPG [Key](/docs/deployment.md#download)

 ```sh
-cd _output
-gpg2 --armor --detach-sign matchbox-$VERSION-linux-amd64.tar.gz
-gpg2 --armor --detach-sign matchbox-$VERSION-darwin-amd64.tar.gz
-gpg2 --armor --detach-sign matchbox-$VERSION-linux-arm.tar.gz
-gpg2 --armor --detach-sign matchbox-$VERSION-linux-arm64.tar.gz
+make release-sign
 ```

 Verify the signatures.

 ```sh
-gpg2 --verify matchbox-$VERSION-linux-amd64.tar.gz.asc matchbox-$VERSION-linux-amd64.tar.gz
-gpg2 --verify matchbox-$VERSION-darwin-amd64.tar.gz.asc matchbox-$VERSION-darwin-amd64.tar.gz
-gpg2 --verify matchbox-$VERSION-linux-arm.tar.gz.asc matchbox-$VERSION-linux-arm.tar.gz
-gpg2 --verify matchbox-$VERSION-linux-arm64.tar.gz.asc matchbox-$VERSION-linux-arm64.tar.gz
+make release-verify
 ```

 ## Publish
--- a/docs/getting-started-docker.md
+++ b/docs/getting-started-docker.md
@@ -29,7 +29,7 @@ $ cd matchbox
 Download Fedora CoreOS or Flatcar Linux image assets to `examples/assets`.

 ```sh
-$ ./scripts/get-fedora-coreos stable 36.20220618.3.1 ./examples/assets
+$ ./scripts/get-fedora-coreos stable 36.20220906.3.2 ./examples/assets
 $ ./scripts/get-flatcar stable 3227.2.0 ./examples/assets
 ```

--- a/docs/getting-started.md
+++ b/docs/getting-started.md
@@ -91,7 +91,7 @@ terraform {

 ### Profiles

-Machine profiles specify the kernel, initrd, kernel args, Ignition Config, and other configs (e.g. templated Container Linux Config, Cloud-config, generic) used to network boot and provision a bare-metal machine. The profile below would PXE boot machines using a Fedora CoreOS kernel and initrd (see [assets](api-http.md#assets) to learn about caching for speed), perform a disk install, reboot (first boot from disk), and use a [Fedora CoreOS Config](https://github.com/coreos/fcct/blob/master/docs/configuration-v1_1.md) to generate an Ignition config to provision.
+Machine profiles specify the kernel, initrd, kernel args, Ignition Config, or other configs (e.g. templated Butane Config, generic) used to network boot and provision a bare-metal machine. The profile below would PXE boot machines using a Fedora CoreOS kernel and initrd (see [assets](api-http.md#assets) to learn about caching for speed), perform a disk install, reboot (first boot from disk), and use a [Fedora CoreOS Config](https://github.com/coreos/fcct/blob/master/docs/configuration-v1_1.md) to generate an Ignition config to provision.

 ```tf
 // Fedora CoreOS profile
@@ -144,7 +144,7 @@ cp terraform.tfvars.example terraform.tfvars
 ```tf
 matchbox_http_endpoint = "http://matchbox.example.com:8080"
 matchbox_rpc_endpoint  = "matchbox.example.com:8081"
-os_version             = "36.20220618.3.1"
+os_version             = "36.20220906.3.2"
 ssh_authorized_key     = "YOUR_SSH_KEY"
 ```

--- a/docs/ignition.md
+++ b/docs/ignition.md
@@ -0,0 +1,160 @@
+# Ignition Configs
+
+[Ignition](https://coreos.github.io/ignition/) configs define how disks should be provisioned (on network boot and first-boot from disk) to partition disks, write files (regular files, systemd units, networkd units, etc.), and configure users. Ignition is used by:
+
+* Fedora CoreOS
+* RHEL CoreOS
+* Flatcar Linux
+
+See the Ignition Config v3.x [specs](https://coreos.github.io/ignition/specs/) for details.
+
+## Usage
+
+Ignition configs can be added to the `/var/lib/matchbox/ignition` directory or in an `ignition` subdirectory of a custom `-data-path`. Ignition configs must end in `.ign` or `ignition`.
+
+```
+/var/lib/matchbox
+ ├── ignition
+ │   └── k8s-controller.ign
+ │   └── k8s-worker.ign
+ └── profiles
+```
+
+Matchbox Profiles can set an Ignition config for provisioning machines. Specify the Ignition config in a [Profile](matchbox.md#profiles) with `ignition_id`.
+
+```json
+{
+  "id": "worker",
+  "name": "My Profile",
+  "boot": {
+    ...
+  },
+  "ignition_id": "my-ignition.ign"
+}
+```
+
+When PXE booting, set kernel arguments depending on the OS (e.g. `ignition.firstboot` on FCOS, `flatcar.first_boot=yes` on Flatcar).
+
+* [Fedora CoreOS](https://github.com/poseidon/matchbox/blob/main/examples/profiles/fedora-coreos.json)
+* [Flatcar Linux](https://github.com/poseidon/matchbox/blob/main/examples/profiles/flatcar.json)
+
+Point the `ignition.config.url` or `flatcar.config.url` to point to the `matchbox` [Ignition endpoint](api-http.md#ignition-config).
+
+Matchbox parses Ignition configs (e.g. `.ign` or `.ignition`) at spec v3.3 or below and renders to the current supported version (v3.3). This relies on Ignition's [forward compatibility](https://github.com/coreos/ignition/blob/main/config/v3_3/config.go#L61).
+
+## Writing Configs
+
+Ignition configs can be prepared externally and loaded via the gRPC API, rather than writing Ignition by hand.
+
+### Terraform
+
+Terraform can be used to prepare Ignition configs, while providing integrations with external systems and rich templating. Using tools like [poseidon/terraform-provider-ct](https://github.com/poseidon/terraform-provider-ct), you can write Butane config (an easier YAML format), validate configs, and load Ignition into Matchbox ([examples](https://github.com/poseidon/matchbox/tree/main/examples/terraform)).
+
+Define a Butane config for Fedora CoreOS or Flatcar Linux:
+
+```yaml
+variant: fcos
+version: 1.5.0
+passwd:
+  users:
+    - name: core
+      ssh_authorized_keys:
+        - ssh-key foo
+```
+
+```yaml
+variant: flatcar
+version: 1.1.0
+passwd:
+  users:
+    - name: core
+      ssh_authorized_keys:
+        - ssh-key foo
+```
+
+Define a `ct_config` data source with strict validation. Optionally use Terraform [templating](https://github.com/poseidon/terraform-provider-ct).
+
+```tf
+data "ct_config" "worker" {
+  content      = file("worker.yaml")
+  strict       = true
+  pretty_print = false
+
+  snippets = [
+    file("units.yaml"),
+    file("storage.yaml"),
+  ]
+}
+```
+
+Then render the Butane config to Ignition and use it in a Matchbox Profile.
+
+```tf
+resource "matchbox_profile" "fedora-coreos-install" {
+  name   = "worker"
+  kernel = "/assets/fedora-coreos/fedora-coreos-${var.os_version}-live-kernel-x86_64"
+  initrd = [
+    "--name main /assets/fedora-coreos/fedora-coreos-${var.os_version}-live-initramfs.x86_64.img"
+  ]
+
+  args = [
+    "initrd=main",
+    "coreos.live.rootfs_url=${var.matchbox_http_endpoint}/assets/fedora-coreos/fedora-coreos-${var.os_version}-live-rootfs.x86_64.img",
+    "coreos.inst.install_dev=/dev/vda",
+    "coreos.inst.ignition_url=${var.matchbox_http_endpoint}/ignition?uuid=$${uuid}&mac=$${mac:hexhyp}",
+  ]
+
+  raw_ignition = data.ct_config.worker.rendered
+}
+```
+
+See the Terraform [examples](https://github.com/poseidon/matchbox/tree/main/examples#terraform-examples) for details.
+
+### Butane
+
+The [Butane](https://coreos.github.io/butane/) command line tool can be used to convert Butane configs (an easier YAML format) to Ignition. Then you can use the Matchbox gRPC API to upload the rendered Ignition to Matchbox for serving to machines on boot.
+
+See [examples/ignition](../examples/ignition) for Butane config examples.
+
+### Matchbox Rendering
+
+While Matchbox recommends preparing Ignition configs externally (e.g. using Terraform's rich templating), Matchbox does still support limited templating and translation features with a builtin Butane converter.
+
+Specify a Butane config in a [Profile](matchbox.md#profiles) with `ignition_id` (file must not end in `.ign` or `.ignition`).
+
+```json
+{
+  "id": "worker",
+  "name": "My Profile",
+  "boot": {
+    ...
+  },
+  "ignition_id": "butane.yaml"
+}
+```
+
+Here is an example Butane config with Matchbox template elements. Template files may contain [Go template](https://golang.org/pkg/text/template/) elements which will be interpreted using group metadata, selectors, and query params.
+
+```yaml
+variant: flatcar
+version: 1.1.0
+storage:
+  files:
+    - path: /var/home/core/foo
+      mode: 0644
+      contents:
+        inline: |
+          {{.example_contents}}
+
+{{ if index . "ssh_authorized_keys" }}
+passwd:
+  users:
+    - name: core
+      ssh_authorized_keys:
+        {{ range $element := .ssh_authorized_keys }}
+        - {{$element}}
+        {{end}}
+{{end}}
+```
+
+Matchbox will use the Butane library to config to the current supported Ignition version. This relies on Ignition's [forward compatibility](https://github.com/coreos/ignition/blob/main/config/v3_3/config.go#L61).
--- a/docs/matchbox.md
+++ b/docs/matchbox.md
@@ -33,9 +33,9 @@ Prepare `/var/lib/matchbox` with `groups`, `profile`, `ignition`, `cloud`, and `
 │   ├── cloud.yaml.tmpl
 │   └── worker.sh.tmpl
 ├── ignition
- │   └── raw.ign
- │   └── etcd.yaml.tmpl
- │   └── simple.yaml.tmpl
+ │   └── worker.ign
+ │   └── butane.yaml.tmpl
+ │   └── butane.yaml
 ├── generic
 │   └── config.yaml
 │   └── setup.cfg
@@ -53,14 +53,14 @@ The [examples](../examples) directory is a valid data directory with some pre-de

 ### Profiles

-Profiles reference an Ignition config, Cloud-Config, and/or generic config by name and define network boot settings.
+Profiles reference an Ignition config, Butane Config, Cloud-Config, and/or generic config by name and define network boot settings.

