diff --git a/assets/terraform-modules/platforms/tinkerbell/controllers/bootkube.tf b/assets/terraform-modules/platforms/tinkerbell/controllers/bootkube.tf
new file mode 100644
index 000000000..4f9defe45
--- /dev/null
+++ b/assets/terraform-modules/platforms/tinkerbell/controllers/bootkube.tf
@@ -0,0 +1,23 @@
+# Self-hosted Kubernetes assets (kubeconfig, manifests)
+module "bootkube" {
+  source = "../../../bootkube"
+
+  cluster_name          = var.cluster_name
+  api_servers           = [format("%s.%s", var.cluster_name, var.dns_zone)]
+  api_servers_external  = var.ip_addresses
+  api_servers_ips       = var.ip_addresses
+  etcd_servers          = module.controller[0].etcd_servers
+  asset_dir             = var.asset_dir
+  network_mtu           = var.network_mtu
+  pod_cidr              = var.pod_cidr
+  service_cidr          = var.service_cidr
+  cluster_domain_suffix = var.cluster_domain_suffix
+  enable_reporting      = var.enable_reporting
+  enable_aggregation    = var.enable_aggregation
+
+  certs_validity_period_hours = var.certs_validity_period_hours
+
+  bootstrap_tokens            = concat(module.controller.*.bootstrap_token, var.worker_bootstrap_tokens)
+  enable_tls_bootstrap        = true
+  disable_self_hosted_kubelet = false
+}
diff --git a/assets/terraform-modules/platforms/tinkerbell/controllers/main.tf b/assets/terraform-modules/platforms/tinkerbell/controllers/main.tf
new file mode 100644
index 000000000..7eacfaacc
--- /dev/null
+++ b/assets/terraform-modules/platforms/tinkerbell/controllers/main.tf
@@ -0,0 +1,52 @@
+module "controller" {
+  source = "../../../controller"
+
+  count = var.node_count
+
+  cluster_name           = var.cluster_name
+  controllers_count      = var.node_count
+  dns_zone               = var.dns_zone
+  count_index            = count.index
+  cluster_dns_service_ip = module.bootkube.cluster_dns_service_ip
+  ssh_keys               = var.ssh_keys
+  cluster_domain_suffix  = var.cluster_domain_suffix
+  host_dns_ip            = var.host_dns_ip
+  apiserver              = format("%s.%s", var.cluster_name, var.dns_zone)
+  ca_cert                = module.bootkube.ca_cert
+
+  clc_snippets = concat(var.clc_snippets, [
+    <<EOF
+storage:
+  files:
+  - path: /etc/hostname
+    filesystem: root
+    mode: 0644
+    contents:
+      inline: |
+        ${var.cluster_name}-controller-${count.index}
+EOF
+    ,
+  ])
+}
+
+resource "tinkerbell_template" "main" {
+  count = var.node_count
+
+  name = "${var.cluster_name}-controller-${count.index}"
+
+  content = templatefile("${path.module}/templates/flatcar-install.tmpl", {
+    ignition_config          = module.controller[count.index].clc_config
+    flatcar_install_base_url = var.flatcar_install_base_url
+    os_version               = var.os_version
+    os_channel               = var.os_channel
+  })
+}
+
+resource "tinkerbell_workflow" "main" {
+  count = var.node_count
+
+  hardwares = <<EOF
+{"device_1": "${var.ip_addresses[count.index]}"}
+EOF
+  template  = tinkerbell_template.main[count.index].id
+}
diff --git a/assets/terraform-modules/platforms/tinkerbell/controllers/outputs.tf b/assets/terraform-modules/platforms/tinkerbell/controllers/outputs.tf
new file mode 100644
index 000000000..6945dfa26
--- /dev/null
+++ b/assets/terraform-modules/platforms/tinkerbell/controllers/outputs.tf
@@ -0,0 +1,48 @@
+output "kubeconfig-admin" {
+  value = module.bootkube.kubeconfig-admin
+}
+
+output "ca_cert" {
+  value = module.bootkube.ca_cert
+}
+
+output "apiserver" {
+  value = format("%s.%s", var.cluster_name, var.dns_zone)
+}
+
+# values.yaml content for all deployed charts.
+output "pod-checkpointer_values" {
+  value = module.bootkube.pod-checkpointer_values
+}
+
+output "kube-apiserver_values" {
+  value = module.bootkube.kube-apiserver_values
+}
+
+output "kubernetes_values" {
+  value = module.bootkube.kubernetes_values
+}
+
+output "kubelet_values" {
+  value = module.bootkube.kubelet_values
+}
+
+output "calico_values" {
+  value = module.bootkube.calico_values
+}
+
+output "lokomotive_values" {
+  value = module.bootkube.lokomotive_values
+}
+
+output "bootstrap-secrets_values" {
+  value = module.bootkube.bootstrap-secrets_values
+}
+
+output "kubeconfig" {
+  value = module.bootkube.kubeconfig-kubelet
+}
+
+output "cluster_dns_service_ip" {
+  value = module.bootkube.cluster_dns_service_ip
+}
diff --git a/assets/terraform-modules/platforms/tinkerbell/controllers/ssh.tf b/assets/terraform-modules/platforms/tinkerbell/controllers/ssh.tf
new file mode 100644
index 000000000..d0f64ec5d
--- /dev/null
+++ b/assets/terraform-modules/platforms/tinkerbell/controllers/ssh.tf
@@ -0,0 +1,97 @@
+# Secure copy etcd TLS assets and kubeconfig to controllers. Activates kubelet.service
+resource "null_resource" "copy-controller-secrets" {
+  count = length(var.ip_addresses)
+
+  connection {
+    type    = "ssh"
+    host    = var.ip_addresses[count.index]
+    user    = "core"
+    timeout = "60m"
+  }
+
+  provisioner "file" {
+    content     = module.controller[count.index].bootstrap_kubeconfig
+    destination = "$HOME/kubeconfig"
+  }
+
+  provisioner "file" {
+    content     = module.bootkube.etcd_ca_cert
+    destination = "$HOME/etcd-client-ca.crt"
+  }
+
+  provisioner "file" {
+    content     = module.bootkube.etcd_client_cert
+    destination = "$HOME/etcd-client.crt"
+  }
+
+  provisioner "file" {
+    content     = module.bootkube.etcd_client_key
+    destination = "$HOME/etcd-client.key"
+  }
+
+  provisioner "file" {
+    content     = module.bootkube.etcd_server_cert
+    destination = "$HOME/etcd-server.crt"
+  }
+
+  provisioner "file" {
+    content     = module.bootkube.etcd_server_key
+    destination = "$HOME/etcd-server.key"
+  }
+
+  provisioner "file" {
+    content     = module.bootkube.etcd_peer_cert
+    destination = "$HOME/etcd-peer.crt"
+  }
+
+  provisioner "file" {
+    content     = module.bootkube.etcd_peer_key
+    destination = "$HOME/etcd-peer.key"
+  }
+
+  provisioner "remote-exec" {
+    inline = [
+      "sudo mkdir -p /etc/ssl/etcd/etcd",
+      "sudo mv etcd-client* /etc/ssl/etcd/",
+      "sudo cp /etc/ssl/etcd/etcd-client-ca.crt /etc/ssl/etcd/etcd/server-ca.crt",
+      "sudo mv etcd-server.crt /etc/ssl/etcd/etcd/server.crt",
+      "sudo mv etcd-server.key /etc/ssl/etcd/etcd/server.key",
+      "sudo cp /etc/ssl/etcd/etcd-client-ca.crt /etc/ssl/etcd/etcd/peer-ca.crt",
+      "sudo mv etcd-peer.crt /etc/ssl/etcd/etcd/peer.crt",
+      "sudo mv etcd-peer.key /etc/ssl/etcd/etcd/peer.key",
+      "sudo chown -R etcd:etcd /etc/ssl/etcd",
+      "sudo chmod -R 500 /etc/ssl/etcd",
+      "sudo mv $HOME/kubeconfig /etc/kubernetes/kubeconfig",
+    ]
+  }
+}
+
+# Secure copy bootkube assets to ONE controller and start bootkube to perform
+# one-time self-hosted cluster bootstrapping.
+resource "null_resource" "bootkube-start" {
+  # Without depends_on, this remote-exec may start before the kubeconfig copy.
+  # Terraform only does one task at a time, so it would try to bootstrap
+  # while no Kubelets are running.
+  depends_on = [
+    null_resource.copy-controller-secrets,
+  ]
+
+  connection {
+    type    = "ssh"
+    host    = var.ip_addresses[0]
+    user    = "core"
+    timeout = "15m"
+  }
+
+  provisioner "file" {
+    source      = var.asset_dir
+    destination = "$HOME/assets"
+  }
+
+  provisioner "remote-exec" {
+    inline = [
+      "sudo mv $HOME/assets /opt/bootkube",
+      "sudo systemctl start bootkube || (sudo journalctl -u bootkube >&2; exit 1)",
+    ]
+  }
+}
diff --git a/assets/terraform-modules/platforms/tinkerbell/controllers/templates/flatcar-install.tmpl b/assets/terraform-modules/platforms/tinkerbell/controllers/templates/flatcar-install.tmpl
new file mode 100644
index 000000000..e94daf846
--- /dev/null
+++ b/assets/terraform-modules/platforms/tinkerbell/controllers/templates/flatcar-install.tmpl
@@ -0,0 +1,41 @@
+version: '0.1'
+name: flatcar-install
+global_timeout: 1800
+tasks:
+- name: "flatcar-install"
+  worker: "{{.device_1}}"
+  volumes:
+  - /dev:/dev
+  - /statedir:/statedir
+  actions:
+  - name: "dump-ignition"
+    image: flatcar-install
+    command:
+    - sh
+    - -c
+    - echo '${base64encode(ignition_config)}' | base64 -d > /statedir/ignition.json
+  - name: "flatcar-install"
+    image: flatcar-install # TODO docs: This image must be pushed to Tinkerbell registry.
+    command:
+    - /usr/local/bin/flatcar-install
+    - -s # Experimentally use the smallest disk to install the OS.
+    %{~ if os_version != "" ~}
+    - -V
+    - ${os_version}
+    %{~ endif ~}
+    %{~ if os_channel != "" ~}
+    - -C
+    - ${os_channel}
+    %{~ endif ~}
+    - -i
+    - /statedir/ignition.json
+    %{~ if flatcar_install_base_url != "" ~}
+    - -b
+    - ${flatcar_install_base_url}
+    %{~ endif ~}
+  - name: "reboot" # This task shouldn't really be there, but there is no other way to reboot the worker into target OS in Tinkerbell for now.
+    image: flatcar-install
+    command:
+    - sh
+    - -c
+    - 'echo 1 > /proc/sys/kernel/sysrq; echo b > /proc/sysrq-trigger'
diff --git a/assets/terraform-modules/platforms/tinkerbell/controllers/variables.tf b/assets/terraform-modules/platforms/tinkerbell/controllers/variables.tf
new file mode 100644
index 000000000..738e4e32c
--- /dev/null
+++ b/assets/terraform-modules/platforms/tinkerbell/controllers/variables.tf
@@ -0,0 +1,110 @@
+variable "dns_zone" {
+  type = string
+}
+
+variable "cluster_name" {
+  type = string
+}
+
+variable "ip_addresses" {
+  type = list(string)
+}
+
+variable "flatcar_install_base_url" {
+  type    = string
+  default = ""
+}
+
+variable "os_version" {
+  type    = string
+  default = ""
+}
+
+variable "os_channel" {
+  type    = string
+  default = ""
+}
+
+variable "asset_dir" {
+  description = "Path to a directory where generated assets should be placed (contains secrets)"
+  type        = string
+}
+
+# Required variables.
+variable "ssh_keys" {
+  type        = list(string)
+  description = "List of SSH public keys for user `core`. Each element must be specified in a valid OpenSSH public key format, as defined in RFC 4253 Section 6.6, e.g. 'ssh-rsa AAAAB3N...'."
+  default     = []
+}
+
+# Optional variables.
+variable "node_count" {
+  type        = number
+  description = "Number of nodes to create."
+  default     = 1
+}
+
+variable "clc_snippets" {
+  type        = list(string)
+  description = "Extra CLC snippets to include in the configuration."
+  default     = []
+}
+
+variable "cluster_domain_suffix" {
+  type        = string
+  description = "Cluster domain suffix. Passed to kubelet as --cluster_domain flag."
+  default     = "cluster.local"
+}
+
+variable "network_mtu" {
+  description = "CNI interface MTU"
+  type        = number
+  default     = 1500
+}
+
+variable "pod_cidr" {
+  description = "CIDR IP range to assign Kubernetes pods"
+  type        = string
+  default     = "10.2.0.0/16"
+}
+
+variable "service_cidr" {
+  description = <<EOF
+CIDR IP range to assign Kubernetes services.
+The 1st IP will be reserved for kube_apiserver, the 10th IP will be reserved for kube-dns.
+EOF
+  type        = string
+  default     = "10.3.0.0/24"
+}
+
+variable "enable_reporting" {
+  type        = bool
+  description = "Enable usage or analytics reporting to upstream component owners (Tigera: Calico)"
+  default     = false
+}
+
+variable "certs_validity_period_hours" {
+  description = "Validity of all the certificates in hours"
+  type        = number
+  default     = 8760
+}
+
+variable "enable_aggregation" {
+  description = "Enable the Kubernetes Aggregation Layer (defaults to false, recommended)"
+  type        = bool
+  default     = true
+}
+
+variable "worker_bootstrap_tokens" {
+  description = "List of token-id and token-secret of each node."
+  type = list(object({
+    token_id     = string
+    token_secret = string
+  }))
+}
+
+variable "host_dns_ip" {
+  type        = string
+  description = "IP address of DNS server to configure on the nodes."
+  default     = "8.8.8.8"
+}
diff --git a/assets/terraform-modules/platforms/tinkerbell/controllers/versions.tf b/assets/terraform-modules/platforms/tinkerbell/controllers/versions.tf
new file mode 100644
index 000000000..d1ed190de
--- /dev/null
+++ b/assets/terraform-modules/platforms/tinkerbell/controllers/versions.tf
@@ -0,0 +1,16 @@
+# Terraform version and plugin versions
+
+terraform {
+  required_version = ">= 0.13"
+
+  required_providers {
+    null = {
+      source  = "hashicorp/null"
+      version = "2.1.2"
+    }
+    tinkerbell = {
+      source  = "tinkerbell/tinkerbell"
+      version = "0.1.0"
+    }
+  }
+}
diff --git a/assets/terraform-modules/platforms/tinkerbell/workerpool/main.tf b/assets/terraform-modules/platforms/tinkerbell/workerpool/main.tf
new file mode 100644
index 000000000..20a679221
--- /dev/null
+++ b/assets/terraform-modules/platforms/tinkerbell/workerpool/main.tf
@@ -0,0 +1,49 @@
+module "worker" {
+  source = "../../../worker"
+
+  count       = var.node_count
+  count_index = count.index
+
+  cluster_dns_service_ip = var.cluster_dns_service_ip
+  ssh_keys               = var.ssh_keys
+  cluster_domain_suffix  = var.cluster_domain_suffix
+  host_dns_ip            = var.host_dns_ip
+  ca_cert                = var.ca_cert
+  apiserver              = var.apiserver
+
+  clc_snippets = concat(var.clc_snippets, [
+    <<EOF
+storage:
+  files:
+  - path: /etc/hostname
+    filesystem: root
+    mode: 0644
+    contents:
+      inline: |
+        ${var.cluster_name}-worker-${var.name}-${count.index}
+EOF
+    ,
+  ])
+}
+
+resource "tinkerbell_template" "main" {
+  count = var.node_count
+
+  name = "${var.cluster_name}-worker-${var.name}-${count.index}"
+
+  content = templatefile("${path.module}/templates/flatcar-install.tmpl", {
+    ignition_config          = module.worker[count.index].clc_config
+    flatcar_install_base_url = var.flatcar_install_base_url
+    os_version               = var.os_version
+    os_channel               = var.os_channel
+  })
+}
+
+resource "tinkerbell_workflow" "main" {
+  count = var.node_count
+
+  hardwares = <<EOF
+{"device_1": "${var.ip_addresses[count.index]}"}
+EOF
+  template  = tinkerbell_template.main[count.index].id
+}
diff --git a/assets/terraform-modules/platforms/tinkerbell/workerpool/output.tf b/assets/terraform-modules/platforms/tinkerbell/workerpool/output.tf
new file mode 100644
index 000000000..f9449b9e3
--- /dev/null
+++ b/assets/terraform-modules/platforms/tinkerbell/workerpool/output.tf
@@ -0,0 +1,3 @@
+output "bootstrap_tokens" {
+  value = module.worker.*.bootstrap_token
+}
diff --git a/assets/terraform-modules/platforms/tinkerbell/workerpool/templates/flatcar-install.tmpl b/assets/terraform-modules/platforms/tinkerbell/workerpool/templates/flatcar-install.tmpl
new file mode 120000
index 000000000..a9256b17c
--- /dev/null
+++ b/assets/terraform-modules/platforms/tinkerbell/workerpool/templates/flatcar-install.tmpl
@@ -0,0 +1 @@
+../../controllers/templates/flatcar-install.tmpl
\ No newline at end of file
diff --git a/assets/terraform-modules/platforms/tinkerbell/workerpool/variables.tf b/assets/terraform-modules/platforms/tinkerbell/workerpool/variables.tf
new file mode 100644
index 000000000..591f11983
--- /dev/null
+++ b/assets/terraform-modules/platforms/tinkerbell/workerpool/variables.tf
@@ -0,0 +1,79 @@
+variable "cluster_name" {
+  type = string
+}
+
+variable "name" {
+  type = string
+}
+
+variable "ip_addresses" {
+  type = list(string)
+}
+
+variable "flatcar_install_base_url" {
+  type    = string
+  default = ""
+}
+
+variable "os_version" {
+  type    = string
+  default = ""
+}
+
+variable "os_channel" {
+  type    = string
+  default = ""
+}
+
+variable "kubeconfig" {
+  type        = string
+  description = "Content of kubelet's kubeconfig file"
+}
+
+# Required variables.
+variable "ssh_keys" {
+  type        = list(string)
+  description = "List of SSH public keys for user `core`. Each element must be specified in a valid OpenSSH public key format, as defined in RFC 4253 Section 6.6, e.g. 'ssh-rsa AAAAB3N...'."
+  default     = []
+}
+
+# Optional variables.
+variable "node_count" {
+  type        = number
+  description = "Number of nodes to create."
+  default     = 1
+}
+
+variable "cluster_dns_service_ip" {
+  type        = string
+  description = "IP address of cluster DNS Service. Passed to kubelet as --cluster_dns parameter."
+  default     = "10.3.0.10"
+}
+
+variable "clc_snippets" {
+  type        = list(string)
+  description = "Extra CLC snippets to include in the configuration."
+  default     = []
+}
+
+variable "cluster_domain_suffix" {
+  type        = string
+  description = "Cluster domain suffix. Passed to kubelet as --cluster_domain flag."
+  default     = "cluster.local"
+}
+
+variable "host_dns_ip" {
+  type        = string
+  description = "IP address of DNS server to configure on the nodes."
+  default     = "8.8.8.8"
+}
+
+variable "ca_cert" {
+  description = "Kubernetes CA certificate needed in the kubeconfig file."
+  type        = string
+}
+
+variable "apiserver" {
+  description = "Apiserver private endpoint needed in the kubeconfig file."
+  type        = string
+}
diff --git a/assets/terraform-modules/platforms/tinkerbell/workerpool/versions.tf b/assets/terraform-modules/platforms/tinkerbell/workerpool/versions.tf
new file mode 100644
index 000000000..3a690254c
--- /dev/null
+++ b/assets/terraform-modules/platforms/tinkerbell/workerpool/versions.tf
@@ -0,0 +1,12 @@
+# Terraform version and plugin versions
+
+terraform {
+  required_version = ">= 0.13"
+
+  required_providers {
+    tinkerbell = {
+      source  = "tinkerbell/tinkerbell"
+      version = "0.1.0"
+    }
+  }
+}
diff --git a/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/.gitignore b/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/.gitignore
new file mode 100644
index 000000000..ff72b5c73
--- /dev/null
+++ b/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/.gitignore
@@ -0,0 +1 @@
+state
diff --git a/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/db/tinkerbell-init.sql b/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/db/tinkerbell-init.sql
new file mode 100644
index 000000000..9b27c818f
--- /dev/null
+++ b/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/db/tinkerbell-init.sql
@@ -0,0 +1,76 @@
+SET ROLE tinkerbell;
+
+CREATE TABLE IF NOT EXISTS hardware (
+	id UUID UNIQUE
+	, inserted_at TIMESTAMPTZ
+	, deleted_at TIMESTAMPTZ
+	, data JSONB
+);
+
+CREATE INDEX IF NOT EXISTS idx_id ON hardware (id);
+CREATE INDEX IF NOT EXISTS idx_deleted_at ON hardware (deleted_at NULLS FIRST);
+CREATE INDEX IF NOT EXISTS idxgin_type ON hardware USING GIN (data JSONB_PATH_OPS);
+
+CREATE TABLE IF NOT EXISTS template (
+        id UUID UNIQUE NOT NULL
+        , name VARCHAR(200) NOT NULL
+        , created_at TIMESTAMPTZ
+        , updated_at TIMESTAMPTZ
+        , deleted_at TIMESTAMPTZ
+        , data BYTEA
+
+        CONSTRAINT CK_name CHECK (name ~ '^[a-zA-Z0-9_-]*$')
+);
+
+CREATE INDEX IF NOT EXISTS idx_tid ON template (id);
+CREATE INDEX IF NOT EXISTS idx_tdeleted_at ON template (deleted_at NULLS FIRST);
+
+CREATE TABLE IF NOT EXISTS workflow (
+	id UUID UNIQUE NOT NULL
+	, template UUID NOT NULL
+	, devices JSONB NOT NULL
+	, created_at TIMESTAMPTZ
+	, updated_at TIMESTAMPTZ
+	, deleted_at TIMESTAMPTZ
+);
+
+CREATE INDEX IF NOT EXISTS idx_wid ON workflow (id);
+CREATE INDEX IF NOT EXISTS idx_wdeleted_at ON workflow (deleted_at NULLS FIRST);
+
+CREATE TABLE IF NOT EXISTS workflow_state (
+        workflow_id UUID UNIQUE NOT NULL
+        , current_task_name VARCHAR(200)
+        , current_action_name VARCHAR(200)
+        , current_action_state SMALLINT
+        , current_worker VARCHAR(200)
+        , action_list JSONB
+        , current_action_index int
+        , total_number_of_actions INT
+);
+
+CREATE INDEX IF NOT EXISTS idx_wfid ON workflow_state (workflow_id);
+
+CREATE TABLE IF NOT EXISTS workflow_event (
+        workflow_id UUID NOT NULL
+        , worker_id UUID  NOT NULL
+        , task_name VARCHAR(200)
+        , action_name VARCHAR(200)
+        , execution_time int
+	, message VARCHAR(200)
+	, status SMALLINT
+        , created_at TIMESTAMPTZ
+);
+
+CREATE INDEX IF NOT EXISTS idx_event ON workflow_event (created_at);
+
+CREATE TABLE IF NOT EXISTS workflow_worker_map (
+        workflow_id UUID NOT NULL
+        , worker_id UUID NOT NULL
+);
+
+CREATE TABLE IF NOT EXISTS workflow_data (
+        workflow_id UUID NOT NULL
+        , version INT
+        , metadata JSONB
+        , data JSONB
+);
diff --git a/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/docker-compose.yml b/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/docker-compose.yml
new file mode 100644
index 000000000..06d54f8a7
--- /dev/null
+++ b/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/docker-compose.yml
@@ -0,0 +1,155 @@
+version: "2.1"
+services:
+  tink-server:
+    image: ${TINKERBELL_TINK_SERVER_IMAGE}
+    restart: unless-stopped
+    environment:
+      FACILITY: ${FACILITY:-onprem}
+      PACKET_ENV: ${PACKET_ENV:-testing}
+      PACKET_VERSION: ${PACKET_VERSION:-ignored}
+      ROLLBAR_TOKEN: ${ROLLBAR_TOKEN:-ignored}
+      ROLLBAR_DISABLE: ${ROLLBAR_DISABLE:-1}
+      PGDATABASE: tinkerbell
+      PGHOST: db
+      PGPASSWORD: tinkerbell
+      PGPORT: 5432
+      PGSSLMODE: disable
+      PGUSER: tinkerbell
+      TINKERBELL_GRPC_AUTHORITY: :42113
+      TINKERBELL_HTTP_AUTHORITY: :42114
+      TINK_AUTH_USERNAME: ${TINKERBELL_TINK_USERNAME}
+      TINK_AUTH_PASSWORD: ${TINKERBELL_TINK_PASSWORD}
+    depends_on:
+      db:
+        condition: service_healthy
+    healthcheck:
+      test: ["CMD-SHELL", "wget -qO- 127.0.0.1:42114/cert"] # port needs to match TINKERBELL_HTTP_AUTHORITY
+      interval: 5s
+      timeout: 2s
+      retries: 30
+    volumes:
+      - ./state/certs:/certs/${FACILITY:-onprem}
+    ports:
+      - 42113:42113/tcp
+      - 42114:42114/tcp
+
+  db:
+    image: postgres:10-alpine
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: tinkerbell
+      POSTGRES_PASSWORD: tinkerbell
+      POSTGRES_USER: tinkerbell
+    volumes:
+      - ./db/tinkerbell-init.sql:/docker-entrypoint-initdb.d/tinkerbell-init.sql:ro
+      - postgres_data:/var/lib/postgresql/data:rw
+    ports:
+      - 5432:5432
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U tinkerbell"]
+      interval: 1s
+      timeout: 1s
+      retries: 30
+
+  tink-cli:
+    image: ${TINKERBELL_TINK_CLI_IMAGE}
+    restart: unless-stopped
+    environment:
+      TINKERBELL_GRPC_AUTHORITY: 127.0.0.1:42113
+      TINKERBELL_CERT_URL: http://127.0.0.1:42114/cert
+    depends_on:
+      tink-server:
+        condition: service_healthy
+      db:
+        condition: service_healthy
+    network_mode: host
+
+  registry:
+    build:
+      context: registry
+      args:
+        REGISTRY_USERNAME: $TINKERBELL_REGISTRY_USERNAME
+        REGISTRY_PASSWORD: $TINKERBELL_REGISTRY_PASSWORD
+    restart: unless-stopped
+    healthcheck:
+      test: ["CMD-SHELL", "curl --cacert /certs/ca.pem https://127.0.0.1"]
+      interval: 5s
+      timeout: 1s
+      retries: 5
+    environment:
+      REGISTRY_HTTP_ADDR: 0.0.0.0:443
+      REGISTRY_HTTP_TLS_CERTIFICATE: /certs/server.pem
+      REGISTRY_HTTP_TLS_KEY: /certs/server-key.pem
+      REGISTRY_AUTH: htpasswd
+      REGISTRY_AUTH_HTPASSWD_REALM: "Registry Realm"
+      REGISTRY_AUTH_HTPASSWD_PATH: /auth/htpasswd
+    volumes:
+      - ./state/certs:/certs
+      - ./state/registry:/var/lib/registry
+    network_mode: host
+
+  boots:
+    image: ${TINKERBELL_TINK_BOOTS_IMAGE}
+    restart: unless-stopped
+    network_mode: host
+    command: -dhcp-addr 0.0.0.0:67 -tftp-addr $TINKERBELL_HOST_IP:69 -http-addr $TINKERBELL_HOST_IP:80 -log-level DEBUG
+    environment:
+      API_AUTH_TOKEN: ${PACKET_API_AUTH_TOKEN:-ignored}
+      API_CONSUMER_TOKEN: ${PACKET_CONSUMER_TOKEN:-ignored}
+      FACILITY_CODE: ${FACILITY:-onprem}
+      PACKET_ENV: ${PACKET_ENV:-testing}
+      PACKET_VERSION: ${PACKET_VERSION:-ignored}
+      ROLLBAR_TOKEN: ${ROLLBAR_TOKEN:-ignored}
+      ROLLBAR_DISABLE: ${ROLLBAR_DISABLE:-1}
+      MIRROR_HOST: ${TINKERBELL_NGINX_IP:-127.0.0.1}
+      DNS_SERVERS: 8.8.8.8
+      PUBLIC_IP: $TINKERBELL_HOST_IP
+      BOOTP_BIND: $TINKERBELL_HOST_IP:67
+      HTTP_BIND: $TINKERBELL_HOST_IP:80
+      SYSLOG_BIND: $TINKERBELL_HOST_IP:514
+      TFTP_BIND: $TINKERBELL_HOST_IP:69
+      DOCKER_REGISTRY: $TINKERBELL_HOST_IP
+      REGISTRY_USERNAME: $TINKERBELL_REGISTRY_USERNAME
+      REGISTRY_PASSWORD: $TINKERBELL_REGISTRY_PASSWORD
+      TINKERBELL_GRPC_AUTHORITY: $TINKERBELL_HOST_IP:42113
+      TINKERBELL_CERT_URL: http://$TINKERBELL_HOST_IP:42114/cert
+      ELASTIC_SEARCH_URL: $TINKERBELL_HOST_IP:9200
+      DATA_MODEL_VERSION: 1
+    depends_on:
+      db:
+        condition: service_healthy
+    ports:
+      - $TINKERBELL_HOST_IP:80:80/tcp
+      - 67:67/udp
+      - 69:69/udp
+
+  nginx:
+    image: nginx:alpine
+    restart: unless-stopped
+    tty: true
+    ports:
+      - $TINKERBELL_NGINX_IP:80:80/tcp
+    volumes:
+      - ./state/webroot:/usr/share/nginx/html/
+
+  hegel:
+    image: ${TINKERBELL_TINK_HEGEL_IMAGE}
+    restart: unless-stopped
+    network_mode: host
+    environment:
+      ROLLBAR_TOKEN: ${ROLLBAR_TOKEN-ignored}
+      ROLLBAR_DISABLE: 1
+      PACKET_ENV: testing
+      PACKET_VERSION: ${PACKET_VERSION:-ignored}
+      GRPC_PORT: 42115
+      HEGEL_FACILITY: ${FACILITY:-onprem}
+      HEGEL_USE_TLS: 0
+      TINKERBELL_GRPC_AUTHORITY: 127.0.0.1:42113
+      TINKERBELL_CERT_URL: http://127.0.0.1:42114/cert
+      DATA_MODEL_VERSION: 1
+    depends_on:
+      db:
+        condition: service_healthy
+
+volumes:
+  postgres_data:
diff --git a/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/flatcar-install/Dockerfile b/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/flatcar-install/Dockerfile
new file mode 100644
index 000000000..d2654e474
--- /dev/null
+++ b/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/flatcar-install/Dockerfile
@@ -0,0 +1,7 @@
+FROM ubuntu
+
+RUN apt update && \
+		apt install -y udev gpg wget
+
+RUN wget https://raw.githubusercontent.com/flatcar-linux/init/flatcar-master/bin/flatcar-install -O /usr/local/bin/flatcar-install && \
+    chmod +x /usr/local/bin/flatcar-install
diff --git a/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/registry/Dockerfile b/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/registry/Dockerfile
new file mode 100644
index 000000000..dedd7d6d0
--- /dev/null
+++ b/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/registry/Dockerfile
@@ -0,0 +1,7 @@
+FROM registry:2.7.1
+RUN apk add --no-cache --update curl apache2-utils
+ARG REGISTRY_USERNAME
+ARG REGISTRY_PASSWORD
+RUN mkdir -p /certs /auth
+RUN htpasswd -Bbn ${REGISTRY_USERNAME} ${REGISTRY_PASSWORD} > /auth/htpasswd
+EXPOSE 443
diff --git a/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/.gitignore b/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/.gitignore
new file mode 100644
index 000000000..355164c12
--- /dev/null
+++ b/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/.gitignore
@@ -0,0 +1 @@
+*/
diff --git a/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/Dockerfile b/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/Dockerfile
new file mode 100644
index 000000000..3162c8a98
--- /dev/null
+++ b/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/Dockerfile
@@ -0,0 +1,7 @@
+FROM alpine:3.11
+ENTRYPOINT [ "/entrypoint.sh" ]
+
+RUN apk add --no-cache --update --upgrade ca-certificates postgresql-client
+RUN apk add --no-cache --update --upgrade --repository=http://dl-cdn.alpinelinux.org/alpine/edge/testing cfssl
+
+COPY . .
diff --git a/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/ca-config.json b/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/ca-config.json
new file mode 100644
index 000000000..d6d666e7a
--- /dev/null
+++ b/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/ca-config.json
@@ -0,0 +1,17 @@
+{
+  "signing": {
+    "default": {
+      "expiry": "168h"
+    },
+    "profiles": {
+      "server": {
+        "expiry": "8760h",
+        "usages": ["signing", "key encipherment", "server auth"]
+      },
+      "signing": {
+        "expiry": "8760h",
+        "usages": ["signing", "key encipherment"]
+      }
+    }
+  }
+}
diff --git a/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/ca.in.json b/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/ca.in.json
new file mode 100644
index 000000000..0c0cf7a24
--- /dev/null
+++ b/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/ca.in.json
@@ -0,0 +1,12 @@
+{
+  "CN": "Autogenerated CA",
+  "key": {
+    "algo": "rsa",
+    "size": 2048
+  },
+  "names": [
+    {
+      "L": "@FACILITY@"
+    }
+  ]
+}
diff --git a/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/entrypoint.sh b/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/entrypoint.sh
new file mode 100755
index 000000000..a172eaa7d
--- /dev/null
+++ b/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/entrypoint.sh
@@ -0,0 +1,13 @@
+#!/usr/bin/env sh
+
+# set -o errexit -o nounset -o pipefail
+
+if [ -z "${TINKERBELL_TLS_CERT:-}" ]; then
+	(
+		echo "creating directory"
+		mkdir -p "certs"
+		./gencerts.sh
+	)
+fi
+
+"$@"
diff --git a/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/gencerts.sh b/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/gencerts.sh
new file mode 100755
index 000000000..66731dfea
--- /dev/null
+++ b/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/gencerts.sh
@@ -0,0 +1,30 @@
+#!/usr/bin/env sh
+
+set -eux
+
+cd /certs
+
+if [ ! -f ca-key.pem ]; then
+	cfssl gencert \
+		-initca ca.json | cfssljson -bare ca
+fi
+
+if [ ! -f server.pem ]; then
+	cfssl gencert \
+		-ca=ca.pem \
+		-ca-key=ca-key.pem \
+		-config=/ca-config.json \
+		-profile=server \
+		server-csr.json |
+		cfssljson -bare server
+fi
+
+cat server.pem ca.pem >bundle.pem.tmp
+
+# only "modify" the file if truly necessary since workflow will serve it with
+# modtime info for client caching purposes
+if ! cmp -s bundle.pem.tmp bundle.pem; then
+	mv bundle.pem.tmp bundle.pem
+else
+	rm bundle.pem.tmp
+fi
diff --git a/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/server-csr.in.json b/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/server-csr.in.json
new file mode 100644
index 000000000..86c1008d4
--- /dev/null
+++ b/assets/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/server-csr.in.json
@@ -0,0 +1,19 @@
+{
+  "CN": "tinkerbell",
+  "hosts": [
+    "tinkerbell.registry",
+    "tinkerbell.tinkerbell",
+    "tinkerbell",
+    "localhost",
+    "127.0.0.1"
+  ],
+  "key": {
+    "algo": "rsa",
+    "size": 2048
+  },
+  "names": [
+    {
+      "L": "@FACILITY@"
+    }
+  ]
+}
diff --git a/assets/terraform-modules/tinkerbell-sandbox/assets/generate-envrc.sh b/assets/terraform-modules/tinkerbell-sandbox/assets/generate-envrc.sh
new file mode 100755
index 000000000..a7eb7a283
--- /dev/null
+++ b/assets/terraform-modules/tinkerbell-sandbox/assets/generate-envrc.sh
@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+
+# stops the execution if a command or pipeline has an error
+set -eu
+
+if command -v tput >/dev/null && tput setaf 1 >/dev/null 2>&1; then
+	# color codes
+	RED="$(tput setaf 1)"
+	RESET="$(tput sgr0)"
+fi
+
+ERR="${RED:-}ERROR:${RESET:-}"
+
+err() (
+	if [ -z "${1:-}" ]; then
+		cat >&2
+	else
+		echo "$ERR " "$@" >&2
+	fi
+)
+
+candidate_interfaces() (
+	ip -o link show |
+		awk -F': ' '{print $2}' |
+		sed 's/[ \t].*//;/^\(lo\|bond0\|\|\)$/d' |
+		sort
+)
+
+validate_tinkerbell_network_interface() (
+	local tink_interface=$1
+
+	if ! candidate_interfaces | grep -q "^$tink_interface$"; then
+		err "Invalid interface ($tink_interface) selected, must be one of:"
+		candidate_interfaces | err
+		return 1
+	else
+		return 0
+	fi
+)
+
+generate_password() (
+	head -c 12 /dev/urandom | sha256sum | cut -d' ' -f1
+)
+
+generate_envrc() (
+	local tink_interface=$1
+
+	validate_tinkerbell_network_interface "$tink_interface"
+
+	local tink_password
+	tink_password=$(generate_password)
+	local registry_password
+	registry_password=$(generate_password)
+	cat <<EOF
+# Tinkerbell Stack version
+
+export OSIE_DOWNLOAD_LINK=https://tinkerbell-oss.s3.amazonaws.com/osie-uploads/osie-v0-n=252,c=bc454bc,b=master.tar.gz
+export TINKERBELL_TINK_SERVER_IMAGE=quay.io/tinkerbell/tink:sha-adb49da
+export TINKERBELL_TINK_CLI_IMAGE=quay.io/tinkerbell/tink-cli:sha-adb49da
+export TINKERBELL_TINK_BOOTS_IMAGE=quay.io/tinkerbell/boots:327-58ab49913b5498908b16e2607d265a61a05f73b6
+export TINKERBELL_TINK_HEGEL_IMAGE=quay.io/tinkerbell/hegel:196-fa897aa020769db8becb9be29adaeb6be92a7fc7
+export TINKERBELL_TINK_WORKER_IMAGE=quay.io/tinkerbell/tink-worker:sha-adb49da
+
+# Network interface for Tinkerbell's network
+export TINKERBELL_NETWORK_INTERFACE="$tink_interface"
+
+# Decide on a subnet for provisioning. Tinkerbell should "own" this
+# network space. Its subnet should be just large enough to be able
+# to provision your hardware.
+export TINKERBELL_CIDR=29
+
+# Host IP is used by provisioner to expose different services such as
+# tink, boots, etc.
+#
+# The host IP should the first IP in the range, and the Nginx IP
+# should be the second address.