 ```json
 {
  "id": "etcd",
  "name": "Container Linux with etcd2",
  "cloud_id": "",
-  "ignition_id": "etcd.yaml",
+  "ignition_id": "worker.ign",
  "generic_id": "some-service.cfg",
  "boot": {
    "kernel": "/assets/coreos/1967.3.0/coreos_production_pxe.vmlinuz",
@@ -128,16 +128,16 @@ Group selectors can use any key/value pairs you find useful. However, several la

 ### Config templates

-Profiles can reference various templated configs. Ignition JSON configs can be generated from [Container Linux Config](https://github.com/coreos/container-linux-config-transpiler/blob/master/doc/configuration.md) template files. Cloud-Config templates files can be used to render a script or Cloud-Config. Generic template files can be used to render arbitrary untyped configs (experimental). Each template may contain [Go template](https://golang.org/pkg/text/template/) elements which will be rendered with machine group metadata, selectors, and query params.
+Profiles can reference various templated configs. Ignition configs can be provided directly or rendered fro [Butane Config](https://coreos.github.io/butane/) template files. Cloud-Config templates files can be used to render a script or Cloud-Config. Generic template files can be used to render arbitrary untyped configs (experimental). Each template may contain [Go template](https://golang.org/pkg/text/template/) elements which will be rendered with machine group metadata, selectors, and query params.

 For details and examples:

-* [Container Linux Config](container-linux-config.md)
+* [Ignition (or Butane)](ignition.md)
 * [Cloud-Config](cloud-config.md)

 #### Variables

-Within Container Linux Config templates, Cloud-Config templates, or generic templates, you can use group metadata, selectors, or request-scoped query params. For example, a request `/generic?mac=52-54-00-89-d8-10&foo=some-param&bar=b` would match the `node1.json` machine group shown above. If the group's profile ("etcd") referenced a generic template, the following variables could be used.
+Within Butane Config templates, Cloud-Config templates, or generic templates, you can use group metadata, selectors, or request-scoped query params. For example, a request `/generic?mac=52-54-00-89-d8-10&foo=some-param&bar=b` would match the `node1.json` machine group shown above. If the group's profile ("etcd") referenced a generic template, the following variables could be used.

 <!-- {% raw %} -->
 ```
--- a/examples/README.md
+++ b/examples/README.md
@@ -32,7 +32,7 @@ For Fedora CoreOS, add an SSH authorized key to the Butane Config (`ignition/fed