+export TINKERBELL_HOST_IP=192.168.1.1
+
+# NGINX IP is used by provisioner to serve files required for iPXE boot
+export TINKERBELL_NGINX_IP=192.168.1.2
+
+# Tink server username and password
+export TINKERBELL_TINK_USERNAME=admin
+export TINKERBELL_TINK_PASSWORD="$tink_password"
+
+# Docker Registry's username and password
+export TINKERBELL_REGISTRY_USERNAME=admin
+export TINKERBELL_REGISTRY_PASSWORD="$registry_password"
+
+# Legacy options, to be deleted:
+export FACILITY=onprem
+export ROLLBAR_TOKEN=ignored
+export ROLLBAR_DISABLE=1
+EOF
+)
+
+main() (
+	if [ -z "${1:-}" ]; then
+		err "Usage: $0 network-interface-name > .env"
+		exit 1
+	fi
+
+	generate_envrc "$1"
+)
+
+main "$@"
diff --git a/assets/terraform-modules/tinkerbell-sandbox/assets/setup.sh b/assets/terraform-modules/tinkerbell-sandbox/assets/setup.sh
new file mode 100755
index 000000000..a15471c98
--- /dev/null
+++ b/assets/terraform-modules/tinkerbell-sandbox/assets/setup.sh
@@ -0,0 +1,518 @@
+#!/usr/bin/env bash
+
+# stops the execution if a command or pipeline has an error
+set -eu
+
+# Tinkerbell stack Linux setup script
+#
+# See https://tinkerbell.org/setup for the installation steps.
+
+# file to hold all environment variables
+ENV_FILE=.env
+
+mkdir -p "/opt/osie"
+SCRATCH="/opt/osie"
+readonly SCRATCH
+function finish() (
+	rm -rf "$SCRATCH"
+)
+trap finish EXIT
+
+DEPLOYDIR=$(pwd)/deploy
+readonly DEPLOYDIR
+readonly STATEDIR=$DEPLOYDIR/state
+
+if command -v tput >/dev/null && tput setaf 1 >/dev/null 2>&1; then
+	# color codes
+	RED="$(tput setaf 1)"
+	GREEN="$(tput setaf 2)"
+	YELLOW="$(tput setaf 3)"
+	RESET="$(tput sgr0)"
+fi
+
+INFO="${GREEN:-}INFO:${RESET:-}"
+ERR="${RED:-}ERROR:${RESET:-}"
+WARN="${YELLOW:-}WARNING:${RESET:-}"
+BLANK="      "
+NEXT="${GREEN:-}NEXT:${RESET:-}"
+
+get_distribution() (
+	local lsb_dist=""
+	# Every system that we officially support has /etc/os-release
+	if [ -r /etc/os-release ]; then
+		# shellcheck disable=SC1091
+		lsb_dist="$(. /etc/os-release && echo "$ID")"
+	fi
+	# Returning an empty string here should be alright since the
+	# case statements don't act unless you provide an actual value
+	echo "$lsb_dist" | tr '[:upper:]' '[:lower:]'
+)
+
+get_distro_version() (
+	local lsb_version="0"
+	# Every system that we officially support has /etc/os-release
+	if [ -r /etc/os-release ]; then
+		# shellcheck disable=SC1091
+		lsb_version="$(. /etc/os-release && echo "$VERSION_ID")"
+	fi
+
+	echo "$lsb_version"
+)
+
+is_network_configured() (
+	# Require the provisioner interface have both the host and nginx IP
+	if ! ip addr show "$TINKERBELL_NETWORK_INTERFACE" |
+		grep -q "$TINKERBELL_HOST_IP"; then
+		return 1
+	fi
+
+	if ! ip addr show "$TINKERBELL_NETWORK_INTERFACE" |
+		grep -q "$TINKERBELL_NGINX_IP"; then
+		return 1
+	fi
+
+	return 0
+)
+
+identify_network_strategy() (
+	local distro=$1
+	local version=$2
+
+	case "$distro" in
+	ubuntu)
+		if jq -n --exit-status '$distro_version >= 17.10' --argjson distro_version "$version" >/dev/null 2>&1; then
+			echo "setup_networking_netplan"
+		else
+			echo "setup_networking_ubuntu_legacy"
+		fi
+		;;
+	centos)
+		echo "setup_networking_centos"
+		;;
+	*)
+		echo "setup_networking_manually"
+		;;
+	esac
+)
+
+setup_networking() (
+	local distro=$1
+	local version=$2
+
+	setup_network_forwarding
+
+	if is_network_configured; then
+		echo "$INFO tinkerbell network interface is already configured"
+		return 0
+	fi
+
+	local strategy
+	strategy=$(identify_network_strategy "$distro" "$version")
+
+	"${strategy}" "$distro" "$version" # execute the strategy
+
+	if is_network_configured; then
+		echo "$INFO tinkerbell network interface configured successfully"
+	else
+		echo "$ERR tinkerbell network interface configuration failed"
+	fi
+)
+
+setup_networking_manually() (
+	local distro=$1
+	local version=$2
+
+	echo "$ERR this setup script cannot configure $distro ($version)"
+	echo "$BLANK please read this script's source and configure it manually."
+	#exit 1
+)
+
+setup_network_forwarding() (
+	# enable IP forwarding for docker
+	if [ "$(sysctl -n net.ipv4.ip_forward)" != "1" ]; then
+		if [ -d /etc/sysctl.d ]; then
+			echo "net.ipv4.ip_forward=1" >/etc/sysctl.d/99-tinkerbell.conf
+		elif [ -f /etc/sysctl.conf ]; then
+			echo "net.ipv4.ip_forward=1" >>/etc/sysctl.conf
+		fi
+
+		sysctl net.ipv4.ip_forward=1
+	fi
+)
+
+setup_networking_netplan() (
+	jq -n \
+		--arg interface "$TINKERBELL_NETWORK_INTERFACE" \
+		--arg cidr "$TINKERBELL_CIDR" \
+		--arg host_ip "$TINKERBELL_HOST_IP" \
+		--arg nginx_ip "$TINKERBELL_NGINX_IP" \
+		'{
+  network: {
+    renderer: "networkd",
+    ethernets: {
+      ($interface): {
+        addresses: [
+          "\($host_ip)/\($cidr)",
+          "\($nginx_ip)/\($cidr)"
+        ]
+      }
+    }
+  }
+}' >"/etc/netplan/${TINKERBELL_NETWORK_INTERFACE}.yaml"
+
+	ip link set "$TINKERBELL_NETWORK_INTERFACE" nomaster
+	netplan apply
+	echo "$INFO waiting for the network configuration to be applied by systemd-networkd"
+	sleep 3
+)
+
+setup_networking_ubuntu_legacy() (
+	if [ ! -f /etc/network/interfaces ]; then
+		echo "$ERR file /etc/network/interfaces not found"
+		exit 1
+	fi
+
+	if grep -q "$TINKERBELL_NETWORK_INTERFACE" /etc/network/interfaces; then
+		echo "$ERR /etc/network/interfaces already has an entry for $TINKERBELL_NETWORK_INTERFACE."
+		echo "$BLANK To prevent breaking your network, please edit /etc/network/interfaces"
+		echo "$BLANK and configure $TINKERBELL_NETWORK_INTERFACE as follows:"
+		generate_iface_config
+		echo ""
+		echo "$BLANK Then run the following commands:"
+		echo "$BLANK ip link set $TINKERBELL_NETWORK_INTERFACE nomaster"
+		echo "$BLANK ifdown $TINKERBELL_NETWORK_INTERFACE:0"
+		echo "$BLANK ifdown $TINKERBELL_NETWORK_INTERFACE:1"
+		echo "$BLANK ifup $TINKERBELL_NETWORK_INTERFACE:0"
+		echo "$BLANK ifup $TINKERBELL_NETWORK_INTERFACE:1"
+		exit 1
+	else
+		generate_iface_config >>/etc/network/interfaces
+		ip link set "$TINKERBELL_NETWORK_INTERFACE" nomaster
+		ifdown "$TINKERBELL_NETWORK_INTERFACE:0"
+		ifdown "$TINKERBELL_NETWORK_INTERFACE:1"
+		ifup "$TINKERBELL_NETWORK_INTERFACE:0"
+		ifup "$TINKERBELL_NETWORK_INTERFACE:1"
+	fi
+)
+
+generate_iface_config() (
+	cat <<EOF
+
+auto $TINKERBELL_NETWORK_INTERFACE:0
+iface $TINKERBELL_NETWORK_INTERFACE:0 inet static
+    address $TINKERBELL_HOST_IP/$TINKERBELL_CIDR
+    pre-up sleep 4
+
+auto $TINKERBELL_NETWORK_INTERFACE:1
+iface $TINKERBELL_NETWORK_INTERFACE:1 inet static
+    address $TINKERBELL_NGINX_IP/$TINKERBELL_CIDR
+    pre-up sleep 4
+EOF
+)
+
+setup_networking_centos() (
+	local HWADDRESS
+	local content
+
+	HWADDRESS=$(ip addr show "$TINKERBELL_NETWORK_INTERFACE" | grep ether | awk -F 'ether' '{print $2}' | cut -d" " -f2)
+	content=$(
+		cat <<EOF
+DEVICE=$TINKERBELL_NETWORK_INTERFACE
+ONBOOT=yes
+HWADDR=$HWADDRESS
+BOOTPROTO=static
+
+IPADDR0=$TINKERBELL_HOST_IP
+PREFIX0=$TINKERBELL_CIDR
+IPADDR1=$TINKERBELL_NGINX_IP
+PREFIX1=$TINKERBELL_CIDR
+EOF
+	)
+
+	local cfgfile="/etc/sysconfig/network-scripts/ifcfg-$TINKERBELL_NETWORK_INTERFACE"
+
+	if [ -f "$cfgfile" ]; then
+		echo "$ERR network config already exists: $cfgfile"
+		echo "$BLANK Please update it to match this configuration:"
+		echo "$content"
+		echo ""
+		echo "$BLANK Then, run the following commands:"
+		echo "ip link set $TINKERBELL_NETWORK_INTERFACE nomaster"
+		echo "ifup $TINKERBELL_NETWORK_INTERFACE"
+	fi
+
+	echo "$content" >"$cfgfile"
+
+	ip link set "$TINKERBELL_NETWORK_INTERFACE" nomaster
+	ifup "$TINKERBELL_NETWORK_INTERFACE"
+)
+
+setup_osie() (
+	mkdir -p "$STATEDIR/webroot"
+
+	local osie_current=$STATEDIR/webroot/misc/osie/current
+	local tink_workflow=$STATEDIR/webroot/workflow/
+	if [ ! -d "$osie_current" ] || [ ! -d "$tink_workflow" ]; then
+		mkdir -p "$osie_current"
+		mkdir -p "$tink_workflow"
+		pushd "$SCRATCH"
+
+		if [ -z "${TB_OSIE_TAR:-}" ]; then
+			curl "${OSIE_DOWNLOAD_LINK}" -o ./osie.tar.gz
+			tar -zxf osie.tar.gz
+		else
+			tar -zxf "$TB_OSIE_TAR"
+		fi
+
+		if pushd osie*/; then
+			if mv workflow-helper.sh workflow-helper-rc "$tink_workflow"; then
+				cp -r ./* "$osie_current"
+			else
+				echo "$ERR failed to move 'workflow-helper.sh' and 'workflow-helper-rc'"
+				exit 1
+			fi
+			popd
+		fi
+	else
+		echo "$INFO found existing osie files, skipping osie setup"
+	fi
+)
+
+check_container_status() (
+	local container_name="$1"
+	local container_id
+	container_id=$(docker-compose -f "$DEPLOYDIR/docker-compose.yml" ps -q "$container_name")
+
+	local start_moment
+	local current_status
+	start_moment=$(docker inspect "${container_id}" --format '{{ .State.StartedAt }}')
+	current_status=$(docker inspect "${container_id}" --format '{{ .State.Health.Status }}')
+
+	case "$current_status" in
+	starting)
+		: # move on to the events check
+		;;
+	healthy)
+		return 0
+		;;
+	unhealthy)
+		echo "$ERR $container_name is already running but not healthy. status: $current_status"
+		exit 1
+		;;
+	*)
+		echo "$ERR $container_name is already running but its state is a mystery. status: $current_status"
+		exit 1
+		;;
+	esac
+
+	local status
+	read -r status < <(docker events \
+		--since "$start_moment" \
+		--filter "container=$container_id" \
+		--filter "event=health_status" \
+		--format '{{.Status}}')
+
+	if [ "$status" != "health_status: healthy" ]; then
+		echo "$ERR $container_name is not healthy. status: $status"
+		exit 1
+	fi
+)
+
+generate_certificates() (
+	mkdir -p "$STATEDIR/certs"
+
+	if [ ! -f "$STATEDIR/certs/ca.json" ]; then
+		jq \
+			'.
+			 | .names[0].L = $facility
+			' \
+			"$DEPLOYDIR/tls/ca.in.json" \
+			--arg ip "$TINKERBELL_HOST_IP" \
+			--arg facility "$FACILITY" \
+			| tee "$STATEDIR/certs/ca.json"
+	fi
+
+	if [ ! -f "$STATEDIR/certs/server-csr.json" ]; then
+		jq \
+			'.
+			| .hosts += [ $ip, "tinkerbell.\($facility).packet.net" ]
+			| .names[0].L = $facility
+			| .hosts = (.hosts | sort | unique)
+			' \
+			"$DEPLOYDIR/tls/server-csr.in.json" \
+			--arg ip "$TINKERBELL_HOST_IP" \
+			--arg facility "$FACILITY" \
+			| tee "$STATEDIR/certs/server-csr.json"
+	fi
+
+	docker build --tag "tinkerbell-certs" "$DEPLOYDIR/tls"
+	docker run --rm \
+		--volume "$STATEDIR/certs:/certs" \
+		tinkerbell-certs
+
+	local certs_dir="/etc/docker/certs.d/$TINKERBELL_HOST_IP"
+
+	# copy public key to NGINX for workers
+	if ! cmp --quiet "$STATEDIR"/certs/ca.pem "$STATEDIR/webroot/workflow/ca.pem"; then
+		cp "$STATEDIR"/certs/ca.pem "$STATEDIR/webroot/workflow/ca.pem"
+	fi
+
+	# update host to trust registry certificate
+	if ! cmp --quiet "$STATEDIR/certs/ca.pem" "$certs_dir/tinkerbell.crt"; then
+		if [ ! -d "$certs_dir/tinkerbell.crt" ]; then
+			# The user will be told to create the directory
+			# in the next block, if copying the certs there
+			# fails.
+			mkdir -p "$certs_dir" || true >/dev/null 2>&1
+		fi
+		if ! cp "$STATEDIR/certs/ca.pem" "$certs_dir/tinkerbell.crt"; then
+			echo "$ERR please copy $STATEDIR/certs/ca.pem to $certs_dir/tinkerbell.crt"
+			echo "$BLANK and run $0 again:"
+
+			if [ ! -d "$certs_dir" ]; then
+				echo "mkdir -p '$certs_dir'"
+			fi
+			echo "cp '$STATEDIR/certs/ca.pem' '$certs_dir/tinkerbell.crt'"
+
+			exit 1
+		fi
+	fi
+)
+
+docker_login() (
+	echo -n "$TINKERBELL_REGISTRY_PASSWORD" | docker login -u="$TINKERBELL_REGISTRY_USERNAME" --password-stdin "$TINKERBELL_HOST_IP"
+)
+
+# This function takes an image specified as first parameter and it tags and
+# push it using the second one. useful to proxy images from a repository to
+# another.
+docker_mirror_image() (
+	local from=$1
+	local to=$2
+
+	docker pull "$from"
+	docker tag "$from" "$to"
+	docker push "$to"
+)
+
+start_registry() (
+	docker-compose -f "$DEPLOYDIR/docker-compose.yml" up --build -d registry
+	check_container_status "registry"
+)
+
+# This function supposes that the registry is up and running.
+# It configures with the required dependencies.
+bootstrap_docker_registry() (
+	docker_login
+
+    # osie looks for tink-worker:latest, so we have to play with it a bit
+    # https://github.com/tinkerbell/osie/blob/master/apps/workflow-helper.sh#L66
+	docker_mirror_image "${TINKERBELL_TINK_WORKER_IMAGE}" "${TINKERBELL_HOST_IP}/tink-worker:latest"
+)
+
+setup_docker_registry() (
+	local registry_images="$STATEDIR/registry"
+	if [ ! -d "$registry_images" ]; then
+		mkdir -p "$registry_images"
+	fi
+	start_registry
+	bootstrap_docker_registry
+)
+
+start_components() (
+	local components=(db hegel tink-server boots tink-cli nginx)
+	for comp in "${components[@]}"; do
+		docker-compose -f "$DEPLOYDIR/docker-compose.yml" up --build -d "$comp"
+		sleep 3
+		check_container_status "$comp"
+	done
+)
+
+command_exists() (
+	command -v "$@" >/dev/null 2>&1
+)
+
+check_command() (
+	if command_exists "$1"; then
+		echo "$BLANK Found prerequisite: $1"
+		return 0
+	else
+		echo "$ERR Prerequisite command not installed: $1"
+		return 1
+	fi
+)
+
+check_prerequisites() (
+	distro=$1
+	version=$2
+
+	echo "$INFO verifying prerequisites for $distro ($version)"
+	failed=0
+	check_command docker || failed=1
+	check_command docker-compose || failed=1
+	check_command ip || failed=1
+	check_command jq || failed=1
+
+	strategy=$(identify_network_strategy "$distro" "$version")
+	case "$strategy" in
+	"setup_networking_netplan")
+		check_command netplan || failed=1
+		;;
+	"setup_networking_ubuntu_legacy")
+		check_command ifdown || failed=1
+		check_command ifup || failed=1
+		;;
+	"setup_networking_centos")
+		check_command ifdown || failed=1
+		check_command ifup || failed=1
+		;;
+	"setup_networking_manually")
+		echo "$WARN this script cannot automatically configure your network."
+		;;
+	*)
+		echo "$ERR bug: unhandled network strategy: $strategy"
+		exit 1
+		;;
+	esac
+
+	if [ $failed -eq 1 ]; then
+		echo "$ERR Prerequisites not met. Please install the missing commands and re-run $0."
+		exit 1
+	fi
+)
+
+whats_next() (
+	echo "$NEXT  1. Enter /vagrant/deploy and run: source ../.env; docker-compose up -d"
+	echo "$BLANK 2. Try executing your fist workflow."
+	echo "$BLANK    Follow the steps described in https://tinkerbell.org/examples/hello-world/ to say 'Hello World!' with a workflow."
+)
+
+do_setup() (
+	# perform some very rudimentary platform detection
+	lsb_dist=$(get_distribution)
+	lsb_version=$(get_distro_version)
+
+	echo "$INFO starting tinkerbell stack setup"
+	check_prerequisites "$lsb_dist" "$lsb_version"
+
+	if [ ! -f "$ENV_FILE" ]; then
+		echo "$ERR Run './generate-envrc.sh network-interface > \"$ENV_FILE\"' before continuing."
+		exit 1
+	fi
+
+	# shellcheck disable=SC1090
+	source "$ENV_FILE"
+
+	setup_networking "$lsb_dist" "$lsb_version"
+
+	setup_osie
+	generate_certificates
+	setup_docker_registry
+
+	echo "$INFO tinkerbell stack setup completed successfully on $lsb_dist server"
+	whats_next
+)
+
+# wrapped up in a function so that we have some protection against only getting
+# half the file during "curl | sh"
+do_setup
diff --git a/assets/terraform-modules/tinkerbell-sandbox/main.tf b/assets/terraform-modules/tinkerbell-sandbox/main.tf
new file mode 100644
index 000000000..8ad70b5fe
--- /dev/null
+++ b/assets/terraform-modules/tinkerbell-sandbox/main.tf
@@ -0,0 +1,251 @@
+# Environment part.
+locals {
+  base_name = "tinkerbell-sandbox-${var.name}"
+}
+
+resource "libvirt_network" "network" {
+  name = local.base_name
+
+  # This addresses will have NAT setup on the used host.
+  addresses = [var.hosts_cidr]
+
+  # Disable DHCP as boots from Tinkerbell stack will act as one
+  # to assign IPs and schedule workflows.
+  dhcp {
+    enabled = false
+  }
+
+  dns {
+    # Do not try to resolve all DNS names, only the static ones
+    # configured below.
+    local_only = true
+
+    # Use 8.8.8.8 as default to follow defaults from Flatcar.
+    forwarders {
+      address = "8.8.8.8"
+    }
+
+    dynamic "hosts" {
+      for_each = var.dns_hosts
+
+      content {
+        hostname = hosts.value.hostname
+        ip       = hosts.value.ip
+      }
+    }
+  }
+}
+
+resource "libvirt_pool" "pool" {
+  name = local.base_name
+  type = "dir"
+  path = abspath(var.pool_path)
+}
+
+resource "libvirt_volume" "os_base" {
+  name   = "os-base"
+  source = abspath(var.flatcar_image_path)
+  pool   = libvirt_pool.pool.name
+  format = "qcow2"
+}
+
+# Provisioner.
+locals {
+  provisioner_netmask = split("/", var.hosts_cidr)[1]
+  provisioner_ips = [
+    # Tink requires 2 IP addresses.
+    # 0 host is network address.
+    # 1 host is gateway address.
+    # So we start with offset of 2.
+    cidrhost(var.hosts_cidr, 2),
+    cidrhost(var.hosts_cidr, 3),
+  ]
+  provisioner_gateway = cidrhost(var.hosts_cidr, 1)
+
+  assets_dir = "${path.module}/assets"
+}
+
+data "ct_config" "provisioner" {
+  content = ""
+
+  snippets = [
+    # Set hostname to easy identify machines.
+    <<EOF
+storage:
+  files:
+  - path: /etc/hostname
+    filesystem: root
+    mode: 0420
+    contents:
+      inline: provisioner
+EOF
+    ,
+    # Disable updates for stability.
+    <<EOF
+systemd:
+  units:
+  - name: locksmithd.service
+    mask: true
+  - name: update-engine.service
+    mask: true
+EOF
+    ,
+    # Enable docker to bring up containers after reboot.
+    <<EOF
+systemd:
+  units:
+  - name: docker.service
+    enabled: true
+EOF
+    ,
+    # Enable time sync to avoid issues with date and time.
+    <<EOF
+systemd:
+  units:
+  - name: systemd-timesyncd.service
+    enabled: true
+EOF
+    ,
+    # Set SSH keys for core user to be able to SSH into the machine.
+    # Also configure root user as Tink is configured as root.
+    <<EOF
+passwd:
+  users:
+  - name: core
+    ssh_authorized_keys:
+%{for key in var.ssh_keys~}
+    - ${key}
+%{endfor~}
+  - name: root
+    ssh_authorized_keys:
+%{for key in var.ssh_keys~}
+    - ${key}
+%{endfor~}
+EOF
+    ,
+    # Configure DNS server as we do not use DHCP server.
+    <<EOF
+storage:
+  files:
+    - path: /etc/systemd/resolved.conf.d/dns_servers.conf
+      filesystem: root
+      mode: 0644
+      contents:
+        inline: |
+          [Resolve]
+          DNS=9.9.9.9
+          Domains=~.
+EOF
+    ,
+    # Configure interface with both IP addresses as Tinkerbell requires.
+    <<EOF
+storage:
+  files:
+    - path: /etc/systemd/network/30-tink.network
+      filesystem: root
+      mode: 0644
+      contents:
+        inline: |
+          [Match]
+          Name=eth0
+
+          [Network]
+          Address=${local.provisioner_ips[0]}/${local.provisioner_netmask}
+          Address=${local.provisioner_ips[1]}/${local.provisioner_netmask}
+          Gateway=${local.provisioner_gateway}
+EOF
+    ,
+  ]
+}
+
+resource "libvirt_ignition" "provisioner" {
+  name = "provisioner-ignition"
+  pool = libvirt_pool.pool.name
+
+  content = data.ct_config.provisioner.rendered
+}
+
+resource "libvirt_volume" "provisioner" {
+  name           = "provisioner"
+  base_volume_id = libvirt_volume.os_base.id
+  pool           = libvirt_pool.pool.name
+  format         = "qcow2"
+  size           = 20 * 1000 * 1000 * 1000 # 20GB
+}
+
+resource "libvirt_domain" "provisioner" {
+  name   = "${local.base_name}-provisioner"
+  vcpu   = 4
+  memory = 4096
+
+  disk {
+    volume_id = libvirt_volume.provisioner.id
+  }
+
+  fw_cfg_name     = "opt/org.flatcar-linux/config"
+  coreos_ignition = libvirt_ignition.provisioner.id
+
+  # Setup SPICE server for debugging.
+  graphics {
+    listen_type = "address"
+  }
+
+  network_interface {
+    network_id = libvirt_network.network.id
+    hostname   = "provisioner"
+  }
+
+  # Setup console, so 'virsh console' can be used to debug
+  # connectivity issues.
+  console {
+    type        = "pty"
+    target_port = "0"
+  }
+
+  connection {
+    type = "ssh"
+    user = "root"
+    host = local.provisioner_ips[0]
+  }
+
+  provisioner "remote-exec" {
+    inline = [
+      "mkdir -p /root/tink/deploy",
+    ]
+  }
+
+  provisioner "file" {
+    source      = "${local.assets_dir}/setup.sh"
+    destination = "/root/tink/setup.sh"
+  }
+
+  provisioner "file" {
+    source      = "${local.assets_dir}/generate-envrc.sh"
+    destination = "/root/tink/generate-envrc.sh"
+  }
+
+  provisioner "file" {
+    source      = "${local.assets_dir}/deploy"
+    destination = "/root/tink"
+  }
+
+  provisioner "remote-exec" {
+    inline = [
+      "set -e",
+      "set -o pipefail",
+      "mkdir -p /opt/bin",
+      "test -f /opt/bin/docker-compose || wget https://github.com/docker/compose/releases/download/1.27.4/docker-compose-Linux-x86_64 -O /opt/bin/docker-compose",
+      "chmod +x /opt/bin/docker-compose",
+      "chmod +x /root/tink/*.sh /root/tink/deploy/tls/*.sh",
+      "/root/tink/generate-envrc.sh eth0 > /root/tink/.env",
+      "sed -i 's/192.168.1.1/${local.provisioner_ips[0]}/g' /root/tink/.env",
+      "sed -i 's/192.168.1.2/${local.provisioner_ips[1]}/g' /root/tink/.env",
+      "echo 'export PATH=\"/opt/bin:$PATH\"' >> /root/tink/.env",
+      "bash -c 'until test -f /opt/bin/docker-compose; do echo \"Waiting for docker-compose binary\"; sleep 1; done'",
+      "bash -c 'cd /root/tink && source .env && ./setup.sh'",
+      "bash -c 'cd /root/tink/deploy && source ../.env && docker-compose up -d'",
+      "cd /root/tink/deploy/flatcar-install && docker build -t ${local.provisioner_ips[0]}/flatcar-install .",
+      "docker push ${local.provisioner_ips[0]}/flatcar-install",
+    ]
+  }
+}
diff --git a/assets/terraform-modules/tinkerbell-sandbox/outputs.tf b/assets/terraform-modules/tinkerbell-sandbox/outputs.tf
new file mode 100644
index 000000000..0eace99b0
--- /dev/null
+++ b/assets/terraform-modules/tinkerbell-sandbox/outputs.tf
@@ -0,0 +1,29 @@
+output "provisioner_ip" {
+  description = "IP address where Tink server is exposed."
+  value       = local.provisioner_ips[0]
+}
+
+output "sandbox_name" {
+  description = "Sandbox name, which should be passed to worker module instances."
+  value       = local.base_name
+}
+
+output "volumes_pool_name" {
+  description = "Name of the storage pool created for sandbox. Should be passed to worker module instances."
+  value       = libvirt_pool.pool.name
+}
+
+output "network_id" {
+  description = "ID of sandbox network. Should be passed to worker module instances."
+  value       = libvirt_network.network.id
+}
+
+output "netmask" {
+  description = "Calculated hosts CIDR network mask for Tinkerbell hardware entries for workers."
+  value       = cidrnetmask(var.hosts_cidr)
+}
+
+output "gateway" {
+  description = "Gateway IP address for Tink workers to have DNS resolution and internet access."
+  value       = local.provisioner_gateway
+}
diff --git a/assets/terraform-modules/tinkerbell-sandbox/variables.tf b/assets/terraform-modules/tinkerbell-sandbox/variables.tf
new file mode 100644
index 000000000..84f89a589
--- /dev/null
+++ b/assets/terraform-modules/tinkerbell-sandbox/variables.tf
@@ -0,0 +1,32 @@
+variable "name" {
+  type        = string
+  description = "Unique identifier of created sandbox used to identify created libvirt objects."
+}
+
+variable "ssh_keys" {
+  type        = list(string)
+  description = "List of SSH keys for provisioner machine for core and root users."
+}
+
+variable "hosts_cidr" {
+  type        = string
+  description = "CIDR for all hosts."
+}
+
+variable "flatcar_image_path" {
+  type        = string
+  description = "Path to Flatcar image."
+}
+
+variable "pool_path" {
+  type        = string
+  description = "Path to store virtual machines disk images."
+}
+
+variable "dns_hosts" {
+  type = list(object({
+    hostname = string
+    ip       = string
+  }))
+  description = "List of DNS entries to add to libvirt DNS server."
+}
diff --git a/assets/terraform-modules/tinkerbell-sandbox/versions.tf b/assets/terraform-modules/tinkerbell-sandbox/versions.tf
new file mode 100644
index 000000000..d28f30b0e
--- /dev/null
+++ b/assets/terraform-modules/tinkerbell-sandbox/versions.tf
@@ -0,0 +1,13 @@
+terraform {
+  required_version = ">= 0.13"
+  required_providers {
+    libvirt = {
+      source  = "dmacvicar/libvirt"
+      version = "0.6.2"
+    }
+    ct = {
+      source  = "poseidon/ct"
+      version = "0.6.1"
+    }
+  }
+}
diff --git a/assets/terraform-modules/tinkerbell-sandbox/worker/assets/hardware_data.tpl b/assets/terraform-modules/tinkerbell-sandbox/worker/assets/hardware_data.tpl
new file mode 100644
index 000000000..3fe1fc0df
--- /dev/null
+++ b/assets/terraform-modules/tinkerbell-sandbox/worker/assets/hardware_data.tpl
@@ -0,0 +1,31 @@
+{
+  "id": "${id}",
+  "metadata": {
+    "facility": {
+      "facility_code": "${facility_code}",
+      "plan_slug": "${plan_slug}",
+      "plan_version_slug": ""
+    },
+    "instance": {},
+    "state": ""
+  },
+  "network": {
+    "interfaces": [
+      {
+        "dhcp": {
+          "arch": "x86_64",
+          "ip": {
+            "address": "${address}",
+            "gateway": "${gateway}",
+            "netmask": "${netmask}"
+          },
+          "mac": "${mac}"
+        },
+        "netboot": {
+          "allow_pxe": true,
+          "allow_workflow": true
+        }
+      }
+    ]
+  }
+}
diff --git a/assets/terraform-modules/tinkerbell-sandbox/worker/main.tf b/assets/terraform-modules/tinkerbell-sandbox/worker/main.tf
new file mode 100644
index 000000000..919711dfb
--- /dev/null
+++ b/assets/terraform-modules/tinkerbell-sandbox/worker/main.tf
@@ -0,0 +1,64 @@
+resource "libvirt_volume" "worker" {
+  name = var.name
+  pool = var.sandbox.volumes_pool_name
+  size = 20 * 1000 * 1000 * 1000 # 20GB
+}
+
+# Generate random numbers in hex format to generate worker MAC address.
+resource "random_id" "mac_address" {
+  count       = 5
+  byte_length = 1
+}
+
+locals {
+  # 52 is a Locally Administered Address Range, so it's safe to use.
+  mac = "52:${join(":", random_id.mac_address.*.hex)}"
+}
+
+resource "libvirt_domain" "worker" {
+  name   = "${var.sandbox.sandbox_name}-${var.name}"
+  vcpu   = 4
+  memory = 4096
+
+  disk {
+    volume_id = libvirt_volume.worker.id
+  }
+
+  # Setup SPICE server for debugging.
+  graphics {
+    listen_type = "address"
+  }
+
+  # Primarily boot from disk, but also allow network boot to run Tinkerbell workflow,
+  # which should install host OS.
+  boot_device {
+    dev = ["hd", "network"]
+  }
+
+  # Setup console, so 'virsh console' can be used to debug
+  # connectivity issues.
+  console {
+    type        = "pty"
+    target_port = "0"
+  }
+
+  network_interface {
+    network_id = var.sandbox.network_id
+    hostname   = var.name
+    mac        = local.mac
+  }
+}
+
+resource "random_uuid" "worker" {}
+
+resource "tinkerbell_hardware" "worker" {
+  data = templatefile("${path.module}/assets/hardware_data.tpl", {
+    id            = random_uuid.worker.result
+    facility_code = "libvirt"
+    plan_slug     = "libvirt"
+    address       = var.ip
+    mac           = local.mac
+    gateway       = var.sandbox.gateway
+    netmask       = var.sandbox.netmask
+  })
+}
diff --git a/assets/terraform-modules/tinkerbell-sandbox/worker/variables.tf b/assets/terraform-modules/tinkerbell-sandbox/worker/variables.tf
new file mode 100644
index 000000000..e075f310f
--- /dev/null
+++ b/assets/terraform-modules/tinkerbell-sandbox/worker/variables.tf
@@ -0,0 +1,20 @@
+variable "name" {
+  type        = string
+  description = "Worker hostname."
+}
+
+variable "ip" {
+  type        = string
+  description = "IP address to assign to the node."
+}
+
+variable "sandbox" {
+  description = "Output from main sandbox module."
+  type = object({
+    sandbox_name      = string
+    volumes_pool_name = string
+    network_id        = string
+    netmask           = string
+    gateway           = string
+  })
+}
diff --git a/assets/terraform-modules/tinkerbell-sandbox/worker/versions.tf b/assets/terraform-modules/tinkerbell-sandbox/worker/versions.tf
new file mode 100644
index 000000000..9ffc593fc
--- /dev/null
+++ b/assets/terraform-modules/tinkerbell-sandbox/worker/versions.tf
@@ -0,0 +1,21 @@
+terraform {
+  required_version = ">= 0.13"
+  required_providers {
+    tinkerbell = {
+      source  = "tinkerbell/tinkerbell"
+      version = "0.1.0"
+    }
+    libvirt = {
+      source  = "dmacvicar/libvirt"
+      version = "0.6.2"
+    }
+    ct = {
+      source  = "poseidon/ct"
+      version = "0.6.1"
+    }
+    random = {
+      source  = "hashicorp/random"
+      version = "3.0.0"
+    }
+  }
+}
diff --git a/ci/tinkerbell/tinkerbell-cluster.lokocfg.envsubst b/ci/tinkerbell/tinkerbell-cluster.lokocfg.envsubst
new file mode 100644
index 000000000..b260b68dc
--- /dev/null
+++ b/ci/tinkerbell/tinkerbell-cluster.lokocfg.envsubst
@@ -0,0 +1,27 @@
+cluster "tinkerbell" {
+  asset_dir       = pathexpand("~/lokoctl-assets")
+  ssh_public_keys = [file(pathexpand("~/.ssh/id_rsa.pub"))]
+
+  experimental_sandbox {
+    hosts_cidr         = "10.17.3.0/24"
+    flatcar_image_path = "/var/tmp/flatcar_production_qemu_image.img"
+    pool_path          = "/var/tmp/pool"
+  }
+
+  # Tinkerbell hardware entry must exist with this IP address.
+  controller_ip_addresses = [
+    "10.17.3.4",
+  ]
+
+  name = "tink"
+
+  dns_zone = "example.com"
+
+  worker_pool "foo" {
+    ip_addresses = [
+      "10.17.3.5"
+    ]
+
+    ssh_public_keys = [file(pathexpand("~/.ssh/id_rsa.pub"))]
+  }
+}
diff --git a/cli/cmd/cluster/cluster.go b/cli/cmd/cluster/cluster.go
index ce82a7af9..97118c399 100644
--- a/cli/cmd/cluster/cluster.go
+++ b/cli/cmd/cluster/cluster.go
@@ -35,6 +35,7 @@ import (
 	_ "github.com/kinvolk/lokomotive/pkg/platform/aws"
 	_ "github.com/kinvolk/lokomotive/pkg/platform/baremetal"
 	_ "github.com/kinvolk/lokomotive/pkg/platform/packet"
+	_ "github.com/kinvolk/lokomotive/pkg/platform/tinkerbell"
 
 	// Register backends by adding an anonymous import.
 	_ "github.com/kinvolk/lokomotive/pkg/backend/s3"
diff --git a/docs/configuration-reference/platforms/tinkerbell.md b/docs/configuration-reference/platforms/tinkerbell.md
new file mode 100644
index 000000000..129584468
--- /dev/null
+++ b/docs/configuration-reference/platforms/tinkerbell.md
@@ -0,0 +1,185 @@
+# Lokomotive Tinkerbell configuration reference
+
+## Contents
+
+* [Introduction](#introduction)
+* [Prerequisites](#prerequisites)
+* [Configuration](#configuration)
+* [Attribute reference](#attribute-reference)
+* [Applying](#applying)
+* [Destroying](#destroying)
+
+## Introduction
+
+This configuration reference provides information on configuring a Lokomotive cluster on bare metal
+using Tinkerbell with all the configuration options available to the user.
+
+## Prerequisites
+
+* `lokoctl` [installed locally.](../../installer/lokoctl.md)
+* `kubectl` installed locally to access the Kubernetes cluster.
+
+### Configuration
+
+To create a Lokomotive cluster, we need to define a configuration.
+
+Example configuration file:
+
+```tf
+# mycluster.lokocfg
+variable "state_s3_bucket" {}
+variable "state_s3_key" {}
+variable "state_s3_region" {}
+variable "lock_dynamodb_table" {}
+
+backend "s3" {
+  bucket         = var.state_s3_bucket
+  key            = var.state_s3_key
+  region         = var.state_s3_region
+  dynamodb_table = var.lock_dynamodb_table
+}
+
+# backend "local" {
+#   path = "path/to/local/file"
+#}
+
+variable "asset_dir" {}
+variable "cluster_name" {}
+variable "dns_zone" {}
+variable "ssh_public_keys" {}
+variable "controller_ip_addresses" {}
+variable "controller_clc_snippets" {}
+variable "controller_flatcar_install_base_url" {}
+variable "os_channel" {}
+variable "os_version" {}
+variable "hosts_cidr" {}
+variable "flatcar_image_path" {}
+variable "pool_path" {}
+variable "enable_aggregation" {}
+variable "enable_reporting" {}
+variable "pod_cidr" {}
+variable "service_cidr" {}
+variable "cluster_domain_suffix" {}
+variable "certs_validity_period_hours" {}
+variable "network_mtu" {}
+variable "disable_self_hosted_kubelet" {}
+variable "ip_addresses" {}
+variable "flatcar_install_base_url" {}
+variable "clc_snippets" {}
+variable "labels" {}
+variable "taints" {}
+
+cluster "tinkerbell" {
+  asset_dir = var.asset_dir
+
+  name = var.cluster_name
+
+  dns_zone = var.dns_zone
+
+  ssh_public_keys = var.ssh_public_keys
+
+  controller_ip_addresses = var.controller_ip_addresses
+
+  controller_clc_snippets = var.controller_clc_snippets
+
+  controller_flatcar_install_base_url = var.controller_flatcar_install_base_url
+
+  os_channel = var.os_channel
+
+  os_version = var.os_version
+
+  experimental_sandbox {
+    hosts_cidr         = var.hosts_cidr
+    flatcar_image_path = var.flatcar_image_path
+    pool_path          = var.pool_path
+  }
+
+  enable_aggregation = var.enable_aggregation
+
+  disable_self_hosted_kubelet = var.disable_self_hosted_kubelet
+
+  enable_reporting = var.enable_reporting
+
+  pod_cidr = var.pod_cidr
+
+  service_cidr = var.service_cidr
+
+  cluster_domain_suffix = var.cluster_domain_suffix
+
+  certs_validity_period_hours = var.certs_validity_period_hours
+
+  network_mtu = var.network_mtu
+
+  disable_self_hosted_kubelet = var.disable_self_hosted_kubelet
+
+  worker_pool "pool1" {
+    ip_addresses = var.ip_addresses
+
+    ssh_public_keys = var.ssh_public_keys
+
+    os_channel = var.os_channel
+
+    os_version = var.os_version
+
+    flatcar_install_base_url = var.flatcar_install_base_url
+
+    clc_snippets = var.clc_snippets
+
+    labels = var.labels
+
+    taints = var.taints
+  }
+}
+```
+
+## Attribute reference
+
+| Argument                                  | Description                                                                                                                                                                                                                                | Default         | Type         | Required |
+|-------------------------------------------|--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------|-:-:-------------|-:-:----------|-:-:------|
+| `asset_dir`                               | Location where Lokomotive stores cluster assets.                                                                                                                                                                                           | -               | string       | true     |
+| `name`                                    | Name of the cluster.                                                                                                                                                                                                                       | -               | string       | true     |
+| `dns_zone`                                | DNS Zone name which will be used for cluster DNS entries. E.g. If you set it to "example.com", then `<name>.example.com` must be set to point to `controller_ip_addresses`. With `experimental_sandbox` DNS entries are set automatically. | -               | string       | true     |
+| `ssh_public_keys`                         | List of SSH public keys for user `core` on controller nodes. Each element must be specified in a valid OpenSSH public key format, as defined in RFC 4253 Section 6.6, e.g. "ssh-rsa AAAAB3N...".                                           | -               | list(string) | true     |
+| `controller_ip_addresses`                 | List of IP addresses of Tinkerbell hardware to be used for controller nodes. With `experimental_sandbox`, machines will be created with this IP addresses.                                                                                 | -               | list(string) | true     |
+| `controller_clc_snippets`                 | Controller Flatcar Container Linux Config snippets.                                                                                                                                                                                        | []              | list(string) | false    |
+| `controller_flatcar_install_base_url`     | URL passed to `flatcar-install` script to fetch Flatcar images from.                                                                                                                                                                       | -               | string       | false    |
+| `os_channel`                              | Flatcar Container Linux channel to install from (stable, beta, alpha, edge).                                                                                                                                                               | "stable"        | string       | false    |
+| `os_version`                              | Flatcar Container Linux version to install. Version such as "2303.3.1" or "current".                                                                                                                                                       | "current"       | string       | false    |
+| `experimental_sandbox`                    | Configuration block for experimental local Tinkerbell sandbox setup using libvirt.                                                                                                                                                         | -               | object       | false    |
+| `experimental_sandbox.hosts_cidr`         | CIDR for all hosts in the cluster, which will be NATed to the outside world for internet access.                                                                                                                                           | -               | string       | true     |
+| `experimental_sandbox.flatcar_image_path` | Absolute path on local filesystem to unpacked Flatcar QEMU image, which will be used as a base OS image for Tinkerbell provisioner server.                                                                                                 | -               | string       | true     |
+| `experimental_sandbox.pool_path           | Absolute path on local filesystem where all VM disk images will be stored. At least 25GB of free disk space is required.                                                                                                                   | -               | string       | true     |
+| `enable_aggregation`                      | Enable the Kubernetes Aggregation Layer.                                                                                                                                                                                                   | true            | bool         | false    |
+| `enable_reporting`                        | Enables usage or analytics reporting to upstream.                                                                                                                                                                                          | false           | bool         | false    |
+| `pod_cidr`                                | CIDR IPv4 range to assign Kubernetes pods.                                                                                                                                                                                                 | "10.2.0.0/16"   | string       | false    |
+| `service_cidr`                            | CIDR IPv4 range to assign Kubernetes services.                                                                                                                                                                                             | "10.3.0.0/16"   | string       | false    |
+| `cluster_domain_suffix`                   | Cluster's DNS domain.                                                                                                                                                                                                                      | "cluster.local" | string       | false    |
+| `certs_validity_period_hours`             | Validity of all the certificates in hours.                                                                                                                                                                                                 | 8760            | number       | false    |
+| `network_mtu`                             | Physical Network MTU.                                                                                                                                                                                                                      | 1500            | number       | false    |
+| `disable_self_hosted_kubelet`             | If true, self-hosted kubelet won't be installed on the cluster.                                                                                                                                                                            | false           | bool         | false    |
+| `worker_pool`                             | Configuration block for worker pools. There can be more than one.                                                                                                                                                                          | -               | list(object) | true     |
+| `worker_pool.ip_addresses`                | List of IP addresses of Tinkerbell hardware to be used for worker pool nodes. With `experimental_sandbox`, machines will be created with this IP addresses.                                                                                | -               | list(string) | true     |
+| `worker_pool.ssh_public_keys`             | List of SSH public keys for user `core` on worker pool nodes. Each element must be specified in a valid OpenSSH public key format, as defined in RFC 4253 Section 6.6, e.g. "ssh-rsa AAAAB3N...".                                          | []              | list(string) | false    |
+| `worker_pool.os_channel`                  | Flatcar Container Linux channel to install from (stable, beta, alpha, edge).                                                                                                                                                               | "stable"        | string       | false    |
+| `worker_pool.os_version`                  | Flatcar Container Linux version to install. Version such as "2303.3.1" or "current".                                                                                                                                                       | "current"       | string       | false    |
+| `worker_pool.flatcar_install_base_url`    | URL passed to `flatcar-install` script to fetch Flatcar images from.                                                                                                                                                                       | -               | string       | false    |
+| `worker_pool.clc_snippets`                | Flatcar Container Linux Config snippets for nodes in the worker pool.                                                                                                                                                                      | []              | list(string) | false    |
+| `worker_pool.labels`                      | Map of extra Kubernetes Node labels for worker nodes.                                                                                                                                                                                      | -               | map(string)  | false    |
+| `worker_pool.taints`                      | Map of Taints to assign to worker nodes.                                                                                                                                                                                                   | -               | map(string)  | false    |
+
+
+## Applying
+
+To create the cluster, execute the following command:
+
+```console
+lokoctl cluster apply
+```
+
+## Destroying
+
+To destroy the Lokomotive cluster, execute the following command:
+
+```console
+lokoctl cluster destroy --confirm
+```
diff --git a/docs/quickstarts/tinkerbell.md b/docs/quickstarts/tinkerbell.md
new file mode 100644
index 000000000..3e19412fc
--- /dev/null
+++ b/docs/quickstarts/tinkerbell.md
@@ -0,0 +1,397 @@
+# Lokomotive Tinkerbell quickstart guide
+
+## Contents
+
+* [Introduction](#introduction)
+* [Requirements](#requirements)
+* [Step 1: Install lokoctl](#step-1-install-lokoctl)
+* [Step 2: Download Flatcar Container Linux image](#step-2-download-flatcar-container-linux-image)
+* [Step 3: Create a cluster configuration](#step-3-create-a-cluster-configuration)
+* [Step 4: Deploy the cluster](#step-4-deploy-the-cluster)
+* [Verification](#verification)
+* [Cleanup](#cleanup)
+* [Troubleshooting](#troubleshooting)
+
+## Introduction
+
+This guide shows how to create a Lokomotive cluster using [Tinkerbell]. By the
+end of this guide, you'll have a basic Lokomotive cluster running on bare metal machines provisioned
+using Tinkerbell with a demo application deployed.
+
+Lokomotive runs on top of [Flatcar Container Linux](https://www.flatcar-linux.org/). This guide
+uses the `stable` channel.
+
+This guide uses experimental Tinkerbell sandbox running locally using [libvirt] virtual machines.
+
+Lokomotive can store Terraform state [locally](../configuration-reference/backend/local.md)
+or remotely within an [AWS S3 bucket](../configuration-reference/backend/s3.md). By default, Lokomotive
+stores Terraform state locally.
+
+[Lokomotive components](../concepts/components.md) complement the "stock" Kubernetes functionality
+by adding features such as load balancing, persistent storage and monitoring to a cluster. To keep
+this guide short you will deploy a single component - `httpbin` - which serves as a demo
+application to verify the cluster behaves as expected.
+
+## Requirements
+
+* [libvirt] installed locally and running.
+* Host machine with at least 25 GB of free disk space available locally.
+* Host machine with at least 4 CPU threads.
+* Host machine with at least 8 GB of RAM.
+* An SSH key pair for accessing the cluster nodes.
+* Terraform `v0.13.x`
+  [installed](https://learn.hashicorp.com/terraform/getting-started/install.html#install-terraform).
+* The `libvirt` Terraform provider `v0.6.2`
+  [installed](https://github.com/dmacvicar/terraform-provider-libvirt#installing).
+* `kubectl` [installed](https://kubernetes.io/docs/tasks/tools/install-kubectl/).
+
+>NOTE: The `kubectl` version used to interact with a Kubernetes cluster needs to be compatible with
+>the version of the Kubernetes control plane. Ideally you should install a `kubectl` binary whose
+>version is identical to the Kubernetes control plane included with a Lokomotive release. However,
+>some degree of version "skew" is tolerated - see the Kubernetes
+>[version skew policy](https://kubernetes.io/docs/setup/release/version-skew-policy/) document for
+>more information. You can determine the version of the Kubernetes control plane included with a
+>Lokomotive release by looking at the [release notes][releases].
+
+## Steps
+
+### Step 1: Install lokoctl
+
+`lokoctl` is the command-line interface for managing Lokomotive clusters.
+
+Download the latest `lokoctl` binary for your platform:
+
+```console
+export os=linux  # For macOS, use `os=darwin`.
+
+export release=$(curl -s https://api.github.com/repos/kinvolk/lokomotive/releases | jq -r '.[0].name' | tr -d v)
+curl -LO "https://github.com/kinvolk/lokomotive/releases/download/v${release}/lokoctl_${release}_${os}_amd64.tar.gz"
+```
+
+Extract the binary and copy it to a place under your `$PATH`:
+
+```console
+tar zxvf lokoctl_${release}_${os}_amd64.tar.gz
+sudo cp lokoctl_${release}_${os}_amd64/lokoctl /usr/local/bin
+rm -rf lokoctl_${release}_${os}_amd64*
+```
+
+### Step 2: Download Flatcar Container Linux image
+
+Before we deploy the cluster, we need to download Flatcar Container Linux image, which will be used as a
+base OS image for Tinkerbell provisioner server.
+
+```bash
+sudo dnf install wget bzip2 # or sudo apt install wget bzip2
+wget https://stable.release.flatcar-linux.net/amd64-usr/current/flatcar_production_qemu_image.img.bz2
+bunzip2 flatcar_production_qemu_image.img.bz2
+```
+
+After you download the image, get absolute path of it using the following command:
+```bash
+realpath flatcar_production_qemu_image.img
+```
+
+It will be needed for next step.
+
+### Step 3: Create a cluster configuration
+
+Create a directory for the cluster-related files and navigate to it:
+
+```console
+mkdir lokomotive-demo && cd lokomotive-demo
+```
+
+Create a file named `cluster.lokocfg` with the following contents:
+
+```hcl
+cluster "tinkerbell" {
+  asset_dir               = "./assets"
+  name                    = "demo"
+  dns_zone                = "example.com"
+  ssh_public_keys         = ["ssh-rsa AAAA..."]
+  controller_ip_addresses = ["10.17.3.4"]
+
+  //os_channel       = "stable"
+  //os_version       = "current"
+
+  experimental_sandbox {
+    pool_path          = "/opt/pool"
+    flatcar_image_path = "/opt/flatcar_production_qemu_image.img"
+    hosts_cidr         = "10.17.3.0/24"
+  }
+
+  worker_pool "pool1" {
+    ip_addresses    = ["10.17.3.5"]
+
+    //os_channel    = "stable"
+    //os_version    = "current"
+  }
+}
+
+# A demo application.
+component "httpbin" {
+  ingress_host = "httpbin.example.com"
+}
+```
+
+Replace the parameters above using the following information:
+
+- `ssh_public_keys` - A list of strings representing the *contents* of the public SSH keys which should
+  be authorized on cluster nodes.
+- `pool_path` - Absolute path where VM disk images will be stored. Can be set output of `echo $(pwd)/pool` command.
+- `flatcar_image_path` - This should be set to the value obtained from previous step.
+
+The rest of the parameters may be left as-is. For more information about the configuration options
+see the [configuration reference](../configuration-reference/platforms/tinkerbell.md).
+
+### Step 4: Deploy the cluster
+
+Add a private key corresponding to one of the public keys specified in `ssh_public_keys` to your `ssh-agent`:
+
+```bash
+ssh-add ~/.ssh/id_rsa
+ssh-add -L
+```
+
+Deploy the cluster:
+
+```console
+lokoctl cluster apply -v
+```
+
+The deployment process typically takes about 15 minutes. Upon successful completion, an output
+similar to the following is shown:
+
+```
+Your configurations are stored in ./assets
+
+Now checking health and readiness of the cluster nodes ...
+
+Node                             Ready    Reason          Message
+
+lokomotive-demo-controller-0       True     KubeletReady    kubelet is posting ready status
+lokomotive-demo-pool-1-worker-0    True     KubeletReady    kubelet is posting ready status
+lokomotive-demo-pool-1-worker-1    True     KubeletReady    kubelet is posting ready status
+
+Success - cluster is healthy and nodes are ready!
+```
+
+## Verification
+
+Use the generated `kubeconfig` file to access the cluster:
+
+```console
+export KUBECONFIG=$(pwd)/assets/cluster-assets/auth/kubeconfig
+kubectl get nodes
+```
+
+Sample output:
+
+```
+NAME                            STATUS   ROLES    AGE   VERSION
+lokomotive-demo-controller-0      Ready    <none>   33m   v1.17.4
+lokomotive-demo-pool-1-worker-0   Ready    <none>   33m   v1.17.4
+lokomotive-demo-pool-1-worker-1   Ready    <none>   33m   v1.17.4
+```
+
+Verify all pods are ready:
+
+```console
+kubectl get pods -A
+```
+
+Verify you can access httpbin:
+
+```console
+kubectl -n httpbin port-forward svc/httpbin 8080
+
+# In a new terminal.
+curl http://localhost:8080/get
+```
+
+Sample output:
+
+```
+{
+  "args": {},
+  "headers": {
+    "Accept": "*/*",
+    "Host": "localhost:8080",
+    "User-Agent": "curl/7.70.0"
+  },
+  "origin": "127.0.0.1",
+  "url": "http://localhost:8080/get"
+}
+```
+
+## Using the cluster
+
+At this point you should have access to a Lokomotive cluster and can use it to deploy applications.
+
+If you don't have any Kubernetes experience, you can check out the [Kubernetes
+Basics](https://kubernetes.io/docs/tutorials/kubernetes-basics/deploy-app/deploy-intro/) tutorial.
+
+>NOTE: Lokomotive uses a relatively restrictive Pod Security Policy by default. This policy
+>disallows running containers as root. Refer to the
+>[Pod Security Policy documentation](../concepts/securing-lokomotive-cluster.md#cluster-wide-pod-security-policy)
+>for more details.
+
+## Cleanup
+
+To destroy the cluster, execute the following command:
+
+```console
+lokoctl cluster destroy -v
+```
+
+Confirm you want to destroy the cluster by typing `yes` and hitting **Enter**.
+
+You can now safely delete the directory created for this guide if you no longer need it.
+
+## Troubleshooting
+
+If some provisioning error occurs, the best strategy is to destroy resources which has been created
+and start over. See [Cleanup](#cleanup) section for instruction how to clean things up.
+
+### Stuck at "copy controller secrets"
+
+```
+...
+module.packet-lokomotive-demo.null_resource.copy-controller-secrets: Still creating... (8m30s elapsed)
+module.packet-lokomotive-demo.null_resource.copy-controller-secrets: Still creating... (8m40s elapsed)
+...
+```
+
+In case the deployment process seems to hang at the `copy-controller-secrets` phase for a long
+time, check the following:
+
+- Verify the correct private SSH key was added to `ssh-agent`.
+- Verify that you can SSH into the created controller node from the machine running `lokoctl`.
+
+### Cluster node provisioning failed
+
+If cluster machine did not start with Flatcar, you need to investigate why provisioning failed. This can be
+done by opening SSH session to provisioner machine and then accessing `tink` CLI using the following commands:
+```sh
+ssh root@10.17.3.2
+source tink/.env && docker-compose -f tink/deploy/docker-compose.yml exec tink-cli sh
+```
+
+#### Checking hardware entries
+
+With `tink` CLI available, you can check if hardware has been registered properly:
+```sh
+tink hardware list
+```
+
+It should return output similar to this:
+```console
++--------------------------------------+-------------------+------------+----------+
+| ID                                   | MAC ADDRESS       | IP ADDRESS | HOSTNAME |
++--------------------------------------+-------------------+------------+----------+
+| 829af385-7d96-e35a-f9d4-8c6495ccd2f3 | 52:13:a0:c9:24:87 | 10.17.3.4  |          |
+| 9f38e568-e5c4-6c2a-0859-6ea22b2650bb | 52:3b:0a:10:13:b8 | 10.17.3.5  |          |
++--------------------------------------+-------------------+------------+----------+
+```
+
+You should find here the IP addresses which are specified in the configuration. If the IP addresses are missing,
+created workflows which installs cluster nodes did not run as they didn't find the machine to run on.
+
+#### Checking workflows
+
+For each cluster node, Tinkerbell workflow should be created, which installs OS on node disk. You can see created
+workflows using the following command:
+```sh
+tink workflow list
+```
+
+Sample output:
+```console
++--------------------------------------+--------------------------------------+---------------------------+-------------------------------+-------------------------------+
+| WORKFLOW ID                          | TEMPLATE ID                          | HARDWARE DEVICE           | CREATED AT                    | UPDATED AT                    |
++--------------------------------------+--------------------------------------+---------------------------+-------------------------------+-------------------------------+