 ```yaml
 variant: fcos
-version: 1.4.0
+version: 1.5.0
 passwd:
  users:
    - name: core
@@ -48,7 +48,7 @@ For Flatcar Linux, add an SSH authorized key to the Butane config (`ignition/fla

 ```yaml
 variant: flatcar
-version: 1.0.0
+version: 1.1.0
 passwd:
  users:
    - name: core
--- a/examples/ignition/fedora-coreos.ign
+++ b/examples/ignition/fedora-coreos.ign
@@ -1,6 +1,6 @@
 {
  "ignition": {
-    "version": "3.3.0"
+    "version": "3.4.0"
  },
  "passwd": {
    "users": [
--- a/examples/ignition/fedora-coreos.yaml
+++ b/examples/ignition/fedora-coreos.yaml
@@ -1,5 +1,5 @@
 variant: fcos
-version: 1.4.0
+version: 1.5.0
 passwd:
  users:
    - name: core
--- a/examples/ignition/flatcar-install.ign
+++ b/examples/ignition/flatcar-install.ign
@@ -1,6 +1,6 @@
 {
  "ignition": {
-    "version": "3.3.0"
+    "version": "3.4.0"
  },
  "passwd": {
    "users": [
--- a/examples/ignition/flatcar-install.yaml
+++ b/examples/ignition/flatcar-install.yaml
@@ -1,6 +1,6 @@
 ---
 variant: flatcar
-version: 1.0.0
+version: 1.1.0
 systemd:
  units:
    - name: installer.service
--- a/examples/ignition/flatcar.ign
+++ b/examples/ignition/flatcar.ign
@@ -1,6 +1,6 @@
 {
  "ignition": {
-    "version": "3.3.0"
+    "version": "3.4.0"
  },
  "passwd": {
    "users": [
--- a/examples/ignition/flatcar.yaml
+++ b/examples/ignition/flatcar.yaml
@@ -1,5 +1,5 @@
 variant: flatcar
-version: 1.0.0
+version: 1.1.0
 passwd:
  users:
    - name: core
--- a/examples/profiles/fedora-coreos-install.json
+++ b/examples/profiles/fedora-coreos-install.json
@@ -2,15 +2,15 @@
  "id": "fedora-coreos-install",
  "name": "Fedora CoreOS install to disk",
  "boot": {
-    "kernel": "/assets/fedora-coreos/fedora-coreos-36.20220618.3.1-live-kernel-x86_64",
+    "kernel": "/assets/fedora-coreos/fedora-coreos-36.20220906.3.2-live-kernel-x86_64",
    "initrd": [
-      "--name main /assets/fedora-coreos/fedora-coreos-36.20220618.3.1-live-initramfs.x86_64.img"
+      "--name main /assets/fedora-coreos/fedora-coreos-36.20220906.3.2-live-initramfs.x86_64.img"
    ],
    "args": [
      "initrd=main",
-      "coreos.live.rootfs_url=http://matchbox.example.com:8080/assets/fedora-coreos/fedora-coreos-36.20220618.3.1-live-rootfs.x86_64.img",
+      "coreos.live.rootfs_url=http://matchbox.example.com:8080/assets/fedora-coreos/fedora-coreos-36.20220906.3.2-live-rootfs.x86_64.img",
      "coreos.inst.install_dev=/dev/vda",
-      "coreos.inst.ignition_url=http://matchbox.example.com:8080/ignition?uuid=$${uuid}&mac=$${mac:hexhyp}"
+      "coreos.inst.ignition_url=http://matchbox.example.com:8080/ignition?uuid=${uuid}&mac=${mac:hexhyp}"
    ]
  },
  "ignition_id": "fedora-coreos.ign"
--- a/examples/profiles/fedora-coreos.json
+++ b/examples/profiles/fedora-coreos.json
@@ -2,13 +2,13 @@
  "id": "fedora-coreos",
  "name": "Fedora CoreOS",
  "boot": {
-    "kernel": "/assets/fedora-coreos/fedora-coreos-36.20220618.3.1-live-kernel-x86_64",
+    "kernel": "/assets/fedora-coreos/fedora-coreos-36.20220906.3.2-live-kernel-x86_64",
    "initrd": [
-      "--name main /assets/fedora-coreos/fedora-coreos-36.20220618.3.1-live-initramfs.x86_64.img"
+      "--name main /assets/fedora-coreos/fedora-coreos-36.20220906.3.2-live-initramfs.x86_64.img"
    ],
    "args": [
      "initrd=main",
-      "coreos.live.rootfs_url=http://matchbox.example.com:8080/assets/fedora-coreos/fedora-coreos-36.20220618.3.1-live-rootfs.x86_64.img",
+      "coreos.live.rootfs_url=http://matchbox.example.com:8080/assets/fedora-coreos/fedora-coreos-36.20220906.3.2-live-rootfs.x86_64.img",
      "ignition.firstboot",
      "ignition.platform.id=metal",
      "ignition.config.url=http://matchbox.example.com:8080/ignition?uuid=${uuid}&mac=${mac:hexhyp}"
--- a/examples/terraform/fedora-coreos-install/fcc/fedora-coreos.yaml
+++ b/examples/terraform/fedora-coreos-install/fcc/fedora-coreos.yaml
@@ -1,5 +1,5 @@
 variant: fcos
-version: 1.4.0
+version: 1.5.0
 passwd:
  users:
    - name: core
--- a/examples/terraform/fedora-coreos-install/terraform.tfvars.example
+++ b/examples/terraform/fedora-coreos-install/terraform.tfvars.example
@@ -1,4 +1,4 @@
 matchbox_http_endpoint = "http://matchbox.example.com:8080"
 matchbox_rpc_endpoint = "matchbox.example.com:8081"
-os_version = "36.20220618.3.1"
+os_version = "36.20220906.3.2"
 ssh_authorized_key = "YOUR_SSH_KEY"
--- a/examples/terraform/fedora-coreos-install/variables.tf
+++ b/examples/terraform/fedora-coreos-install/variables.tf
@@ -16,7 +16,7 @@ variable "os_stream" {

 variable "os_version" {
  type        = string
-  description = "Fedora CoreOS version to PXE and install (e.g. 36.20220618.3.1)"
+  description = "Fedora CoreOS version to PXE and install (e.g. 36.20220906.3.2)"
 }

 variable "ssh_authorized_key" {
--- a/examples/terraform/flatcar-install/butane/flatcar-install.yaml
+++ b/examples/terraform/flatcar-install/butane/flatcar-install.yaml
@@ -1,6 +1,6 @@
 ---
 variant: flatcar
-version: 1.0.0
+version: 1.1.0
 systemd:
  units:
    - name: installer.service
--- a/examples/terraform/flatcar-install/butane/flatcar.yaml
+++ b/examples/terraform/flatcar-install/butane/flatcar.yaml
@@ -1,6 +1,6 @@
 ---
 variant: flatcar
-version: 1.0.0
+version: 1.1.0
 passwd:
  users:
    - name: core
--- a/go.mod
+++ b/go.mod
@@ -1,29 +1,41 @@
 module github.com/poseidon/matchbox

-go 1.16
+go 1.19

 require (
-	github.com/ajeddeloh/go-json v0.0.0-20160803184958-73d058cf8437 // indirect
-	github.com/ajeddeloh/yaml v0.0.0-20170912190910-6b94386aeefd // indirect
-	github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4 // indirect
-	github.com/coreos/container-linux-config-transpiler v0.9.0
+	github.com/coreos/butane v0.20.0
 	github.com/coreos/coreos-cloudinit v1.14.0
-	github.com/coreos/go-semver v0.3.0 // indirect
-	github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e // indirect
-	github.com/coreos/ignition v0.35.0
-	github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f
-	github.com/coreos/yaml v0.0.0-20141224210557-6b16a5714269 // indirect
-	github.com/golang/protobuf v1.5.2
-	github.com/kr/pretty v0.2.0 // indirect
-	github.com/sirupsen/logrus v1.9.0
-	github.com/spf13/cobra v1.5.0
-	github.com/stretchr/testify v1.8.0
-	github.com/vincent-petithory/dataurl v0.0.0-20160330182126-9a301d65acbb // indirect
-	go4.org v0.0.0-20160314031811-03efcb870d84 // indirect
-	golang.org/x/crypto v0.0.0-20210817164053-32db794688a5
-	golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d
-	golang.org/x/text v0.3.7 // indirect
-	google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa // indirect
-	google.golang.org/grpc v1.48.0
-	gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
+	github.com/coreos/ignition/v2 v2.18.0
+	github.com/coreos/pkg v0.0.0-20220810130054-c7d1c02cb6cf
+	github.com/golang/protobuf v1.5.4
+	github.com/sirupsen/logrus v1.9.3
+	github.com/spf13/cobra v1.8.0
+	github.com/stretchr/testify v1.9.0
+	golang.org/x/crypto v0.21.0
+	golang.org/x/net v0.22.0
+	google.golang.org/grpc v1.62.1
 )
+
+require (
+	github.com/aws/aws-sdk-go v1.50.25 // indirect
+	github.com/clarketm/json v1.17.1 // indirect
+	github.com/coreos/go-json v0.0.0-20230131223807-18775e0fb4fb // indirect
+	github.com/coreos/go-semver v0.3.1 // indirect
+	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
+	github.com/coreos/vcontext v0.0.0-20230201181013-d72178a18687 // indirect
+	github.com/coreos/yaml v0.0.0-20141224210557-6b16a5714269 // indirect
+	github.com/davecgh/go-spew v1.1.1 // indirect
+	github.com/inconshreveable/mousetrap v1.1.0 // indirect
+	github.com/kr/text v0.2.0 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
+	github.com/rogpeppe/go-internal v1.9.0 // indirect
+	github.com/spf13/pflag v1.0.6-0.20210604193023-d5e0c0615ace // indirect
+	github.com/vincent-petithory/dataurl v1.0.0 // indirect
+	golang.org/x/sys v0.18.0 // indirect
+	golang.org/x/text v0.14.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20240213162025-012b6fc9bca9 // indirect
+	google.golang.org/protobuf v1.33.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)
+
+replace gopkg.in/yaml.v2 => gopkg.in/yaml.v2 v2.4.0
--- a/go.sum
+++ b/go.sum
@@ -1,201 +1,74 @@
-cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw=
-github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU=
-github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU=
-github.com/ajeddeloh/go-json v0.0.0-20160803184958-73d058cf8437 h1:gZCtZ+Hh/e3CGEX8q/yAcp8wWu5ZS6NMk6VGzpQhI3s=
-github.com/ajeddeloh/go-json v0.0.0-20160803184958-73d058cf8437/go.mod h1:otnto4/Icqn88WCcM4bhIJNSgsh9VLBuspyyCfvof9c=
-github.com/ajeddeloh/yaml v0.0.0-20170912190910-6b94386aeefd h1:NlKlOv3aVJ5ODMC0JWPvddw05KENkL3cZttIuu8kJRo=
-github.com/ajeddeloh/yaml v0.0.0-20170912190910-6b94386aeefd/go.mod h1:idhzw68Q7v4j+rQ2AGyq3OlZW2Jij9mdmGA4/Sk6J0E=
-github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4 h1:Hs82Z41s6SdL1CELW+XaDYmOH4hkBN4/N9og/AsOv7E=
-github.com/alecthomas/units v0.0.0-20190717042225-c3de453c63f4/go.mod h1:ybxpYRFXyAe+OPACYpWeL0wqObRcbAqCMya13uyzqw0=
-github.com/antihax/optional v1.0.0/go.mod h1:uupD/76wgC+ih3iEmQUL+0Ugr19nfwCT1kdvxnR2qWY=
-github.com/census-instrumentation/opencensus-proto v0.2.1/go.mod h1:f6KPmirojxKA12rnyqOA5BBL4O983OfeGPqjHWSTneU=
-github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
-github.com/cespare/xxhash/v2 v2.1.1/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
-github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
-github.com/cncf/udpa/go v0.0.0-20201120205902-5459f2c99403/go.mod h1:WmhPx2Nbnhtbo57+VJT5O0JRkEi1Wbu0z5j0R8u5Hbk=
-github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4/go.mod h1:6pvJx4me5XPnfI9Z40ddWsdw2W/uZgQLFXToKeRcDiI=
-github.com/cncf/xds/go v0.0.0-20210312221358-fbca930ec8ed/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20210922020428-25de7278fc84/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211001041855-01bcc9b48dfe/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1/go.mod h1:eXthEFrGJvWHgFFCl3hGmgk+/aYT6PnTQLykKQRLhEs=
-github.com/coreos/container-linux-config-transpiler v0.9.0 h1:UBGpT8qWqzi48hNLrzMAgAUNJsR0LW8Gk5/dR/caI8U=
-github.com/coreos/container-linux-config-transpiler v0.9.0/go.mod h1:SlcxXZQ2c42knj8pezMiQsM1f+ADxFMjGetuMKR/YSQ=
+github.com/aws/aws-sdk-go v1.50.25 h1:vhiHtLYybv1Nhx3Kv18BBC6L0aPJHaG9aeEsr92W99c=
+github.com/aws/aws-sdk-go v1.50.25/go.mod h1:LF8svs817+Nz+DmiMQKTO3ubZ/6IaTpq3TjupRn3Eqk=
+github.com/clarketm/json v1.17.1 h1:U1IxjqJkJ7bRK4L6dyphmoO840P6bdhPdbbLySourqI=
+github.com/clarketm/json v1.17.1/go.mod h1:ynr2LRfb0fQU34l07csRNBTcivjySLLiY1YzQqKVfdo=
+github.com/coreos/butane v0.20.0 h1:lKdyBDazlM5cenywmAT6Fcwp5B2rVeYtIqZDSbYu3MA=
+github.com/coreos/butane v0.20.0/go.mod h1:JPxQB/3omxqSg1ZWAOg5x3aslzx4nDvmb7Wyv8gC150=
 github.com/coreos/coreos-cloudinit v1.14.0 h1:3bQRJaie3QC8EovAVbxiimLQgdxM6DxP1vJfUCEEl9w=
 github.com/coreos/coreos-cloudinit v1.14.0/go.mod h1:hV3swhSwq+bRX5apuk57gG+3fsQacgbrZVxjPTqo0zo=
-github.com/coreos/go-semver v0.3.0 h1:wkHLiw0WNATZnSG7epLsujiMCgPAc9xhjJ4tgnAxmfM=
-github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
-github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e h1:Wf6HqHfScWJN9/ZjdUKyjop4mf3Qdd+1TvvltAvM3m8=
-github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e/go.mod h1:F5haX7vjVVG0kc13fIWeqUViNPyEJxv/OmvnBo0Yme4=
-github.com/coreos/ignition v0.35.0 h1:UFodoYq1mOPrbEjtxIsZbThcDyQwAI1owczRDqWmKkQ=
-github.com/coreos/ignition v0.35.0/go.mod h1:WJQapxzEn9DE0ryxsGvm8QnBajm/XsS/PkrDqSpz+bA=
-github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f h1:lBNOc5arjvs8E5mO2tbpBpLoyyu8B6e44T7hJy6potg=
-github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
+github.com/coreos/go-json v0.0.0-20230131223807-18775e0fb4fb h1:rmqyI19j3Z/74bIRhuC59RB442rXUazKNueVpfJPxg4=
+github.com/coreos/go-json v0.0.0-20230131223807-18775e0fb4fb/go.mod h1:rcFZM3uxVvdyNmsAV2jopgPD1cs5SPWJWU5dOz2LUnw=
+github.com/coreos/go-semver v0.3.1 h1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=
+github.com/coreos/go-semver v0.3.1/go.mod h1:irMmmIw/7yzSRPWryHsK7EYSg09caPQL03VsM8rvUec=
+github.com/coreos/go-systemd/v22 v22.5.0 h1:RrqgGjYQKalulkV8NGVIfkXQf6YYmOyiJKk8iXXhfZs=
+github.com/coreos/go-systemd/v22 v22.5.0/go.mod h1:Y58oyj3AT4RCenI/lSvhwexgC+NSVTIJ3seZv2GcEnc=
+github.com/coreos/ignition/v2 v2.18.0 h1:sPSGGsxaCuFMpKOMBQ71I9RIR20SIF4dWnoTomcPEYQ=
+github.com/coreos/ignition/v2 v2.18.0/go.mod h1:TURPHDqWUWTmej8c+CEMBENMU3N/Lt6GfreHJuoDMbA=
+github.com/coreos/pkg v0.0.0-20220810130054-c7d1c02cb6cf h1:GOPo6vn/vTN+3IwZBvXX0y5doJfSC7My0cdzelyOCsQ=
+github.com/coreos/pkg v0.0.0-20220810130054-c7d1c02cb6cf/go.mod h1:E3G3o1h8I7cfcXa63jLwjI0eiQQMgzzUDFVpN/nH/eA=
+github.com/coreos/vcontext v0.0.0-20230201181013-d72178a18687 h1:uSmlDgJGbUB0bwQBcZomBTottKwEDF5fF8UjSwKSzWM=
+github.com/coreos/vcontext v0.0.0-20230201181013-d72178a18687/go.mod h1:Salmysdw7DAVuobBW/LwsKKgpyCPHUhjyJoMJD+ZJiI=
 github.com/coreos/yaml v0.0.0-20141224210557-6b16a5714269 h1:/1sjrpK5Mb6IwyFOKd+u7321tXfNAsj0Ci8CivZmSlo=
 github.com/coreos/yaml v0.0.0-20141224210557-6b16a5714269/go.mod h1:Bl1D/T9QJhVdu6eFoLrGxN90+admDLGaLz2HXH/VzDc=
-github.com/cpuguy83/go-md2man/v2 v2.0.2/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/cpuguy83/go-md2man/v2 v2.0.3/go.mod h1:tgQtvFlXSQOSOSIRvRPT7W67SCa46tRHOmNcaadrF8o=
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/envoyproxy/go-control-plane v0.9.0/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.1-0.20191026205805-5f8ba28d4473/go.mod h1:YTl/9mNaCwkRvm6d1a2C3ymFceY/DCBVvsKhRF0iEA4=
-github.com/envoyproxy/go-control-plane v0.9.4/go.mod h1:6rpuAdCZL397s3pYoYcLgu1mIlRU8Am5FuJP05cCM98=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20201210154907-fd9021fe5dad/go.mod h1:cXg6YxExXjJnVBQHBLXeUAgxn2UodCpnH306RInaBQk=
-github.com/envoyproxy/go-control-plane v0.9.9-0.20210512163311-63b5d3c536b0/go.mod h1:hliV/p42l8fGbc6Y9bQ70uLwIvmJyVE5k4iMKlh8wCQ=
-github.com/envoyproxy/go-control-plane v0.10.2-0.20220325020618-49ff273808a1/go.mod h1:KJwIaB5Mv44NWtYuAOFCVOjcI94vtpEz2JU/D2v6IjE=
-github.com/envoyproxy/protoc-gen-validate v0.1.0/go.mod h1:iSmxcyjqTsJpI2R4NaDN7+kN2VEUnK/pcBlmesArF7c=
-github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2rRYeMEF04=
-github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b/go.mod h1:SBH7ygxi8pfUlaOkMMuAQtPIUF8ecWP5IEl/CR7VP2Q=
-github.com/golang/mock v1.1.1/go.mod h1:oTYuIxOrZwtPieC+H1uAHpcLFnEyAGVDL/k47Jfbm0A=
-github.com/golang/protobuf v1.2.0/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.2/go.mod h1:6lQm79b+lXiMfvg/cZm0SGofjICqVBUtrP5yJMmIC1U=
-github.com/golang/protobuf v1.3.3/go.mod h1:vzj43D7+SQXF/4pzW/hwtAqwc6iTitCiVSaWz5lYuqw=
-github.com/golang/protobuf v1.4.0-rc.1/go.mod h1:ceaxUfeHdC40wWswd/P6IGgMaK3YpKi5j83Wpe3EHw8=
-github.com/golang/protobuf v1.4.0-rc.1.0.20200221234624-67d41d38c208/go.mod h1:xKAWHe0F5eneWXFV3EuXVDTCmh+JuBKY0li0aMyXATA=
-github.com/golang/protobuf v1.4.0-rc.2/go.mod h1:LlEzMj4AhA7rCAGe4KMBDvJI+AwstrUpVNzEA03Pprs=
-github.com/golang/protobuf v1.4.0-rc.4.0.20200313231945-b860323f09d0/go.mod h1:WU3c8KckQ9AFe+yFwt9sWVRKCVIyN9cPHBJSNnbL67w=
-github.com/golang/protobuf v1.4.0/go.mod h1:jodUvKwWbYaEsadDk5Fwe5c77LiNKVO9IDvqG2KuDX0=
-github.com/golang/protobuf v1.4.1/go.mod h1:U8fpvMrcmy5pZrNK1lt4xCsGvpyWQ/VVv6QDs8UjoX8=
-github.com/golang/protobuf v1.4.2/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.4.3/go.mod h1:oDoupMAO8OvCJWAcko0GGGIgR6R6ocIYbsSw735rRwI=
-github.com/golang/protobuf v1.5.0/go.mod h1:FsONVRAS9T7sI+LIUmWTfcYkHO4aIWwzhcaSAoJOfIk=
-github.com/golang/protobuf v1.5.2 h1:ROPKBNFfQgOUMifHyP+KYbvpjbdoFNs+aK7DXlji0Tw=
-github.com/golang/protobuf v1.5.2/go.mod h1:XVQd3VNwM+JqD3oG2Ue2ip4fOMUkwXdXDdiuN0vRsmY=
-github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
-github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
-github.com/google/go-cmp v0.4.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.0/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.5/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/go-cmp v0.5.6 h1:BKbKCqvP6I+rmFHt06ZmyQtvB8xAkWdhFyr0ZUNZcxQ=
-github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE=
-github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/grpc-ecosystem/grpc-gateway v1.16.0/go.mod h1:BDjrQk3hbvj6Nolgz8mAMFbcEtjT1g+wF4CSlocrBnw=
-github.com/inconshreveable/mousetrap v1.0.0 h1:Z8tu5sraLXCXIcARxBp/8cbvlwVa7Z1NHg9XEKhtSvM=
-github.com/inconshreveable/mousetrap v1.0.0/go.mod h1:PxqpIevigyE2G7u3NXJIT2ANytuPF1OarO4DADm73n8=
-github.com/kr/pretty v0.2.0 h1:s5hAObm+yFO5uHYt5dYjxi2rXrsnmRpJx4OYvIWUaQs=
-github.com/kr/pretty v0.2.0/go.mod h1:ipq/a2n7PKx3OHsz4KJII5eveXtPO4qwEXGdVfWzfnI=
-github.com/kr/pty v1.1.1/go.mod h1:pFQYn66WHrOpPYNljwOMqo10TkYh1fy3cYio2l3bCsQ=
-github.com/kr/text v0.1.0 h1:45sCR5RtlFHMR4UwH9sdQ5TC8v0qDQCHnXt+kaKSTVE=
-github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
+github.com/godbus/dbus/v5 v5.0.4/go.mod h1:xhWf0FNVPg57R7Z0UbKHbJfkEywrmjJnf7w5xrFpKfA=
+github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=
+github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
+github.com/google/go-cmp v0.6.0 h1:ofyhxvXcZhMsU5ulbFiLKl/XBFqE1GSq7atu8tAmTRI=
+github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
+github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_model v0.0.0-20190812154241-14fe0d1b01d4/go.mod h1:xMI15A0UPsDsEKsMN9yxemIoYk6Tm2C1GtYGdfGttqA=
-github.com/rogpeppe/fastuuid v1.2.0/go.mod h1:jVj6XXZzXRy/MSR5jhDC/2q6DgLz+nrA6LYCDYWNEvQ=
+github.com/rogpeppe/go-internal v1.9.0 h1:73kH8U+JUqXU8lRuOHeVHaa/SZPifC7BkcraZVejAe8=
+github.com/rogpeppe/go-internal v1.9.0/go.mod h1:WtVeX8xhTBvf0smdhujwtBcq4Qrzq/fJaraNFVN+nFs=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/sirupsen/logrus v1.9.0 h1:trlNQbNUG3OdDrDil03MCb1H2o9nJ1x4/5LYw7byDE0=
-github.com/sirupsen/logrus v1.9.0/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
-github.com/spaolacci/murmur3 v0.0.0-20180118202830-f09979ecbc72/go.mod h1:JwIasOWyU6f++ZhiEuf87xNszmSA2myDM2Kzu9HwQUA=
-github.com/spf13/cobra v1.5.0 h1:X+jTBEBqF0bHN+9cSMgmfuvv2VHJ9ezmFNf9Y/XstYU=
-github.com/spf13/cobra v1.5.0/go.mod h1:dWXEIy2H428czQCjInthrTRUg7yKbok+2Qi/yBIJoUM=
-github.com/spf13/pflag v1.0.5 h1:iy+VFUOCP1a+8yFto/drg2CJ5u0yRoB7fZw3DKv/JXA=
+github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
+github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=
+github.com/spf13/cobra v1.8.0 h1:7aJaZx1B85qltLMc546zn58BxxfZdR/W22ej9CFoEf0=
+github.com/spf13/cobra v1.8.0/go.mod h1:WXLWApfZ71AjXPya3WOlMsY9yMs7YeiHhFVlvLyhcho=
 github.com/spf13/pflag v1.0.5/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
+github.com/spf13/pflag v1.0.6-0.20210604193023-d5e0c0615ace h1:9PNP1jnUjRhfmGMlkXHjYPishpcw4jpSt/V/xYY3FMA=
+github.com/spf13/pflag v1.0.6-0.20210604193023-d5e0c0615ace/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
 github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/objx v0.4.0/go.mod h1:YvHI0jy2hoMjB+UWwv71VJQ9isScKT/TqJzVSSt89Yw=
-github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk=
-github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU=
-github.com/vincent-petithory/dataurl v0.0.0-20160330182126-9a301d65acbb h1:lyL3z7vYwTWXf4/bI+A01+cCSnfhKIBhy+SQ46Z/ml8=
-github.com/vincent-petithory/dataurl v0.0.0-20160330182126-9a301d65acbb/go.mod h1:FHafX5vmDzyP+1CQATJn7WFKc9CvnvxyvZy6I1MrG/U=
-go.opentelemetry.io/proto/otlp v0.7.0/go.mod h1:PqfVotwruBrMGOCsRd/89rSnXhoiJIqeYNgFYFoEGnI=
-go4.org v0.0.0-20160314031811-03efcb870d84 h1:WZkGC1qzoax/QSt84wmvIxk+ZOmGIChsTzdrv9t4nvk=
-go4.org v0.0.0-20160314031811-03efcb870d84/go.mod h1:MkTOUMDaeVYJUOUsaDXIhWPZYa1yOyC1qaOBpL57BhE=
-golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
-golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
-golang.org/x/crypto v0.0.0-20210817164053-32db794688a5 h1:HWj/xjIHfjYU5nVXpTM0s39J9CbLn7Cc5a7IC5rwsMQ=
-golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
-golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA=
-golang.org/x/lint v0.0.0-20181026193005-c67002cb31c3/go.mod h1:UVdnD1Gm6xHRNCYTkRU2/jEulfH38KcIWyp/GAMgvoE=
-golang.org/x/lint v0.0.0-20190227174305-5b3e6a55c961/go.mod h1:wehouNa3lNwaWXcvxsM5YxQ5yQlVC4a0KAMCusXpPoU=
-golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3/go.mod h1:6SW0HCj/g11FgYtHlgUYUwCkIfeOF89ocIRzGO/8vkc=