+| dc9669e2-b57c-4e08-9655-6d8d2a1d3791 | 42bb7fd3-240a-4df5-a46e-dd8820f6c231 | {"device_1": "10.17.3.4"} | 2020-10-14 10:17:58 +0000 UTC | 2020-10-14 10:17:58 +0000 UTC |
+| b58bd418-1586-48fc-b640-09c43c1b83d7 | 2e83e46d-edfa-41e7-b4fa-4a1741031a8c | {"device_1": "10.17.3.5"} | 2020-10-14 10:17:58 +0000 UTC | 2020-10-14 10:17:58 +0000 UTC |
++--------------------------------------+--------------------------------------+---------------------------+-------------------------------+-------------------------------
+```
+
+You can check state of each individual workflow using the following sample commands:
+```sh
+tink workflow state dc9669e2-b57c-4e08-9655-6d8d2a1d3791
+tink workflow events dc9669e2-b57c-4e08-9655-6d8d2a1d3791
+```
+
+Sample output:
+```console
+/ # tink workflow state dc9669e2-b57c-4e08-9655-6d8d2a1d3791
++----------------------+--------------------------------------+
+| FIELD NAME           | VALUES                               |
++----------------------+--------------------------------------+
+| Workflow ID          | dc9669e2-b57c-4e08-9655-6d8d2a1d3791 |
+| Workflow Progress    | 66%                                  |
+| Current Task         | flatcar-install                      |
+| Current Action       | reboot                               |
+| Current Worker       | 829af385-7d96-e35a-f9d4-8c6495ccd2f3 |
+| Current Action State | ACTION_IN_PROGRESS                   |
++----------------------+--------------------------------------+
+/ # tink workflow events dc9669e2-b57c-4e08-9655-6d8d2a1d3791
++--------------------------------------+-----------------+-----------------+----------------+---------------------------------+--------------------+
+| WORKER ID                            | TASK NAME       | ACTION NAME     | EXECUTION TIME | MESSAGE                         |      ACTION STATUS |
++--------------------------------------+-----------------+-----------------+----------------+---------------------------------+--------------------+
+| 829af385-7d96-e35a-f9d4-8c6495ccd2f3 | flatcar-install | dump-ignition   |              0 | Started execution               | ACTION_IN_PROGRESS |
+| 829af385-7d96-e35a-f9d4-8c6495ccd2f3 | flatcar-install | dump-ignition   |              4 | Finished Execution Successfully |     ACTION_SUCCESS |
+| 829af385-7d96-e35a-f9d4-8c6495ccd2f3 | flatcar-install | flatcar-install |              0 | Started execution               | ACTION_IN_PROGRESS |
+| 829af385-7d96-e35a-f9d4-8c6495ccd2f3 | flatcar-install | flatcar-install |             98 | Finished Execution Successfully |     ACTION_SUCCESS |
+| 829af385-7d96-e35a-f9d4-8c6495ccd2f3 | flatcar-install | reboot          |              0 | Started execution               | ACTION_IN_PROGRESS |
++--------------------------------------+-----------------+-----------------+----------------+---------------------------------+--------------------+
+```
+
+If everything went well, you should see `ACTION_IN_PROGRESS` state on `reboot` action as in the example above. This is expected, as this action
+reboots the node, to it has no time to send information about successful execution back to Tinkerbell server.
+
+### Error opening Flatcar image file
+
+```
+Error: Error while determining image type for /root/assets/terraform/flatcar_production_qemu_image.img: Error while opening /root/assets/terraform/flatcar_production_qemu_image.img: open /root/assets/terraform/flatcar_production_qemu_image.img: no such file or directory
+```
+
+If you see error similar to this, it means that `flatcar_image_path` parameter is not set correctly.
+Please make sure that it's value points to the valid Flatcar image.
+
+
+### Cannot access storage pool
+
+```
+Error: Error creating libvirt domain: virError(Code=38, Domain=18, Message='Cannot access storage file '/root/pool/provisioner' (as uid:64055, gid:108): Permission denied')
+```
+
+Libvirt is not able to use some path as storage pools. If error similar to this occurs, try
+changing the path in `pool_path` attribute to some other value or make sure that UID and GID
+mentioned in the error message has permissions to write to configured path.
+
+### Domain already exist with UUID ...
+
+```
+Error: Error defining libvirt domain: virError(Code=9, Domain=20, Message='operation failed: domain 'tinkerbell-sandbox-demo-provisioner' already exists with uuid 55ce0fc5-a961-4625-8e45-71dcc9bd4f43')
+```
+
+If cluster creation failed for you previously, you may see this
+error message on consecutive runs.
+
+This error is caused by libvirt Terraform provider not being able to
+properly clean up machines which has failed to create.
+
+If this occurs, run the following command to see which machines are created:
+```sh
+virsh list --all
+```
+
+Then, remove the machine using example command:
+```sh
+virsh undefine <machine name>
+```
+
+[releases]: https://github.com/kinvolk/lokomotive/releases
+[Tinkerbell]: https://tinkerbell.org/
+[libvirt]: https://libvirt.org/
diff --git a/examples/tinkerbell-testing/cluster.lokocfg b/examples/tinkerbell-testing/cluster.lokocfg
new file mode 100644
index 000000000..df5dfcdb0
--- /dev/null
+++ b/examples/tinkerbell-testing/cluster.lokocfg
@@ -0,0 +1,60 @@
+variable "dns_zone" {}
+variable "ssh_public_keys" {}
+variable "flatcar_image_path" {}
+
+variable "asset_dir" {
+  default = "./lokomotive-assets"
+}
+
+variable "pool_path" {
+  default = "./pool"
+}
+
+variable "cluster_name" {
+  default = "lokomotive-cluster"
+}
+
+variable "controller_ips" {
+  default = [
+    "10.17.3.4",
+  ]
+}
+
+variable "worker_ips" {
+  default = [
+    "10.17.3.5",
+  ]
+}
+
+variable "hosts_cidr" {
+  default = "10.17.3.0/24"
+}
+
+cluster "tinkerbell" {
+  asset_dir               = pathexpand(var.asset_dir)
+  name                    = var.cluster_name
+  dns_zone                = var.dns_zone
+  ssh_public_keys         = var.ssh_public_keys
+  controller_ip_addresses = var.controller_ips
+
+  //os_channel       = "stable"
+  //os_version       = "current"
+
+  experimental_sandbox {
+    pool_path          = pathexpand(var.pool_path)
+    flatcar_image_path = pathexpand(var.flatcar_image_path)
+    hosts_cidr         = var.hosts_cidr
+  }
+
+  worker_pool "my-wp-name" {
+    ip_addresses    = var.worker_ips
+    ssh_public_keys = var.ssh_public_keys
+
+    //os_channel    = "stable"
+    //os_version    = "current"
+  }
+}
+
+component "metrics-server" {}
+
+component "flatcar-linux-update-operator" {}
diff --git a/pkg/assets/generated_assets.go b/pkg/assets/generated_assets.go
index a0ca6a0bc..b4ffbb95f 100644
--- a/pkg/assets/generated_assets.go
+++ b/pkg/assets/generated_assets.go
@@ -6505,6 +6505,298 @@ var vfsgenAssets = func() http.FileSystem {
 
 			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x8c\x57\x5b\x6b\x23\x3b\x12\x7e\xef\x5f\x51\xdb\x3b\x81\x18\xec\x76\xe6\xca\x12\x30\x61\xe7\x65\xd8\x97\x65\x60\x17\xce\xc3\x10\x84\xac\xae\x76\x6b\xac\x96\x84\x4a\x6d\xc7\xc7\xf8\xbf\x1f\x4a\xea\xf6\x25\x76\xce\x4c\x9e\x62\xd5\x45\x75\xfb\xbe\x52\x07\x24\xd7\x07\x85\x50\x7a\xa9\xd6\x18\x45\x8d\x1b\xad\xb0\x84\xd2\xba\x1a\xa9\x84\x7d\x01\xa0\x5c\x6f\x23\x9c\xfd\x2d\x60\x23\x43\xb5\x75\x61\x8d\x41\x24\x69\x01\xd0\x3a\x8a\x56\x76\x78\xa6\x55\xbe\xdb\xb3\xa2\x32\x3d\x45\x0c\x82\xa5\x87\x59\x3e\xf3\xce\x99\xe1\x20\xfb\x99\xbd\xdb\x27\x4f\x95\xb6\x35\xbe\x1c\xca\x02\xc0\x1b\x69\xe1\xfa\xde\xb8\xf3\x58\x00\x34\x52\x69\xa3\xa3\x46\x3a\x4a\x7f\xb0\x78\x38\xdf\x3d\x17\x00\xce\x63\x90\x51\xdb\x95\xa0\x1d\x45\xec\x06\x0f\xda\xbf\xa0\x20\x15\xb4\x8f\xa2\x0f\x06\xfe\xb1\x80\xb2\x84\x27\x28\x55\x4f\xd1\x75\x82\xe5\x25\x3c\x42\xe3\x42\x27\xe3\x7d\xd9\x18\x19\x95\x0c\xe2\x8e\xca\x69\x72\xe0\x48\xa8\x56\x5a\x8b\x66\x52\x00\x2c\xb5\x31\x7c\x87\xda\x29\x83\x43\xe6\xad\xeb\x83\xd9\xa5\x2c\x82\xfb\x89\x2a\x0a\x5d\x5f\x64\x71\x3a\x2e\x00\x5e\x07\x74\x3b\xce\x02\x40\x9a\xad\xdc\x91\xf0\x2f\x78\x74\xd6\x48\x43\x5c\x8f\x9e\x30\x88\x5a\x46\x79\x59\xad\xb7\x72\x65\xcd\x4a\x45\xa1\x9c\x6d\xf4\xaa\xd2\x96\xa2\x34\x66\xa6\x57\x56\x47\xed\x2c\x55\x01\x6d\x8d\x01\x6b\x78\xbc\xd2\xbd\xd2\x29\x0a\x80\x7f\xc2\x7f\x1a\xb0\x2e\x82\x0f\x48\x68\x23\x68\x0b\xb1\x45\xe8\xa4\x9f\x82\x8e\x1c\x1f\x41\x6e\x3e\x2b\x84\x8d\x64\x1f\x42\xd7\x24\x6a\x6c\x64\x6f\xe2\xa1\xe2\x31\x92\xa1\xde\xca\x80\xe2\x52\x09\x16\x60\x9c\x5b\xf7\xfe\xbe\xe0\xdc\x6e\x78\x99\x26\xc1\xd8\xb2\x61\xa8\xee\x36\xe5\x14\xce\xe6\x6a\x32\x7d\xcb\x7c\x0c\x82\x15\x26\x9c\x8f\xd1\x0d\xe6\x8e\xee\x93\x8d\x5e\x59\x17\x30\xf5\x7d\x85\xc4\xd3\x56\xe4\x3a\xcf\xe7\xf0\x87\x8e\x2d\x58\xdc\x62\x80\xef\x09\x47\xdc\xf5\x8d\xae\x31\x4c\x21\x19\x68\xbb\x4a\x0d\x4a\xfd\x51\x32\xd5\x22\xe0\x4c\x05\x4c\x01\x80\x6b\x52\xad\x32\xfa\xa6\x27\xc7\xdb\x56\xab\x16\xb6\x08\x5b\x69\x23\x44\x07\xa4\x0d\xe6\xff\xe4\xc6\xe9\x1a\x6a\xa4\x18\xdc\x8e\xfd\x27\xc4\x4e\x41\x12\xbb\xda\x41\x27\x77\xa0\x9c\x8d\x52\x5b\x30\x4e\x49\x93\xdb\x38\xf8\x3e\x4e\x4b\xbe\x8c\xc1\x72\xe0\xac\xa3\x5c\xd1\x88\x33\xb9\xa2\xdc\xd8\xff\xb7\x9a\x60\x2b\x77\x7c\x6d\x2b\x6d\x6d\x38\x52\xcf\xbd\xb7\x8a\xf1\xb7\x95\x04\xda\x92\xd7\x3c\x2e\xa9\xed\x9a\x1e\x93\x65\x1b\xa3\xa7\xc7\xf9\xbc\xd6\xa4\x7a\xa2\xaa\x95\xd4\x6a\xe5\x82\xaf\x94\xeb\xe6\x71\x1e\xb5\xa7\x59\xeb\xb6\xd1\xcd\x74\xe7\x0d\x76\x68\xe3\xac\x73\x75\x6f\x70\x96\xaf\xa0\x99\xb3\x33\xec\x7a\x93\x0a\x35\xff\xf0\xf1\xe1\xf3\xfc\x43\x01\x43\x00\x24\x9c\x1d\x81\x9f\xf2\x17\xf9\x5c\x38\xfb\x5c\x1c\x8a\x82\x63\x47\x42\xc8\x93\x4b\x20\x03\x72\xea\x35\xcf\x49\xaa\x78\xa3\x29\xc2\xd2\xb9\x38\xe5\xe4\x42\x6f\x61\x00\xfb\x6c\x40\x44\x91\x5a\x56\x1e\xa7\xbf\x84\xf2\x0a\x2b\x23\x4d\xda\xc8\xbd\x59\x40\xc4\xce\x1b\x19\xb1\xd1\x06\xef\xcb\x77\x7b\x2f\x63\x5b\xe5\xac\x0e\x73\x65\xe6\x83\x83\x6a\x27\x3b\x53\xc5\xce\x9b\x72\x3a\x0c\xd9\x89\x58\xae\x68\xef\x24\x1a\x35\x37\x18\x88\x87\xe7\x86\xe6\x20\xca\x90\x18\xd8\xcb\x68\xdb\xbf\x08\x87\xdd\x40\x51\x99\xf1\xcb\xa4\x43\xd4\x8a\x35\xee\xe8\x15\xdd\xfe\x24\x67\xd1\x2a\x57\xe3\x3d\x3b\x1e\xb5\x26\xc9\xc6\x3b\x8a\x43\x26\x62\x2c\x05\x2c\x7e\x83\x2c\x00\x0e\x13\x6e\xce\xd5\xf2\x59\xae\xbc\x20\x24\x8e\xbc\x84\x72\xb9\xf2\x37\xf7\x4f\x4e\xb2\xd6\x24\x97\x06\xd9\x06\x16\x0b\x88\xa1\x47\x78\x82\x07\x78\xbc\xb5\x9b\x32\xae\x8e\x14\xbc\x80\x8b\x6d\x97\x27\xe7\xc7\x19\x4d\x3c\x57\x89\x96\x65\x5d\x07\x24\x12\x8d\xec\xb4\xd9\x71\xcd\xb4\xdf\x7c\x2a\xf3\x60\x7d\xfd\xf6\x3d\x41\x0e\x8c\x5c\xa2\xa1\xaa\x48\x20\xa3\x14\x71\xb7\x13\x92\xb8\x18\x23\x1d\x75\xc8\x65\x5a\x56\xc6\xad\x5d\xe7\xa2\xde\x60\xa5\xdd\xbc\xdb\xcd\x24\xd9\xc5\x5d\x5d\x4e\x73\xd9\x86\xb0\x86\xdd\x30\xee\x88\x8a\xeb\x32\x94\xf3\xa1\x92\x64\x27\x09\x5b\x03\xd3\xe4\x95\x90\xe9\xf5\xdf\xff\xfb\x2f\x7c\xf9\xfc\xf9\xe3\xc3\xc0\x02\x10\xb0\x73\x11\xd3\x39\x4f\x7c\xe6\x81\xaf\xdf\xbe\x33\x0d\x78\xc4\xf0\x5b\x61\xb2\xe2\x29\xd0\xe4\x3f\xf5\xef\x06\x32\x7e\x0b\x11\x69\x7a\x6e\xc0\x22\x37\xed\x1c\x15\x49\x73\x3f\x50\x96\x23\x21\x83\x6a\x4f\x43\xce\xbf\x06\xd9\xba\x5f\x62\x8e\x62\x10\xa3\x4d\xd3\x11\x0d\x09\x46\x37\xc5\x20\x3d\x3c\x01\x77\xd7\xc6\xfb\xf7\x0f\xd3\x5f\x82\xf4\x68\x36\x3b\x39\xbf\x81\x58\xfe\x8b\x6e\x8d\x76\x9c\xae\x05\x04\x69\x6b\xd7\x09\x8a\x41\xdb\x55\x75\xf4\x23\x46\xb5\x1f\x0f\xcf\xbc\x7d\x7a\x13\x5f\x79\x20\x54\x01\xe3\x2f\x3d\x64\xb5\x1b\x5e\x94\x14\x0a\x43\x3c\x87\xc9\x70\x74\x54\xe1\x9d\x87\xe1\xf4\x42\x1b\x09\x3a\x2f\x66\xe9\x75\x56\x38\x3c\x7e\xf9\xf4\xe9\x63\x39\x98\x1d\x26\x13\x78\x3c\xaf\x1d\xeb\x9e\xaa\x32\x19\xd4\x6e\x92\xc8\xaf\x58\x04\x60\xfd\x2f\x12\xb5\x25\xc1\x37\x27\x94\xfa\x6c\xa6\x74\x1d\xf8\x51\x99\x8d\x06\x21\x1f\x4e\xe1\xfd\xc3\x68\x3c\xbe\x2d\x6b\xd7\x49\x6d\x05\xf5\x4d\xa3\x5f\xc6\xdc\x6f\xc9\x06\x3b\x46\xae\xc8\xc8\xbd\x88\xb5\xc3\xb0\xc2\xfb\x7d\x7e\xff\xa6\x1c\x83\xc5\x88\xc4\x38\xe0\xa3\x12\xd2\xfb\xe9\x90\x6b\x90\x1d\x8c\xb1\x30\x4c\xaf\xfd\x5e\xd3\xd5\x13\x7b\x38\xbd\x2e\xef\x68\x9a\x1e\x96\x09\x9c\x55\xa6\x8e\xf1\xd7\x88\xd1\xf1\x0a\xde\xe6\xf1\x55\x81\x8f\xef\xe2\x24\x1b\x7b\x81\xb1\xf7\x22\xc8\xe3\xab\xf3\x4c\xf1\x24\xbb\x52\x16\x6d\x5d\xbf\xa5\xcc\xb2\x6b\x03\xa2\xb7\x0d\x88\x6e\x1b\x88\x86\xde\x34\x10\x0d\xbd\x6a\xed\xc5\x47\xc5\xab\xd6\xb2\x6c\x50\xe7\x11\xfa\xd3\x59\xbc\x55\x9a\x51\x36\xa8\xde\x24\x87\xbf\x21\x8e\x64\x76\x48\x0f\xc3\xf4\x55\x12\xb9\x75\x97\x2b\x94\xac\xf6\x1e\x23\x1d\xe3\x53\x62\x3c\x3a\x51\xe5\x25\xbd\x97\x50\x1e\xff\xdb\x5f\x7e\x28\x5c\x7d\x22\x1c\x8a\xbf\x02\x00\x00\xff\xff\x4f\xda\x9c\x0b\xaa\x0d\x00\x00"),
 		},
+		"/terraform-modules/platforms": &vfsgen۰DirInfo{
+			name:    "platforms",
+			modTime: time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+		},
+		"/terraform-modules/platforms/tinkerbell": &vfsgen۰DirInfo{
+			name:    "tinkerbell",
+			modTime: time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+		},
+		"/terraform-modules/platforms/tinkerbell/controllers": &vfsgen۰DirInfo{
+			name:    "controllers",
+			modTime: time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+		},
+		"/terraform-modules/platforms/tinkerbell/controllers/bootkube.tf": &vfsgen۰CompressedFileInfo{
+			name:             "bootkube.tf",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 933,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x74\x93\x4d\x8e\xdb\x30\x0c\x85\xf7\x3a\x05\xe1\x62\x80\xa4\x98\xba\xbd\x40\x4e\xd0\x65\x97\x83\x81\xa0\x48\xb4\x47\x88\x2c\x1a\x24\x95\x4e\x5b\xf4\xee\x85\xe2\x26\xfe\xc3\x18\x5e\xf9\x7d\x22\xe9\xf7\xa8\x4f\xf0\x03\x53\xf7\xe5\x8d\x44\x31\xc0\xf7\x72\x46\xce\xa8\x28\xe0\x44\x50\x05\x0e\x97\x72\x46\x4f\xb9\x8b\xfd\x33\x0c\x2e\xc7\x0e\x45\xe5\x68\x06\x0a\x25\x21\x34\x67\x22\xad\x48\x03\x7f\x0c\x80\x50\x61\x8f\x70\x82\xa6\x6d\xbf\x4e\xef\x03\x30\x06\xc0\xa7\x22\x8a\x6c\xb3\x1b\x10\x1e\xcf\x09\xae\x8e\xdb\xa5\x66\x00\xdc\x18\xad\x20\x5f\x91\x05\x96\xe8\x4b\x47\x3c\x38\x3d\x34\x4f\xd2\x3e\x49\xf3\xbc\x3b\x3b\x7d\x09\x59\xec\x6f\xca\x78\x7c\x5d\xd7\xb2\xf8\xae\xc8\xd9\xa5\x7b\xdb\x38\x5a\x17\x02\xa3\x08\xca\x06\x8d\xa3\xac\x26\xdc\xa0\xa8\x3e\xec\x47\x3c\xc1\x64\x4d\xeb\x29\x2b\x53\x4a\xc8\x2f\xdf\x5e\xdb\x25\x5c\xdb\x54\x77\x6d\x88\x0c\x00\x5b\x23\x1e\x9a\x01\xc8\xa8\x3f\x89\x2f\x76\xd0\xb2\xe3\x16\x9a\x01\x18\x29\x58\x1f\xc3\xba\xe0\x7f\xf2\xae\xd5\x84\x90\xaf\xd1\xe3\x06\x9d\xb0\xa5\xb6\x08\x2b\xd0\xe0\x62\xb6\x52\xba\x2e\xbe\x6f\xc2\x5a\x69\xd5\x93\xec\xce\x09\x2d\xe3\x48\xac\x31\xf7\xcb\xf2\x5b\x6d\xc6\x5d\xdf\x33\xf6\x4e\x23\xe5\x1d\xbe\xd0\x6e\x1b\x84\xac\x62\xaf\x2e\xc5\x10\xf5\x97\x1d\x91\x23\x05\xfb\x46\x85\xe5\x3e\xda\xc7\x44\x2d\x50\xf7\x51\x94\xdd\x68\x95\x2e\x98\x65\xed\x96\xa7\xec\x9d\x1e\x76\x11\xb6\x9f\xdb\xcd\xc1\x69\xcd\x6a\x00\xc8\x76\x5b\xf4\x38\xff\x9b\x26\x99\xe5\xb9\x91\x72\xa9\x5b\x1e\xa2\xdc\x28\xc1\xd4\xd9\xe9\x12\xda\x7a\x5b\x12\x2a\x9c\xa0\x73\x49\xd0\xfc\x35\xff\x02\x00\x00\xff\xff\xbb\x53\x27\x13\xa5\x03\x00\x00"),
+		},
+		"/terraform-modules/platforms/tinkerbell/controllers/main.tf": &vfsgen۰CompressedFileInfo{
+			name:             "main.tf",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 1439,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x94\x54\xcd\x8a\xe3\x3c\x10\xbc\xeb\x29\x1a\x31\x03\x19\x48\x9c\xef\x83\x61\x0f\x66\x72\xdc\xbd\xee\x03\x0c\x83\x50\xec\x76\x22\x22\x4b\x46\x2d\x27\x33\x9b\xf5\xbb\x2f\x92\x2c\xec\xfc\xc1\xae\xc9\x21\x71\x95\x5a\xd5\x55\xdd\x69\x6d\xdd\x6b\x04\x5e\x59\xe3\x9d\xd5\x1a\x1d\x87\x33\x03\x20\xdb\xbb\x0a\x61\x03\xbc\x28\xd6\xe9\x33\xa3\x30\x06\x50\xd9\xde\x78\xd8\xc0\x51\xba\xc2\xd8\x1a\x45\x7c\x11\x11\xdd\x93\x47\x27\x8c\x6c\x11\xa6\x27\x51\xe7\x60\xac\x92\x8b\x52\x2a\x30\xe7\xce\xca\x02\xd4\x86\xc4\x2f\x6b\xe6\x15\x27\x66\x06\xb3\x2e\xa1\x4c\x8d\x9f\x97\xbc\x08\x14\x11\x98\x89\x0c\x27\x09\xdd\x51\x55\x28\x54\x07\x1b\x48\x8e\x14\x5b\x6b\xfd\xa1\xdf\x62\x71\x9f\x18\x2c\xa2\xbd\x38\xe0\x17\xdd\x15\x94\xc1\xf9\x4d\xb6\x95\xca\x08\xea\x9b\x46\x7d\x5e\xdb\x71\x01\x32\x80\xbd\x25\x1f\xaf\x54\xdd\x6d\xf1\x19\xc8\x00\x64\xa7\x82\x2e\x74\xd7\x3a\x1a\xeb\x5a\xe9\x17\xfc\x99\x8a\x67\xe2\xcb\x1b\xfb\x97\x17\xd6\xbd\x04\xa9\x52\x54\xe8\x3c\xdc\xb4\x74\x63\x4a\x22\xa6\xb4\x2b\x41\x46\x75\x1d\x7a\x8a\x2e\x9b\x4a\xfa\x45\xba\x6b\x42\x96\xf0\xce\x42\xa9\xb7\xb7\xef\x3f\x7f\x30\xf2\xd6\xc9\x1d\x96\x0c\xa0\x51\x1a\x29\x7c\x59\x41\x27\xfd\xbe\x84\x35\xfa\x6a\x1d\x3a\x1c\x27\x64\xa4\x7c\x91\xc7\xb6\x04\x67\xad\x8f\x2f\x5b\x5b\x63\x09\xff\x7d\x7b\x7d\x8d\x3f\xc3\x1c\xa1\xf1\xb1\x52\x78\x94\xd1\xca\x60\x09\xbf\x59\x6e\xe2\xe9\x7c\xdd\xff\xb0\x9a\xa6\x6f\xf5\x74\x9e\xcd\xc7\xc0\x82\xca\x70\x6a\xc9\x00\x3e\x5e\xd8\xc0\x98\xc3\x71\x27\xb8\x57\xe6\x80\x6e\x8b\x5a\x0b\x8f\x6d\xa7\xa5\x47\x0e\x3c\xe4\x97\x76\xe7\xf1\x66\xc4\x8d\xd8\x00\xff\x27\x2d\xe3\xb6\xc5\xfe\x60\x03\xf9\xca\xe0\xca\x82\x3f\x9d\x83\x6b\x45\xca\x67\x58\x67\x90\xd6\x8d\x96\xbe\x92\x6e\xa5\x0c\x79\xa9\x75\xe1\xdb\x4e\xf3\x65\xd4\x07\xa0\x76\x46\x79\x65\x8d\xa8\xac\x69\xd4\xee\x4e\xd2\x93\x9a\xf7\x99\x96\x8f\x98\x69\x3a\x94\xa2\x49\xb7\x88\xf1\x16\xb1\x95\x84\xa2\x77\x7a\xec\xfe\x11\x1c\xcf\x5a\x12\x47\x74\xa4\xac\xb9\xbb\x41\x13\x9c\xd9\xd5\x5e\x1a\x83\xfa\x11\x7b\x84\x19\xc0\xf0\x38\xb0\x93\x75\x87\x46\xdb\xd3\x5f\x06\xb6\x97\xae\x3e\x49\x87\x61\xb2\xd3\xe8\x9e\x79\x8d\xf1\x3f\xe0\x7f\x5e\xe6\x20\x55\x27\x64\x5d\x3b\x24\x42\xba\xb0\x6b\xe0\x79\x92\x72\x30\x41\xef\x9d\xf9\x29\x82\x98\x4b\xa7\x55\xcd\x06\xf6\x27\x00\x00\xff\xff\x6e\x27\xce\xf0\x9f\x05\x00\x00"),
+		},
+		"/terraform-modules/platforms/tinkerbell/controllers/outputs.tf": &vfsgen۰CompressedFileInfo{
+			name:             "outputs.tf",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 966,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x8c\x93\x51\x6e\xeb\x20\x10\x45\xff\x59\x05\xf2\x53\xa4\x57\xa9\x66\x07\x5d\x8b\x45\x86\x49\x83\x0c\x0c\x82\xc1\x52\x5a\x65\xef\x15\xb2\x9b\xda\x6e\x92\xf2\x6b\x9d\x7b\xe4\xb9\x33\x50\xe1\x58\x58\x76\x63\x39\x22\x50\x38\xd9\xf7\x5e\x1b\x6f\x43\x27\x3f\x85\x94\x93\x76\x05\xe5\x9b\xf4\x64\x8a\x43\x75\x24\xe2\x0a\xaa\x3d\x2d\xae\x42\x7c\x9b\x40\x0f\x80\x89\x9f\x0b\x16\x68\x9d\xd3\xd1\x66\x4c\x13\xa6\x6d\xf2\x44\xc9\x6b\xfe\xdf\x1d\xb2\x3a\xe4\xee\x55\x4e\x3a\x29\x70\x25\x33\xa6\x21\x68\x8f\xf3\x17\x13\xf2\xf0\x41\x01\x5f\xaa\xf1\xdf\x1c\xce\xea\xa2\xbd\x93\x40\x81\x31\x70\x15\x49\xed\x9c\x34\x18\x1d\x5d\xd0\x48\x38\xeb\xc4\x59\xdd\x7e\x20\x92\xe9\xe1\x8c\x30\x46\xb2\xa1\xea\x67\xcb\xf3\x41\x1e\x84\xd6\x83\x55\xae\xbf\x4d\xd7\x64\xbd\x1b\xd9\x3b\x53\x40\xc6\xdc\xec\xdb\xe0\x7b\x97\x43\x6e\x16\xfd\xb0\xdb\xb5\x3b\x0b\xd4\x24\xd9\xa0\x6b\x87\xa3\x91\x3c\xb1\x9d\xb0\xc9\xf3\x0b\x5f\xbb\x2a\x95\x39\xe9\xd8\x67\x84\x84\xdc\x56\xd4\xa3\xd4\xbe\xaf\xf9\xf8\x9b\x1f\xc9\x52\xdb\xa6\xaf\xe5\x86\xeb\xe5\xd6\x35\x5b\xc0\xc1\xc6\x3f\x8a\xbb\x9b\x11\x57\xf1\x15\x00\x00\xff\xff\x1f\xd6\x14\x02\xc6\x03\x00\x00"),
+		},
+		"/terraform-modules/platforms/tinkerbell/controllers/ssh.tf": &vfsgen۰CompressedFileInfo{
+			name:             "ssh.tf",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 2786,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xac\x56\xdf\x6b\xe3\x46\x10\x7e\xf7\x5f\x31\x28\xa5\xdc\x95\x48\xce\x15\xae\x0f\x2d\x2e\xf4\xe1\xa0\xd0\x1f\x07\xbd\x83\x3e\x1c\xc1\xec\xed\x8e\xe3\xad\x57\x3b\x62\x66\xe4\x44\xf4\xf2\xbf\x97\x5d\x59\xb1\xad\xc6\xb1\x69\xf5\x92\x20\xf9\x9b\xef\x9b\x4f\x3b\xb3\x33\x57\xf0\x01\x6d\xcb\x08\x96\x9a\x0e\x50\xad\x83\x8f\xbf\x7e\x00\x23\x82\x2a\x60\xa2\x83\x4d\xfb\x19\x2d\xc5\x95\xbf\x03\x25\xb0\x14\x95\x29\x04\x64\xa9\xe0\x27\xab\x7e\x6b\x14\x25\x83\x02\x6a\x25\xc8\x5b\x6f\x71\xc6\x28\xd4\xb2\x45\x28\x62\x1b\xc2\x72\x78\x2c\xa0\x48\x3a\xe5\x9e\xa5\x14\xb4\x8c\x2a\x05\xfc\x3d\x03\xb0\xd4\x46\x85\x05\x04\x8c\x77\xba\x7e\xb5\x35\x5c\xf9\x66\x69\x9c\x63\x14\x41\x79\x3d\xcb\x98\x18\xd1\xaa\xa7\x98\x43\x00\xb4\x6b\x30\xfd\x5f\x40\x21\xb2\x2e\xf2\xbb\x35\x89\xf6\xef\xc6\x1c\x9f\xb2\x46\xe5\xa3\xc3\x87\xdb\x8c\x6d\x05\x79\x17\x6f\x89\xb1\x27\x50\x5f\x23\xb5\x29\x97\xe2\xbb\x9b\x3a\xbd\x7b\x4c\xe2\x0d\xd3\xd6\x8b\xa7\x88\x0c\xc5\xca\x07\x2c\x76\x49\x24\x47\x18\xb3\x26\x2c\xa0\x26\xd7\x06\xac\xf6\x36\x8f\x54\xab\xcf\x44\x2a\xca\xa6\x59\xee\x3f\x6e\x66\x71\x28\xea\xa3\xc9\xe6\x16\x50\x7c\xf5\xf3\xfb\xdf\xde\xcd\xf7\x98\xff\x98\x46\x92\x4b\x24\x55\x3a\xde\xa5\x35\x4b\x8b\xac\xa7\xf5\x12\xaa\xb4\xc1\x63\xd4\xd2\x9a\xca\xb2\x4e\xa3\x9b\x19\x2f\xd7\x9e\x5a\x78\x83\xdd\x65\xba\x1b\xec\x26\xd1\x4d\xbd\x80\x7c\x89\xe1\x1e\x39\x99\xe1\x9d\xf0\x79\xc3\x3b\xdd\xa9\x0c\x37\x78\x99\xdd\x84\x9b\xcc\x6c\x16\x3d\x6f\x35\x6b\x9e\x34\xca\x58\x93\x62\x89\x0f\x68\x07\x69\x1f\x83\x8f\x08\x0b\xf8\x94\x1f\x01\x0a\x69\x1d\x41\xbd\x71\x9e\xa1\x6c\x20\xd1\xce\x45\x42\xa6\xcf\x7f\x8a\xeb\x63\xe4\x16\x0e\xaa\xea\x9b\x51\xc0\x08\x6c\x9f\x23\x3c\x6e\xc2\x67\x00\xf3\xfe\x00\x87\x2e\x7d\x5e\x7f\x5f\x5c\xa7\x19\xce\x87\x6f\xb0\x7b\x21\x3c\x7d\xd8\x49\x0c\xa5\x63\x7a\xd9\xce\x50\x3c\xa7\xa2\xcf\x85\x9e\x30\xf2\x54\x1f\x23\x1b\x6b\xba\x8f\x50\xfe\x91\x09\xbe\xcf\xe3\xf1\x28\xf8\x5f\xf0\x9a\x5c\x82\xbf\xbd\xb9\x79\x11\x58\x6f\x61\x7c\xb9\xf7\xf8\xf4\xcc\x11\x15\xe5\xf0\xde\xef\x83\x6f\x73\xed\x3e\xce\x66\xc7\x43\x7b\xe8\x87\x61\x68\x2b\xc1\xfb\xdf\xdf\x1d\x4c\xea\x3c\xc6\x45\x0d\xeb\x1e\xab\x04\x0d\xf2\x8a\xb8\x9e\x5d\x01\x45\x2c\xd3\xc0\x03\xc1\xb0\x2a\xd3\xec\x44\x07\x36\xb4\xa2\xc8\xf0\x34\xac\x1a\x1f\xef\xaa\x17\x26\xfb\xc0\x5d\x66\xa9\xbe\x8f\xae\xe0\x4f\xaf\xeb\x34\x48\x1d\x36\x18\x9d\x2c\x29\x5e\x83\xae\xbd\xc0\x41\xcf\x41\x6d\xba\x21\x41\x5c\x11\x23\xe8\x1a\x0f\x17\x8f\xe4\xb3\xca\x74\x1f\x91\xd9\xa4\xb4\x81\x62\xe8\xc0\x11\x4a\x4a\x1f\xd4\xc8\x06\x8c\x82\xc9\x93\xfb\x1a\x84\xc0\x2b\xdc\x53\x1b\x1c\x28\x77\xc9\xef\x93\x91\x4c\x74\xbf\xf6\x01\x21\x12\xfc\xd2\xaf\x2e\x02\x86\x11\xb8\x8d\x31\xdb\x84\x83\x84\x9f\x2e\x81\x23\xc7\xd5\x89\x4d\x26\x9d\xd5\xed\x14\x8b\xca\xcd\x65\xeb\xc9\x9b\xb7\x17\xac\x27\xbb\x33\x83\xbd\x54\x2e\x96\xa5\xf3\x7c\xfa\xe2\xec\xeb\xe9\x7f\xdf\x98\x43\xa9\xef\xca\x73\x4e\x8d\xce\x87\x5a\x19\xb5\x85\x74\xa2\x58\x5b\x0d\xe3\x72\xfd\xf2\x05\x5e\x65\xc4\x5f\xd4\x72\x34\x21\x41\xca\x76\xff\xfb\x8f\x5f\x7f\xfb\x03\xe0\x83\x57\x78\xf3\x7a\xd4\x2d\xff\x04\x00\x00\xff\xff\x23\x18\x08\x41\xe2\x0a\x00\x00"),
+		},
+		"/terraform-modules/platforms/tinkerbell/controllers/templates": &vfsgen۰DirInfo{
+			name:    "templates",
+			modTime: time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+		},
+		"/terraform-modules/platforms/tinkerbell/controllers/templates/flatcar-install.tmpl": &vfsgen۰CompressedFileInfo{
+			name:             "flatcar-install.tmpl",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 1149,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xa4\x53\x41\x8f\xd3\x3c\x10\xbd\xe7\x57\xbc\xaf\xbb\x9f\x02\x12\x69\xb6\x12\x42\x28\x08\x2e\xc0\xb9\x87\x5d\x71\x8d\x9c\x78\x9a\x98\x3a\x9e\xae\xc7\xe9\x52\x95\xee\x6f\x47\x6e\x92\x6e\xc5\xb6\x27\x2e\xd6\x58\xf3\xe6\xcd\xf3\x3c\xcf\x96\xbc\x18\x76\x05\xd2\xbb\xf9\x22\x4d\x9c\xea\xa8\xc0\xca\xaa\x50\x2b\x9f\x19\x27\x41\x59\x9b\x34\x96\x2b\x65\xcb\x60\x3a\xe2\x3e\x14\x58\x7c\xbc\xbb\x4b\x82\x92\xb5\x14\x49\x86\xa1\x66\xf6\x57\xd1\x2c\x01\x9e\xd8\xaf\xc9\x17\x98\xed\xf7\x73\x4d\x5b\x53\x53\xb9\x38\x1c\x62\x66\xcb\xb6\xef\x48\x8a\x04\xc8\x90\x6b\xda\x16\xf1\x18\x6e\x12\x54\x20\x6d\x7c\x71\x8a\x12\x40\xd5\xc1\xb0\x1b\x0b\xc6\x8e\xba\xef\x36\x99\x69\x9c\x89\xa9\xc8\x0a\x98\x4e\x35\x17\x1e\x10\x53\x35\x77\x9d\x72\xba\x38\x5e\x32\x48\x3b\x06\x59\x3d\x06\x54\xb7\x8c\xf4\x76\x5f\x29\xa1\x0f\xef\xc9\xd5\xac\xe9\xcd\x44\x5f\xd6\xec\x56\xa6\x79\x7b\x48\xf1\x1b\x03\x02\x99\xc6\x97\x17\xb9\xf9\x04\x9d\xff\x14\x76\xe7\x3a\x2f\x4c\xe6\x9a\x52\xdc\xe0\x61\xf9\x6d\x09\xcd\xb5\x14\x78\x68\x8d\x0c\x40\x74\xbd\x04\x54\x84\x4d\x2f\x2d\x69\x04\xc6\x83\x71\x6b\xf2\x15\x59\x0b\x4f\x8d\x91\xe0\x77\xf3\x4b\x0f\xcd\x7b\xf1\xb9\xe5\x5a\xd9\xbc\x32\x2e\xbf\x34\x9a\x0c\x99\xe0\x06\xdf\x7f\x6d\xc8\x9b\x8e\x5c\x4c\xec\xd0\x0b\x21\xb4\x04\xe9\x94\xb5\x24\x01\xda\xc8\x3a\x76\x9e\xb4\xc6\xe4\xf2\x7e\x68\xfa\xff\xfe\x19\x66\x05\x96\x72\xfc\x51\xf8\xef\x33\x66\x33\x3c\x1f\xa6\x0e\x3f\xc6\xe0\x76\xff\x02\x3a\x9c\x6a\xc9\x69\xb3\x9a\xd0\x2f\x64\x75\xab\x9c\x23\xfb\x8a\xec\xeb\x39\xd9\x08\xba\x42\x96\x21\x33\xd3\x28\xae\x7a\x75\xea\x39\x8e\xa7\x1c\xdf\x58\x46\xab\xcb\xde\xbf\x56\x50\x9d\x14\x5c\x2b\xb9\xa8\xe7\xf4\x29\x3c\x55\xcc\x61\x16\x0d\x8f\x2e\xc7\x6d\x82\xb4\xdc\x5b\xed\xd2\x00\x4f\x47\x0b\xaa\xa3\x03\x9e\xde\xa1\xea\xc3\x10\xc2\x08\x1c\x83\xe3\x05\x4f\x6a\x17\x0d\x19\xb8\x8e\x7e\x0c\x2b\x07\xe3\x02\x23\x28\xdf\x50\xc0\xf2\x1e\xc6\x9d\x7f\x97\x15\x7b\x38\x7e\x9a\xff\xf3\xc6\xa4\xc7\x95\x59\xc4\x2d\xd8\x78\xae\x73\xd9\x49\xbe\x26\xef\xc8\xc6\xd0\x3f\x7e\x1a\x76\xaa\x3a\x07\xf8\xc7\x2c\x78\xd3\x34\xe4\xd3\xe4\x4f\x00\x00\x00\xff\xff\x58\x4c\x7b\x16\x7d\x04\x00\x00"),
+		},
+		"/terraform-modules/platforms/tinkerbell/controllers/variables.tf": &vfsgen۰CompressedFileInfo{