-golang.org/x/net v0.0.0-20180724234803-3673e40ba225/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20180826012351-8a410e7b638d/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190108225652-1e06a53dbb7e/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190213061140-3a22650c66bd/go.mod h1:mL1N/T3taQHkDXs73rZJwtUhF3w3ftmwwsq0BUmARs4=
-golang.org/x/net v0.0.0-20190311183353-d8887717615a/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
-golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA=
-golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
-golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
-golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM=
-golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d h1:LO7XpTYMwTqxjLcGWPijK3vRXg1aWdlNOVOHRq45d7c=
-golang.org/x/net v0.0.0-20210813160813-60bc85c4be6d/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
-golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U=
-golang.org/x/oauth2 v0.0.0-20200107190931-bf48bf16ab8d/go.mod h1:gOpvHmFTYa4IltrdGE7lF6nIHvwfUNPOp7c8zoXwtLw=
-golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20181221193216-37e7f081c4d4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
-golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200323222414-85ca7c5b95cd/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20201119102817-f84b799fce68/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210119212857-b64e53b001e4/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210330210617-4fbd30eecc44/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210423082822-04245dca01da/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
-golang.org/x/sys v0.0.0-20210510120138-977fb7262007/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8 h1:0A+M6Uqn+Eje4kHMK80dtF3JCXC4ykBgQG4Fe06QRhQ=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
+github.com/vincent-petithory/dataurl v1.0.0 h1:cXw+kPto8NLuJtlMsI152irrVw9fRDX8AbShPRpg2CI=
+github.com/vincent-petithory/dataurl v1.0.0/go.mod h1:FHafX5vmDzyP+1CQATJn7WFKc9CvnvxyvZy6I1MrG/U=
+golang.org/x/crypto v0.21.0 h1:X31++rzVUdKhX5sWmSOFZxx8UW/ldWx55cbf08iNAMA=
+golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs=
+golang.org/x/net v0.22.0 h1:9sGLhx7iRIHEiX0oAJ3MRZMUCElJgy7Br1nO+AMN3Tc=
+golang.org/x/net v0.22.0/go.mod h1:JKghWKKOSdJwpW2GEx0Ja7fmaKnMsbu+MWVZTokSYmg=
 golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
-golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
-golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.5/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
-golang.org/x/text v0.3.7 h1:olpwvP2KacW1ZWvsR7uQhoyTYvKAupfQrRGBFM352Gk=
-golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
-golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
-golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY=
-golang.org/x/tools v0.0.0-20190311212946-11955173bddd/go.mod h1:LCzVGOaR6xXOjkQ3onu1FJEFr0SW1gC7cKk1uF8kGRs=
-golang.org/x/tools v0.0.0-20190524140312-2c0ae7006135/go.mod h1:RgjU9mgBXZiqYHBnxXauZ1Gv1EHHAz9KjViQ78xBX0Q=
-golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
-golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
-google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
-google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7/EB5XEv4=
-google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc=
-google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc=
-google.golang.org/genproto v0.0.0-20200513103714-09dca8ec2884/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c=
-google.golang.org/genproto v0.0.0-20200526211855-cb27e3aa2013/go.mod h1:NbSheEEYHJ7i3ixzK3sjbqSGDJWnxyFXZblF3eUsNvo=
-google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa h1:I0YcKz0I7OAhddo7ya8kMnvprhcWM045PmkBdMO9zN0=
-google.golang.org/genproto v0.0.0-20211208223120-3a66f561d7aa/go.mod h1:5CzLGKJ67TSI2B9POpiiyGha0AjJvZIUgRMt1dSmuhc=
-google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c=
-google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg=
-google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY=
-google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk=
-google.golang.org/grpc v1.33.1/go.mod h1:fr5YgcSWrqhRRxogOsw7RzIpsmvOZ6IcH4kBYTpR3n0=
-google.golang.org/grpc v1.36.0/go.mod h1:qjiiYl8FncCW8feJPdyg3v6XW24KsRHe+dy9BAGRRjU=
-google.golang.org/grpc v1.40.0/go.mod h1:ogyxbiOoUXAkP+4+xa6PZSE9DZgIHtSpzjDTB9KAK34=
-google.golang.org/grpc v1.48.0 h1:rQOsyJ/8+ufEDJd/Gdsz7HG220Mh9HAhFHRGnIjda0w=
-google.golang.org/grpc v1.48.0/go.mod h1:vN9eftEi1UMyUsIF80+uQXhHjbXYbm0uXoFCACuMGWk=
-google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8=
-google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0=
-google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM=
-google.golang.org/protobuf v1.20.1-0.20200309200217-e05f789c0967/go.mod h1:A+miEFZTKqfCUM6K7xSMQL9OKL/b6hQv+e19PK+JZNE=
-google.golang.org/protobuf v1.21.0/go.mod h1:47Nbq4nVaFHyn7ilMalzfO3qCViNmqZ2kzikPIcrTAo=
-google.golang.org/protobuf v1.22.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.0/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.23.1-0.20200526195155-81db48ad09cc/go.mod h1:EGpADcykh3NcUnDUJcl1+ZksZNG86OlYog2l/sGQquU=
-google.golang.org/protobuf v1.25.0/go.mod h1:9JNX74DMeImyA3h4bdi1ymwjUzf21/xIlbajtzgsN7c=
-google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
-google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.27.1 h1:SnqbnDw1V7RiZcXPx5MEeqPv2s79L9i7BJUlG/+RurQ=
-google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
+golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4=
+golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
+golang.org/x/text v0.14.0 h1:ScX5w1eTa3QqT8oi6+ziP7dTV1S2+ALU0bI+0zXKWiQ=
+golang.org/x/text v0.14.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240213162025-012b6fc9bca9 h1:hZB7eLIaYlW9qXRfCq/qDaPdbeY3757uARz5Vvfv+cY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20240213162025-012b6fc9bca9/go.mod h1:YUWgXUFRPfoYK1IHMuxH5K6nPEXSCzIMljnQ59lLRCk=
+google.golang.org/grpc v1.62.1 h1:B4n+nfKzOICUXMgyrNd19h/I9oH0L1pizfk1d4zSgTk=
+google.golang.org/grpc v1.62.1/go.mod h1:IWTG0VlJLCh1SkC58F7np9ka9mx/WNkjl4PGJaiq+QE=
+google.golang.org/protobuf v1.33.0 h1:uNO2rsAINq/JlFpSdYEKIZ0uKD/R9cpdv0T+yoGwGmI=
+google.golang.org/protobuf v1.33.0/go.mod h1:c6P6GXX6sHbq/GpV6MGZEdwhWPcYBgnhAHhKbcUYpos=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 h1:YR8cESwS4TdDjEe65xsg0ogRM/Nc3DYOhEAlW+xobZo=
-gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.2.3/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
-gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
 gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
-honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
--- a/matchbox/cli/generic_create.go
+++ b/matchbox/cli/generic_create.go
@@ -1,10 +1,11 @@
 package cli

 import (
-	"io/ioutil"
+	"os"
 	"path/filepath"

 	"context"
+
 	"github.com/spf13/cobra"

 	pb "github.com/poseidon/matchbox/matchbox/server/serverpb"
@@ -36,7 +37,7 @@ func runGenericPutCmd(cmd *cobra.Command, args []string) {
 	}

 	client := mustClientFromCmd(cmd)
-	config, err := ioutil.ReadFile(flagFilename)
+	config, err := os.ReadFile(flagFilename)
 	if err != nil {
 		exitWithError(ExitError, err)
 	}
--- a/matchbox/cli/group_create.go
+++ b/matchbox/cli/group_create.go
@@ -1,9 +1,9 @@
 package cli

 import (
-	"io/ioutil"
-
 	"context"
+	"os"
+
 	"github.com/spf13/cobra"

 	pb "github.com/poseidon/matchbox/matchbox/server/serverpb"
@@ -49,7 +49,7 @@ func runGroupPutCmd(cmd *cobra.Command, args []string) {
 }

 func loadGroup(filename string) (*storagepb.Group, error) {
-	data, err := ioutil.ReadFile(filename)
+	data, err := os.ReadFile(filename)
 	if err != nil {
 		return nil, err
 	}
--- a/matchbox/cli/ignition_create.go
+++ b/matchbox/cli/ignition_create.go
@@ -1,10 +1,11 @@
 package cli

 import (
-	"io/ioutil"
+	"os"
 	"path/filepath"

 	"context"
+
 	"github.com/spf13/cobra"

 	pb "github.com/poseidon/matchbox/matchbox/server/serverpb"
@@ -36,7 +37,7 @@ func runIgnitionPutCmd(cmd *cobra.Command, args []string) {
 	}

 	client := mustClientFromCmd(cmd)
-	config, err := ioutil.ReadFile(flagFilename)
+	config, err := os.ReadFile(flagFilename)
 	if err != nil {
 		exitWithError(ExitError, err)
 	}
--- a/matchbox/cli/profile_create.go
+++ b/matchbox/cli/profile_create.go
@@ -1,9 +1,9 @@
 package cli

 import (
-	"io/ioutil"
-
 	"context"
+	"os"
+
 	"github.com/spf13/cobra"

 	pb "github.com/poseidon/matchbox/matchbox/server/serverpb"
@@ -57,7 +57,7 @@ func validateArgs(cmd *cobra.Command, args []string) error {
 }

 func loadProfile(filename string) (*storagepb.Profile, error) {
-	data, err := ioutil.ReadFile(filename)
+	data, err := os.ReadFile(filename)
 	if err != nil {
 		return nil, err
 	}
--- a/matchbox/client/doc.go
+++ b/matchbox/client/doc.go
@@ -2,13 +2,12 @@
 //
 // Create a matchbox gRPC client using `client.New`:
 //
-//     cfg := &client.Config{
-//       Endpoints: []string{"127.0.0.1:8081"},
-//       DialTimeout: 10 * time.Second,
-//     }
-//     client, err := client.New(cfg)
-//     defer client.Close()
+//	cfg := &client.Config{
+//	  Endpoints: []string{"127.0.0.1:8081"},
+//	  DialTimeout: 10 * time.Second,
+//	}
+//	client, err := client.New(cfg)
+//	defer client.Close()
 //
 // Callers must Close the client after use.
-//
 package client
--- a/matchbox/http/ignition.go
+++ b/matchbox/http/ignition.go
@@ -5,8 +5,9 @@ import (
 	"net/http"
 	"strings"

-	ct "github.com/coreos/container-linux-config-transpiler/config"
-	ignition "github.com/coreos/ignition/config/v2_2"
+	butane "github.com/coreos/butane/config"
+	"github.com/coreos/butane/config/common"
+	ignition "github.com/coreos/ignition/v2/config/v3_4"
 	"github.com/sirupsen/logrus"

 	"github.com/poseidon/matchbox/matchbox/server"
@@ -60,17 +61,17 @@ func (s *Server) ignitionHandler(core server.Server) http.Handler {
 			"profile": profile.Id,
 		}).Debug("Matched an Ignition or Container Linux Config template")

-		// Skip rendering if raw Ignition JSON is provided
+		// Serve Ignition (e.g. *.ign) content directly
 		if isIgnition(profile.IgnitionId) {
-			_, report, err := ignition.Parse([]byte(contents))