+			name:             "variables.tf",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 2539,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x9c\x56\xdd\x4e\x24\x37\x13\xbd\x9f\xa7\x28\xcd\x77\xb1\x20\x41\x7f\xc3\xfe\x90\x55\xb4\x7b\x41\x66\x59\x05\x85\x00\x02\x92\x9b\x28\xf2\xd6\xd8\xd5\xdd\x0e\x1e\xbb\x53\x55\x0d\x3b\x89\x78\xf7\xc8\xdd\xc3\x32\x3f\x4d\xb2\x8b\xb8\x40\xd3\x76\x1d\x9f\x3a\x55\xa7\xec\x5b\x64\x8f\xb3\x40\x30\x76\x51\xcc\x5f\x29\xd2\x18\xfe\x1e\x01\xe8\xa2\x21\x78\x0f\xa2\xec\x63\x35\xba\x1f\x8d\x1e\x37\xda\xd0\x8a\x12\x9b\x88\xf3\xff\xde\xec\x1b\x83\xce\x31\x89\x90\xac\x6d\x0e\x5e\x74\xa7\x8f\xd8\x5d\x0f\x29\x03\xaa\x45\x36\x3e\x8a\x62\x08\x66\x86\x42\xa6\xe5\xb0\x12\x0e\xf0\x78\x1c\x80\xa3\x12\xdb\xa0\xf0\x1e\xc6\xe3\x75\xa8\x24\xe6\x96\x58\x7c\x8a\xcf\x0b\xb6\x35\xc6\x48\xcf\x39\x19\x45\x48\x8d\xf3\xdc\xc7\x3a\x12\xcb\xbe\x51\x9f\x62\xde\x7c\x81\x5a\x83\x26\x40\x70\x9e\xc9\x6a\xe2\x05\xdc\xd5\xc4\x04\x15\x45\x62\x54\x72\xd0\x21\x08\x48\x9d\xda\xe0\x60\x46\xd0\x04\xb4\xe4\x60\xc7\xa6\xa8\xe8\xa3\x80\x90\x65\x52\xd9\x1d\xaf\x90\x5b\x23\x78\x3f\x1a\xfd\x0f\x2e\xe9\xcf\xd6\x33\x39\x78\x20\x27\xc5\x0a\x4f\x91\xda\xdc\xd0\x42\xd6\x53\xec\x51\xd6\x4a\xb4\x95\xc3\xa9\x17\x85\x54\xc2\xd5\xd5\x8f\xd0\xb4\xb3\xe0\x2d\x64\x20\x28\x13\x43\x2b\xc4\xf0\xc9\x26\xa6\x4f\x05\x1c\xa3\xad\x81\x02\xcd\x29\x2a\xcc\x5b\xd1\x9c\x8c\x34\x64\x7d\xe9\xc9\x81\x8f\x80\x70\x8b\xc1\x3b\x38\x6f\x28\xae\xc3\x65\xb4\x39\xea\x1e\xa0\x64\xb1\x7d\xec\x03\x2e\x3f\x4e\xe1\xf5\xcb\x37\xaf\xe0\x8a\x6c\xc7\xe7\xb0\x38\xdc\x03\x2a\xaa\x02\x5e\x88\xd4\xfb\x2c\x08\x47\x47\x47\x47\x3f\xbc\x3a\x2b\x8a\xe2\x45\x31\x5e\xa9\x55\x9f\xdb\x6f\xbf\xf7\xea\x9c\x77\xf9\x60\x18\x56\x27\x26\x47\xc6\xa6\x36\xea\x90\x3e\xb1\x9d\xcf\x88\xb7\x95\x39\xeb\xbe\x67\x6d\x72\xbc\xe4\x42\x5b\x26\x54\x1a\xe0\x71\xb0\xe9\x2d\x6b\x24\xfa\xa6\x21\x7d\x46\x49\x8e\x3f\x2b\x23\x4c\x4f\xa7\xf0\x80\x91\xcf\xf6\xd1\x86\xd6\x51\xd6\x4d\x6b\x02\x9b\x62\xe9\xab\x96\x31\x47\x3d\xa9\xcc\xb6\xdd\x5d\x9a\xa3\x8f\x46\xda\xb2\xf4\x9f\x87\xb8\xad\xb8\x62\x8d\xd5\xb4\x07\x80\x1e\x00\x7a\x80\x02\x2e\x72\x83\xbb\x4c\xf0\xa6\x9d\x51\x20\xcd\x35\xde\xdf\x5f\x3f\x0e\xca\x80\xd5\x00\xc9\x07\x56\x45\x48\x16\xc3\x86\xf7\x22\xe9\x5d\xe2\x1b\x33\xd7\x76\xd0\x7d\xd3\xb3\x13\xf0\x51\x89\x4b\xb4\x04\x3f\x5f\xff\xb2\x6d\xa0\x95\xd2\xae\x55\xeb\xcd\x64\xb2\x7e\x56\x93\x9c\xb1\xde\x0d\xdb\x7c\x7a\xf2\xe1\x12\x4e\x2e\x80\x31\x56\xd4\xf9\x5d\xc4\x57\x11\x7e\x6a\x67\xc4\x91\x94\x04\x9a\xe4\xe4\x49\xff\x6e\x65\x7d\x30\x29\x5e\x16\x93\x62\xf2\xff\x83\xc3\x8d\x9c\x85\xf8\xd6\x5b\x7a\x92\xcb\xbb\x77\xc7\xe7\x1f\x47\x5f\x41\x68\x09\x24\xc5\xe8\xba\x26\x38\x10\xcd\xfb\xef\x7c\x08\xd9\xb5\x4c\x79\x99\x5c\x67\xf2\x5c\x36\x83\x8d\xef\x3e\xf1\x5e\xd7\x5c\x07\x13\xad\xff\x35\x60\xdf\x45\x29\x46\x99\xcb\x37\xe4\xfc\xaa\xcb\xf9\xe5\xeb\x8d\x9c\x29\xe6\xff\x86\xa9\x49\xac\x3e\x56\x43\x4d\x39\x4b\x29\x0c\x18\xa5\x8b\x84\x56\xb0\x22\x48\x0c\x18\x31\x2c\xd4\x5b\x81\x2f\x60\x59\x9d\xb6\x11\x65\xc2\x39\xd8\x34\x6f\x52\xcc\xf3\x2b\xdd\x45\x62\x81\x9d\x6b\x5f\x11\xe3\xf7\x30\xc5\xe0\x6d\xda\xdd\xee\xd0\x12\x83\xd0\x86\x93\x88\x55\x4c\x37\xea\xbc\x2e\x4c\x43\xec\x93\x33\x75\x6a\x59\x06\xdb\xe7\xd7\xe5\xce\x3c\x49\x30\x84\xde\xbd\xc4\xea\x4b\x6f\x31\xd7\xca\x47\xe8\xa3\xbf\xb6\x7f\xdf\x7e\x77\x38\x19\xd4\x10\xab\x8a\xa9\xea\x46\xc2\x20\x95\xa5\x60\x99\xc1\x4a\xaf\x1c\x3d\x46\xc1\x29\x2e\x88\x61\x67\x79\x5e\x37\x78\x3a\x09\xf6\x80\xc9\xa6\xf9\x9c\xa2\x23\x37\x70\x55\x7d\x29\xd0\x2a\x4f\xe5\x76\x43\xbb\x6c\x68\x62\x33\x4b\x49\x45\x19\x1b\xa3\xe9\x86\xe2\xb0\x6e\x0f\x37\x53\xb7\x65\xdf\x3b\xc0\xe8\x96\x3f\xfa\x2b\x33\x2f\x52\xbe\x95\xf2\x7c\x2e\xc6\x1b\x8f\x92\x34\xfb\x83\xac\xee\x64\x60\xe8\xc3\x8c\x77\x9b\x4d\xfa\xb0\xb2\x04\x5c\x59\xb9\xdf\xdd\x78\xcf\xd4\x49\xd4\xe4\xd7\x95\x6f\xbe\x65\x6c\x9e\x5c\xc0\xf2\xe5\x94\xe9\x7e\x38\xbb\x82\xde\x68\xdd\x75\xb2\x9c\xe1\x04\xa9\x1f\xea\xdd\x45\x33\x34\x27\xdf\x16\xdd\x5f\x76\xce\x3f\x01\x00\x00\xff\xff\x0e\xf8\xaa\x95\xeb\x09\x00\x00"),
+		},
+		"/terraform-modules/platforms/tinkerbell/controllers/versions.tf": &vfsgen۰CompressedFileInfo{
+			name:             "versions.tf",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 279,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x74\x8c\xbd\xb2\x82\x30\x10\x85\xfb\x7d\x8a\x33\xdc\x3e\xfc\xdc\x1a\x9f\xc2\xde\x41\x58\x65\x47\x4c\x70\x43\x68\x1c\xde\xdd\x01\xc1\x50\x68\x93\xc9\x9e\x73\xbe\xef\x0f\x47\x56\xad\x2e\x4e\xef\x18\x59\xbd\x38\x8b\xca\x36\xe8\xbb\x70\x15\xbb\x45\x9e\x68\xf8\xcc\x9e\x04\x28\x3f\x82\x28\x37\xa7\x8d\x29\x91\x1c\x4a\x64\x26\xff\x4f\x68\xdf\xf7\xea\x46\x69\x58\xfd\x82\x01\x36\x74\x1d\xca\xf5\x00\xbc\x0b\x5a\x33\x66\xbc\xad\x7c\x2b\xb5\xd3\x3e\x9d\x37\xc9\x3a\xd8\xf9\x0b\x93\x9b\xe2\x9d\x4f\xcb\x3b\x88\xbd\xb1\x9e\xf9\x97\x31\xf6\x69\xfc\x7e\x11\x67\x26\x37\x59\x14\x4f\x34\xd1\x2b\x00\x00\xff\xff\x2c\x5c\x66\xcf\x17\x01\x00\x00"),
+		},
+		"/terraform-modules/platforms/tinkerbell/workerpool": &vfsgen۰DirInfo{
+			name:    "workerpool",
+			modTime: time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+		},
+		"/terraform-modules/platforms/tinkerbell/workerpool/main.tf": &vfsgen۰CompressedFileInfo{
+			name:             "main.tf",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 1254,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x9c\x53\xc1\x6e\xdb\x3a\x10\xbc\xf3\x2b\x16\x84\x0f\x79\x80\x2d\xbf\x02\x41\x0f\x42\x7c\x6c\xaf\xfd\x80\x20\x20\x18\x6a\x65\x13\xa6\x48\x81\xbb\xb2\x13\xb8\xfa\xf7\x82\xa4\xd4\xc8\x8d\x0d\x14\x25\x7c\x30\x39\xdc\xd9\xd1\xce\xb0\x0b\xcd\xe0\x10\xe4\x39\xc4\x23\x46\x09\x17\x01\x40\x61\x88\x06\x61\x07\xb2\xaa\xb6\xe5\x37\xc1\x42\x00\x98\x30\x78\x86\xb2\x76\x70\xd2\xb1\xf2\xa1\x41\x95\x8f\x67\x58\x59\xdf\xe0\x1b\xec\xca\xae\xca\xbb\x5c\xeb\x06\x62\x8c\xaa\xf1\xa4\x08\xe3\xc9\x1a\x54\xb6\x9f\x68\x6e\x83\x49\x0f\x1d\xd4\x11\xdf\x09\xae\x57\xa9\x9a\xc1\x25\x7b\xe8\xb4\xf5\x8a\x86\xb6\xb5\x6f\xf0\x27\xfb\x12\x14\x00\x87\x40\x9c\x5b\xda\xfe\x33\xf9\x02\x4c\xfc\x5a\x19\x8c\x0c\x37\x75\x4c\xa0\x00\xd0\xbd\x4d\xf2\x31\xde\xba\xf6\x1b\x2c\xe3\x30\x8a\xbc\xed\x7b\x64\xca\xc3\xf2\x46\xf3\x43\x51\xfb\x81\xac\xe1\x59\x24\x82\xa7\xa7\x6f\x3f\xbe\x0b\xe2\x10\xf5\x1e\x6b\x01\xd0\x5a\x87\x94\xfe\x6c\xa0\xd7\x7c\xa8\x61\x8b\x6c\xb6\x49\xb3\xd7\x1d\xe6\x9a\x7c\xe5\x9d\x18\xbb\x1a\x62\x08\x9c\x0f\xbb\xd0\x60\x0d\xff\x7f\x7d\x7c\xcc\x5b\x13\x3c\xa3\xe7\xcc\x94\x96\xf5\xce\x7a\xac\xe1\xa7\x98\xa5\xaf\x2e\xcb\x09\x26\xf2\x71\x53\x12\xb1\x29\x50\x39\x5a\x5d\x16\x76\x8f\x22\xa9\x4d\xd5\x6b\x01\xf0\xf2\x9f\x18\x85\x88\x38\x45\x4b\xb2\xf5\x47\x8c\xaf\xe8\x9c\x62\xec\x7a\xa7\x19\x25\xc8\xe4\x4c\x89\x60\x09\xd9\xa7\x78\x09\x80\xd4\x2a\x45\xf3\x9f\x34\x4d\x01\xce\xdf\x0b\x3b\x98\x5b\xa7\x29\x3d\xc8\xd5\x25\x4d\xb1\x2a\x2f\x62\xdc\xce\x20\x6d\x5b\xa7\xd9\xe8\xb8\xb1\x9e\x58\x3b\x57\x71\xd7\x3b\xb9\xce\x3a\x01\xec\xde\x5b\xb6\xc1\x2b\x13\x7c\x6b\xf7\x4b\xbf\x0b\x53\x55\x54\x3d\x2f\x74\xbc\x64\x7f\x4b\x41\xb1\xa9\x74\x50\x53\x07\xf5\xaa\x09\xd5\x10\xdd\x34\x81\x7b\x70\xae\x0d\xa4\x4e\x18\xc9\x06\x7f\x33\x97\x1f\xf0\x7c\xdb\x1c\xb4\xf7\xe8\xee\xdd\x9e\x60\x01\x30\xde\x37\x2d\x7d\x53\xeb\xc2\xf9\x2f\x4d\x3b\xe8\xd8\x9c\x75\xc4\x94\xf2\x12\xe3\x8b\x6c\x30\xbf\xf0\x2f\xb2\x9e\xcd\xb4\xbd\xd2\x4d\x13\x91\x08\xe9\x6a\x5c\xa3\x9c\xd3\x34\x9b\x92\xf4\xde\xc8\x50\x95\xc4\x5c\x4f\xda\x36\x62\x14\xbf\x02\x00\x00\xff\xff\x5a\x51\x78\xad\xe6\x04\x00\x00"),
+		},
+		"/terraform-modules/platforms/tinkerbell/workerpool/output.tf": &vfsgen۰FileInfo{
+			name:    "output.tf",
+			modTime: time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			content: []byte("\x6f\x75\x74\x70\x75\x74\x20\x22\x62\x6f\x6f\x74\x73\x74\x72\x61\x70\x5f\x74\x6f\x6b\x65\x6e\x73\x22\x20\x7b\x0a\x20\x20\x76\x61\x6c\x75\x65\x20\x3d\x20\x6d\x6f\x64\x75\x6c\x65\x2e\x77\x6f\x72\x6b\x65\x72\x2e\x2a\x2e\x62\x6f\x6f\x74\x73\x74\x72\x61\x70\x5f\x74\x6f\x6b\x65\x6e\x0a\x7d\x0a"),
+		},
+		"/terraform-modules/platforms/tinkerbell/workerpool/templates": &vfsgen۰DirInfo{
+			name:    "templates",
+			modTime: time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+		},
+		"/terraform-modules/platforms/tinkerbell/workerpool/templates/flatcar-install.tmpl": &vfsgen۰CompressedFileInfo{
+			name:             "flatcar-install.tmpl",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 1149,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xa4\x53\x41\x8f\xd3\x3c\x10\xbd\xe7\x57\xbc\xaf\xbb\x9f\x02\x12\x69\xb6\x12\x42\x28\x08\x2e\xc0\xb9\x87\x5d\x71\x8d\x9c\x78\x9a\x98\x3a\x9e\xae\xc7\xe9\x52\x95\xee\x6f\x47\x6e\x92\x6e\xc5\xb6\x27\x2e\xd6\x58\xf3\xe6\xcd\xf3\x3c\xcf\x96\xbc\x18\x76\x05\xd2\xbb\xf9\x22\x4d\x9c\xea\xa8\xc0\xca\xaa\x50\x2b\x9f\x19\x27\x41\x59\x9b\x34\x96\x2b\x65\xcb\x60\x3a\xe2\x3e\x14\x58\x7c\xbc\xbb\x4b\x82\x92\xb5\x14\x49\x86\xa1\x66\xf6\x57\xd1\x2c\x01\x9e\xd8\xaf\xc9\x17\x98\xed\xf7\x73\x4d\x5b\x53\x53\xb9\x38\x1c\x62\x66\xcb\xb6\xef\x48\x8a\x04\xc8\x90\x6b\xda\x16\xf1\x18\x6e\x12\x54\x20\x6d\x7c\x71\x8a\x12\x40\xd5\xc1\xb0\x1b\x0b\xc6\x8e\xba\xef\x36\x99\x69\x9c\x89\xa9\xc8\x0a\x98\x4e\x35\x17\x1e\x10\x53\x35\x77\x9d\x72\xba\x38\x5e\x32\x48\x3b\x06\x59\x3d\x06\x54\xb7\x8c\xf4\x76\x5f\x29\xa1\x0f\xef\xc9\xd5\xac\xe9\xcd\x44\x5f\xd6\xec\x56\xa6\x79\x7b\x48\xf1\x1b\x03\x02\x99\xc6\x97\x17\xb9\xf9\x04\x9d\xff\x14\x76\xe7\x3a\x2f\x4c\xe6\x9a\x52\xdc\xe0\x61\xf9\x6d\x09\xcd\xb5\x14\x78\x68\x8d\x0c\x40\x74\xbd\x04\x54\x84\x4d\x2f\x2d\x69\x04\xc6\x83\x71\x6b\xf2\x15\x59\x0b\x4f\x8d\x91\xe0\x77\xf3\x4b\x0f\xcd\x7b\xf1\xb9\xe5\x5a\xd9\xbc\x32\x2e\xbf\x34\x9a\x0c\x99\xe0\x06\xdf\x7f\x6d\xc8\x9b\x8e\x5c\x4c\xec\xd0\x0b\x21\xb4\x04\xe9\x94\xb5\x24\x01\xda\xc8\x3a\x76\x9e\xb4\xc6\xe4\xf2\x7e\x68\xfa\xff\xfe\x19\x66\x05\x96\x72\xfc\x51\xf8\xef\x33\x66\x33\x3c\x1f\xa6\x0e\x3f\xc6\xe0\x76\xff\x02\x3a\x9c\x6a\xc9\x69\xb3\x9a\xd0\x2f\x64\x75\xab\x9c\x23\xfb\x8a\xec\xeb\x39\xd9\x08\xba\x42\x96\x21\x33\xd3\x28\xae\x7a\x75\xea\x39\x8e\xa7\x1c\xdf\x58\x46\xab\xcb\xde\xbf\x56\x50\x9d\x14\x5c\x2b\xb9\xa8\xe7\xf4\x29\x3c\x55\xcc\x61\x16\x0d\x8f\x2e\xc7\x6d\x82\xb4\xdc\x5b\xed\xd2\x00\x4f\x47\x0b\xaa\xa3\x03\x9e\xde\xa1\xea\xc3\x10\xc2\x08\x1c\x83\xe3\x05\x4f\x6a\x17\x0d\x19\xb8\x8e\x7e\x0c\x2b\x07\xe3\x02\x23\x28\xdf\x50\xc0\xf2\x1e\xc6\x9d\x7f\x97\x15\x7b\x38\x7e\x9a\xff\xf3\xc6\xa4\xc7\x95\x59\xc4\x2d\xd8\x78\xae\x73\xd9\x49\xbe\x26\xef\xc8\xc6\xd0\x3f\x7e\x1a\x76\xaa\x3a\x07\xf8\xc7\x2c\x78\xd3\x34\xe4\xd3\xe4\x4f\x00\x00\x00\xff\xff\x58\x4c\x7b\x16\x7d\x04\x00\x00"),
+		},
+		"/terraform-modules/platforms/tinkerbell/workerpool/variables.tf": &vfsgen۰CompressedFileInfo{
+			name:             "variables.tf",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 1763,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xa4\x54\x4f\x6f\x13\x3f\x10\xbd\xe7\x53\x8c\xf2\x3b\xf4\x87\xd4\x5a\x2d\x85\x8a\x4b\x0f\x21\x14\x81\xa8\xda\xaa\x39\x22\xb4\x9d\xf5\xce\x26\xa3\x7a\x6d\xe3\xb1\xa3\x56\x88\xef\x8e\xbc\xbb\x51\xb3\xe9\x22\x68\x50\x6e\xc9\xbc\x3f\x7e\xf3\x26\x6b\x0c\x8c\xa5\x21\x98\x6a\x93\x24\x52\x28\x2c\x36\x34\x85\x1f\x13\x80\xf8\xe8\x09\xce\x41\x62\x60\xbb\x9c\xfc\x9c\x4c\x9e\x86\xff\x6a\x88\x7d\x81\x55\x15\x48\x84\x64\x30\x6c\x58\xe2\xff\x1d\xe2\xd5\x10\x52\x1b\x8c\x1a\x43\xc1\x56\x22\x1a\x53\x94\x28\x54\xa4\x60\xb6\xe0\x00\x4f\x72\x00\x15\xd5\x98\x4c\x84\x73\x98\x4e\x87\x54\x4e\x8a\x35\x05\x61\x67\xf7\x03\xeb\x15\x5a\x4b\xfb\x28\xdf\xa7\x92\xb4\xb3\x35\x2f\x87\xe0\x67\x04\xa2\x03\xfb\xc8\xce\x66\x92\xb9\xb3\x91\x6c\x04\x57\x43\x26\x30\x14\x0f\x04\x9e\xa8\xa0\x66\x43\xad\xd0\x7f\x70\x4b\xdf\x13\x07\xaa\x60\xa3\x29\x6a\x4b\x5e\x64\x55\xdc\xd3\xa3\x8c\x89\x0f\x92\x7f\x66\xe1\x92\xa5\xd5\x5f\x2c\x3e\x81\x4f\xa5\x61\x0d\x99\x08\x6a\x17\x20\x09\x05\xb8\xd3\x2e\xd0\x9d\x82\x0b\xd4\x2b\x20\x43\x4d\x36\xdc\x24\x89\x50\x12\x88\x27\xcd\x35\x53\x05\x6c\x01\x61\x8d\x86\x2b\xb8\xf6\x64\x87\x74\x99\xad\xc1\x78\x08\x28\x39\x43\xb6\x1d\xe0\xf6\xe3\x1c\xde\xbc\x7e\x7b\x0a\x0b\xd2\xad\x9f\x33\x75\x76\x08\xa4\x96\x0a\x0e\x44\x56\x47\x41\x10\x66\xb3\xd9\xec\xfd\xe9\x95\x52\xea\x40\x4d\xb7\x56\xd0\xbd\xed\xeb\xb7\x2e\x9d\xeb\xf6\x3d\x68\xc6\xd3\xb1\xae\xa2\x42\xbb\x64\xe3\x58\x3e\x36\x35\x25\x85\xe7\xc9\x5c\xb5\xdf\xe7\x6c\x32\x5e\x20\x3a\xd0\x81\x30\xd2\x88\x8f\x93\x61\x1b\x36\x77\x55\x59\x29\x84\xc2\x9a\x35\x15\xec\x5f\xd2\x8c\xcf\x37\xd0\xdf\x51\x36\xd0\xf3\xc1\x87\xab\x05\x2c\x3a\x3e\x05\x37\x28\x42\x55\xb6\xd5\x77\x27\xa7\x7b\x74\xb4\xa5\x0d\x1e\x03\x36\x14\x29\x8c\x58\x9e\x9e\x1c\xab\x53\x75\xac\x4e\x8e\xa7\xbb\xe6\x75\x21\x96\xbd\xa7\xb8\x47\x9f\x2e\x1e\x62\x40\x98\x5f\xce\x61\xc3\x91\x1d\xb2\xd5\x26\x55\x94\x97\x1e\x57\x04\x5d\xbd\x53\xc0\x8c\xfa\xed\x5a\x47\xf2\x74\x0d\xb2\x2d\x24\xd5\x35\x3f\xbc\xe8\xd0\xfa\x00\x3b\x02\xe8\x08\xfe\x1c\x61\x37\x5d\x1b\x5c\x8e\x05\xd8\x8f\x29\xe3\x34\x9a\x9d\x10\x57\x4e\x62\xbb\xfe\x7f\x59\x7b\x5e\x77\xae\x0f\x85\xb6\x7c\x7d\x68\x04\xae\x4b\xb1\xad\xe5\x98\xb1\x77\xaa\xfd\xec\xee\x15\x0b\x4d\xa1\x3f\x81\x1d\xdd\x2f\xa9\xa4\x60\x29\x92\xc0\x7c\x06\x79\x8c\x6b\xd6\x18\x09\x2c\x51\xd5\x5d\x6b\x96\xdc\xf9\x6f\x6a\xc5\x47\x5f\x36\x50\x46\xcf\xdd\x33\x46\xb5\x67\x9b\x5f\xc1\x07\x5e\x67\x4d\xb2\x95\x77\x6c\xe3\xfe\xe2\xbf\x02\x00\x00\xff\xff\x6c\x30\x19\xef\xe3\x06\x00\x00"),
+		},
+		"/terraform-modules/platforms/tinkerbell/workerpool/versions.tf": &vfsgen۰CompressedFileInfo{
+			name:             "versions.tf",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 203,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x4c\x8d\x31\x0e\xc2\x30\x0c\x45\x77\x9f\xe2\x2b\xec\x21\x15\x73\x38\x05\x3b\x2a\xc4\x20\x8b\x90\x14\xa7\xe9\x82\x7a\x77\x54\x68\x69\x07\x4b\xd6\xfb\xff\xd9\x3b\x9c\x58\xb5\xbd\x65\x7d\x62\x60\x2d\x92\x13\xda\x14\xd0\xc5\x7a\x97\xb4\xa0\x42\xd4\xff\x6b\x6f\x02\x94\x5f\x55\x94\xc3\x79\x71\x3c\xcc\xd1\xc3\xd9\xe6\x60\x68\x9b\x77\x9a\x07\x09\xac\xe5\xab\x01\xbd\xa4\x07\xeb\x85\x63\x84\x9f\x11\x50\x72\xd5\x2b\x63\x3a\xb2\xe6\xfb\x75\x35\x73\x6f\xf3\xcc\xd9\xc6\xba\x1f\x1f\x69\x9a\x91\x3e\x01\x00\x00\xff\xff\x63\xd5\xde\x65\xcb\x00\x00\x00"),
+		},
+		"/terraform-modules/tinkerbell-sandbox": &vfsgen۰DirInfo{
+			name:    "tinkerbell-sandbox",
+			modTime: time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+		},
+		"/terraform-modules/tinkerbell-sandbox/assets": &vfsgen۰DirInfo{
+			name:    "assets",
+			modTime: time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+		},
+		"/terraform-modules/tinkerbell-sandbox/assets/deploy": &vfsgen۰DirInfo{
+			name:    "deploy",
+			modTime: time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+		},
+		"/terraform-modules/tinkerbell-sandbox/assets/deploy/.gitignore": &vfsgen۰FileInfo{
+			name:    ".gitignore",
+			modTime: time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			content: []byte("\x73\x74\x61\x74\x65\x0a"),
+		},
+		"/terraform-modules/tinkerbell-sandbox/assets/deploy/db": &vfsgen۰DirInfo{
+			name:    "db",
+			modTime: time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+		},
+		"/terraform-modules/tinkerbell-sandbox/assets/deploy/db/tinkerbell-init.sql": &vfsgen۰CompressedFileInfo{
+			name:             "tinkerbell-init.sql",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 2175,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xa4\x95\x4b\x6f\x9b\x4c\x14\x86\xd7\xf0\x2b\xce\xe2\x93\x62\x7f\xb2\xa5\xa8\xbb\x2a\x2b\x4c\x48\x4c\x83\xc1\x85\xa1\x4a\x53\xb5\xa3\x89\x39\x4e\x47\xe6\x62\x0d\xe3\x4b\xbb\xe8\x6f\xaf\xb8\x94\x8b\x03\x36\x51\xbc\xb2\x38\xef\xb9\xcc\xf3\x72\x18\xcf\x20\xe0\x3a\x96\x01\x92\xc7\x1b\x14\xcf\x18\x86\x37\xaa\xaa\xbb\x86\x46\x0c\x20\xda\xcc\x32\xc0\xbc\x03\xdb\x21\x60\x3c\x9a\x1e\xf1\xe0\x27\x13\xc1\x81\x09\x84\x91\xaa\xf0\x00\x7c\xdf\xbc\x05\xdf\x36\x3f\xfb\x86\xaa\x4c\x80\xc7\x29\x0a\x89\x01\x65\x12\x88\xb9\x30\x3c\xa2\x2d\x96\xe4\x29\x0b\x05\x18\x62\x4f\x84\x49\x06\x9f\x3c\xc7\x9e\xa9\xe3\xba\xb9\x69\xdf\x1a\x8f\x27\xcd\x79\x70\xa4\x3c\x00\xc7\x6e\x8c\xc1\x83\xf1\xcd\xa5\x9c\x46\xef\x56\x6e\xe3\xb9\xed\x5b\x96\x07\x77\xa6\xeb\x91\x8b\xf5\x5e\x78\x4c\xe5\xaf\x2d\xb6\x8a\xf9\x9e\x69\xdf\xc3\xbd\x69\xc3\xa8\x3e\x10\x5d\x6a\x64\x4e\x9d\xa5\x37\x3e\x4f\x55\x62\xb4\x0d\x99\xcc\xa8\x42\xf9\x6b\xc3\xcd\xc5\xd9\x8c\x55\x7c\x02\x31\x8b\x10\xbe\x68\xae\x3e\xd7\xdc\xd1\x87\xeb\xeb\x71\x97\x68\x25\x90\x75\x60\xaf\x05\xbb\x6d\x70\x5e\xd0\x63\x5c\x43\x90\x1d\x77\xf6\x95\x18\x9a\x5a\x3d\xd5\x1d\xdb\x23\xae\x66\xda\x04\xf4\x07\x9a\x4f\xaa\xcf\x0d\xfd\x01\x46\xf9\xff\x3f\x70\xf5\xe3\x1b\x9b\xfe\xd6\xa6\x4f\xd7\xd3\x8f\x74\xfa\xfd\xff\xff\xae\xc6\x43\xdc\x97\x85\xfd\x35\xaf\x21\xf6\xcb\xb6\xff\x75\x72\xaf\xff\xe7\xbc\x3a\x24\x62\xb3\x0e\x93\xc3\xeb\x0d\xa8\xf9\x2b\x93\xba\x4b\x2e\x68\x46\x02\xdc\xf3\x15\xa6\xc5\x1b\xd2\x8a\xf4\x98\xa5\xf4\xba\xd4\xbf\x57\x03\x58\x1e\x0a\x96\xf5\x79\x86\xb0\x3c\xb4\x59\xd6\xc9\xef\x62\x49\x53\xd9\x7e\xfb\xab\xc0\xe5\x35\x58\xed\x84\xc0\x58\x52\xc9\xd2\x0d\x7d\xb5\x13\x1d\x42\xb6\x92\x3c\x89\xdf\x22\x2d\xa6\xf3\x16\x9a\x65\x99\x36\xe9\xd0\x65\xe3\xa2\xe8\xab\x56\x56\x09\x79\x2a\xcb\xef\x5c\x6f\x27\x1e\x07\x78\x04\x1e\xcb\x86\x44\x26\x92\x85\x34\xde\x45\xcf\x28\x68\xb2\x2e\xa5\x29\x64\xa3\x0c\xb1\x79\xdd\xf6\xf9\x1f\xeb\x06\xe2\xa1\x2e\xe1\x1e\x63\x79\xce\xa5\x0e\x7b\x0a\x34\x95\xa2\x4b\x72\xd1\xb9\x01\x8e\xe1\x11\x57\xbb\x5c\x25\x79\x84\x39\x41\x65\x02\x11\xa6\x29\x7b\x39\x49\x52\x26\x90\x21\xd8\xa5\x9d\x8e\x76\xaf\xe0\x00\xce\x05\x9c\x26\xe8\x12\x57\x5d\x72\x28\xe7\x92\x59\xc4\xb6\xef\x83\x5d\x29\x86\x36\xce\x3f\xe5\x6f\x6b\xb9\x47\x91\xf2\x24\x86\x36\xc6\x08\x25\x6b\xdc\xeb\x27\x97\x45\x75\xd9\xff\x0d\x00\x00\xff\xff\x65\xae\x96\x3a\x7f\x08\x00\x00"),
+		},
+		"/terraform-modules/tinkerbell-sandbox/assets/deploy/docker-compose.yml": &vfsgen۰CompressedFileInfo{
+			name:             "docker-compose.yml",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 4734,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xdc\x58\x5d\x6f\xa3\x38\x17\xbe\xef\xaf\xb0\xf2\xbe\x97\x4b\x48\xfa\x5d\xdf\x11\xe2\x49\x50\x49\x88\x0c\x99\xdd\x6a\x35\x42\x04\xbc\x09\x2a\x01\xc6\x76\xd2\xa9\x56\xf3\xdf\x57\x06\x4c\x49\x30\x69\xb6\xd5\xee\xc5\xce\x5c\x0c\x39\xe7\x39\xfe\x3a\xcf\x79\x7c\x3c\x7b\x42\x59\x9c\xa5\x10\xf4\x2e\xfb\xc3\xde\x05\x23\x74\x1f\x87\x84\xc1\x0b\x00\x78\x9c\x3e\x6b\xc2\x40\xa8\xf8\x09\x40\xbc\x0d\xd6\x04\x82\xff\xff\xe9\x59\xf3\x47\x84\x47\xc8\xb6\x7d\xf1\xe9\xbb\x08\x7f\x45\xd8\xb7\x66\xc6\x04\xfd\x2c\xa0\x94\x30\x1e\x50\x0e\xc1\x2e\x4d\x08\x63\x1a\xe3\x59\x9e\x93\xa8\xf0\x91\x74\x1f\xd3\x2c\xdd\x92\x94\x97\xe3\x02\xf0\xc5\x30\x2d\xdb\xf2\x9e\xc4\xe0\xf5\xb7\x96\xa5\x39\x25\xdb\x9f\x15\x66\x61\x98\x8f\xc8\xf3\xd1\xfc\xab\x40\x35\x7e\x69\x9c\x30\x1e\xa7\xeb\x23\xe0\x57\x84\x5d\xcb\x99\x37\xc0\xd2\xa2\xc5\xeb\x34\xa3\x24\x92\x01\xd8\xb1\xed\x91\x81\x7d\xcf\x79\x44\x05\xfe\xd0\xd0\x05\x1f\x5b\xae\x31\xb2\x51\x33\x40\x9a\xb4\x61\xbd\x98\xc9\xd8\xf0\x8c\x91\xe1\x22\x58\x1c\x28\xa1\x2b\x92\x24\xb5\x73\xea\xb8\x1e\x04\xd1\xaa\x36\x2c\x0c\xd7\xfd\xd5\xc1\x63\x25\x7a\xe1\x60\x0f\x82\x9b\xeb\xab\xcb\xda\xe4\xba\xf6\xcc\x19\x23\x08\xa2\x98\x05\xab\x84\xd4\x8e\xa5\x8b\xb0\x62\x90\x46\xea\x26\x78\x61\xfa\xc6\xd2\x9b\x3a\xb8\x38\x7a\x78\x7d\x39\x1c\x5e\xb5\x71\x53\xcf\x5b\xb4\x70\xd7\x0d\x5c\xe1\xf4\xc5\x84\x73\x63\x86\x54\x04\x91\xbe\x9f\xad\xa8\xb7\xfd\xb6\xa3\xa4\xaf\x8c\x8a\x48\x4e\xd2\x88\xf9\x59\x2a\x59\x13\xad\xe4\x17\x00\x61\x96\x46\x31\x2f\x98\x5c\x71\xd8\xdf\x90\x20\xe1\x9b\xd7\x02\x52\x7e\x87\x1b\x12\x3e\xcb\x18\xc1\x1a\x08\x7e\xef\x99\xb3\xb1\xe6\x4e\x91\x6d\xf7\x7e\x01\xbd\x97\x35\xe1\x40\xfb\xee\x68\x60\x78\x79\xd7\x1f\xf4\x07\xfd\x61\xb9\x5d\x3d\x24\x94\xf7\xbe\x81\xff\x81\x3c\xa3\x1c\xa4\x84\x44\x0c\xf0\x0c\x6c\x03\x1e\x6e\xba\x4f\xab\x9a\x2b\x4e\x39\xa1\xfb\x20\x81\xe0\x86\xc9\xe9\xe3\x2d\xc9\x76\x1c\x82\x4b\x69\xa1\x84\xd3\x98\x30\x08\xae\x06\x85\x65\x9f\x25\xbb\x6d\x59\x8a\xe2\x8f\x06\xfa\x3a\xe3\x01\x27\xc5\x52\x18\x2c\xff\xd1\xbb\x0a\x46\x2c\xb3\x11\x5b\xe4\xb6\xcc\xb0\xce\xc3\xfc\xc0\x7e\x5d\x6d\x51\xd8\x2f\xde\x8e\xb5\x2a\xf7\x3c\x63\x7c\x4d\x09\x83\xc3\x81\x16\x24\x79\x9c\x92\x8f\x54\xf8\xc2\x71\xbd\x09\x46\xae\x3f\x1e\xa9\xa8\x2d\xbd\xa7\xe8\x2f\x31\x4a\x66\x2b\x0e\x2b\x5a\xe9\x6f\x20\x2d\x4e\x63\xde\x67\xdf\x13\xa8\x47\x59\xf8\x4c\xa8\x46\x52\x4e\x5f\xf3\x2c\x4e\x79\xe1\x8b\x56\xfd\x48\x89\xa7\x59\x3d\xa6\x3c\x0a\x3f\x0a\x78\x00\xf5\x7d\x40\xf5\x24\x5e\xe9\xd2\xfc\x3d\xd1\x0b\x07\x7d\x51\x65\x40\x94\x2d\xac\x6b\xf7\x5c\x42\xe6\x6b\x3f\x66\x94\x04\xd1\x2b\xd0\x96\x8d\x4d\xf7\xbe\xb5\xa8\x35\x6c\x51\x6b\xa8\xa2\x96\x54\xf6\x30\x89\xdf\x91\x75\xd3\xb6\x3e\xa1\xe9\x27\x94\xe6\xb0\xb6\x14\x92\x63\x22\xec\xf9\x4b\x6c\x43\xb0\xe1\x3c\x87\xba\xae\xaa\xc6\x0e\x55\x68\x5d\x5b\x67\xc8\xc3\xdf\xd2\x92\x94\xf0\x97\x8c\x3e\xfb\xdb\x2c\x22\x10\x6c\x32\xc6\xc5\x99\x52\xb2\x8e\x19\xa7\xaf\xe5\x30\xab\x5d\x9c\x44\x72\xc4\x30\x4b\x39\xf9\xc1\x61\x8d\xa9\xec\x01\x5d\xb3\xb7\x59\x31\x9a\x58\xae\x87\x9f\x9a\x42\xda\x38\x92\x96\xbb\x1d\xd8\xd0\x52\x55\xa0\x74\xbf\x9b\xcc\x73\xb9\x19\xee\x68\x02\x34\x2d\x0c\x44\x36\x40\xa5\x47\x61\xd0\xcf\xc9\xb6\xc8\x1b\x6b\x26\x4e\x41\xd8\xb6\x16\xb6\x09\x7b\xd3\x45\xaf\x7a\x5b\xa5\xe0\x8e\xc7\x18\x82\x41\x31\xd5\x00\x5e\x5f\x5f\x29\x51\x9e\xed\x16\xd4\xb2\xbe\x58\xa6\xe1\x21\x28\xd7\x5c\xb2\x45\xac\xbb\x33\xec\x11\x3d\x1d\xc1\xb5\x67\xf2\xaa\x0a\x11\x3c\x17\xbc\xcd\x03\xc6\x5e\x22\x95\xd7\x9f\x7a\x45\x2e\xc6\x3e\x46\x86\x3d\x83\xa0\x87\x2b\x62\x00\x4c\x82\x64\xdb\x3b\x1d\xb4\x30\xc4\x04\x7a\xb0\xe3\x1b\xfd\x60\x9a\xb3\x2e\x8c\x96\xb3\x26\x6e\xad\x67\x07\x34\x55\xb3\x7d\x95\x65\x52\xdb\x3a\xe5\x63\xe4\x38\x9e\x7b\xae\x80\x28\xa6\x29\x4b\x67\xbb\x0d\xd2\x08\x02\x2d\xda\x84\xb9\x16\x44\x11\xad\xb3\x7c\x7b\x07\x34\xfe\x07\xaf\xac\x4d\xca\x8b\xae\xca\xb7\x16\xf0\xf6\x01\x68\x82\x88\xdd\x88\xfb\x01\xd0\x92\x6c\xad\x25\x64\x4f\x12\x30\x46\xa3\xe5\xa4\x8b\x70\xc6\xc2\x2a\x13\x51\xb7\x89\x55\x5b\x79\xe4\x38\x6e\x17\x85\xdb\x74\xe6\xee\x72\x86\x70\x2b\xf6\xc8\x71\x1c\x2b\xaf\x76\xdf\x2c\x7a\xbc\xff\x5a\x73\x3c\xb3\x30\x76\xb0\x5f\x36\xc1\x07\x04\x9a\x4f\xac\xf9\x6f\x22\x41\x5a\x2d\x20\x32\x68\x3c\x77\xab\x07\x87\x0b\xc1\x7d\xbf\xf8\x2b\x37\xb7\x1c\xd9\x96\x29\xc2\x54\xc9\xae\x40\x82\x96\x0b\x7f\x64\xcd\xc7\x4a\x14\xbc\xbd\xab\x80\x45\xed\x77\xe3\xee\x07\x15\xce\x7d\x72\x6d\x67\x72\x02\x79\xf3\xd6\x2d\x7f\x39\x3d\xf5\x83\xdc\xa3\x63\x3e\x22\x5c\x4b\xf7\xa9\xed\x7c\xf0\xda\xf8\xd0\xa5\x71\xf2\x52\x57\x6d\xe8\xdc\xeb\xbd\x2b\xb6\x71\xd1\x03\x80\x6c\xc3\xf5\x2c\xd3\x77\x91\x81\xcd\x69\x19\xaf\x0a\x7c\xb8\x1c\xc8\xd4\x88\xb7\x97\x2f\xde\x47\xf6\x1b\xe3\x87\x9f\x7f\x4d\x1c\x75\x76\x6a\x76\xc0\xfb\xc1\x41\xa7\x7d\x7b\x07\x6f\xef\xf4\x5d\xd4\xb0\x3c\xc0\xdb\x87\xc2\x72\x01\x40\xba\x8e\xd3\x1f\x07\x8a\x5a\x5a\xce\x6c\xb9\x39\x7f\x85\x80\xd3\x1d\x79\x6f\x81\x75\x65\x1d\xae\xb0\xf3\xee\x78\x21\x2b\x9a\x65\x1c\xea\x3b\x46\x75\xb6\x09\x28\xd1\x8b\x85\xe9\x1b\xbe\x4d\x74\xb1\xf2\x0d\x59\x93\xe4\x9d\xbb\x60\x8a\x26\xc8\xfe\xe4\x5d\xa0\x6a\x02\x4e\x8a\xd3\xbb\xda\x34\x54\xa8\x67\xa5\x97\x1f\x95\xcb\xa2\x2a\xca\x77\xba\x20\xf0\x8d\xd4\x92\x62\xff\xe7\xfc\x37\x47\x89\x5c\xba\x48\xb4\x1d\x10\x0c\xfe\xd5\x6e\xfa\x1f\xa9\x98\x8b\x06\xb7\x0e\x5f\x50\x17\x7f\x05\x00\x00\xff\xff\x7e\xa2\xae\x92\x7e\x12\x00\x00"),
+		},
+		"/terraform-modules/tinkerbell-sandbox/assets/deploy/flatcar-install": &vfsgen۰DirInfo{
+			name:    "flatcar-install",
+			modTime: time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+		},
+		"/terraform-modules/tinkerbell-sandbox/assets/deploy/flatcar-install/Dockerfile": &vfsgen۰CompressedFileInfo{
+			name:             "Dockerfile",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 245,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x84\x8e\x31\x8a\xc3\x30\x14\x44\x6b\xeb\x14\x53\xb9\x59\x6c\xf5\x7b\x80\xed\x76\x0d\x86\xed\xd2\x7c\xcb\x8a\x2c\x90\x25\x21\xfd\x1f\x3b\xb7\x0f\x4e\xc0\x55\x20\xdd\xf0\x98\xc7\xcc\xcf\x38\xfc\x42\x26\x89\x2c\x4a\x8d\xff\x7f\xa0\xcc\x90\x3c\x13\x5b\xb4\x2d\x2e\xaa\x69\x0e\xe2\x63\x65\x0a\x01\xdd\x1d\x32\xdb\x1b\x5c\x76\xd8\x9c\xe5\x97\x73\x24\x2c\xcc\xb9\x7e\x6b\x5d\x68\xeb\x9d\xe7\x45\x26\xa9\xb6\x98\x14\xd9\x46\xee\x4d\x5a\xf5\x35\x10\x1b\x2a\x5d\xf0\x51\x76\xed\xa3\xe7\x13\xad\x54\xd9\x16\x3d\xf9\x78\xa2\x73\x72\x80\x96\x5a\x74\x48\x86\xc2\xdb\xc6\xf3\x27\x00\x98\x65\x4d\x33\xbe\xf6\x0f\x82\x7a\x04\x00\x00\xff\xff\x8e\x01\xbb\xf1\xf5\x00\x00\x00"),
+		},
+		"/terraform-modules/tinkerbell-sandbox/assets/deploy/registry": &vfsgen۰DirInfo{
+			name:    "registry",
+			modTime: time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+		},
+		"/terraform-modules/tinkerbell-sandbox/assets/deploy/registry/Dockerfile": &vfsgen۰CompressedFileInfo{
+			name:             "Dockerfile",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 229,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x64\xcc\xbb\x6a\xc3\x30\x14\xc6\xf1\x5d\x4f\x71\x86\xae\xc7\xa6\xae\xa1\xd0\xa1\xe0\x52\xd5\x74\xf0\x05\xa9\xa6\xc9\x14\x14\x49\xc4\xc6\x8e\x23\x74\x21\x84\xe0\x77\x0f\x71\x30\x24\x64\xfd\x7f\x7c\xbf\x1f\x56\x15\x60\xf5\xae\x73\xde\x9e\x3e\x92\xe8\x3d\x7a\x25\xac\x29\x41\x98\x1e\x84\x52\x80\x38\x1e\x50\x0a\xd9\x6a\x40\x0c\x46\x09\xaf\x41\x06\x3b\x80\x30\xd7\x98\x60\xf0\xdd\xe0\x48\xc6\x72\x60\x34\xff\xe5\x7f\x6c\xbd\x69\x38\x65\x65\x56\xd0\xc7\x5a\x67\x9c\xff\x57\xec\x7b\xe6\xf7\xbd\xea\x2c\xa0\x81\x58\x6a\xeb\x1d\xc4\x22\xf8\x76\x5e\x5a\x6f\x84\x73\x47\x05\xf8\xb5\x1d\xe1\xe5\xfc\xa4\x4e\xf7\x71\x41\x27\xf8\xbc\x19\xf1\xf2\x27\x74\x55\x57\x9c\x42\x9a\xbe\x91\x4b\x00\x00\x00\xff\xff\xe7\x4b\x4e\x7e\xe5\x00\x00\x00"),