+			ign, report, err := ignition.ParseCompatibleVersion([]byte(contents))
 			if err != nil {
-				s.logger.Warningf("warning parsing Ignition JSON: %s", report.String())
+				s.logger.Warningf("warning parsing Ignition: %s", report.String())
 			}
-			s.writeJSON(w, []byte(contents))
+			s.renderJSON(w, ign)
 			return
 		}

-		// Container Linux Config template
+		// Butane Config template (discouraged)

 		// collect data for rendering
 		data, err := collectVariables(req, group)
@@ -80,7 +81,7 @@ func (s *Server) ignitionHandler(core server.Server) http.Handler {
 			return
 		}

-		// render the template for an Ignition config with data
+		// render the template
 		var buf bytes.Buffer
 		err = s.renderTemplate(&buf, data, contents)
 		if err != nil {
@@ -88,24 +89,20 @@ func (s *Server) ignitionHandler(core server.Server) http.Handler {
 			return
 		}

-		// Parse bytes into a Container Linux Config
-		config, ast, report := ct.Parse(buf.Bytes())
-		if report.IsFatal() {
-			s.logger.Errorf("error parsing Container Linux config: %s", report.String())
+		// translate to Ignition
+		ignBytes, report, err := butane.TranslateBytes(buf.Bytes(), common.TranslateBytesOptions{})
+		if err != nil {
+			s.logger.Errorf("error translating Butane Config: %s", report.String())
 			http.NotFound(w, req)
 			return
 		}

-		// Convert Container Linux Config into an Ignition Config
-		ign, report := ct.Convert(config, "", ast)
-		if report.IsFatal() {
-			s.logger.Errorf("error converting Container Linux config: %s", report.String())
-			http.NotFound(w, req)
-			return
+		// validate
+		ign, report, err := ignition.ParseCompatibleVersion(ignBytes)
+		if err != nil {
+			s.logger.Warningf("warning parsing Ignition: %s", report.String())
 		}
-
 		s.renderJSON(w, ign)
-		return
 	}
 	return http.HandlerFunc(fn)
 }
--- a/matchbox/http/ignition_test.go
+++ b/matchbox/http/ignition_test.go
@@ -6,6 +6,7 @@ import (
 	"testing"

 	"context"
+
 	logtest "github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/assert"

@@ -14,8 +15,8 @@ import (
 	fake "github.com/poseidon/matchbox/matchbox/storage/testfakes"
 )

-func TestIgnitionHandler_V2_1_JSON(t *testing.T) {
-	content := `{"ignition":{"version":"2.1.0","config":{}},"storage":{},"systemd":{"units":[{"name":"etcd2.service","enable":true}]},"networkd":{},"passwd":{}}`
+func TestIgnitionHandler_v3_4(t *testing.T) {
+	const content = `{"ignition":{"config":{"replace":{"verification":{}}},"proxy":{},"security":{"tls":{}},"timeouts":{},"version":"3.4.0"},"kernelArguments":{},"passwd":{"users":[{"name":"core","sshAuthorizedKeys":["key"]}]},"storage":{},"systemd":{"units":[{"enabled":false,"name":"docker.service"}]}}`
 	profile := &storagepb.Profile{
 		Id:         fake.Group.Profile,
 		IgnitionId: "file.ign",
@@ -26,123 +27,145 @@ func TestIgnitionHandler_V2_1_JSON(t *testing.T) {
 	}
 	logger, _ := logtest.NewNullLogger()
 	srv := NewServer(&Config{Logger: logger})
-	c := server.NewServer(&server.Config{Store: store})
-	h := srv.ignitionHandler(c)
+	core := server.NewServer(&server.Config{Store: store})
+	h := srv.ignitionHandler(core)
+
 	ctx := withGroup(context.Background(), fake.Group)
 	w := httptest.NewRecorder()
-	req, _ := http.NewRequest("GET", "/", nil)
-	h.ServeHTTP(w, req.WithContext(ctx))
+	req, _ := http.NewRequestWithContext(ctx, "GET", "/", nil)
+	h.ServeHTTP(w, req)
 	// assert that:
-	// - raw Ignition config served directly
+	// - serve Ignition JSON
 	assert.Equal(t, http.StatusOK, w.Code)
-	assert.Equal(t, jsonContentType, w.HeaderMap.Get(contentType))
+	assert.Equal(t, jsonContentType, w.Header().Get(contentType))
 	assert.Equal(t, content, w.Body.String())
 }

-func TestIgnitionHandler_V2_2_JSON(t *testing.T) {
-	content := `{"ignition":{"version":"2.2.0","config":{}},"storage":{},"systemd":{"units":[{"name":"etcd2.service","enable":true}]},"networkd":{},"passwd":{}}`
+func TestIgnitionHandler_v3_1(t *testing.T) {
+	const ign31 = `{"ignition":{"config":{"replace":{"verification":{}}},"proxy":{},"security":{"tls":{}},"timeouts":{},"version":"3.1.0"},"kernelArguments":{},"passwd":{"users":[{"name":"core","sshAuthorizedKeys":["key"]}]},"storage":{},"systemd":{"units":[{"enabled":false,"name":"docker.service"}]}}`
+	const ign34 = `{"ignition":{"config":{"replace":{"verification":{}}},"proxy":{},"security":{"tls":{}},"timeouts":{},"version":"3.4.0"},"kernelArguments":{},"passwd":{"users":[{"name":"core","sshAuthorizedKeys":["key"]}]},"storage":{},"systemd":{"units":[{"enabled":false,"name":"docker.service"}]}}`
 	profile := &storagepb.Profile{
 		Id:         fake.Group.Profile,
 		IgnitionId: "file.ign",
 	}
 	store := &fake.FixedStore{
-		Profiles:        map[string]*storagepb.Profile{fake.Group.Profile: profile},
-		IgnitionConfigs: map[string]string{"file.ign": content},
+		Profiles: map[string]*storagepb.Profile{
+			fake.Group.Profile: profile,
+		},
+		IgnitionConfigs: map[string]string{
+			"file.ign": ign31,
+		},
 	}
 	logger, _ := logtest.NewNullLogger()
 	srv := NewServer(&Config{Logger: logger})
-	c := server.NewServer(&server.Config{Store: store})
-	h := srv.ignitionHandler(c)
+	core := server.NewServer(&server.Config{Store: store})
+	h := srv.ignitionHandler(core)
+
 	ctx := withGroup(context.Background(), fake.Group)
 	w := httptest.NewRecorder()
-	req, _ := http.NewRequest("GET", "/", nil)
-	h.ServeHTTP(w, req.WithContext(ctx))
+	req, _ := http.NewRequestWithContext(ctx, "GET", "/", nil)
+	h.ServeHTTP(w, req)
 	// assert that:
-	// - raw Ignition config served directly
+	// - older Ignition v3.x converted to compatible latest version (e.g. v3.3)
+	// - serve Ignition JSON
 	assert.Equal(t, http.StatusOK, w.Code)
-	assert.Equal(t, jsonContentType, w.HeaderMap.Get(contentType))
-	assert.Equal(t, content, w.Body.String())
+	assert.Equal(t, jsonContentType, w.Header().Get(contentType))
+	assert.Equal(t, ign34, w.Body.String())
 }

-func TestIgnitionHandler_CL_YAML(t *testing.T) {
-	// exercise templating features, not a realistic Container Linux Config template
-	content := `
+func TestIgnitionHandler_MissingIgnition(t *testing.T) {
+	logger, _ := logtest.NewNullLogger()
+	srv := NewServer(&Config{Logger: logger})
+	core := server.NewServer(&server.Config{Store: &fake.EmptyStore{}})
+	h := srv.ignitionHandler(core)
+
+	ctx := withProfile(context.Background(), fake.Profile)
+	w := httptest.NewRecorder()
+	req, _ := http.NewRequestWithContext(ctx, "GET", "/", nil)
+	h.ServeHTTP(w, req)
+	assert.Equal(t, http.StatusNotFound, w.Code)
+}
+
+func TestIgnitionHandler_Butane(t *testing.T) {
+	// exercise templating features, not a realistic Butane template
+	butane := `
+variant: flatcar
+version: 1.1.0
 systemd:
  units:
-    - name: {{.service_name}}.service
-      enable: true
    - name: {{.uuid}}.service
-      enable: true
+      enabled: true
+      contents: {{.pod_network}}
    - name: {{.request.query.foo}}.service
-      enable: true
+      enabled: true
      contents: {{.request.raw_query}}
 `
-	expectedIgnition := `{"ignition":{"config":{},"security":{"tls":{}},"timeouts":{},"version":"2.2.0"},"networkd":{},"passwd":{},"storage":{},"systemd":{"units":[{"enable":true,"name":"etcd2.service"},{"enable":true,"name":"a1b2c3d4.service"},{"contents":"foo=some-param\u0026bar=b","enable":true,"name":"some-param.service"}]}}`
+	expectedIgnition := `{"ignition":{"config":{"replace":{"verification":{}}},"proxy":{},"security":{"tls":{}},"timeouts":{},"version":"3.4.0"},"kernelArguments":{},"passwd":{},"storage":{},"systemd":{"units":[{"contents":"10.2.0.0/16","enabled":true,"name":"a1b2c3d4.service"},{"contents":"foo=some-param\u0026bar=b","enabled":true,"name":"some-param.service"}]}}`
+
 	store := &fake.FixedStore{
-		Profiles:        map[string]*storagepb.Profile{fake.Group.Profile: testProfileIgnitionYAML},
-		IgnitionConfigs: map[string]string{testProfileIgnitionYAML.IgnitionId: content},
+		Profiles: map[string]*storagepb.Profile{
+			fake.Group.Profile: testProfileWithButane,
+		},
+		IgnitionConfigs: map[string]string{
+			testProfileWithButane.IgnitionId: butane,
+		},
 	}
 	logger, _ := logtest.NewNullLogger()
 	srv := NewServer(&Config{Logger: logger})
-	c := server.NewServer(&server.Config{Store: store})
-	h := srv.ignitionHandler(c)
+	core := server.NewServer(&server.Config{Store: store})
+	h := srv.ignitionHandler(core)
+
 	ctx := withGroup(context.Background(), fake.Group)
 	w := httptest.NewRecorder()
-	req, _ := http.NewRequest("GET", "/?foo=some-param&bar=b", nil)
-	h.ServeHTTP(w, req.WithContext(ctx))
+	req, _ := http.NewRequestWithContext(ctx, "GET", "/?foo=some-param&bar=b", nil)
+	h.ServeHTTP(w, req)
 	// assert that:
-	// - Container Linux Config template rendered with Group selectors, metadata, and query variables
-	// - Transformed to an Ignition config (JSON)
+	// - Template rendered with Group selectors, metadata, and query variables
+	// - Butane translated to an Ignition config
 	assert.Equal(t, http.StatusOK, w.Code)
-	assert.Equal(t, jsonContentType, w.HeaderMap.Get(contentType))
+	assert.Equal(t, jsonContentType, w.Header().Get(contentType))
 	assert.Equal(t, expectedIgnition, w.Body.String())
 }

 func TestIgnitionHandler_MissingCtxProfile(t *testing.T) {
 	logger, _ := logtest.NewNullLogger()
 	srv := NewServer(&Config{Logger: logger})
-	c := server.NewServer(&server.Config{Store: &fake.EmptyStore{}})
-	h := srv.ignitionHandler(c)
+	core := server.NewServer(&server.Config{Store: &fake.EmptyStore{}})
+	h := srv.ignitionHandler(core)
+
 	w := httptest.NewRecorder()
 	req, _ := http.NewRequest("GET", "/", nil)
 	h.ServeHTTP(w, req)
 	assert.Equal(t, http.StatusNotFound, w.Code)
 }

-func TestIgnitionHandler_MissingIgnitionConfig(t *testing.T) {
-	logger, _ := logtest.NewNullLogger()
-	srv := NewServer(&Config{Logger: logger})
-	c := server.NewServer(&server.Config{Store: &fake.EmptyStore{}})
-	h := srv.ignitionHandler(c)
-	ctx := withProfile(context.Background(), fake.Profile)
-	w := httptest.NewRecorder()
-	req, _ := http.NewRequest("GET", "/", nil)
-	h.ServeHTTP(w, req.WithContext(ctx))
-	assert.Equal(t, http.StatusNotFound, w.Code)
-}
-
 func TestIgnitionHandler_MissingTemplateMetadata(t *testing.T) {