+		},
+		"/terraform-modules/tinkerbell-sandbox/assets/deploy/tls": &vfsgen۰DirInfo{
+			name:    "tls",
+			modTime: time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+		},
+		"/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/.gitignore": &vfsgen۰FileInfo{
+			name:    ".gitignore",
+			modTime: time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			content: []byte("\x2a\x2f\x0a"),
+		},
+		"/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/Dockerfile": &vfsgen۰CompressedFileInfo{
+			name:             "Dockerfile",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 247,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x94\x8e\xb1\x6a\x03\x31\x0c\x40\x77\x7f\x85\xc8\x2e\x9b\xd0\x2d\xd0\xa9\xb4\xd0\xa1\x77\xe1\x48\x87\x50\x3a\x18\x5b\xf1\x89\x1a\xd9\xb5\x14\xe8\xfd\x7d\x87\xfb\x82\x6c\xef\x2d\x8f\xf7\xb6\xcc\x1f\x10\x6b\x67\xa1\xd3\x93\x3f\x1e\xdd\xeb\x74\x59\xae\xe7\xf9\x7d\xba\xc0\x17\x1c\x02\x89\x8d\xad\x37\x16\xf3\xba\x1e\xe0\xdb\xb9\xe5\x73\x82\xd8\x7f\x20\xe6\x0c\x88\xd2\x30\xc5\xb4\x12\x20\xde\x7b\x8e\xb6\x43\x19\x31\x13\xa4\x88\x89\x86\xf1\x8d\x53\x34\x52\xe8\x4d\xad\x0c\xd2\xdf\x8a\xa9\x32\x89\x3d\xd0\x42\x1c\xd4\x9b\xb2\xb5\xb1\x3d\xaf\x66\xfd\x14\x42\xae\x98\xb2\xf8\xfd\xbe\xb2\xdc\xff\x7c\x1b\x25\xec\x1e\x28\x17\x0a\x46\x6a\x2c\x05\xd2\x4d\xb5\x3a\xf7\x32\x9f\xaf\xe0\xc1\xbb\xff\x00\x00\x00\xff\xff\x21\xfd\x30\xdd\xf7\x00\x00\x00"),
+		},
+		"/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/ca-config.json": &vfsgen۰CompressedFileInfo{
+			name:             "ca-config.json",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 317,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xac\x8f\x4d\x0e\xc2\x20\x10\x85\xf7\x9c\xe2\x65\xd6\x2c\x74\x53\x9b\x5e\xc5\xb8\x20\x3a\x05\x62\x45\xc2\x8f\xb1\x31\xdc\xdd\xb4\x55\xac\xae\xdd\x90\xf0\xcd\xcb\xf7\x66\x1e\x02\xa0\x68\xb5\xb3\x4e\x53\x87\xe9\x0b\xd0\x89\x7b\x95\x87\x54\x01\x40\x7c\xf7\x36\x8c\xd4\x81\xb6\x4d\x6b\x68\xc6\x45\x2e\x71\x1f\xae\xbd\x1d\x38\xae\xf3\x91\xc3\x8d\xc3\x8a\x7c\x39\xda\x5d\xb3\x31\x24\x3f\xa3\x1c\x95\x9e\x05\xfb\xba\x8d\x04\x9d\x79\x04\xbb\xa3\xf5\x86\xc3\x85\x5d\x9a\xd8\x22\x86\xca\xc9\xd0\xe1\x25\x28\xb2\xd6\xfe\x9c\xf2\xa7\xde\x5a\x24\xde\x6f\x11\x45\x3c\x03\x00\x00\xff\xff\x5b\xbb\xc7\xc5\x3d\x01\x00\x00"),
+		},
+		"/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/ca.in.json": &vfsgen۰CompressedFileInfo{
+			name:             "ca.in.json",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 137,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x24\xcb\xb1\x0a\xc2\x40\x10\x84\xe1\x7e\x9f\x62\x98\xda\x42\xc4\x42\xae\xca\x71\x20\x04\x82\x95\x8d\x88\xc5\x81\x4b\x10\x35\x81\xdc\x59\xa8\xdc\xbb\xcb\xae\xed\xcc\xff\x7d\x05\x60\x3a\x30\x80\xf1\x55\xe7\x51\x27\x5d\x72\xd5\x2b\x52\xe4\xca\xbe\xbb\xbe\x19\x60\x19\xc0\xfc\x18\x67\x4b\x97\x92\xfd\x05\x58\x6e\x1f\x65\xc0\x66\xbd\xdd\x09\xd0\xdc\x4c\xf9\xa9\x85\x01\x67\x4f\xfe\x16\xe0\x60\xb4\xdb\xc7\xd4\x0f\xfd\xf1\xd4\xd1\xf7\x26\xc0\x45\x9a\xfc\x02\x00\x00\xff\xff\x0f\x79\x7f\x9a\x89\x00\x00\x00"),
+		},
+		"/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/entrypoint.sh": &vfsgen۰CompressedFileInfo{
+			name:             "entrypoint.sh",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 181,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x2c\xc8\xcf\x4e\x84\x30\x10\x80\xf1\x73\xe7\x29\xc6\xc2\x41\x0f\xa5\x77\xbd\x18\x0d\x07\x23\xf1\x80\xdc\x8c\x21\x58\x06\x3a\x51\x5b\x32\x2d\x9b\xfd\x93\x7d\xf7\xcd\x92\xbd\x7d\xdf\xaf\xb8\xb3\x6b\x12\xfb\xc3\xc1\x52\xd8\x61\xf2\x00\x05\x26\xca\x68\x22\x92\x08\xed\x79\xcb\x10\xd7\x70\xd3\x85\x17\x9a\x06\xfe\x03\xe0\x09\xbf\xd0\x1c\x51\x97\xa7\xee\xed\xe3\xbd\x6e\x5f\xea\xa6\xe9\xbb\xe6\xb3\x7f\xad\xdb\xee\xd1\x9c\x35\x7e\x3f\x61\xf6\x14\x40\xdd\x83\x52\xe4\x7c\x44\xed\x84\x86\xcc\x61\xc6\x91\x85\x5c\x8e\x72\xd0\xa0\xd4\xff\xef\xc8\x82\x66\x41\xed\x48\x72\xba\x52\x65\x67\x0a\xdb\x55\xc9\x83\x7a\x80\x89\x01\x74\xf9\xac\xe1\x12\x00\x00\xff\xff\xda\xa1\x9d\xec\xb5\x00\x00\x00"),
+		},
+		"/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/gencerts.sh": &vfsgen۰CompressedFileInfo{
+			name:             "gencerts.sh",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 571,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x84\x90\x4b\x6e\xe3\x30\x0c\x86\xd7\xd6\x29\xfe\x24\x6b\xc7\x07\x18\x78\x2e\x32\x33\x0b\x85\xa6\x62\x4e\xf4\x30\x44\x39\xae\x81\x1e\xbe\xf0\xa3\x80\x1b\xa0\xe8\xee\x27\xf5\x81\xfc\xc4\xcb\xa9\x19\x35\x37\x37\x89\x0d\xc7\x27\xb4\x37\x46\xb9\xa0\xe6\xf1\xcd\x18\xea\xd0\x10\xe7\xa2\xc6\x88\xc3\x1f\x9c\x50\x3b\x90\xad\x1f\x3c\x5f\x07\x0e\xf8\xf7\x0b\xa5\xe7\x68\x2a\x72\xaa\x1e\x77\x8e\x0b\x8d\xbf\xa6\xaa\x6a\x89\x52\xc8\x82\xec\xf5\xbf\xa6\x88\x77\xac\xcc\x9a\xeb\x9b\xcd\x0c\xb2\xc6\xc9\x71\xb0\x72\x7e\x72\xfe\x71\x30\xd9\x96\xec\x4a\xed\xe5\xa2\xd3\x1e\xac\xb6\x76\x8a\x4e\xee\x6d\x43\x76\x8f\x9b\xc6\xfa\x36\xe4\xe4\xc4\x73\xbb\x2d\x5c\x7b\x5b\xac\x49\xf3\xae\x6b\xaa\xea\x55\x78\x63\x56\x69\xb2\xe5\xa8\xbb\xfb\xfc\xbe\x8d\xb1\xf3\xbc\xe4\x6b\x09\x83\x31\x17\xa4\xe8\x67\x9c\x43\xea\xc4\xcd\xe7\xe5\x4f\x58\x36\x43\x1c\x4a\x1e\xfd\x8c\xc8\xc4\xaa\x36\xcf\x50\x89\xc4\x98\x52\x7e\x38\x9f\x26\x4c\xe2\xfd\xb6\x02\x52\x30\x49\xe9\xcd\x05\x21\x75\x45\x02\x43\xa2\x4b\x70\x29\x83\xbc\x70\x2c\x20\x4b\xbd\xc4\x3b\x86\x31\x0f\x49\x59\x97\xa3\x9e\x40\x61\x40\xad\xf8\x2a\x75\x28\x3f\x6f\x1c\x9e\xdf\x33\x86\xbd\xb2\xa9\x72\x78\x41\x96\x2b\x7c\x04\x00\x00\xff\xff\x73\x3a\x77\xbd\x3b\x02\x00\x00"),
+		},
+		"/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/server-csr.in.json": &vfsgen۰CompressedFileInfo{
+			name:             "server-csr.in.json",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 256,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x64\x8e\xbd\x0a\xc2\x30\x14\x85\xf7\x3c\xc5\xe1\xce\x12\xda\x22\x28\x99\x2a\x05\xa1\x50\x9c\x5c\x44\x1c\xa2\x5c\x6a\x69\x6c\x21\xe9\x52\x4b\xde\x5d\x92\x52\xfc\x5b\xcf\xb9\xdf\x77\xcf\x24\x00\x2a\x0e\xa4\x40\x43\xd3\xb5\x6c\xaf\x6c\x0c\xad\x42\x7a\xef\xdd\xe0\x48\xe1\x2c\x00\x7c\xd6\xd2\x72\xdd\xb8\xc1\x8e\xf1\xee\xbb\xfa\x91\xe0\x4f\x0b\x90\xe9\x6f\xda\x04\xfb\x12\xa4\xd9\x46\x26\x32\x91\x29\x09\xe0\x12\x9f\xb7\x3c\x92\xc2\x34\xf7\xda\xd4\x7d\x58\x68\x9d\x5e\x10\xd7\x3c\x99\x14\xb2\x64\xbd\x15\x80\x8f\x4c\xa7\x1f\xfc\x1e\x3c\xb3\x00\x55\x01\xcd\xf7\xbb\xa2\xac\xca\xe3\x29\xa7\x98\xfb\xf0\x49\x78\xf1\x0a\x00\x00\xff\xff\xdc\xf4\xbe\x5b\x00\x01\x00\x00"),
+		},
+		"/terraform-modules/tinkerbell-sandbox/assets/generate-envrc.sh": &vfsgen۰CompressedFileInfo{
+			name:             "generate-envrc.sh",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 2769,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x8c\x56\x7f\x73\xda\xb8\x16\xfd\x1b\x7d\x8a\xbb\x86\x29\xe1\x4d\x0c\xd8\x4d\x48\x60\xd7\x9d\x47\x8b\x9b\x7a\xc2\x42\xc6\xb0\xaf\xbb\xb3\xd9\x65\x64\xfb\x1a\xeb\xc5\x48\x54\x92\x49\xd2\xa6\xdf\x7d\x47\xe6\x47\x48\x1b\x36\xfd\xcf\xd2\x95\xce\x39\xf7\xfa\xe8\x4a\xd5\x9f\x5a\x85\x92\xad\x88\xf1\x16\xf2\x15\x44\x54\x65\x84\x54\x41\x69\xb1\x54\xa0\x33\x04\xbc\xc3\xb8\xd0\x4c\x70\x60\x29\x50\x88\xc5\x62\x41\x79\x02\x42\xc2\x92\x2d\x31\x67\x1c\x21\xa3\x0a\x28\x07\x94\x52\x48\xa2\x50\x83\x8d\x05\x21\x2c\xdd\x2d\xb6\x57\xa0\x97\x85\x86\x37\xad\x04\x57\x2d\x5e\xe4\x39\xbc\x7a\xb5\x9e\x52\xa8\x69\x0a\xce\x7e\xc8\x7d\xf3\xca\xf9\xd9\x70\x73\x52\xa9\x42\x2c\x72\x21\x21\x16\x09\x2a\x52\x09\xfd\x81\x67\xd5\x8e\xf6\x77\x36\x2c\x33\x3d\xf1\xa7\x8f\x81\xb9\x6c\x37\x2c\x92\x32\x42\xfc\x30\xf4\xac\xda\x97\xd0\x1f\xf4\xec\xaf\x7e\x18\x8e\xc3\x9e\x19\x4d\xfc\x69\xcf\xfe\x6a\x11\x82\x52\x1e\x35\xe0\x88\x54\x58\x0a\x7f\x82\xfd\x19\xac\xda\x17\xc7\x84\xe0\xaf\xad\x82\x4a\x4c\x35\xbc\x79\xe5\x92\x0a\xe6\x0a\x49\xa5\x82\x71\x26\xc0\xaa\xf9\x61\x08\x16\x58\xb5\xff\x5a\xeb\x68\xca\x48\x83\x90\x98\xf2\x84\x25\x54\xe3\x8c\x71\x8d\x32\xa5\x31\xaa\x0d\xc3\x12\x6c\x01\x39\xe3\x37\xa0\x32\x71\x0b\x0f\xa4\x52\xa1\xb7\x37\x60\xbf\xaf\xf7\xa0\x0e\xf5\x2f\x4b\xc9\xb8\x86\x9a\xfb\xb5\x5e\xc6\x14\x26\x50\x57\xad\x3f\xe1\x5a\xff\xd5\xfc\x4f\xab\xf5\x73\xeb\xef\xeb\xa3\x5c\x5c\x3f\x44\x82\x27\xed\xeb\x87\xeb\x87\xeb\x46\xad\x95\x6c\x16\x0b\xa9\x0d\xfd\x8a\xe6\x6b\x76\xcd\xf8\x0d\xca\x08\xf3\x7c\xc6\x51\xdf\x0a\x79\xf3\x28\x68\xad\x27\x17\x31\xcd\xc1\xac\x7b\x8c\x78\x35\x87\x94\xb5\xf8\x09\x9e\x4b\x04\x1e\x60\x2e\x71\x09\xf6\x27\xb0\xfe\xae\x3d\xdd\x5a\xb3\x76\x05\x43\x29\xc1\x0a\x78\xa9\x05\x76\x0b\xe0\xe8\x9b\x1d\x0d\x50\x98\x63\xac\x31\x39\x86\x45\xa1\x34\x44\x08\x82\x23\x88\xb4\x67\x95\x65\x7f\x56\x00\x4a\x49\x2a\x15\x89\xba\x90\x1c\x9c\xdd\x4f\xd9\x4c\xb4\xb7\xff\x61\x8e\x1c\xa5\xd9\xbc\xa4\x4a\xdd\x0a\x99\xac\x93\xce\x90\x26\x60\xc7\xe0\xb8\x50\xfa\xad\x90\x94\x27\x62\x01\x0f\xa0\x32\xea\x9e\x76\x54\x61\xbe\xe3\x42\x83\x9d\xd4\xa1\x0e\x76\xea\x3c\x41\x43\xbe\x92\xf1\x4b\xf5\xfb\xa1\x9f\x00\xd6\x37\xe5\xb0\xc8\x13\xcc\xad\x6e\x52\x79\x32\xf4\x6a\x47\xdf\xa5\xd6\xd8\x6e\x94\x38\x67\x4a\xcb\xfb\xbd\xcd\xdf\x4d\x1d\x00\x30\x26\xff\xe5\x17\x7f\xfc\x9e\x54\x61\xba\x93\x0d\x13\x4d\xe3\x1b\x58\xa1\x54\x4c\x70\x42\xf0\x6e\x29\xa4\x86\xf1\x24\xf0\x67\x83\xf1\xc7\xd1\x70\xdc\x1f\xcc\x86\xc1\xe8\xd2\xcb\xb4\x5e\xaa\x5e\xab\xf5\x98\xb2\x2d\x94\x6a\xaa\xd7\x4d\xba\xa0\x9f\x05\xa7\xb7\xaa\x19\x8b\x45\x4b\x28\x86\x76\xb1\xcc\x05\x4d\xd4\x7a\xb0\x6a\xdb\xdc\x73\x4f\xdd\xe3\xd8\x8b\xe2\x93\xd3\x93\x28\x3e\x8e\xbc\x05\x55\x1a\x65\x53\x53\xd9\x9c\x7f\xde\xd2\x4e\x83\xd1\xa5\x1f\xbe\xf5\x87\xc3\x99\xf9\x9c\x4d\xfc\xf0\x7f\x7e\x38\x0b\x7e\xed\x5f\xf8\xde\xa7\x82\xde\x37\x99\xd8\x13\x50\x7e\xf6\x54\x46\x6d\x9a\x44\x27\xdd\x84\x1e\xc2\x79\x37\x0c\xfe\x1d\xc4\x8e\x73\xf6\x23\x40\x6f\xc7\xe3\xe9\xe4\x30\x54\x24\x84\x56\xbd\xd7\xee\x99\x7d\x7a\x4e\xa3\x93\x6e\xd7\x79\x1d\x9d\x9e\x74\xcf\xbb\xed\xf3\xc8\xe9\xa0\xdb\x69\x9f\x25\x6e\xe7\x94\x76\x1c\xda\x3e\x4d\xcf\x5e\x47\x9d\x43\x44\x1f\xfc\x0b\x7f\x78\x98\x28\xc3\x39\xe6\x3d\xa7\xdb\xb1\x53\x7a\xde\x3d\xa3\xb4\xed\xb6\xcf\x3a\xdd\x24\x3a\x8f\x30\x8e\xba\x11\xba\x5d\x9a\x50\x8c\x3a\x11\x76\x5d\x7a\x96\xc6\x67\x87\x88\x3e\x8e\xc3\xcb\x97\x4a\x6c\x1b\x63\xa3\x7c\x52\x20\x52\x85\xd1\xda\xf1\x7b\x0d\x20\x15\x72\xcf\x5b\x75\x05\x9b\x43\xf1\x0c\xf9\xc8\x9f\x1a\xea\x59\x30\x9a\xfa\xe1\xfb\xfe\x3b\xdf\x7b\xe6\xb8\x54\x61\x80\x31\x4b\x4c\xd7\x00\x0a\xaa\x88\x38\xea\x92\x64\x29\xc5\x8a\x19\xc7\x32\x3e\x6f\xee\xdb\x59\x65\xa2\xc8\x13\xb0\xc4\x2d\xb7\x40\x67\x4c\x91\xea\x56\x04\xa8\x25\x8d\xb1\x09\x81\x56\x5b\xa8\xcd\xea\x08\xe1\xff\xa6\x3d\xe5\x54\xce\x11\x90\x8b\x62\x9e\x81\x16\x66\x9e\x46\x39\x92\xaa\x19\xec\x28\xe1\x5e\x14\x12\x32\x2a\x93\x5b\x2a\xb1\xf9\x4c\x6e\xef\x82\x41\xe8\xb9\x5d\xa3\xff\x83\x50\x1a\x82\x2b\x60\x0a\x0a\xd3\xef\xa3\xfb\x47\x20\x94\x06\xd7\x6c\x57\x08\x09\x4b\x53\x94\xc8\xcd\xad\x27\x57\xcc\xb4\x42\x55\xc4\x19\x50\x93\x81\x29\xcc\x31\x94\xee\x3a\x06\xd4\x71\x93\x54\xcd\x29\xce\x10\xb2\x0d\xfe\x26\x13\x73\x9d\xa7\x4c\x6e\x38\x79\x39\x96\x94\xcf\xf1\x18\xcc\x2d\x6d\x86\xa3\x39\xe3\x77\x10\x5c\x99\x27\xc0\x2e\x7d\x13\x50\x18\x0b\x9e\x00\x4d\x12\x89\x4a\x3d\x97\xd7\x87\xf1\x64\x3a\x0b\xae\x3c\xa7\xeb\x36\x9d\xce\x79\xd3\x69\x3a\xa5\x0f\x2e\x82\xd1\xef\xff\x9e\xa4\xc9\xc9\x28\xcb\x51\x81\xc4\x4f\x05\x93\x98\x94\x3f\x92\x5d\xfd\xee\x97\x89\x3d\x67\x11\x83\xfb\x94\xcf\x25\x9b\xee\xb5\x46\x94\x86\x4f\x72\xba\xc0\x32\xbd\x5d\x53\x3c\xe0\xf5\xdf\x26\x7e\x38\xea\xff\xea\x7b\x34\x59\x30\x7e\x68\xd5\x55\x7f\x32\xf9\x38\x0e\x07\x5b\x43\x6e\x51\xd7\x7e\x14\xf1\x0d\x4a\x08\x37\x4d\xb7\xae\x7e\x58\x41\xe8\x5f\x04\x93\x69\xf8\xc7\xcb\x2a\x76\x2b\xf7\x94\x7c\xd7\xe5\x4b\x35\x43\x9c\xd3\xf8\x1e\xc4\xd2\xbc\xde\xd4\xf1\xc6\xb3\x09\xe6\xa8\x31\xe9\x6d\xa1\xdf\xf7\xdf\x05\xc3\x60\xfa\x87\x27\xf8\x52\xe2\x62\x3b\x1d\x8e\x87\xc3\xb7\xfd\x70\x36\x1d\x5f\xfa\x23\x8f\xcd\xb9\x90\x98\x7c\x1b\x1c\x04\x93\xfe\xdb\xa1\xef\x39\xc4\xdc\x1c\x0d\x42\x16\x94\xf1\x17\x1f\x54\xe5\xfb\xe0\x37\x45\xe7\xd8\x83\x5a\x7b\x7b\x00\xed\xdd\xd1\xb6\xcb\x82\xbd\x81\x26\xf2\x95\x79\x09\xe0\x1d\xd3\xe6\xaa\x37\x0f\xba\xca\xd3\xab\x18\xac\x9a\x63\x6d\x89\xcb\xc7\x18\xf9\x27\x00\x00\xff\xff\x58\x1c\x40\xba\xd1\x0a\x00\x00"),
+		},
+		"/terraform-modules/tinkerbell-sandbox/assets/setup.sh": &vfsgen۰CompressedFileInfo{
+			name:             "setup.sh",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 13414,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xcc\x3b\x7f\x73\xdb\x36\xb2\x7f\x13\x9f\x62\x43\x6b\x2a\xab\x2f\xa4\xac\xdc\xcd\xbd\xa9\x5a\x65\xce\x8d\x95\x56\x53\x9f\xed\x91\xfd\x9a\x76\x92\x8c\x06\x22\x41\x09\x35\x05\x30\x00\x28\x47\xb5\xfd\xdd\xdf\xe0\x07\x49\x50\x3f\x1c\xb7\xbd\xf7\xe6\xfc\x87\x47\x02\x76\x17\x8b\xdd\xc5\xee\x62\xb1\x3a\x7a\xd1\x2f\xa5\xe8\xcf\x29\xeb\x13\xb6\x86\x39\x96\x4b\x84\x8e\x40\x2a\x5e\x48\x50\x4b\x02\xe4\x33\x49\x4a\x45\x39\x03\x9a\x01\x86\x84\xaf\x56\x98\xa5\xc0\x05\x14\xb4\x20\x39\x65\x04\x96\x58\x02\x66\x40\x84\xe0\x02\x49\xa2\x20\x22\xa5\x26\x72\x43\xd9\x2d\x11\x73\x92\xe7\x20\x15\x4e\x6e\xe1\x9c\xb2\xf2\x33\x48\xa2\xca\x02\x64\x22\x68\xa1\xd0\x11\x3a\x82\x6b\x42\x60\xa9\x54\x21\x87\xfd\xbe\xaa\x71\x62\x2e\x16\x7d\x0b\x9b\x71\x61\x78\xa1\x4c\x2a\x9c\xe7\xd8\xb0\x23\x15\x29\x64\xac\xd7\xc9\x68\x4e\x40\x71\x58\xf2\x3c\x05\x9c\xe7\x40\xd8\x9a\x0a\xce\x56\x84\x29\x58\x63\x41\xf1\x3c\x27\x12\x8d\x2f\x7e\x9e\xbd\x9d\x9c\x8f\x47\x31\x61\x6b\x84\x56\xb7\x29\x15\x10\x15\x10\xf6\x79\xa1\xfa\x5c\x52\x12\xa2\xeb\x37\xd3\xd3\x9b\x37\x3f\x8e\xfc\x31\x41\x70\xca\x59\xbe\x01\x37\x89\xb2\x92\x25\x86\x85\x8c\x32\x2a\x97\xc7\x3d\x38\x46\x81\x58\x41\x24\x32\x08\x3b\x0e\x2a\x44\x3d\xa4\x04\x2e\x1c\x10\x8c\x7f\x99\xdc\x20\x74\x36\xbe\x3a\xbf\xfc\xf5\x6c\x32\x1d\x75\x8e\x8b\xbb\xb4\xd7\x4f\x49\x91\xf3\x4d\xb3\x46\x0d\xe0\x2d\x7b\x73\x7a\x33\x36\x28\xf5\x64\x5f\x2a\xac\x08\x42\x34\xab\x15\x12\xad\x41\x15\xa5\x82\xd7\xfd\x94\xac\xfb\xac\xcc\x73\xf8\xea\x2b\x3b\x24\x89\xc2\x19\x0c\xfc\xa9\x57\xaf\xbf\x1a\x7c\xab\x65\xca\x50\x70\x04\x09\xcf\xb9\x80\x84\xa7\x44\xa2\x60\x3a\x3e\x1b\x85\x9d\x63\x1f\xb3\x17\xa2\xe0\x87\xe9\x78\x7c\xb1\x35\xf1\x4a\x4f\xfc\x3a\x3e\x3f\xbf\x7c\xb7\x35\xf3\x37\x3d\x33\x1d\x5f\x8f\x6f\x9a\x89\x85\x38\xe9\x85\x28\xa3\x08\x4d\x2e\xde\x5e\x8e\xc2\xce\xbd\xa1\x39\x8c\x1e\xf5\xf7\x61\xe7\xde\xc0\x0f\xa3\xc7\x10\x8d\xa7\x53\x3d\x3f\x1d\x9f\x0d\xa3\xc7\xf1\x74\x7a\x39\x6d\x4d\xbf\x3b\x9d\x6a\x56\xee\xed\xd2\xc3\xe8\x51\x0f\x4c\x2e\x7e\x68\x01\x7d\x7f\x7e\x7a\xf1\xd3\x28\x04\xf3\x17\xa2\x8b\xf1\x2f\x37\xfe\x9a\xfa\x7b\x0b\x1e\x2d\x88\x9a\xa5\x54\x2a\x41\xe7\xc6\xe0\xad\x5e\x73\x9e\xe0\x1c\x72\x39\x37\x73\xa3\x30\xd4\x02\x1b\xaf\x89\xd8\x80\xdc\x48\x45\x56\xa0\x96\x58\xc1\x1d\x01\x9e\x65\x34\xa1\x38\xcf\x37\x20\xcb\xa2\xe0\x42\x99\x93\xd1\x27\x2a\xe9\x73\x19\x09\x92\x13\x2c\x09\x0a\x68\x06\xef\x21\x12\xdb\x13\xf0\xb1\x52\x48\x70\x04\x72\x49\xf2\x3c\x59\x92\xe4\x16\x52\x2a\xb5\xfd\x8e\xae\xdf\x0c\x4e\xbe\x19\xa0\x20\x68\x78\xe9\x1c\xc7\x3b\x54\xbe\xfa\x0a\x48\xb2\xe4\x10\x76\x26\x67\xa1\xd6\x42\x46\x35\xc7\x53\xa2\x4a\xc1\x28\x5b\x98\x93\xba\x2a\xd4\x06\xf4\x4e\xd9\x02\x96\x44\x10\x90\x4b\x5e\xe6\x29\xcc\x09\xe0\x5c\xd0\xc5\x52\x81\xa4\x2c\x21\x9a\x21\x63\x20\x9a\xb2\xb1\x39\x7d\xa6\x24\xa4\x9c\x75\x15\xe0\x44\x41\xc9\x72\x22\x25\x6c\x78\x09\x85\xe0\x6b\x9a\x12\xbd\x00\x4e\x54\x89\x73\x58\xe3\xbc\x24\x28\x70\xfc\x54\x7c\x87\xf0\x00\x4a\x40\xf7\xfd\xb0\x2c\x0a\x22\x86\x1f\xbb\xfa\x73\xce\xef\xcc\x67\xd4\xf3\x34\xc1\x67\x6b\x22\xe4\x1e\x5d\xb8\xe1\x51\x78\xf2\x9f\xa1\x8f\x9a\x9f\xa7\x55\xf2\xf3\x78\x7a\x3d\xb9\xbc\x98\x35\xaa\x69\x49\xc7\x51\xd1\xae\x03\x51\x39\x63\x44\xdd\x71\x71\x3b\x4b\x38\xcb\xe8\xa2\x14\x24\xb5\x62\xd0\xda\xfc\x54\x52\x61\xd4\x63\xc5\xae\xd1\x88\x00\xca\x14\x11\x19\x4e\xb4\x4f\x5e\x13\x98\x73\xb5\x34\x30\x4b\x2e\x15\x68\x2f\xc1\x16\x94\x7d\x86\xc9\x95\xd9\xf5\x0b\xa0\x05\xe0\x34\x15\x5a\xfd\x77\x10\x76\x6e\x26\x17\x3f\x8d\xa7\xdf\x8f\xcf\xcf\x67\x17\xe3\x9b\x77\x97\xd3\x9f\x66\x93\x8b\x9b\xf1\xf4\xed\xe9\x9b\x71\x08\x0f\x28\x08\x16\x82\x14\x10\x7d\x6a\xc3\xfe\x78\x79\x7d\x33\x9b\x5c\x85\xb5\xbc\x84\x31\x36\x18\xb8\x1d\xfe\x1b\x97\xba\xf8\x61\x72\xf1\xcb\x53\x6b\xb9\xaf\x27\x46\x84\x29\x61\x8a\x66\x9b\x5a\x90\x52\x09\xac\xc8\x62\xe3\x5b\x93\xb5\xb3\x51\x67\x50\x0d\x54\xaa\xec\xbc\x42\x28\x30\x86\x1f\x76\x2c\x50\x08\x94\xa1\xa0\x9c\x97\x4c\x95\x3d\x14\xe8\x7d\xfd\xf6\x09\x22\x06\x51\x44\x3e\x53\x15\xe9\x03\x52\x4a\xe8\x76\xda\xb6\x0b\xaf\x47\x30\xf8\xef\x78\x70\xd2\x85\x28\xc2\x62\xf1\x9b\xe4\x0c\xb6\x40\xc2\x4e\xa5\xfb\x43\x5e\x3a\x70\x86\x62\x22\x62\xb5\x23\xca\x16\xfa\x63\x91\x63\x16\xa2\x20\x20\xb9\xb6\xe7\x83\x90\x96\xf3\x59\x4e\x16\x38\xd9\x68\x78\xed\x1a\x82\x6f\xbf\x45\x41\x42\x98\xe2\x52\xef\xe9\x00\xaa\x05\x08\x1d\xf8\xd7\x4f\x40\xae\x30\x2b\xf5\x99\xab\x60\x89\xc4\x89\x56\xc6\x36\xe0\xf3\x75\xd0\xc2\x9c\x65\x5c\xdc\x61\x91\x52\xb6\xb0\x96\xb5\xf7\x9c\xd4\x42\xab\x5c\xe1\xc5\xdb\x4b\x68\x52\x0b\x70\x18\xde\x79\xa1\x52\x7b\x3e\x82\xd3\x0d\x34\x64\xc2\xc6\xbe\x4e\x9c\x7d\x59\xfe\x2a\x43\x42\x41\xf5\x69\xd4\x39\x3e\x68\x6e\x9e\x01\x35\x7a\xee\x21\x14\x84\x9d\xfb\x0a\xe6\x31\xdc\x0b\x05\x47\x2e\x01\xb3\x67\xbd\x5e\xf7\xdf\xb9\xf5\x06\x17\x64\x99\x24\x44\xca\xac\xb4\x0a\x74\xf6\xe4\x28\x8d\xa7\xd3\xe7\x11\xb2\xf9\x59\x86\x69\x6e\x44\x98\xd1\x7d\xfa\xaf\x0d\xe5\xf9\x86\xe0\xf3\xb1\xa4\xb2\x95\x48\x42\x82\x19\xe3\xaa\xd9\x0c\x38\x69\xc2\x71\x25\x4c\xed\x71\x1d\x09\x93\x1b\x40\x61\xdd\xb3\xd6\xba\x23\x68\x48\x75\x25\x48\x5e\x8a\x84\x18\x8f\xd9\x10\xa4\x0a\x2a\x9e\x63\x1d\x75\xf4\x99\x87\xc1\xce\xde\x3c\x0b\xad\xdc\x35\x61\x3a\x62\xc0\xe4\x0a\x9a\x39\x93\xd4\xa6\x3c\xb9\x25\xc2\x85\xa0\xb0\x73\x2c\x37\x32\x51\xb9\x76\x29\x8c\xa8\x98\x16\xeb\xbf\xc7\xb4\xa8\x08\xf6\x42\x78\x31\x82\x70\x10\x7a\x91\xc9\xc6\xae\xd4\x86\x1c\x8b\x1d\xa7\xde\xbc\xdb\xf0\x1e\x6a\xa3\x81\x76\x35\x3e\x5a\xff\x9b\x6f\x22\x2f\xfd\xd6\x1b\x37\x3e\xc5\xae\x91\xb5\xd6\xd0\x93\xcf\x5f\xe6\xf5\x36\xaa\xf5\x3d\x28\x08\xdc\x86\xf7\x22\x1e\xb4\x1c\xe7\xf1\xac\x74\xad\x07\xfe\x80\x82\xc0\x38\x57\xcf\x1c\xbf\x14\x64\x1a\x9c\x84\xa6\xa2\x0d\xfe\x66\x72\x36\xf5\x21\x74\x00\x9d\xd1\x62\x7f\xdc\xf3\xe0\x4c\x7c\xdd\x01\xac\xa3\x96\x81\xec\xde\x23\xa8\x4e\xcf\x10\xf4\x17\x00\x41\x58\x4a\x04\x11\x43\x23\x44\x3d\x93\x86\x2f\xcd\x0c\x51\x4b\x22\x18\x51\xb2\x02\x05\x38\xee\xd4\x9b\xec\x35\xa3\x60\xe2\x2b\x91\x92\xc8\x21\xbc\xaf\x07\x01\xc2\x0f\xc7\x1d\xc7\x7f\xaf\xff\xe1\xb8\xa3\x77\xdb\x73\xd4\x1b\x88\x8a\x73\x0f\xa4\x86\xf8\xe8\x3e\x3d\xa2\xea\xff\x23\x7a\xec\xc2\xeb\xd0\xe8\xd5\xa9\xa3\xdf\xb9\x7f\x4a\xde\x8f\xf1\x06\xaf\xf2\x50\x7b\xae\x02\x72\xca\x6e\xf5\xf1\xfd\xa2\x8e\x18\x5f\x61\xa9\xf4\x11\x71\xab\x00\x2e\x8a\x7c\x83\x5a\xde\xed\x0e\x53\x55\x9d\x28\xed\x25\x2b\xcf\xd4\xf6\x47\x8a\x9b\xf4\xb6\x28\x72\x4a\x52\x98\x57\xe9\x62\x1a\xd5\x02\x47\x81\xcc\x09\x29\xe0\x6f\x7b\xad\xae\x15\x3d\xad\xed\x99\x93\xf1\xa2\x3e\x1b\x0e\xb8\x5f\x6b\x47\x7a\x47\xc4\x73\x5e\xe6\xbe\x7a\x08\x43\x3b\xb1\x8c\x97\xcc\x04\x1f\xe7\x62\xea\x34\x6a\x7f\x4e\xb4\x2b\xb6\x03\xc4\xf7\x31\x73\x88\x8f\x2a\x1a\x56\x97\x7b\xa6\xc4\xc6\x48\xf8\xc9\xa5\xe3\xb0\xa1\x6e\x9d\xec\x0d\x87\x42\x90\xb5\xbe\x8a\xcf\x05\xc1\x5a\x94\xfa\xb6\x20\x2a\x2d\xbd\xac\xdc\x30\x49\xa9\x3a\xc4\xcd\x0e\xd5\xb6\x67\x7e\x92\x25\xc0\x12\x32\x9e\xe7\xfc\x4e\x0e\x35\x9d\x05\x61\x44\x47\xd1\x19\xd5\xa4\x5d\xe4\xac\xe9\xef\xf2\xbf\x24\x0c\x44\xc9\x8c\x65\x59\x3a\x7a\x0b\xee\xda\x6d\x49\xb6\x10\x7c\xf3\x7e\x9a\xb1\xca\xb8\x77\x49\x64\x29\xbf\x63\x4f\x63\x0f\x4f\xfe\x1c\xda\x60\x0f\x5a\x59\xfc\x89\xb5\xbe\x88\x34\xf0\x2d\xd8\xa5\x12\x7b\x85\x5f\x05\x88\x5d\xbd\xeb\x08\xf7\xa7\xbc\x45\xe0\x64\xf1\x34\x86\xdd\xd7\xf3\x40\x07\x16\xb4\xdc\x76\xed\x87\x68\x7e\x19\x70\x50\xe7\x46\x7b\xa5\x62\x5d\x4c\x82\x15\x7c\xf7\xdd\xf8\xf2\x2d\x42\xb8\x54\xfc\x4b\x7a\x42\x86\xc2\x97\xa0\x80\x32\xa2\xcc\x7d\x9e\x26\xc8\x8b\x1c\xb0\x27\xba\xf5\xb7\xc3\xa2\x41\x28\x04\x89\x74\xee\x65\xfc\xe5\xdf\x9f\xc5\xdb\xe0\x59\xbc\x0d\x9e\xc5\x5b\x15\x50\x9f\xc5\x9c\x16\xde\x3e\x87\x6e\xef\x34\x7e\xfa\xf9\xe3\xbb\xd3\xb3\xb3\xe9\xf8\xfa\xba\x1a\x48\x38\x53\x84\x29\x84\x82\x7a\x4a\x27\xfa\x7f\xe8\x2a\x6b\x9d\xb6\x09\xe3\xf0\x00\xf8\xee\x16\xa2\xb7\xd0\x35\xdf\xbb\xd0\xbd\x2f\x04\x65\x0a\x3a\xaf\x1e\xbb\xf0\x00\x49\xa9\x20\x4a\x43\x08\x21\xca\x5e\xf5\x50\xe0\xd6\x1f\x75\x8e\x51\xe0\x99\xc2\xd9\xf8\xe7\xc9\x9b\xf1\xe8\xc9\x95\xd1\xe5\xc5\xf7\x97\x97\x37\xa3\x0d\x91\xc8\x32\x3f\xea\x34\xfb\xd3\x53\x57\xd3\xcb\x9b\xcb\x91\x93\x34\x9a\x5c\xe9\xb9\x93\xd1\x1e\x13\x40\x57\xd3\xf1\xdb\xc9\x2f\xed\x39\x23\x6d\x8b\x34\x18\xed\xd3\x8d\xc3\x1a\xec\x62\xe9\x2d\x04\xbd\xfa\x32\x95\x64\x0b\x1d\x11\x47\x61\x9d\x25\x1a\xfb\xaf\xdc\x41\x64\xb3\x72\xd9\xa7\x59\x92\x2d\xa2\xa7\xc5\x8d\xaa\x72\x4e\x06\x61\xc7\x11\x0e\xf7\x47\xe1\x76\x96\x50\xc7\x3b\xf2\x99\x4a\x9d\x6c\xd5\xd8\xdb\x9e\xef\xca\x86\xab\xb2\x48\xb1\x32\x97\x02\xc5\x61\x85\x55\xb2\xb4\x77\x88\x56\xd2\xe1\x47\x07\xa7\xcb\xf0\xe9\x50\xf3\xf2\x79\xb1\xe6\xaf\x04\x99\x2f\xbb\xee\xad\xd2\x54\xc5\x39\xbc\x6e\x64\xfa\xa7\xf3\xb8\x67\x78\xc6\xb0\x39\xae\x5c\x52\x62\x4f\x68\x53\xae\xef\x54\x05\xf1\xfe\x1d\x99\x0b\xce\x55\x58\x9b\x92\x06\x9f\x25\xa5\x10\xe6\xd0\x6c\xc3\xf5\x57\x54\x26\xa6\xa8\xdf\x77\x30\x15\x9e\xbe\xf6\xcc\xb4\x35\x64\x39\xbf\xdb\x83\x58\x4d\xf5\x9b\x9c\x2f\x85\xb0\xe3\x2f\x17\xc2\x47\x78\x78\x68\xe6\x5a\x24\x7d\x13\xf4\x36\xd2\xc2\x6f\x4f\xb5\xd1\x51\x10\x14\xa5\x5c\xa6\xfe\xf3\x42\x7d\xfb\xfb\x1d\xc2\xce\xfd\xcd\xf7\xb3\xcb\xeb\xc9\x78\x76\x73\x3a\x1d\x46\x8f\xfe\x7a\x41\x52\x8a\x5c\x83\x98\xf9\xb3\xcb\x77\x17\xe7\x97\xa7\x67\xb3\xf3\xc9\xc5\x4f\x8f\x21\x44\x1c\x62\x23\x92\x58\x61\x11\x2f\x7e\xd7\x08\x0a\x0b\x88\x7e\xff\x9c\x41\x7b\xbc\xaa\x2e\xd5\xd3\x61\xc7\x5b\x35\xac\xef\x74\x34\x03\xcb\xac\x46\xff\xba\xdf\x30\x42\x33\x58\xad\xa1\xda\x54\xb4\x24\x79\x41\x44\x2c\x97\xdb\x43\x91\x48\x76\x24\xd0\x50\x09\x92\x02\x22\x01\x71\xff\xeb\x3d\x12\xac\x99\x6c\xe5\xdb\xa6\x12\x61\xce\x29\x5f\x13\xe8\xee\x72\xd0\x35\x09\xe5\xf6\x44\x24\x92\x6e\x68\x89\xb9\x2c\xc6\x95\xcc\x82\x82\x17\xa9\xab\x9f\xb5\x6b\x24\xe6\x3e\x62\xd2\x77\xeb\x48\xf4\xf1\xd5\x3c\x9a\x9c\x5f\xbe\x04\x79\x4b\x8b\xa2\x1e\x34\x36\x5e\x67\x01\xa6\xbc\xac\x83\xbf\xc2\x94\x11\x31\xb3\xe5\x44\x3f\x3e\x35\x73\x0c\xaf\xc8\x28\xec\xe8\x14\x62\x7b\x8a\xa6\x36\x6e\x54\xdf\x46\x9d\x63\x5b\x66\x88\x12\xbe\x2a\xb8\x24\xd6\x39\x36\x6f\x49\xed\xd9\x78\xb3\xca\x43\x28\xa4\xbd\x66\xb4\x57\x0c\x7b\x5e\x05\x0c\x0b\x35\x5b\xf1\x95\x77\x8a\x9c\x1e\x1c\xe3\x28\xf0\x61\x6a\x2e\x80\x32\x59\x90\x44\xbb\x8c\x7b\x9f\x4d\x6d\x8b\x51\xc6\xc5\x0a\x2b\xe8\xde\xdf\x43\x7c\xad\xb0\x22\xfa\xbf\x50\x24\x3d\x55\xf0\xf8\xd8\xd5\x11\xb1\xb5\xc6\x9f\xa5\xfa\x23\xc1\xb9\x5a\x9a\x2f\xa5\xb4\x94\xeb\x5a\x6f\x7b\x05\x5b\xf3\x35\x3b\xa1\x6c\xd1\x43\x41\x30\x84\x23\x6b\x47\xf6\x4e\x69\xde\x48\xd7\xe6\x55\xc4\x28\xd0\x95\x3d\x97\x66\x85\x4d\xaf\x55\x41\x34\x33\x25\xf3\xe6\x3c\x2b\xdd\x92\xb5\x5f\x91\x14\x25\x33\x4f\x37\xf3\x52\x99\xfb\xa1\x23\x10\x83\xe5\x51\x07\xab\x36\xd3\x5e\xe2\xbd\x5d\xb0\xfd\x23\x6b\x51\x25\xed\xab\x8f\x01\x80\x95\xbe\x30\x8b\x3f\xb0\xac\xa9\xfd\x7a\x16\x63\xac\xc2\x94\xdb\x22\xe1\xbe\xc3\x77\xf0\x5d\xa5\x43\x27\x46\x5b\x4d\xb1\xef\x4f\x61\xc7\x37\xa2\xaa\xd2\x92\xd1\x5c\x11\x01\x61\xbd\x8b\x51\xc7\x57\xfa\x36\x98\xa1\x3b\xb2\x42\xab\xd5\xea\x40\x6a\xd3\x70\xc6\xe0\x6c\xc1\x15\xe4\x2a\xe0\x17\x23\x08\x5b\xf8\xc3\x4a\x07\x07\x92\x8b\x3d\x02\xde\xaf\xb8\x5d\xc9\x6d\x5d\x09\x12\x22\x14\xcd\x68\x82\x15\x91\x87\x23\xa1\x86\x92\x75\xf6\xf3\xc2\x1e\xf1\xf6\x6c\x3f\xc1\xf1\x6f\x92\x33\x9f\xe3\xdf\x3e\x19\x39\x04\xdd\x58\xff\x87\x07\x88\x35\xb7\xf2\xfd\xc9\xc7\xf8\x1c\x46\xd0\xc9\x70\x42\x73\xaa\x36\x06\xc6\x82\xfa\x9e\x43\xe5\x86\x2a\x65\x8e\xb0\x01\x70\x65\xb8\xa7\x6a\x65\x0e\xa6\xa2\x0e\x61\xe7\xed\xe9\x9b\xc9\xf9\xe4\xe6\x57\x37\xff\x00\x8a\x90\xc3\x3b\x68\x0a\x22\x87\xf6\x2a\x89\x58\x6b\x9f\x26\xc5\x17\xf6\xfc\x00\xf1\x92\x4b\x25\xe1\xbf\x46\xf0\x1e\x3a\xb4\x78\x09\xa1\x57\x04\xfd\x70\x5c\xcb\xa0\x17\x17\x38\xb9\x25\x2a\x66\x44\x07\x7b\x87\x7c\x58\x5e\x35\xe5\x11\x1c\xbb\x4f\x0f\x20\xb9\x50\xf0\x00\x25\xa3\x9f\x4a\xd2\x7b\x42\xac\xde\x06\xfe\xdf\xc4\xbb\x2d\x34\x27\x66\x77\x3a\xe7\x25\xcd\x53\x88\x22\x85\x17\xbe\x88\x22\x6b\x7a\xb0\xb5\x81\xb0\xc6\xd3\xf9\x6c\x14\x89\x95\x3b\x71\x6b\x9e\x97\xab\xdd\xc5\x87\xce\x84\x0d\xd4\x36\xf5\xe6\xaa\xa0\xbf\xcd\x52\x2a\xdc\x65\xc1\x2e\x61\x51\xe3\xb4\xbf\x4f\x22\xc8\x36\x38\x14\x1b\x28\xca\x79\x4e\x13\xb8\x25\x1b\xed\xb7\xcd\x35\xc5\x14\xb4\x74\xd4\x27\x42\xba\x77\xca\x64\x55\x40\x14\x7d\x2a\xa9\xc9\x6a\x2b\x26\xc3\xc6\x02\x0b\xb2\xda\x93\x83\x36\x29\xa2\x05\x69\x12\x96\xa4\xf8\x4b\x74\x9c\x12\x8e\xaa\x0b\x87\x79\xca\xd5\x71\x47\x94\x52\x81\x20\x0b\x2a\x95\xd8\x80\xe7\x26\x9e\xdc\x48\x6b\x7d\xad\xb5\x5a\xa4\x7e\xeb\x4d\x22\x54\xd8\x7e\x63\x70\x59\xed\x41\x68\x3f\xe1\x3c\xd2\x37\x19\x28\x25\x11\x70\x47\xf3\x1c\xe6\x04\x14\xcf\x4d\x02\x96\x08\x82\xdd\x5b\x56\x4a\x05\x49\x14\x17\x1b\x8b\x42\x99\xab\xdd\x7e\x56\x30\xcf\x79\x72\xfb\x12\x4c\x77\x4b\xb1\xd1\xd1\x48\x4f\x99\xb5\xf5\x27\x41\x2c\x8a\xce\xeb\xa4\x39\xc5\x9e\x4b\xac\x39\x0c\x75\x3a\xae\x44\x49\xb6\x5f\x54\xab\x87\x4f\x2b\xa5\x5d\x37\xfa\x87\x84\xe3\x3b\x7d\x57\xc8\x34\xc6\xb6\x9f\xa6\x16\xc1\x61\xa2\x1e\xb9\xa6\xca\xa9\x8f\x4f\xe7\x04\xf0\x02\x53\x7d\x9d\x74\x79\xf4\xae\x42\x5a\x1a\x70\x64\x6a\xb1\x74\x1b\x38\x9b\xd1\xda\x34\xd6\x42\x25\x7a\x7e\x2f\xbb\x5d\x1f\x71\x8b\xdb\xae\xe5\xa5\x8e\xf7\x9a\xa2\x0d\x5d\xf6\x50\xce\x72\xbe\xa0\xee\x8d\xc6\xac\x13\x6d\x95\xd8\xa6\xe3\x1f\x26\xd7\x37\xd3\x5f\x67\x57\xa7\xd7\xd7\xef\x2e\xa7\x67\x21\x3c\xb8\x07\x31\x30\xb8\x10\x95\xa3\xfd\x18\xff\x73\x3d\x9e\x5e\x9c\xfe\x6b\xac\x93\xbb\x02\x4b\x79\xc7\x45\x1a\x49\x95\x52\xb6\xdf\x2b\x6a\xae\xb4\x51\x52\x09\x75\xef\x96\xc2\xb7\xc4\x54\xb6\xe9\x0a\x2f\x08\xe8\xec\x91\x66\x94\xa4\xa6\x5c\x4c\x85\x54\x50\x60\x81\x57\x44\x67\x10\x5a\x0f\xfa\xa2\x8f\x17\x1a\x23\x45\x47\xe6\x82\xa3\x87\x4a\x59\x59\xa7\x24\x09\x67\x29\x70\x46\x62\x6d\xfa\x59\x99\x6b\x65\x17\x82\x7f\xde\xd8\x25\x24\x64\x82\xaf\x00\x83\x20\x05\x97\x54\x5b\x3e\x28\x8e\x8e\x00\x33\xae\x8d\x3a\xae\x04\xb7\xa2\x42\x70\x31\x33\x48\x7e\xf6\xaf\xd1\xbd\xa7\x51\xc5\xed\xab\xa8\x13\x59\xa1\xcd\x3b\xec\x68\xa0\xc6\xf7\x1a\x5f\x6d\xc7\xf4\x8d\x8a\x87\x1e\xb8\x5c\xba\x21\x7d\xd9\x36\x49\x56\xe5\x4c\xec\xa2\x7f\xfc\xd2\x50\x6a\x87\xe3\xc2\x44\x5a\xbb\x26\x14\xec\xbf\xd8\x40\x58\x41\xec\xd5\x8f\x69\xd9\x91\x44\xda\x76\x1e\x2d\xe1\xda\xd7\x51\xa9\x97\x72\x87\x43\x27\xab\x31\x3a\x82\x89\xf7\xf6\x2b\xe1\x8e\xba\xce\x17\x61\x3b\x65\x52\x48\x49\x41\x58\x4a\x58\x42\x89\x8c\xd1\x9c\x73\x25\x95\xc0\xc5\xcc\x09\x7d\xdf\xde\xad\x09\x23\x53\x53\x3c\xb2\x37\xb6\x9c\xf3\x5b\x69\x1f\x9a\x28\xbb\x8d\x6c\xe8\x18\xe6\x3a\x39\x53\x2f\x41\x72\xb8\x73\xad\x37\x5a\xf7\x39\xde\x58\x46\xa8\x02\x0c\x73\xaa\x1c\xa5\xaa\xd7\x71\x41\xd5\xb2\x9c\xc7\x09\x5f\x79\x67\xcb\xd6\x27\xe6\x39\x9f\xf7\x6d\xc9\xa4\x8f\x8b\x42\xf6\x77\xef\xac\x47\xe7\xff\xf8\x47\xcd\xa9\x6f\x33\xa6\x1c\xd0\x1c\x02\xfd\x71\xf6\xee\x72\xfa\xd3\x78\x3a\x9b\xfc\xeb\xf4\x87\xb1\x69\x35\xb8\xdf\x3d\x26\x8f\xfd\xdd\x3d\x79\xa5\x98\xbd\x82\xb2\xa6\x58\x8d\xd9\xf5\xe5\xc8\xf3\xa8\x8d\x8e\x5b\x6e\x6b\x0b\xe3\x40\x7d\x64\x1b\xca\x36\xb3\xb5\x8d\x15\x05\x07\x75\xd9\x58\xb6\x31\x53\xa6\x6f\x17\xed\xeb\x74\x35\x3a\x3a\x4e\xe7\xb0\x24\x0b\x62\x4b\x41\x91\xcd\x84\xc0\x50\xb6\x23\x49\x4e\xed\xe3\x6e\x0f\x05\x99\x69\x96\x5c\x15\x60\xfc\xcd\x7d\x43\xe6\xfd\x3f\x3f\x3e\x86\xdf\x42\xca\x51\xf0\x97\x8f\x8f\xbe\x7b\xaf\x0a\xed\xac\xab\x47\xc9\xe0\xe0\x41\xaa\x40\x53\xce\x88\xa9\x24\xd8\x82\xe1\xcc\xd6\x32\xdd\x43\x42\xd3\x27\x1a\x76\xfe\xb9\xd3\x66\xe4\x17\x20\x0c\x60\xfd\xc2\xd9\x26\x06\x61\x67\x10\x6e\xdf\x78\x6c\xb4\x7a\x6b\xca\x1e\x85\x20\xe6\xcc\x49\xaa\xc8\x10\x4c\x85\xc2\xbb\x01\xef\x76\x94\x5c\x79\xf0\x75\x33\xab\xbe\x2b\xb9\x66\x5f\x92\x6e\x51\x19\xb4\xeb\x25\xfe\x7a\x6e\xab\x5e\x17\xc9\xbe\xfe\x11\x53\xa3\x59\x13\x41\x33\x93\x5a\xb4\x08\xd8\x17\xce\x7d\x9d\x23\xb6\x88\x34\x3a\x69\xdc\x99\x65\xd5\xf9\xd3\x87\x07\x57\x66\x1a\x0d\xf6\x43\xd4\x96\xf0\x04\x24\x2d\x9e\x9a\xfd\xed\x53\x6b\xf6\x2f\xf5\x1e\x55\xc5\x8e\x0a\xcc\x96\x39\x0e\x37\x97\xf5\x3c\xeb\x73\x2a\x72\xef\xf1\x2d\x86\xcd\xad\xff\x4b\x8d\x67\xbb\xb4\xdc\x0b\x5c\x9b\xd4\x36\x48\x59\x3c\x6b\x2d\xd7\xa9\xf6\x7f\xbb\x48\xdd\xe4\xe6\xd5\x55\xde\x9d\x4e\x2f\xfc\x36\xa2\xaa\x23\x09\x97\x8a\xaf\xb0\xa2\x89\xe9\x44\x6d\x1e\xad\xfd\x47\xf0\x78\x4f\x67\x9d\x39\x1d\xf3\x72\x31\x84\x92\x2d\x31\x4b\x73\x92\xd6\x6f\x16\x95\xda\x4c\x01\xc1\x69\xf0\x40\xf1\xc5\x78\xdd\x8e\x2b\x81\x46\xe4\x13\x0c\xf6\x57\x2c\xae\x5a\xc7\x40\x33\xbe\x22\x2a\xae\x5e\x3b\xdc\x61\x34\x21\x75\x45\xa5\xf4\x9f\x25\x6c\x24\x26\x91\xcd\x54\xe3\xdd\x5a\xc6\xdd\x12\x2b\x39\xd3\x99\xbd\x97\x0e\x86\x9d\x8b\xf1\x2f\x37\x00\x83\x18\xc6\x4c\x27\x59\xfd\x35\x5e\x08\xcc\x94\x6b\x89\xaf\xe2\xfb\xb0\x6a\xc6\x8a\xe3\x7e\x4c\xd8\xfa\xdb\xed\xf3\xa4\xdd\x66\xba\xdd\xda\xf5\x2a\x86\x1b\xb1\xa9\x7e\xbc\x50\xb5\x1c\x64\x54\xaa\xba\xd8\x1c\x6f\xe3\x00\xc0\x5b\xf3\xe6\xe2\x5a\xed\x48\x21\x21\x25\x5a\x99\x73\x92\x6a\x5f\x7f\xe0\x37\x0a\xe4\x33\x5e\x15\x39\x91\xfd\x25\xc9\x73\xae\xe3\x67\x9e\xf6\x75\x02\x20\xf1\x06\xba\x3f\xea\x41\x78\xa7\x07\x5f\x74\x6d\x3a\x80\x7d\x1e\x4c\xc2\x3c\x33\x16\x56\xb5\x8b\x15\x44\x64\x5c\xac\x40\xf2\x15\x01\xd3\xd9\x2c\xca\x94\xae\x08\x53\x58\x6c\x74\x5a\xa1\xcc\x74\x4a\x14\x31\xb9\x12\x6a\x5a\xc2\x3b\xc7\xdb\x5d\xec\x3d\xd4\x6a\x50\xf6\x00\xea\xee\xd3\xde\x96\x6f\xac\xaa\x9d\x7e\xb7\x9f\xfd\x01\x47\x55\xb0\xde\xe3\x7a\x5b\x0d\xde\x5b\xed\xcc\xed\x52\x4d\xf5\x3b\x8c\x03\xa5\xb3\x69\xc9\xa0\x1b\xf7\xab\x02\x58\x44\xd8\x5a\x24\xb1\x5c\x56\xc6\x1f\x35\x1d\x5e\xaf\xe1\x43\x43\xee\x43\xd8\x85\x39\xc9\xb8\x30\x8d\x88\x8a\xb2\x52\x67\x86\x3b\x5d\x34\x87\x7b\xb9\x4f\x50\xe0\x4c\xcd\xe3\x71\xbb\xff\x54\x8b\xe5\xc9\x9d\x36\xef\x56\x28\xd8\x5b\xc4\xab\x40\xb6\x93\x15\x74\xa8\x63\xd3\x13\xbd\x49\x3b\x72\xa2\xb6\x5a\x35\x81\x33\xa8\x79\x02\x9b\xbc\x84\x28\x68\xce\x9d\x4d\xb0\xef\x04\x2e\x0a\x92\xea\x13\x43\x19\x60\x2f\xd7\xe6\x75\xd3\xbc\x49\x5e\x8d\xe1\x15\x82\x3b\xfb\xb2\x97\x4f\xa9\xc0\xfc\x1c\x65\x41\x94\x36\x0e\x74\x04\x4b\x9c\x67\xf6\xa9\x92\xe6\x04\xd2\xd2\xfc\x9c\x20\x34\xcf\x4d\x0f\x20\x97\x61\x6d\xd8\xe8\x7f\x03\x00\x00\xff\xff\xed\x0b\x5c\x8f\x66\x34\x00\x00"),
+		},
+		"/terraform-modules/tinkerbell-sandbox/main.tf": &vfsgen۰CompressedFileInfo{
+			name:             "main.tf",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 5949,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xb4\x58\x6d\x6f\x1b\x37\x12\xfe\xae\x5f\x31\xd8\xa4\x75\xd3\xf3\xee\x4a\xae\x91\x4b\xdc\xaa\x40\x2e\x49\x9b\x00\x77\xa9\x71\xce\xe1\x3e\x24\x81\x40\x2d\x47\x5a\xc2\xbb\xe4\x96\xc3\x95\xac\x3a\xea\x6f\x3f\x0c\xc9\x5d\xad\x54\xc5\x4e\xae\x77\x31\x10\x4b\xe4\xf0\x99\x67\x86\xf3\x46\x3f\x80\x97\x7a\xa5\xac\xd1\x35\x6a\x07\x8d\xb0\x2e\x1b\x55\xa6\x10\x15\xc1\xed\x08\x60\x2e\x08\x67\x5a\xd4\x08\x53\x48\x9c\xd2\xd7\x68\xe7\x58\x55\x29\x09\x2d\xe7\xe6\x26\x7d\x78\xbb\x12\x36\x63\x81\x6d\x32\xda\x8e\x46\x16\xc9\xb4\xb6\x40\x48\x2a\x35\x5f\x29\xeb\x66\x1a\xdd\xda\xd8\xeb\x04\x92\xfe\x13\x03\x47\x4c\xaf\x2a\xeb\xb5\x8c\x46\x00\x0f\xe0\x6d\xa9\x08\x84\x94\x16\x89\x90\x60\xad\xaa\x0a\x4a\xb1\x42\x78\xf3\xec\x2d\x10\xba\xb6\x01\xa3\xc1\x95\x08\x2d\xa1\x84\xd2\x90\xcb\x46\x30\x38\x31\x85\x77\x4c\x8b\x37\x68\x56\x28\x69\x3f\x04\xe0\x17\x8a\xc4\xbc\x42\x78\xf1\xea\xf9\x25\x08\x82\xb9\x31\x8e\x60\x61\x4d\x0d\x6f\x7b\xdb\x80\x9c\x28\xae\x83\x56\x51\x38\x96\x33\x1a\xfd\x79\x67\x40\x10\xa9\xa5\x86\xd7\x97\x04\x42\x4b\xa0\xa2\x44\xd9\x56\x08\x6c\xd9\xa2\x32\x6b\x62\x26\xb2\x2c\x1a\x6f\x25\x00\x6a\xd6\x28\x61\x0a\x0b\x51\x11\xc3\x6c\x99\x8b\xd4\x14\x05\x1e\xc0\x0b\x03\xda\x38\x70\x76\xc3\x0a\xd8\x83\xd5\x0a\x41\x54\x15\xbc\x78\x73\xe5\x1d\x45\xa7\x60\x74\xb5\xf1\x26\x93\x13\x4e\x15\x4c\x89\xe2\xf9\xc2\xe8\x85\x5a\xb6\x16\x25\xcc\xb1\x32\xeb\xcc\xaf\x7b\xcf\xce\xfc\xb1\x29\x38\xdb\x7a\xdf\xb2\xf8\xbf\x08\xe1\x49\xe6\x7f\xd8\x36\x89\x0b\xd1\x56\x8e\x55\x2f\x4c\x55\x99\x75\xb7\x12\x1d\xf3\x53\x25\x5c\x21\x6c\x00\x5d\x18\xbb\x16\x56\xa2\xed\xd8\xf7\x5e\xe7\xf8\x88\xa8\x89\xdf\xd9\x06\x7d\x72\xa3\x45\xad\x0a\x48\xfc\x65\x24\xfd\xb1\x85\xb1\x33\x14\x45\x09\x53\xe0\xab\x92\x9a\x66\x5e\x62\x14\xf7\x0b\xa3\x1d\x47\x64\x27\x0f\xfe\x9a\x63\xd4\x78\xc9\x6c\x25\xaa\x16\xb3\x6e\xb9\x97\x53\x4d\xfc\xb0\x2f\xa7\x9a\x28\xb1\x1d\x75\xff\x6f\x8f\x47\x6c\x63\x4c\x95\x40\x12\x7e\xdd\x11\xab\x00\x6e\xd3\xf8\xc4\x90\xca\xb2\xd1\x8d\x70\x6c\x8f\x98\x13\x7f\xfa\x86\xed\x62\x90\x19\x7f\x7b\x74\x5c\xd7\xca\x54\x6d\x8d\x09\x24\x86\x66\x8c\x3c\x50\xc8\x06\x24\x86\x52\xbf\x3c\x02\x88\x47\xf7\xf1\x17\xe1\x76\x66\xaa\x16\x4b\x8c\x8a\x00\x58\xab\x3f\x3f\x34\xc9\x73\xc9\x22\xf3\x85\xb1\xb5\x70\xac\xe1\xd7\xc2\xac\xcf\x7c\xee\x3e\x80\x4b\x6b\x56\x8a\x94\xd1\x68\xf7\xaa\x40\xb3\x5b\xe7\x7c\xae\x05\x5d\xc3\x14\xa8\xa9\x94\xfb\x26\xc9\x93\x53\xd8\xcf\xb6\x47\xef\x26\x1f\x0e\x4e\xa9\xc6\x67\x65\x0c\x41\x4e\x36\xb0\xf8\x6b\xab\x2c\x12\x9c\xc1\xeb\xcb\x5d\xf2\x66\x51\x66\xec\x6f\x0f\x14\x41\xac\x1b\x9d\x48\x27\x30\xe9\x05\x96\xc2\xe1\x5a\x6c\x0e\x05\xae\x0c\xac\x7d\xbe\x58\x07\x6b\xe5\x4a\x30\x8b\x05\xa1\x03\xb3\x80\xb3\x20\xc3\x64\x19\xe4\x9b\x7d\xfe\xa7\x70\xf6\xe8\xf4\x6e\x81\xef\xbc\xc0\xa1\x95\x1d\x91\xe9\xa7\x0f\x4e\x1e\x71\x84\x0b\x22\x74\x34\x93\xca\xf2\x15\x3c\xbc\xe5\x8b\xcb\x6a\xc3\x95\x64\x9b\x87\x4d\x7f\x25\x52\x38\x01\x49\xe1\x66\x21\xc7\x39\x2a\x77\xea\x42\xac\x74\x89\x32\x85\x24\x61\x68\xd2\xaa\x69\xd0\x0d\xdd\x7d\x85\x6e\x97\x3d\xce\x00\x0a\xda\x80\x92\xa8\x9d\x5a\x6c\xa0\x16\x45\xa9\x74\xe7\xf8\x1f\x7e\x78\xf9\xcb\x4f\x23\x72\xc6\x8a\x25\x5e\x70\xa4\xa8\x0a\x89\x3f\xa4\x3e\xbe\x2f\x20\x47\x57\xe4\x7b\x59\xe7\x45\x36\xe4\xb0\xbe\x00\x6b\x8c\xf3\x8b\xb5\x91\x78\x01\xe3\xf3\xb3\xf1\x68\x90\xcf\x1e\xc9\x67\xa9\xae\x94\xc6\x8b\xa1\xfb\x46\xac\x99\xf7\x4e\xbb\xc2\x18\xcb\x75\xdb\x48\xe1\x90\x38\x68\xf9\x3a\xe7\xaa\x52\x6e\xb3\x47\xd7\x2b\x97\x8c\xdd\x6a\xe5\x22\x5d\xe6\x77\xc1\x59\x7b\x4d\xb5\x72\xa5\xcc\x08\xed\x4a\x15\x81\x33\xc7\xf0\x45\xa8\x8b\x3b\xd9\xa0\x28\x45\xbd\x54\x1a\x3f\x25\x7e\xc8\xf2\xa5\xaf\xf0\x20\x4d\x71\x8d\x96\xdd\x3b\xb7\x4a\x2f\xa1\x6d\xbc\xcd\x42\x69\xae\x96\x62\xe1\xd0\x82\x45\xee\x38\x9f\xcb\x3c\x20\xee\xd1\x88\xdd\xe4\x6e\x26\x4e\xd5\x08\xb4\xd1\x85\xef\x57\x2b\xa3\x24\x28\xa2\xd6\x77\x52\x57\x02\x9b\xe8\x7b\x17\xcb\x7d\x2e\x97\xb8\x97\xf2\x19\x86\x96\x5f\x40\x8b\xc3\xef\xea\xea\x15\x5c\xe3\x26\xdc\x61\x61\xac\x6f\xdd\xc1\x5b\x08\x81\xb5\xf1\x42\x4a\x3b\xe3\xfb\x5c\x0c\xcb\x2e\x99\x9f\x55\x64\x76\x9d\xce\x87\x59\x80\x10\x14\xca\x89\xa2\x61\x23\x14\xe4\x45\x86\xe6\x35\x82\x68\x1d\xac\x23\xb4\x7b\xd6\x31\x21\x2f\x49\x54\xce\x44\xeb\x4a\x63\xd5\x6f\x28\x67\xcc\xf8\x62\xf4\xd5\x2d\x93\xbe\xc6\x0d\x28\xed\x2b\x1d\x4b\xf1\xd6\xef\xa1\x95\xa4\xf0\xf0\xf6\x1a\x37\xdb\xd1\x57\xb7\xa8\xe5\xc2\x58\xbf\xde\x61\xf7\x09\xf1\x3f\xc3\x3e\xf4\xef\xf3\xde\x2b\x3c\x2f\xf0\xbd\x04\xb7\xac\x39\x28\xfd\x68\xd1\x52\x9c\x79\xc2\xe6\x7d\x99\x7e\x90\xeb\xf1\xee\xf3\x38\x99\xc8\x8c\xfd\x9c\xc9\x9c\x7b\x76\x00\x24\xbf\xd4\x75\xf6\x63\xd5\xa0\xaf\x07\x8f\xcf\xcf\xf7\x3b\x7c\x5f\x11\x76\x35\xe1\x63\xbf\x02\xf0\xee\x9f\x41\xeb\x87\xc1\xda\x8b\x37\x57\xd3\xa7\x99\xff\x19\xae\x9a\x5a\x28\x4d\xd3\xdf\xb3\x3b\x3c\xa4\xb4\x43\xbb\x10\x05\x86\x5c\x98\x1b\x57\xee\x75\x9f\x2e\x9c\xe2\x28\xd8\xf5\xa8\xff\xd2\x63\xb1\x73\xe5\xdf\x8d\x53\x9e\x9d\xb3\xf8\xfd\xff\xe3\xa8\x7f\x08\x57\x94\x43\x37\xbd\x11\x35\x4e\xd1\x95\xe3\xd1\x50\xec\x4d\xe0\x30\x14\x7c\x16\xac\x9f\x3e\xbc\x0d\x23\xce\x41\xe3\x7e\x37\xfe\xb0\xcd\x8f\xed\xc5\x51\x60\xfb\x05\x50\x93\xcf\x87\xfa\x39\x34\xd3\xa3\x50\xb1\xd1\xee\xe7\xc2\x87\xe3\x23\x96\x5a\x6a\xe5\x94\xd1\xc7\x9a\x67\xf7\xb2\x19\x6c\xa4\xbd\x7c\x37\x48\x7d\x72\x8c\xda\xeb\xbe\xdc\xaa\xb3\xbe\x53\x0f\xd9\x66\x16\xb5\x44\x8b\xf2\x9e\x11\xf0\x38\xbb\xdd\xbf\x7d\x9e\x49\xf7\x3a\x0b\xe7\x67\x4a\x0e\x88\x86\xb5\x2c\x0e\x95\x99\x92\xbb\xa1\x70\x87\x76\xdf\x70\x38\xd0\x1b\x87\x44\x00\x52\xbf\xed\x53\x3a\x1b\xc3\xb7\x30\x19\x8f\x0f\x7f\x3d\x80\xb3\xf1\xcf\x7f\x3b\x6e\xb1\xf4\x99\x7a\x87\xc5\x7e\x26\x3a\x18\xb7\xb7\xe9\x81\xf1\xab\xa2\x69\xbd\x2c\xe7\x49\x8d\xb5\xb1\x3c\x78\x9d\x8f\x9f\x3e\xf6\x0f\x2c\x45\xd7\xf1\xf1\x70\x87\x83\x86\xb7\xe4\x9d\xe4\x5f\x2d\x8b\xf5\xac\x58\x2c\x67\xbd\xfb\x79\x0e\x6f\x5c\x6e\xec\xb2\x9b\xb7\xd3\x4a\xe9\xf6\x26\x8f\x53\x99\x8f\x03\x8b\x86\xfa\x58\x1b\x68\xea\x96\x0e\x75\x8d\x62\x6b\x6c\x1b\xb8\xba\x7c\xfd\xfc\x65\x57\xb8\xb9\x1f\x48\x9c\xb7\xcb\xa5\xd2\x4b\xae\x3b\x4b\x2b\x9a\x52\x15\xdd\x8b\xab\x52\xe4\x50\xcf\xba\xa7\x47\xac\x5c\x49\xc7\x3d\x96\x98\xd9\xae\xd0\x85\x63\xfd\xfa\xd0\x0b\x71\xb1\xab\x4b\xc1\x05\x83\x97\xd6\xb1\x98\xdb\x0e\x99\x17\x46\x93\xa9\xf0\x14\xc8\xc0\xc9\x4a\x59\x2a\xbb\xa5\x13\x28\x84\xe6\xe6\xee\x9f\xe8\xce\x04\x9b\x46\xf1\xbd\xaa\xb1\x70\x6a\xa5\xdc\x26\x4e\x26\x59\x48\x25\x3e\x18\xf9\x7a\xfb\x06\x81\xef\x36\xe1\x59\xe9\x84\x5d\x22\xc7\xac\xf5\x23\xef\xb8\xa7\xd4\xa1\x1a\x3d\x44\x98\x42\x42\x54\x86\xa3\x7e\x5c\x98\x42\xc2\xb5\x36\xe9\x0d\xed\x1f\x76\x7f\xac\x7a\x1d\xf4\x60\x07\x12\x8b\xb5\xe1\x19\xf1\x06\x8b\xee\x35\x1b\xca\x71\x3f\x70\x03\x24\xf5\x35\x8f\xf6\x69\x03\x39\x2b\xcb\xb9\xf8\xe7\x12\x9b\xca\x6c\x92\xd0\x93\x8e\x63\x73\x47\xe8\x40\x63\xd2\x74\x0e\xe8\xf2\x61\xf7\x72\xd8\xe6\xfe\x4f\x21\x59\x67\x9e\x44\x72\x4a\x8b\x18\x7e\xc9\x40\xf3\x50\xee\x4f\x2b\x5d\xa2\x46\x1b\xa6\xe4\x95\x2d\x3e\x43\xfb\xd1\x03\x7f\x9a\x46\xf4\xe6\xdd\xba\x8f\x6b\xfa\xac\x1b\xe4\x87\x62\x8a\xf1\xb6\xba\xef\x06\x1a\xd5\xe0\x42\xa8\x6a\xb7\xb1\xbb\x6a\xae\x11\x73\xa5\x77\x5b\x0e\xc9\x41\xba\xe8\x77\xf2\x30\xd1\xa7\x85\xa9\x1b\x43\x08\x1f\x3f\xc2\x7a\xc9\x6f\x33\xe7\x1a\xba\xc8\xf3\xa5\x72\x65\x3b\xcf\x0a\x53\x47\xc9\x3c\x4a\xe6\x16\x2b\x14\x84\x94\x4b\xb3\xd6\x95\x11\x32\x9f\x64\x67\x7f\xcd\xce\x0f\x10\xd3\xbf\x73\x59\x4a\x6f\x9e\x3c\x9e\x3d\x3e\x87\xf4\x97\x4f\x69\xde\x51\x2c\xca\xda\x48\xf8\xcb\xcd\x97\x48\xee\xae\xf6\xdb\x8c\xca\x3f\x86\x78\xee\x2a\xf2\x5b\xbb\xc3\x77\x85\x03\xf0\x88\x02\x3f\x0e\x71\x32\xd4\xab\xa1\xeb\x25\xa4\x0a\x4e\x28\x9f\x3c\x3d\xcb\x26\x8f\x9f\x64\x93\x6c\x72\x74\x8a\xe8\x86\x95\xe5\xc9\x97\xa1\x9d\x7d\x12\x6d\x72\x0f\x1a\x16\xa5\x81\x13\xbc\xf1\xf5\xe8\xf2\xd9\xdb\x57\xd3\xf7\x49\xe7\xca\x8b\x87\xbc\xf0\x3e\x39\x81\x1f\xef\xb0\x6e\x2e\xa8\x84\xb4\x80\x93\x56\x3b\x55\xc1\x3d\x31\xf3\x3d\x8f\xf4\x5e\xe9\xfb\xe4\xdf\x42\x39\x7e\x69\xfa\x8e\xb1\x1f\x59\x73\xa5\x85\xdd\xbc\x4f\xbe\x07\xaa\x10\x1b\x98\xf0\x39\x8d\x27\x47\xd4\x16\x72\xc0\x0d\xbe\xfe\xba\x4b\x3e\x66\xc9\x5f\xb3\xbe\x7c\xdc\x7b\x3a\xde\xff\x10\x24\xcb\x3b\x9c\x03\x86\x6d\x03\xa9\x1c\x20\x1e\x03\xca\xbb\x6e\xab\x34\x39\x51\x55\x3b\x18\x98\xb7\xaa\x92\x90\x3a\xb8\x2b\x0c\x0e\x8f\x67\x3b\x75\x11\xa6\x69\xa9\xfc\x12\x88\xbd\xea\xbd\x1d\xfd\x27\x00\x00\xff\xff\x30\xbc\xb8\xf1\x3d\x17\x00\x00"),
+		},
+		"/terraform-modules/tinkerbell-sandbox/outputs.tf": &vfsgen۰CompressedFileInfo{
+			name:             "outputs.tf",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 930,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\xac\xd3\xc1\x8a\x9c\x40\x10\x06\xe0\xbb\x4f\xf1\x33\xa7\x04\x82\xe4\x05\xf6\xb4\x03\x61\x2f\x4b\xc8\xe4\x16\x82\x94\xdd\xb5\x6b\x33\x6d\x97\x54\xb5\xba\x21\xec\xbb\x87\xd6\x11\x26\x83\x73\x4a\x3c\x28\xd8\x5d\xfd\x7f\x96\xdd\x32\xe6\x61\xcc\x38\x0c\x2a\x53\xb0\x20\x89\xb5\x09\xc3\x01\xbf\x2b\xc0\xb3\x39\x0d\x43\x0e\x92\xf0\x80\xc3\xd3\x57\x90\xf7\xca\x66\x98\x3b\x56\xc6\xf7\x90\xce\x30\xd6\x89\x15\xc1\xc0\x6f\x83\x18\xfb\xfa\x50\x01\x13\xc5\x91\xb1\x5e\x0f\x88\xe2\x28\xd6\x7f\x47\xd8\x8f\xcf\x3f\xab\xf7\xaa\xda\x00\x46\xc9\xb7\xf2\xd6\x24\xea\x79\x37\xfe\xb4\x4e\x40\x99\xf0\x09\x73\x17\x5c\x07\xeb\x64\x8c\x1e\x2d\x63\x20\x33\xf6\xc8\x82\x59\xf4\xcc\x8a\x5e\xfc\x18\x19\x21\x59\xa6\xe4\xd8\xee\xb2\x5a\x32\x5e\x52\xaf\x35\x93\xc4\xb1\x67\x6b\x06\x91\x78\x9f\xf4\x4c\x3d\x43\x5e\x90\x3b\x86\x65\x51\x7a\x65\x94\x0a\x38\x65\xca\xec\xf1\x22\x8a\xcb\x87\xd5\x38\xfd\x1b\x36\xb4\x53\xd0\xbc\x88\xea\xe5\x76\x6b\x4e\x9c\xcb\x72\x4d\xf0\xfb\xbf\xef\x58\xa8\xb6\x75\x71\x9d\xfc\xbf\x54\xdb\x72\xdb\x33\xf8\x1b\x59\x4f\x76\xde\x65\x3d\x52\x74\x63\x5c\xba\xd5\x89\x65\xc3\xe3\xd3\xf1\xdb\xc6\x43\x29\x5b\xba\x58\xf6\x1a\x6b\xcb\x31\xa2\x23\xf5\x33\x29\x83\x53\xd6\xc0\xb6\x8c\xaf\xe4\x3d\xa2\x0b\x5e\x2f\x80\x0f\x13\x69\xbd\xa4\x34\xe5\xed\xc7\x6b\xe3\x2b\x65\x9e\xe9\xd7\xae\xf1\xcb\x3a\x86\xab\x13\xb0\x99\xb6\xe0\xd2\xb6\x8e\x26\xc6\xf1\xf9\x04\x65\x93\x38\x2e\xd5\x94\x3c\x42\xca\x5c\x08\x20\xe7\xd8\xee\xef\xc4\xeb\x03\x72\xe1\x54\xef\xd5\x9f\x00\x00\x00\xff\xff\xb3\x15\xbc\x63\xa2\x03\x00\x00"),
+		},
+		"/terraform-modules/tinkerbell-sandbox/variables.tf": &vfsgen۰CompressedFileInfo{
+			name:             "variables.tf",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 743,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x9c\x92\x41\x4b\xc3\x40\x10\x85\xef\xf9\x15\x43\x4e\xed\xc5\x7f\xd0\x93\x45\x14\x44\xc4\xe2\x39\x4c\xb2\x93\x66\xec\x76\x37\xce\x4c\x83\x45\xfa\xdf\x65\x37\xad\x96\x46\x84\x9a\xe3\x66\x78\xef\x9b\xf7\x66\x40\x61\xac\x3d\x41\x19\x70\x4b\x25\x7c\x16\x00\xb6\xef\x09\x8e\xdf\x02\xd4\x84\xc3\xba\x00\x70\xa4\x8d\x70\x6f\x1c\x03\x2c\xa0\x7c\x0d\xfc\xbe\x23\x60\x47\xc1\xb8\x65\x12\x88\x2d\x34\x42\x68\xe4\x40\x31\xb8\x3a\x7e\xc0\x4e\xc9\x81\xc5\xd3\xd4\xfe\x7b\xc0\x73\x3d\xb0\x18\xc4\xfa\x8d\x1a\xd3\x9b\xb2\x38\x14\xc5\x0f\x8c\x6a\x57\x6d\x68\xaf\xbf\x01\x79\x56\x9b\x8d\x54\xf3\x29\xd6\x23\xab\x25\x92\xd5\xea\x1e\x92\x02\xb4\x51\xa0\x97\x38\xb0\x72\x0c\x24\xb0\xc5\xa6\xe3\x40\xf9\xbd\x89\x42\x80\xc1\x81\xc4\x68\x09\x56\x26\x24\x5d\x54\xd3\xaa\x61\x27\xd7\x84\x73\xfb\xb0\x7c\xc9\x0e\xe8\x3d\x64\x89\x4b\xdd\xd6\xa3\x35\x28\x15\x6f\x71\x4d\x55\x8f\xd6\x5d\xa3\xff\x8c\xd6\xa5\x5c\xef\x46\x15\xc8\x2a\x97\x16\x7d\x8c\xfe\xdf\xca\x6a\x29\x9b\xd4\xd1\x0e\xfd\x29\x34\x05\xc7\xba\x19\xdd\x26\x1b\xb9\xa0\x55\x5e\xf5\xcc\xee\xd8\xd6\xd8\xf2\x2c\x3d\x43\x8e\x23\x1d\xdb\x39\x04\x00\xf7\x53\xb4\xc3\xfc\x8f\x82\x97\x4f\x2b\xa0\x60\xc2\xa4\x89\x17\x5d\x3e\xb4\xd3\x5d\xa5\xbf\x4a\x32\x90\x64\xcc\xaf\x00\x00\x00\xff\xff\xc3\x0a\xc2\x98\xe7\x02\x00\x00"),
+		},
+		"/terraform-modules/tinkerbell-sandbox/versions.tf": &vfsgen۰CompressedFileInfo{
+			name:             "versions.tf",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 225,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x74\xcd\xc1\x0a\xc2\x30\x0c\x06\xe0\x7b\x9f\xe2\xa7\x0f\xd0\x6d\x0a\xde\xea\xab\x48\x6d\x23\x04\xdc\x32\xd3\xad\x17\xe9\xbb\x8b\xb3\xe0\x2e\xbb\x04\x92\xfc\xf9\xb2\x90\x6a\x78\x88\x8e\x78\x1b\x40\xe9\xb5\xb2\x52\xba\x15\xd2\xcc\x32\xc1\xc3\x5e\x3d\x7a\x37\x9c\xed\x7e\x3d\xab\x14\x4e\xa4\x79\xbb\x02\x9e\x7c\x2f\xac\x0b\x7c\xeb\x81\x2c\xab\x46\xc2\x17\x48\x63\x88\x85\x63\xd0\xae\xc5\x6c\xcb\xec\x9e\xf4\xee\xe2\x4e\xbf\x79\xdd\x6a\x3c\xc0\x66\xc9\xc4\x49\xa6\x2e\x1e\x31\xc3\x9f\xa9\xa6\x9a\x4f\x00\x00\x00\xff\xff\xe4\x3b\x0a\xee\xe1\x00\x00\x00"),
+		},
+		"/terraform-modules/tinkerbell-sandbox/worker": &vfsgen۰DirInfo{
+			name:    "worker",
+			modTime: time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+		},
+		"/terraform-modules/tinkerbell-sandbox/worker/assets": &vfsgen۰DirInfo{
+			name:    "assets",
+			modTime: time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+		},
+		"/terraform-modules/tinkerbell-sandbox/worker/assets/hardware_data.tpl": &vfsgen۰CompressedFileInfo{
+			name:             "hardware_data.tpl",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 589,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x64\x90\xdd\x6a\xc3\x30\x0c\x85\xef\xf3\x14\x42\xec\xb2\x97\xa3\x8c\xbe\xca\x18\x41\xb3\xd5\xd6\xd4\xb1\x8b\xad\x2e\x2d\xc1\xef\x3e\x1c\xe7\xc7\x69\xae\xc2\x39\xfe\x72\xa4\xa3\xa1\x01\x40\xa3\xf1\x04\xf8\x31\x18\x9d\xf0\x90\x8d\x8e\x85\x34\x09\xe1\x09\x32\x00\x80\x67\x52\xc6\x1a\x79\x2d\x4e\xe5\xb5\xca\x6b\x2e\x09\x1b\xab\x84\x8d\xe8\xdd\x92\x6b\xa3\x7d\x5c\x0a\xb6\xc8\x77\xe4\x8f\x43\x34\x7e\x45\x71\x7c\x4d\x05\x42\xe3\xa2\x90\x53\x79\xd6\x30\x7b\x51\x48\x78\x46\x47\x13\x1d\x4b\xef\xc3\x6d\x5d\xde\x38\xe1\x70\x26\xc5\x11\x4f\xf0\x3d\x0d\x9c\x6b\x00\xa0\xbe\xaa\x7b\x55\x6c\xf4\x28\xa8\x6b\x8e\x7d\x7e\x1d\xdb\xe3\xe7\xb2\x66\xc9\x7b\xa7\x33\xaf\x75\xe0\x18\x4b\xbf\x49\xa4\xcd\x6f\x00\x78\x21\xe1\x9e\x5e\x05\x9a\xc4\x0e\x72\x2c\x1d\xc5\x5b\x81\x26\x91\xb0\x62\xd2\x66\x99\x8e\x54\x41\x3b\x52\x15\x56\x41\x39\xf1\xd7\x7b\xd9\x55\xb4\xd6\xf7\xed\xfd\x99\xcf\x27\xe1\xc1\x87\xfd\x63\xbe\xe3\xd9\xfa\x7e\x22\xd6\xf4\xa6\xfe\xfe\xe4\xd3\x37\xa9\xf9\x0f\x00\x00\xff\xff\x25\xe5\x03\xb4\x4d\x02\x00\x00"),
+		},
+		"/terraform-modules/tinkerbell-sandbox/worker/main.tf": &vfsgen۰CompressedFileInfo{
+			name:             "main.tf",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 1513,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x6c\x54\x5d\x6b\xdc\x46\x14\x7d\xd7\xaf\x38\x8c\x0d\x4e\xc2\x56\xd9\x98\xba\xd0\xc0\x3e\xb8\xa1\x84\x42\x4b\x43\xdd\xb7\x52\xc4\x95\xe6\xae\x34\xf5\x68\x46\xcc\x87\xd6\xaa\xd9\xff\x1e\x66\xa4\x95\xbd\x9b\xec\x8b\xb4\xf7\x6b\xce\x3d\xe7\x8c\x1c\x7b\x1b\x5d\xc3\x10\x5a\xd5\xa3\x72\xa1\x1a\xad\x8e\x3d\x0b\x88\x83\x75\x8f\xec\x04\x9e\x0b\xc0\x50\xcf\xd8\x61\x24\x57\xa6\xd7\x02\x18\xac\xd5\x4b\xc4\x93\x91\xb5\x7d\x2a\xe7\x4e\x5f\xa5\x54\xb5\x94\x79\xf5\x7f\x6a\xbc\xdd\xe2\x1d\x3e\x6c\xb7\x97\x8f\x2b\xdc\x6e\x3f\xff\x52\x1c\x8b\xe2\x0a\x9f\xd9\xb0\xa3\xc0\x70\x64\xa4\xed\x61\x62\x5f\xb3\xf3\x50\x06\x1d\x3f\x61\x6f\x5d\x4f\x01\xc1\xa2\x3d\x15\xce\x08\xf1\xc7\xfd\x27\x90\x94\x8e\xbd\x2f\x8b\x97\x85\xe6\x31\x95\x92\x02\xa2\xa7\xa6\x5a\x4a\xe6\x85\x1a\x1b\x4d\xc0\xfc\xdb\xe1\xae\x00\xea\x29\x70\xa5\xd9\xb4\xa1\xc3\x0e\x1f\x12\x26\x6d\x1b\xd2\x3e\xd7\x5f\xe1\xee\x16\xca\x83\xf0\x7b\x0a\xea\x09\xf7\xb2\x57\x46\xf9\xc0\x8e\x25\xee\xe7\xd9\xf8\x8b\x4c\xcb\x1b\x78\x0b\x15\x6e\x3c\x3c\xed\x39\x21\x8e\x9e\xcb\x02\xe8\xa9\xc1\x0e\xe2\xee\xf6\xe3\xf5\xf3\x7f\x56\x99\x37\xe2\xa3\xd8\x60\xc5\x59\xbe\x42\x59\xbe\x2b\x3b\x7e\x7a\x7b\x14\x09\xc7\xb7\x22\x49\xdb\x93\x32\xdf\x13\x29\xad\x23\xae\x9f\x5f\xeb\xb2\x3c\xb3\x24\xc7\x1f\xe6\x5c\x7e\x17\x05\x30\x36\x43\xcc\x4d\x3f\x26\x80\xdc\x5b\x37\xa5\x3f\xdb\x9f\x7f\x2a\x0a\x40\x2a\xff\x98\x67\x03\xb3\xba\x95\x92\xd8\xe1\xdc\x2b\xe5\x0c\xa2\x54\xb2\x00\x8e\x45\x66\xeb\x81\x43\x1c\xf0\xf0\xe5\xb7\x4f\xbf\xc2\xb3\x1b\xd9\x25\x01\x21\xb9\x8e\x6d\xab\x4c\x9b\xe8\x68\x1d\x0d\x9d\x6a\xfc\x72\x80\x4e\x64\x9a\x2a\x4c\x43\x72\x8c\x38\xc9\xf5\x32\xf3\x8b\x53\x3d\x39\xa5\x27\xd4\xd6\x06\xec\x9d\xed\x33\xc0\x0d\xea\x18\x40\xda\x5b\x90\xd6\xf6\x00\xc3\x21\x41\x9a\xcb\x82\x85\x8b\x06\x7f\x2b\xf3\xc8\xae\x66\xad\xb3\x6d\xf6\xda\x1e\x36\x79\xea\xa1\x53\x4d\x07\xdf\xd9\xa8\x25\x94\xf1\x81\xb4\x46\x67\x7d\xc0\x9f\x0f\x09\x65\x1a\x52\x49\x1e\x55\xc3\x0b\x50\xc9\x23\x76\xf8\x47\x74\x52\x6c\x20\x96\xc3\xc4\xbf\x97\xcb\x37\xd6\x78\xab\x67\x37\xdc\x8c\xca\xf9\xee\x14\xba\x41\x43\x06\x35\x27\x5f\xc8\x04\x30\xd3\x92\x5b\x1b\x6b\x0c\x37\x41\x8d\x2a\x4c\x50\xde\x47\xf6\x65\xb6\x6b\x6e\x5c\x00\x64\x8a\x56\xf3\x8a\x21\x4c\x62\x8e\x93\x6b\x39\x54\x83\x75\x21\xc5\xb7\x2b\x77\x0b\xc6\x4a\x99\xc0\x6e\x4f\xeb\x26\x6b\x5c\x5e\x5c\xe5\x97\x44\xae\x4b\x74\xac\xee\x7a\xf5\x11\x98\x2d\xbd\x22\xc9\xf7\x25\xb9\x38\x9f\x7b\x66\xdc\xc5\xe4\x31\xe6\xeb\xb8\xba\xf6\xac\x26\xac\x12\x55\x1d\x39\x79\x20\x77\xf9\x19\x92\x14\x08\x3b\x04\xee\x07\x4d\x81\xf7\x4a\xf3\x1b\x71\xfd\x3c\x50\xe8\xca\xde\xca\xa8\xf9\xf8\x9e\xbc\xe7\xe0\xdf\x9f\x26\x54\xa9\xa7\x0c\x83\x16\x9b\x65\x69\x25\xf1\xea\xb7\xc3\x2b\x68\x27\x27\x3b\xf6\x51\x87\x5c\xbd\xa7\x46\x69\x15\xa6\xaa\xb1\x32\xfb\x72\xf1\xfe\xcc\xf8\xa0\xc9\x54\x5e\xc7\xf6\xa4\xc5\x59\x76\xb1\xf0\x7a\x52\x62\x4e\x0d\x97\xbc\x7d\x43\x1d\xd0\x52\xe0\x03\x4d\x67\x8d\x27\x69\x96\xdc\x49\xbf\x9e\xfc\xe3\x77\xeb\x96\x5c\x92\xe2\x6d\x71\x2c\xbe\x06\x00\x00\xff\xff\x93\x60\x67\xd6\xe9\x05\x00\x00"),
+		},
+		"/terraform-modules/tinkerbell-sandbox/worker/variables.tf": &vfsgen۰CompressedFileInfo{
+			name:             "variables.tf",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 425,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x94\x8f\x41\x4e\xc3\x30\x10\x45\xf7\x3e\xc5\x57\x56\xb0\xe1\x06\x39\x00\x2b\xd8\xb1\x8c\x26\xf5\x90\x9a\xc4\x1e\xcb\x33\x6e\xa9\x50\xee\x8e\x4c\x83\xaa\xd2\x6e\x98\x95\xa5\xf7\xfd\x66\xfe\x81\x4a\xa0\x71\x61\x74\x89\x22\x77\xf8\x72\x80\x9d\x32\x63\x9b\x1e\x6a\x25\xa4\xc9\x01\x9e\x75\x57\x42\xb6\x20\x09\x3d\xba\x37\x29\x33\x17\xec\x45\xad\x7d\x7d\xea\xdc\xea\xdc\x45\x17\xf2\x7f\x64\xcf\xaf\x20\xef\x0b\xab\xc2\x04\xa4\x1a\xa6\xd4\x5e\xb6\x67\x24\xf1\x37\x76\xa5\xe4\x47\xf9\x3c\xaf\xf8\xe3\x7a\xa9\x96\xab\xe1\xbd\x48\x44\xa4\x90\xb0\x85\x11\xc5\xd7\xa5\xa9\xb6\xab\x7a\xc8\xf8\xc1\x3b\x7b\x68\x12\xfc\xc6\x86\xd6\xe6\xe6\x5e\xe0\x20\x4b\x8d\xac\x43\x16\x59\xce\x99\x2b\x9c\xd8\x8e\x52\xe6\x21\xf8\x3b\x6d\x7f\x70\x24\x9d\x71\x99\x2b\x3c\x91\xf1\x91\x4e\xf7\xf1\xfa\xe8\x56\xf7\x1d\x00\x00\xff\xff\x3d\x00\xb1\xe3\xa9\x01\x00\x00"),
+		},
+		"/terraform-modules/tinkerbell-sandbox/worker/versions.tf": &vfsgen۰CompressedFileInfo{
+			name:             "versions.tf",
+			modTime:          time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
+			uncompressedSize: 394,
+
+			compressedContent: []byte("\x1f\x8b\x08\x00\x00\x00\x00\x00\x00\xff\x74\xcf\x41\xae\x84\x20\x0c\x06\xe0\xbd\xa7\x68\x3c\x00\xe0\x33\x79\x3b\xdf\x55\x5e\x10\x3a\xb1\x19\xa5\x4e\x51\x36\x13\xef\x3e\x19\x35\x91\x05\x6e\x08\xe9\xff\xf3\x91\x2e\x28\x62\x1f\x2c\x13\xbc\x2b\x00\xc1\xd7\x4a\x82\xfe\x3f\xa1\x44\xe2\x00\x1d\xd4\x7f\x1d\x18\xd5\xb4\x75\x1e\xcf\xc2\x89\x3c\x4a\xdc\x5f\x01\x2c\x14\x9e\x28\x3d\x8e\x23\x74\xe7\x08\x20\xf2\x2a\x0e\xe1\x6b\x5c\xb9\xbe\xae\xf5\xd9\xcb\xfe\x32\xaa\x51\xe6\x98\x6f\xfb\x39\x52\x9f\x48\x96\xb2\xea\x27\xeb\x12\x39\x2b\xfa\xac\x15\xc5\x5f\xf5\x93\x8b\xee\x06\x9b\x39\x22\x79\x0e\xda\xdd\x31\x4d\xce\x88\x0d\x9e\xa7\x32\x35\xd8\x38\x90\x63\x99\xf5\xd1\x2a\x78\xad\x32\xf9\xa2\x5b\xb5\x55\x9f\x00\x00\x00\xff\xff\x55\xe0\x0f\x6d\x8a\x01\x00\x00"),
+		},
 		"/terraform-modules/worker": &vfsgen۰DirInfo{
 			name:    "worker",
 			modTime: time.Date(1970, 1, 1, 0, 0, 1, 0, time.UTC),
@@ -7594,6 +7886,8 @@ var vfsgenAssets = func() http.FileSystem {
 		fs["/terraform-modules/kvm-libvirt"].(os.FileInfo),
 		fs["/terraform-modules/node"].(os.FileInfo),
 		fs["/terraform-modules/packet"].(os.FileInfo),
+		fs["/terraform-modules/platforms"].(os.FileInfo),
+		fs["/terraform-modules/tinkerbell-sandbox"].(os.FileInfo),
 		fs["/terraform-modules/worker"].(os.FileInfo),
 	}
 	fs["/terraform-modules/aws"].(*vfsgen۰DirInfo).entries = []os.FileInfo{