-	content := `
-ignition_version: 1
+	butane := `
+variant: flatcar
+version: 1.1.0
 systemd:
  units:
    - name: {{.missing_key}}
-      enable: true
+      enabled: true
 `
 	store := &fake.FixedStore{
-		Profiles:        map[string]*storagepb.Profile{fake.Group.Profile: fake.Profile},
-		IgnitionConfigs: map[string]string{fake.Profile.IgnitionId: content},
+		Profiles: map[string]*storagepb.Profile{
+			fake.Group.Profile: fake.Profile,
+		},
+		IgnitionConfigs: map[string]string{
+			fake.Profile.IgnitionId: butane,
+		},
 	}
 	logger, _ := logtest.NewNullLogger()
 	srv := NewServer(&Config{Logger: logger})
-	c := server.NewServer(&server.Config{Store: store})
-	h := srv.ignitionHandler(c)
+	core := server.NewServer(&server.Config{Store: store})
+	h := srv.ignitionHandler(core)
+
 	ctx := withGroup(context.Background(), fake.Group)
 	w := httptest.NewRecorder()
-	req, _ := http.NewRequest("GET", "/", nil)
-	h.ServeHTTP(w, req.WithContext(ctx))
+	req, _ := http.NewRequestWithContext(ctx, "GET", "/", nil)
+	h.ServeHTTP(w, req)
 	// assert that:
-	// - Ignition template rendering errors because "missing_key" is not
-	// present in the template variables
+	// - Template rendering errors because "missing_key" is not present
 	assert.Equal(t, http.StatusNotFound, w.Code)
 }
--- a/matchbox/http/ipxe.go
+++ b/matchbox/http/ipxe.go
@@ -10,7 +10,7 @@ import (
 )

 const ipxeBootstrap = `#!ipxe
-chain ipxe?uuid=${uuid}&mac=${mac:hexhyp}&domain=${domain}&hostname=${hostname}&serial=${serial}
+chain ipxe?uuid=${uuid}&mac=${mac:hexhyp}&domain=${domain}&hostname=${hostname}&serial=${serial}&arch=${buildarch:uristring}
 `

 var ipxeTemplate = template.Must(template.New("iPXE config").Parse(`#!ipxe
@@ -25,7 +25,7 @@ boot
 // client machine data and chainload to the ipxeHandler.
 func ipxeInspect() http.Handler {
 	fn := func(w http.ResponseWriter, req *http.Request) {
-		fmt.Fprintf(w, ipxeBootstrap)
+		fmt.Fprint(w, ipxeBootstrap)
 	}
 	return http.HandlerFunc(fn)
 }
--- a/matchbox/http/metadata_test.go
+++ b/matchbox/http/metadata_test.go
@@ -8,6 +8,7 @@ import (
 	"testing"

 	"context"
+
 	logtest "github.com/sirupsen/logrus/hooks/test"
 	"github.com/stretchr/testify/assert"

@@ -49,7 +50,7 @@ func TestMetadataHandler(t *testing.T) {
 	assert.Equal(t, http.StatusOK, w.Code)
 	// convert response (random order) to map (tests compare in order)
 	assert.Equal(t, expectedLines, metadataToMap(w.Body.String()))
-	assert.Equal(t, plainContentType, w.HeaderMap.Get(contentType))
+	assert.Equal(t, plainContentType, w.Header().Get(contentType))
 }

 func TestMetadataHandler_MetadataEdgeCases(t *testing.T) {
@@ -75,7 +76,7 @@ func TestMetadataHandler_MetadataEdgeCases(t *testing.T) {
 		// - key/value pairs are newline separated
 		assert.Equal(t, http.StatusOK, w.Code)
 		assert.Contains(t, w.Body.String(), c.expected)
-		assert.Equal(t, plainContentType, w.HeaderMap.Get(contentType))
+		assert.Equal(t, plainContentType, w.Header().Get(contentType))
 	}
 }

--- a/matchbox/http/render_test.go
+++ b/matchbox/http/render_test.go
@@ -15,11 +15,11 @@ func TestRenderJSON(t *testing.T) {
 	srv := NewServer(&Config{Logger: logger})
 	w := httptest.NewRecorder()
 	data := map[string][]string{
-		"a": []string{"b", "c"},
+		"a": {"b", "c"},
 	}
 	srv.renderJSON(w, data)
 	assert.Equal(t, http.StatusOK, w.Code)
-	assert.Equal(t, jsonContentType, w.HeaderMap.Get(contentType))
+	assert.Equal(t, jsonContentType, w.Header().Get(contentType))
 	assert.Equal(t, `{"a":["b","c"]}`, w.Body.String())
 }

--- a/matchbox/http/test_fixtures.go
+++ b/matchbox/http/test_fixtures.go
@@ -7,20 +7,8 @@ import (
 var (
 	validMACStr = "52:da:00:89:d8:10"

-	testProfileIgnitionYAML = &storagepb.Profile{
+	testProfileWithButane = &storagepb.Profile{
 		Id:         "g1h2i3j4",
-		IgnitionId: "ignition.yaml",
-	}
-
-	testProfileGeneric = &storagepb.Profile{
-		Id:         "g1h2i3j4",
-		IgnitionId: "generic.tmpl",
-	}
-
-	testGroupWithMAC = &storagepb.Group{
-		Id:       "test-group",
-		Name:     "test group",
-		Profile:  "g1h2i3j4",
-		Selector: map[string]string{"mac": validMACStr},
+		IgnitionId: "butane.yaml",
 	}
 )
--- a/matchbox/sign/writer_test.go
+++ b/matchbox/sign/writer_test.go
@@ -5,7 +5,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"net/http/httptest"
 	"strings"
@@ -30,7 +29,7 @@ func TestSignatureHandler(t *testing.T) {
 	h.ServeHTTP(w, req)
 	assert.Equal(t, http.StatusOK, w.Code)
 	assert.Equal(t, expectedBody, w.Body.String())
-	assert.NotEqual(t, "application/json", w.HeaderMap.Get("Content-Type"))
+	assert.NotEqual(t, "application/json", w.Header().Get("Content-Type"))
 }

 func TestSignatureHandler_ErrorStatusCode(t *testing.T) {
@@ -75,7 +74,7 @@ func TestSignatureHandler_SignatureError(t *testing.T) {
 type upperSigner struct{}

 func (s *upperSigner) Sign(w io.Writer, message io.Reader) error {
-	b, err := ioutil.ReadAll(message)
+	b, err := io.ReadAll(message)
 	if err != nil {
 		return err
 	}
--- a/matchbox/storage/filestore_test.go
+++ b/matchbox/storage/filestore_test.go
@@ -2,7 +2,6 @@ package storage

 import (
 	"encoding/json"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -244,7 +243,7 @@ func TestCloudGet(t *testing.T) {
 // for testing. Returns the directory tree root. The caller must remove the
 // temp directory when finished.
 func setup(fixedStore *fake.FixedStore) (root string, err error) {
-	root, err = ioutil.TempDir("", "data")
+	root, err = os.MkdirTemp("", "data")
 	if err != nil {
 		return "", err
 	}
@@ -264,7 +263,7 @@ func setup(fixedStore *fake.FixedStore) (root string, err error) {
 		if err != nil {
 			return root, err
 		}
-		err = ioutil.WriteFile(profileFile, []byte(data), defaultFileMode)
+		err = os.WriteFile(profileFile, []byte(data), defaultFileMode)
 		if err != nil {
 			return root, err
 		}
@@ -279,28 +278,28 @@ func setup(fixedStore *fake.FixedStore) (root string, err error) {
 		if err != nil {
 			return root, err
 		}
-		err = ioutil.WriteFile(groupFile, []byte(data), defaultFileMode)
+		err = os.WriteFile(groupFile, []byte(data), defaultFileMode)
 		if err != nil {
 			return root, err
 		}
 	}
 	for name, content := range fixedStore.IgnitionConfigs {
 		ignitionFile := filepath.Join(ignitionDir, name)
-		err = ioutil.WriteFile(ignitionFile, []byte(content), defaultFileMode)
+		err = os.WriteFile(ignitionFile, []byte(content), defaultFileMode)
 		if err != nil {
 			return root, err
 		}
 	}
 	for name, content := range fixedStore.GenericConfigs {
 		genericFile := filepath.Join(genericDir, name)
-		err = ioutil.WriteFile(genericFile, []byte(content), defaultFileMode)
+		err = os.WriteFile(genericFile, []byte(content), defaultFileMode)
 		if err != nil {
 			return root, err
 		}
 	}
 	for name, content := range fixedStore.CloudConfigs {
 		cloudConfigFile := filepath.Join(cloudDir, name)
-		err = ioutil.WriteFile(cloudConfigFile, []byte(content), defaultFileMode)
+		err = os.WriteFile(cloudConfigFile, []byte(content), defaultFileMode)
 		if err != nil {
 			return root, err
 		}
--- a/matchbox/storage/fs.go
+++ b/matchbox/storage/fs.go
@@ -2,7 +2,7 @@ package storage

 import (
 	"errors"
-	"io/ioutil"
+	"io/fs"
 	"os"
 	"path"
 	"path/filepath"
@@ -28,17 +28,17 @@ func (d Dir) readFile(path string) ([]byte, error) {
 	if err != nil {
 		return nil, err
 	}
-	return ioutil.ReadFile(path)
+	return os.ReadFile(path)
 }

 // readDir reads the directory named by the given path and returns a list of
 // sorted directory entries. Restricted to a specified directory tree.
-func (d Dir) readDir(dirname string) ([]os.FileInfo, error) {
+func (d Dir) readDir(dirname string) ([]fs.DirEntry, error) {
 	path, err := d.sanitize(dirname)
 	if err != nil {
 		return nil, err
 	}
-	return ioutil.ReadDir(path)
+	return os.ReadDir(path)
 }

 // writeFile writes the data as a file at given path, restricted to a specific
@@ -52,7 +52,7 @@ func (d Dir) writeFile(path string, data []byte) error {
 	if err := os.MkdirAll(filepath.Dir(path), defaultDirectoryMode); err != nil {
 		return err
 	}
-	return ioutil.WriteFile(path, data, defaultFileMode)
+	return os.WriteFile(path, data, defaultFileMode)
 }

 // deleteFile removes the file at the given path, restricted to a specific
--- a/matchbox/storage/fs_test.go
+++ b/matchbox/storage/fs_test.go
@@ -1,7 +1,6 @@
 package storage

 import (
-	"io/ioutil"
 	"os"
 	"path/filepath"
 	"testing"
@@ -21,7 +20,7 @@ func TestDir(t *testing.T) {
 		{"d/e/ff", "d/e/ff"},
 		{"d/e/ff/../gg", "d/e/gg"},
 	}
-	tdir, err := ioutil.TempDir("", "matchbox")
+	tdir, err := os.MkdirTemp("", "matchbox")
 	assert.Nil(t, err)
 	defer os.RemoveAll(tdir)

@@ -29,7 +28,8 @@ func TestDir(t *testing.T) {
 	dir := Dir(tdir)
 	// write files rooted in the dir
 	for _, c := range cases {
-		dir.writeFile(c.path, []byte(c.expected))
+		err = dir.writeFile(c.path, []byte(c.expected))
+		assert.Nil(t, err)
 	}
 	// ensure expected files were created
 	for _, c := range cases {
--- a/matchbox/tlsutil/tlsutil.go
+++ b/matchbox/tlsutil/tlsutil.go
@@ -3,7 +3,7 @@ package tlsutil
 import (
 	"crypto/x509"
 	"encoding/pem"
-	"io/ioutil"
+	"os"
 )

 // NewCertPool creates x509 certPool with provided CA files.
@@ -11,7 +11,7 @@ func NewCertPool(CAFiles []string) (*x509.CertPool, error) {
 	certPool := x509.NewCertPool()

 	for _, CAFile := range CAFiles {
-		pemByte, err := ioutil.ReadFile(CAFile)
+		pemByte, err := os.ReadFile(CAFile)
 		if err != nil {
 			return nil, err
 		}
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -24,7 +24,7 @@ nav:
  - Home: 'index.md'
  - 'Matchbox':
    - 'Concepts': 'matchbox.md'
-    - 'Container Linux Config': 'container-linux-config.md'
+    - 'Ignition': 'ignition.md'
    - 'Cloud-Config': 'cloud-config.md'
    - 'HTTP API': 'api-http.md'
    - 'gRPC API': 'api-grpc.md'
--- a/requirements.txt
+++ b/requirements.txt
@@ -1,4 +1,4 @@
-mkdocs==1.3.1
-mkdocs-material==8.3.9
-pygments==2.12.0
-pymdown-extensions==9.5
+mkdocs==1.5.3
+mkdocs-material==9.5.14
+pygments==2.17.2
+pymdown-extensions==10.7.1
--- a/scripts/README.md
+++ b/scripts/README.md
@@ -13,9 +13,9 @@ This will create:

 ```
 examples/assets/fedora-coreos/
-├── fedora-coreos-36.20220618.3.1-live-initramfs.x86_64.img
-├── fedora-coreos-36.20220618.3.1-live-kernel-x86_64
-├── fedora-coreos-36.20220618.3.1-live-rootfs.x86_64.img
+├── fedora-coreos-36.20220906.3.2-live-initramfs.x86_64.img
+├── fedora-coreos-36.20220906.3.2-live-kernel-x86_64
+├── fedora-coreos-36.20220906.3.2-live-rootfs.x86_64.img
 ```

 ## get-flatcar
--- a/scripts/get-fedora-coreos
+++ b/scripts/get-fedora-coreos
@@ -5,7 +5,7 @@
 set -eou pipefail

 STREAM=${1:-"stable"}
-VERSION=${2:-"36.20220618.3.1"}
+VERSION=${2:-"36.20220906.3.2"}
 DEST_DIR=${3:-"$PWD/examples/assets"}
 DEST=$DEST_DIR/fedora-coreos
 BASE_URL=https://builds.coreos.fedoraproject.org/prod/streams/$STREAM/builds/$VERSION/x86_64
--- a/scripts/get-flatcar
+++ b/scripts/get-flatcar
@@ -39,7 +39,7 @@ fi
 echo "Downloading Flatcar Linux $CHANNEL $VERSION images and sigs to $DEST"

 echo "Flatcar Linux Image Signing Key"
-curl -# https://www.flatcar-linux.org/security/image-signing-key/Flatcar_Image_Signing_Key.asc -o "${DEST}/Flatcar_Image_Signing_Key.asc"
+curl -# https://www.flatcar.org/security/image-signing-key/Flatcar_Image_Signing_Key.asc -o "${DEST}/Flatcar_Image_Signing_Key.asc"
 $GPG --import <"$DEST/Flatcar_Image_Signing_Key.asc" || true

 # Version
--- a/scripts/libvirt
+++ b/scripts/libvirt
@@ -35,7 +35,9 @@ function usage {
  echo -e "\tdestroy\t\tdestroy the QEMU/KVM nodes"
 }

-COMMON_VIRT_OPTS="--memory=${VM_MEMORY} --vcpus=1 --disk pool=default,size=${VM_DISK} --os-variant=fedora-coreos-stable --noautoconsole"
+# --install=no_install=yes is a workaround for a virt-manager 4.1.0 regression
+# https://github.com/virt-manager/virt-manager/issues/426
+COMMON_VIRT_OPTS="--memory=${VM_MEMORY} --vcpus=2 --disk pool=default,size=${VM_DISK} --os-variant=fedora-coreos-stable --noautoconsole --install=no_install=yes"

 NODE1_NAME=node1
 NODE1_MAC=52:54:00:a1:9c:ae