@@ -7876,6 +8170,83 @@ var vfsgenAssets = func() http.FileSystem {
 		fs["/terraform-modules/packet/flatcar-linux/kubernetes/workers/cl/install.yaml.tmpl"].(os.FileInfo),
 		fs["/terraform-modules/packet/flatcar-linux/kubernetes/workers/cl/worker.yaml.tmpl"].(os.FileInfo),
 	}
+	fs["/terraform-modules/platforms"].(*vfsgen۰DirInfo).entries = []os.FileInfo{
+		fs["/terraform-modules/platforms/tinkerbell"].(os.FileInfo),
+	}
+	fs["/terraform-modules/platforms/tinkerbell"].(*vfsgen۰DirInfo).entries = []os.FileInfo{
+		fs["/terraform-modules/platforms/tinkerbell/controllers"].(os.FileInfo),
+		fs["/terraform-modules/platforms/tinkerbell/workerpool"].(os.FileInfo),
+	}
+	fs["/terraform-modules/platforms/tinkerbell/controllers"].(*vfsgen۰DirInfo).entries = []os.FileInfo{
+		fs["/terraform-modules/platforms/tinkerbell/controllers/bootkube.tf"].(os.FileInfo),
+		fs["/terraform-modules/platforms/tinkerbell/controllers/main.tf"].(os.FileInfo),
+		fs["/terraform-modules/platforms/tinkerbell/controllers/outputs.tf"].(os.FileInfo),
+		fs["/terraform-modules/platforms/tinkerbell/controllers/ssh.tf"].(os.FileInfo),
+		fs["/terraform-modules/platforms/tinkerbell/controllers/templates"].(os.FileInfo),
+		fs["/terraform-modules/platforms/tinkerbell/controllers/variables.tf"].(os.FileInfo),
+		fs["/terraform-modules/platforms/tinkerbell/controllers/versions.tf"].(os.FileInfo),
+	}
+	fs["/terraform-modules/platforms/tinkerbell/controllers/templates"].(*vfsgen۰DirInfo).entries = []os.FileInfo{
+		fs["/terraform-modules/platforms/tinkerbell/controllers/templates/flatcar-install.tmpl"].(os.FileInfo),
+	}
+	fs["/terraform-modules/platforms/tinkerbell/workerpool"].(*vfsgen۰DirInfo).entries = []os.FileInfo{
+		fs["/terraform-modules/platforms/tinkerbell/workerpool/main.tf"].(os.FileInfo),
+		fs["/terraform-modules/platforms/tinkerbell/workerpool/output.tf"].(os.FileInfo),
+		fs["/terraform-modules/platforms/tinkerbell/workerpool/templates"].(os.FileInfo),
+		fs["/terraform-modules/platforms/tinkerbell/workerpool/variables.tf"].(os.FileInfo),
+		fs["/terraform-modules/platforms/tinkerbell/workerpool/versions.tf"].(os.FileInfo),
+	}
+	fs["/terraform-modules/platforms/tinkerbell/workerpool/templates"].(*vfsgen۰DirInfo).entries = []os.FileInfo{
+		fs["/terraform-modules/platforms/tinkerbell/workerpool/templates/flatcar-install.tmpl"].(os.FileInfo),
+	}
+	fs["/terraform-modules/tinkerbell-sandbox"].(*vfsgen۰DirInfo).entries = []os.FileInfo{
+		fs["/terraform-modules/tinkerbell-sandbox/assets"].(os.FileInfo),
+		fs["/terraform-modules/tinkerbell-sandbox/main.tf"].(os.FileInfo),
+		fs["/terraform-modules/tinkerbell-sandbox/outputs.tf"].(os.FileInfo),
+		fs["/terraform-modules/tinkerbell-sandbox/variables.tf"].(os.FileInfo),
+		fs["/terraform-modules/tinkerbell-sandbox/versions.tf"].(os.FileInfo),
+		fs["/terraform-modules/tinkerbell-sandbox/worker"].(os.FileInfo),
+	}
+	fs["/terraform-modules/tinkerbell-sandbox/assets"].(*vfsgen۰DirInfo).entries = []os.FileInfo{
+		fs["/terraform-modules/tinkerbell-sandbox/assets/deploy"].(os.FileInfo),
+		fs["/terraform-modules/tinkerbell-sandbox/assets/generate-envrc.sh"].(os.FileInfo),
+		fs["/terraform-modules/tinkerbell-sandbox/assets/setup.sh"].(os.FileInfo),
+	}
+	fs["/terraform-modules/tinkerbell-sandbox/assets/deploy"].(*vfsgen۰DirInfo).entries = []os.FileInfo{
+		fs["/terraform-modules/tinkerbell-sandbox/assets/deploy/.gitignore"].(os.FileInfo),
+		fs["/terraform-modules/tinkerbell-sandbox/assets/deploy/db"].(os.FileInfo),
+		fs["/terraform-modules/tinkerbell-sandbox/assets/deploy/docker-compose.yml"].(os.FileInfo),
+		fs["/terraform-modules/tinkerbell-sandbox/assets/deploy/flatcar-install"].(os.FileInfo),
+		fs["/terraform-modules/tinkerbell-sandbox/assets/deploy/registry"].(os.FileInfo),
+		fs["/terraform-modules/tinkerbell-sandbox/assets/deploy/tls"].(os.FileInfo),
+	}
+	fs["/terraform-modules/tinkerbell-sandbox/assets/deploy/db"].(*vfsgen۰DirInfo).entries = []os.FileInfo{
+		fs["/terraform-modules/tinkerbell-sandbox/assets/deploy/db/tinkerbell-init.sql"].(os.FileInfo),
+	}
+	fs["/terraform-modules/tinkerbell-sandbox/assets/deploy/flatcar-install"].(*vfsgen۰DirInfo).entries = []os.FileInfo{
+		fs["/terraform-modules/tinkerbell-sandbox/assets/deploy/flatcar-install/Dockerfile"].(os.FileInfo),
+	}
+	fs["/terraform-modules/tinkerbell-sandbox/assets/deploy/registry"].(*vfsgen۰DirInfo).entries = []os.FileInfo{
+		fs["/terraform-modules/tinkerbell-sandbox/assets/deploy/registry/Dockerfile"].(os.FileInfo),
+	}
+	fs["/terraform-modules/tinkerbell-sandbox/assets/deploy/tls"].(*vfsgen۰DirInfo).entries = []os.FileInfo{
+		fs["/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/.gitignore"].(os.FileInfo),
+		fs["/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/Dockerfile"].(os.FileInfo),
+		fs["/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/ca-config.json"].(os.FileInfo),
+		fs["/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/ca.in.json"].(os.FileInfo),
+		fs["/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/entrypoint.sh"].(os.FileInfo),
+		fs["/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/gencerts.sh"].(os.FileInfo),
+		fs["/terraform-modules/tinkerbell-sandbox/assets/deploy/tls/server-csr.in.json"].(os.FileInfo),
+	}
+	fs["/terraform-modules/tinkerbell-sandbox/worker"].(*vfsgen۰DirInfo).entries = []os.FileInfo{
+		fs["/terraform-modules/tinkerbell-sandbox/worker/assets"].(os.FileInfo),
+		fs["/terraform-modules/tinkerbell-sandbox/worker/main.tf"].(os.FileInfo),
+		fs["/terraform-modules/tinkerbell-sandbox/worker/variables.tf"].(os.FileInfo),
+		fs["/terraform-modules/tinkerbell-sandbox/worker/versions.tf"].(os.FileInfo),
+	}
+	fs["/terraform-modules/tinkerbell-sandbox/worker/assets"].(*vfsgen۰DirInfo).entries = []os.FileInfo{
+		fs["/terraform-modules/tinkerbell-sandbox/worker/assets/hardware_data.tpl"].(os.FileInfo),
+	}
 	fs["/terraform-modules/worker"].(*vfsgen۰DirInfo).entries = []os.FileInfo{
 		fs["/terraform-modules/worker/README.md"].(os.FileInfo),
 		fs["/terraform-modules/worker/bootstrap-tokens.tf"].(os.FileInfo),
diff --git a/pkg/platform/tinkerbell/doc.go b/pkg/platform/tinkerbell/doc.go
new file mode 100644
index 000000000..66d09c2d5
--- /dev/null
+++ b/pkg/platform/tinkerbell/doc.go
@@ -0,0 +1,17 @@
+// Copyright 2020 The Lokomotive Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// Package tinkerbell provides Platform implementation using Tinkerbell provisioning
+// system.
+package tinkerbell
diff --git a/pkg/platform/tinkerbell/template.go b/pkg/platform/tinkerbell/template.go
new file mode 100644
index 000000000..ce5a205a7
--- /dev/null
+++ b/pkg/platform/tinkerbell/template.go
@@ -0,0 +1,328 @@
+// Copyright 2020 The Lokomotive Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package tinkerbell
+
+var terraformConfigTmpl = `
+locals {
+  cluster_name = "{{.Name}}"
+  dns_zone     = "{{.DNSZone}}"
+
+  # Convert Go slices into Terraform lists.
+  ssh_keys = [
+  {{- range .SSHPublicKeys}}
+    "{{.}}",
+  {{- end}}
+  ]
+
+  controller_ips = [
+  {{- range .ControllerIPAddresses}}
+    "{{.}}",
+  {{- end}}
+  ]
+
+  {{- range $index, $pool := .WorkerPools }}
+  worker_{{ $pool.Name }}_ips = [
+  {{- range $pool.IPAddresses}}
+    "{{.}}",
+  {{- end}}
+  ]
+  {{- end}}
+
+  # Calculate DNS names for etcd endpoints.
+  controller_etcd_names = [
+    for i in range(length(local.controller_ips)) : "${local.cluster_name}-etcd${i}.${local.dns_zone}"
+  ]
+}
+
+{{- if .Sandbox }}
+terraform {
+  required_providers {
+    tinkerbell = {
+      source  = "tinkerbell/tinkerbell"
+      version = "0.1.0"
+    }
+    libvirt = {
+      source  = "dmacvicar/libvirt"
+      version = "0.6.2"
+    }
+  }
+}
+
+provider "libvirt" {
+  uri = "qemu:///system"
+}
+
+module "tinkerbell_sandbox" {
+  source = "../terraform-modules/tinkerbell-sandbox"
+
+  name               = local.cluster_name
+  hosts_cidr         = "{{ .Sandbox.HostsCIDR }}"
+  flatcar_image_path = "{{ .Sandbox.FlatcarImagePath }}"
+  pool_path          = "{{ .Sandbox.PoolPath }}"
+
+  ssh_keys = local.ssh_keys
+
+  dns_hosts = concat(
+    [for ip in local.controller_ips : {
+      hostname = "${local.cluster_name}.${local.dns_zone}"
+      ip       = ip
+    }],
+    [for i, name in local.controller_etcd_names : {
+      hostname = name
+      ip       = local.controller_ips[i]
+    }],
+  )
+}
+
+provider "tinkerbell" {
+  grpc_authority = "${module.tinkerbell_sandbox.provisioner_ip}:42113"
+  cert_url       = "http://${module.tinkerbell_sandbox.provisioner_ip}:42114/cert"
+}
+
+module "tink_controllers" {
+  source = "../terraform-modules/tinkerbell-sandbox/worker"
+
+  count = length(local.controller_ips)
+
+  ip       = local.controller_ips[count.index]
+  name     = "${local.cluster_name}-controller-${count.index}"
+
+  sandbox = module.tinkerbell_sandbox
+
+  depends_on = [
+    module.tinkerbell_sandbox,
+  ]
+}
+
+{{ range $index, $pool := .WorkerPools }}
+module "tink_worker_{{ $pool.Name }}" {
+  source = "../terraform-modules/tinkerbell-sandbox/worker"
+
+  count = length(local.worker_{{ $pool.Name }}_ips)
+
+  ip   = local.worker_{{ $pool.Name }}_ips[count.index]
+  name = "${local.cluster_name}-worker-{{ $pool.Name }}-${count.index}"
+
+  sandbox = module.tinkerbell_sandbox
+
+  depends_on = [
+    module.tinkerbell_sandbox,
+  ]
+}
+
+{{- end }}
+{{- end }}
+
+module "controllers" {
+  source = "../terraform-modules/platforms/tinkerbell/controllers"
+
+  ip_addresses = local.controller_ips
+
+  # Generic configuration.
+  asset_dir    = "../cluster-assets"
+  cluster_name = local.cluster_name
+  ssh_keys     = local.ssh_keys
+  dns_zone     = local.dns_zone
+
+  {{- if .ControllerFlatcarInstallBaseURL}}
+  flatcar_install_base_url = "{{.ControllerFlatcarInstallBaseURL}}"
+  {{- end}}
+
+  {{- if .ControllerCLCSnippets}}
+  clc_snippets = [
+  {{- range .ControllerCLCSnippets }}
+    <<EOF
+{{.}}
+EOF
+    ,
+  {{- end}}
+  ]
+  {{- end}}
+
+  {{- if .OSChannel}}
+  os_channel = "{{.OSChannel}}"
+  {{- end }}
+
+  {{- if .OSVersion}}
+  os_version = "{{.OSVersion}}"
+  {{- end }}
+
+  enable_aggregation = {{.EnableAggregation}}
+
+  {{- if .NetworkMTU }}
+  network_mtu = {{.NetworkMTU}}
+  {{- end }}
+
+  {{- if .PodCIDR }}
+  pod_cidr = "{{.PodCIDR}}"
+  {{- end }}
+
+  {{- if .ServiceCIDR }}
+  service_cidr = "{{.ServiceCIDR}}"
+  {{- end }}
+
+  {{- if .ClusterDomainSuffix }}
+  cluster_domain_suffix = "{{.ClusterDomainSuffix}}"
+  {{- end }}
+
+  enable_reporting = {{.EnableReporting}}
+
+  {{- if .CertsValidityPeriodHours }}
+  certs_validity_period_hours = {{.CertsValidityPeriodHours}}
+  {{- end }}
+
+  worker_bootstrap_tokens = concat(
+    {{- range $index, $pool := .WorkerPools }}
+    module.worker_{{ $pool.Name }}.bootstrap_tokens,
+    {{- end }}
+  )
+
+  {{- if $.Sandbox }}
+
+  # If sandbox is enabled, set libvirt gateway as DNS server
+  # for all nodes, so Kubernetes API FQDN and etcd DNS names
+  # can be resolved.
+  host_dns_ip = module.tinkerbell_sandbox.gateway
+
+  depends_on = [
+    # Create sandbox first, as otherwise Tinkerbell templates
+    # and workflows can't be created.
+    module.tinkerbell_sandbox,
+
+    # Wait until controllers hardware is registered into Tinkerbell
+    # before creating templates and workflows.
+    module.tink_controllers,
+  ]
+  {{- end }}
+}
+
+{{- range $index, $pool := .WorkerPools }}
+
+module "worker_{{ $pool.Name }}" {
+  source = "../terraform-modules/platforms/tinkerbell/workerpool"
+
+  kubeconfig             = module.controllers.kubeconfig
+  cluster_dns_service_ip = module.controllers.cluster_dns_service_ip
+  ca_cert                = module.controllers.ca_cert
+  apiserver              = module.controllers.apiserver
+
+  cluster_name = local.cluster_name
+  name         = "{{ $pool.Name }}"
+
+  {{- if $pool.SSHPublicKeys}}
+  ssh_keys = [
+  {{- range $pool.SSHPublicKeys}}
+    "{{.}}",
+  {{- end}}
+  ]
+  {{- end}}
+
+  {{- if $pool.FlatcarInstallBaseURL}}
+  flatcar_install_base_url = "{{$pool.FlatcarInstallBaseURL}}"
+  {{- end}}
+
+  ip_addresses = local.worker_{{ $pool.Name }}_ips
+
+  {{- if $.ClusterDomainSuffix }}
+  cluster_domain_suffix = "{{$.ClusterDomainSuffix}}"
+  {{- end }}
+
+  {{- if $pool.CLCSnippets}}
+  clc_snippets = [
+  {{- range $pool.CLCSnippets}}
+    <<EOF
+{{.}}
+EOF
+    ,
+  {{- end}}
+  ]
+  {{- end}}
+
+  {{- if $pool.Labels }}
+  labels = {
+  {{- range $k, $v := $pool.Labels }}
+    "{{ $k }}" = "{{ $v }}",
+  {{- end }}
+  }
+  {{- end }}
+
+  {{- if $pool.Taints }}
+  taints = {
+  {{- range $k, $v := $pool.Taints }}
+    "{{ $k }}" = "{{ $v }}",
+  {{- end }}
+  }
+  {{- end }}
+
+  {{- if $.Sandbox }}
+  host_dns_ip = module.tinkerbell_sandbox.gateway
+
+  depends_on = [
+    # Create sandbox first, as otherwise Tinkerbell templates
+    # and workflows can't be created.
+    module.tinkerbell_sandbox,
+
+    # Wait until workers hardware is registered into Tinkerbell
+    # before creating templates and workflows.
+    module.tink_worker_{{ $pool.Name }},
+  ]
+  {{- end }}
+}
+{{- end}}
+
+# Stub output, which indicates, that Terraform run at least once.
+# Used when checking, if we should ask user for confirmation, when
+# applying changes to the cluster.
+output "initialized" {
+  value			= true
+	sensitive = true
+}
+
+# values.yaml content for all deployed charts.
+output "pod-checkpointer_values" {
+  value 		= module.controllers.pod-checkpointer_values
+	sensitive = true
+}
+
+output "kube-apiserver_values" {
+  value     = module.controllers.kube-apiserver_values
+  sensitive = true
+}
+
+output "kubernetes_values" {
+  value     = module.controllers.kubernetes_values
+  sensitive = true
+}
+
+output "kubelet_values" {
+  value     = module.controllers.kubelet_values
+  sensitive = true
+}
+
+output "calico_values" {
+  value 		= module.controllers.calico_values
+	sensitive = true
+}
+
+output "lokomotive_values" {
+  value     = module.controllers.lokomotive_values
+  sensitive = true
+}
+
+output "bootstrap-secrets_values" {
+  value     = module.controllers.bootstrap-secrets_values
+  sensitive = true
+}
+`
diff --git a/pkg/platform/tinkerbell/tinkerbell.go b/pkg/platform/tinkerbell/tinkerbell.go
new file mode 100644
index 000000000..923ffd5d7
--- /dev/null
+++ b/pkg/platform/tinkerbell/tinkerbell.go
@@ -0,0 +1,304 @@
+// Copyright 2020 The Lokomotive Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package tinkerbell
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+	"text/template"
+
+	"github.com/hashicorp/hcl/v2"
+	"github.com/hashicorp/hcl/v2/gohcl"
+	"github.com/mitchellh/go-homedir"
+
+	"github.com/kinvolk/lokomotive/pkg/assets"
+	"github.com/kinvolk/lokomotive/pkg/platform"
+	"github.com/kinvolk/lokomotive/pkg/terraform"
+)
+
+// Config represents Tinkerbell platform configuration.
+type Config struct { //nolint:maligned
+	AssetDir              string   `hcl:"asset_dir"`
+	Name                  string   `hcl:"name"`
+	DNSZone               string   `hcl:"dns_zone"`
+	SSHPublicKeys         []string `hcl:"ssh_public_keys"`
+	ControllerIPAddresses []string `hcl:"controller_ip_addresses"`
+
+	ControllerCLCSnippets           []string `hcl:"controller_clc_snippets,optional"`
+	ControllerFlatcarInstallBaseURL string   `hcl:"controller_flatcar_install_base_url,optional"`
+
+	OSChannel string `hcl:"os_channel,optional"`
+	OSVersion string `hcl:"os_version,optional"`
+
+	// If true, Tinkerbell server will be created, then used to setup Lokomotive cluster.
+	Sandbox *Sandbox `hcl:"experimental_sandbox,block"`
+
+	// Generic options.
+	EnableAggregation        bool   `hcl:"enable_aggregation,optional"`
+	EnableReporting          bool   `hcl:"enable_reporting,optional"`
+	PodCIDR                  string `hcl:"pod_cidr,optional"`
+	ServiceCIDR              string `hcl:"service_cidr,optional"`
+	ClusterDomainSuffix      string `hcl:"cluster_domain_suffix,optional"`
+	CertsValidityPeriodHours int    `hcl:"certs_validity_period_hours,optional"`
+	NetworkMTU               int    `hcl:"network_mtu,optional"`
+	DisableSelfHostedKubelet bool   `hcl:"disable_self_hosted_kubelet,optional"`
+
+	WorkerPools []WorkerPool `hcl:"worker_pool,block"`
+}
+
+// Sandbox represents Tinkerbell sandbox setup configuration.
+type Sandbox struct {
+	HostsCIDR        string `hcl:"hosts_cidr"`
+	FlatcarImagePath string `hcl:"flatcar_image_path"`
+	PoolPath         string `hcl:"pool_path"`
+}
+
+// WorkerPool represents Tinkerbell worker pool configuration.
+type WorkerPool struct {
+	PoolName string `hcl:"name,label"`
+
+	IPAddresses   []string `hcl:"ip_addresses"`
+	SSHPublicKeys []string `hcl:"ssh_public_keys,optional"`
+
+	OSChannel             string   `hcl:"os_channel,optional"`
+	OSVersion             string   `hcl:"os_version,optional"`
+	FlatcarInstallBaseURL string   `hcl:"flatcar_install_base_url,optional"`
+	CLCSnippets           []string `hcl:"clc_snippets,optional"`
+
+	// Generic options.
+	Labels map[string]string `hcl:"labels,optional"`
+	Taints map[string]string `hcl:"taints,optional"`
+}
+
+// Name returns worker pool name.
+func (w *WorkerPool) Name() string {
+	return w.PoolName
+}
+
+// init registers tinkerbell as a platform.
+func init() { //nolint:gochecknoinits
+	platform.Register("tinkerbell", NewConfig())
+}
+
+// LoadConfig loads platform configuration using given HCL structs.
+func (c *Config) LoadConfig(configBody *hcl.Body, evalContext *hcl.EvalContext) hcl.Diagnostics {
+	if configBody == nil {
+		emptyConfig := hcl.EmptyBody()
+		configBody = &emptyConfig
+	}
+
+	if diags := gohcl.DecodeBody(*configBody, evalContext, c); len(diags) != 0 {
+		return diags
+	}
+
+	for i, k := range c.SSHPublicKeys {
+		c.SSHPublicKeys[i] = strings.TrimSpace(k)
+	}
+
+	for _, p := range c.WorkerPools {
+		for i, k := range p.SSHPublicKeys {
+			p.SSHPublicKeys[i] = strings.TrimSpace(k)
+		}
+	}
+
+	return c.Validate()
+}
+
+// NewConfig returns Tinkerbell default configuration.
+func NewConfig() *Config {
+	return &Config{
+		EnableAggregation: true,
+	}
+}
+
+// Meta is part of Platform interface and returns common information about the platform configuration.
+func (c *Config) Meta() platform.Meta {
+	nodes := len(c.ControllerIPAddresses)
+	for _, workerpool := range c.WorkerPools {
+		nodes += len(workerpool.IPAddresses)
+	}
+
+	return platform.Meta{
+		AssetDir:      c.AssetDir,
+		ExpectedNodes: nodes,
+	}
+}
+
+// Initialize unpacks control plane Helm charts into assets directory and creates
+// Terraform configuration file.
+func (c *Config) Initialize(ex *terraform.Executor) error {
+	assetDir, err := homedir.Expand(c.AssetDir)
+	if err != nil {
+		return err
+	}
+
+	// TODO: A transient change which shall be reverted in a follow up PR to handle
+	// https://github.com/kinvolk/lokomotive/issues/716.
+	// Extract control plane chart files to cluster assets directory.
+	for _, c := range platform.CommonControlPlaneCharts() {
+		src := filepath.Join(assets.ControlPlaneSource, c.Name)
+		dst := filepath.Join(assetDir, "cluster-assets", "charts", c.Namespace, c.Name)
+
+		if err := assets.Extract(src, dst); err != nil {
+			return fmt.Errorf("extracting charts: %w", err)
+		}
+	}
+
+	// TODO: A transient change which shall be reverted in a follow up PR to handle
+	// https://github.com/kinvolk/lokomotive/issues/716.
+	// Extract self-hosted kubelet chart only when enabled in config.
+	if !c.DisableSelfHostedKubelet {
+		src := filepath.Join(assets.ControlPlaneSource, "kubelet")
+		dst := filepath.Join(assetDir, "cluster-assets", "charts", "kube-system", "kubelet")
+
+		if err := assets.Extract(src, dst); err != nil {
+			return fmt.Errorf("extracting kubelet chart: %w", err)
+		}
+	}
+
+	terraformRootDir := terraform.GetTerraformRootDir(assetDir)
+
+	return c.createTerraformConfigFile(terraformRootDir)
+}
+
+// Apply applies Terraform configuration.
+func (c *Config) Apply(ex *terraform.Executor) error {
+	if err := c.Initialize(ex); err != nil {
+		return err
+	}
+
+	return ex.Apply()
+}
+
+// Destroy destroys Terraform managed resources.
+func (c *Config) Destroy(ex *terraform.Executor) error {
+	if err := c.Initialize(ex); err != nil {
+		return err
+	}
+
+	return ex.Destroy()
+}
+
+func (c *Config) createTerraformConfigFile(terraformPath string) error {
+	tmplName := "cluster.tf"
+
+	t := template.Must(template.New("cluster.tf").Parse(terraformConfigTmpl))
+
+	path := filepath.Join(terraformPath, tmplName)
+
+	f, err := os.Create(path)
+	if err != nil {
+		return fmt.Errorf("failed to create file %q: %w", path, err)
+	}
+
+	if err := t.Execute(f, c); err != nil {
+		return fmt.Errorf("failed to write template to file %q: %w", path, err)
+	}
+
+	if err := f.Close(); err != nil {
+		return fmt.Errorf("failed closing file %q: %w", path, err)
+	}
+
+	return nil
+}
+
+// Validate validates cluster configuration.
+func (c *Config) Validate() hcl.Diagnostics {
+	var d hcl.Diagnostics
+
+	// Convert Tinkerbell worker pool to generic workerpool collection.
+	x := []platform.WorkerPool{}
+	for i, pool := range c.WorkerPools {
+		x = append(x, &c.WorkerPools[i])
+
+		if pool.PoolName == "" {
+			d = append(d, &hcl.Diagnostic{
+				Severity: hcl.DiagError,
+				Summary:  "Worker pools name can't be empty",
+				Detail:   fmt.Sprintf("Worker pool %d name is empty", i),
+			})
+		}
+
+		if len(pool.IPAddresses) == 0 {
+			d = append(d, &hcl.Diagnostic{
+				Severity: hcl.DiagError,
+				Summary:  "Worker pool must have at least one IP address configured",
+				Detail:   fmt.Sprintf("Worker pool %q IP addresses list is empty", pool.PoolName),
+			})
+		}
+	}
+
+	d = append(d, platform.WorkerPoolNamesUnique(x)...)
+	d = append(d, c.validateRequiredFields()...)
+
+	return d
+}
+
+func (c *Config) validateRequiredFields() hcl.Diagnostics {
+	var d hcl.Diagnostics
+
+	if c.AssetDir == "" {
+		d = append(d, &hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Asset dir can't be empty",
+		})
+	}
+
+	if c.Name == "" {
+		d = append(d, &hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Cluster name can't be empty",
+		})
+	}
+
+	if c.DNSZone == "" {
+		d = append(d, &hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "DNS zone can't be empty",
+		})
+	}
+
+	if len(c.SSHPublicKeys) == 0 {
+		d = append(d, &hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Controllers must have at least one SSH key configured",
+		})
+	}
+
+	if c.Sandbox != nil && c.Sandbox.FlatcarImagePath == "" {
+		d = append(d, &hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Tinkerbell sandbox must have Flatcar image path configured",
+		})
+	}
+
+	if c.Sandbox != nil && c.Sandbox.HostsCIDR == "" {
+		d = append(d, &hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Tinkerbell sandbox must have hosts CIDR configured",
+		})
+	}
+
+	if c.Sandbox != nil && c.Sandbox.PoolPath == "" {
+		d = append(d, &hcl.Diagnostic{
+			Severity: hcl.DiagError,
+			Summary:  "Tinkerbell sandbox must have pool path configured",
+		})
+	}
+
+	return d
+}
diff --git a/pkg/platform/tinkerbell/tinkerbell_test.go b/pkg/platform/tinkerbell/tinkerbell_test.go
new file mode 100644
index 000000000..f9da40ba5
--- /dev/null
+++ b/pkg/platform/tinkerbell/tinkerbell_test.go
@@ -0,0 +1,297 @@
+// Copyright 2020 The Lokomotive Authors
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+package tinkerbell_test
+
+import (
+	"io/ioutil"
+	"os"
+	"path/filepath"
+	"reflect"
+	"testing"
+
+	"github.com/hashicorp/hcl/v2"
+	"github.com/hashicorp/hcl/v2/gohcl"
+	"github.com/hashicorp/hcl/v2/hclparse"
+
+	lokoconfig "github.com/kinvolk/lokomotive/pkg/config"
+	"github.com/kinvolk/lokomotive/pkg/platform/tinkerbell"
+	"github.com/kinvolk/lokomotive/pkg/terraform"
+)
+
+func baseConfig() *tinkerbell.Config {
+	return &tinkerbell.Config{
+		AssetDir:              "foo",
+		Name:                  "foo",
+		DNSZone:               "example",
+		SSHPublicKeys:         []string{"foo"},
+		ControllerIPAddresses: []string{"foo"},
+		Sandbox: &tinkerbell.Sandbox{
+			HostsCIDR:        "foo",
+			FlatcarImagePath: "foo",
+			PoolPath:         "foo",
+		},
+		WorkerPools: []tinkerbell.WorkerPool{
+			{
+				PoolName:      "foo",
+				IPAddresses:   []string{"foo"},
+				SSHPublicKeys: []string{"foo"},
+			},
+		},
+	}
+}
+
+//nolint:funlen
+func TestConfigValidation(t *testing.T) {
+	cases := map[string]struct {
+		mutatingF   func(*tinkerbell.Config)
+		expectError bool
+	}{
+		"base config": {
+			mutatingF: func(c *tinkerbell.Config) {},
+		},
+		"require asset dir": {
+			mutatingF: func(c *tinkerbell.Config) {
+				c.AssetDir = ""
+			},
+			expectError: true,
+		},
+		"require name": {
+			mutatingF: func(c *tinkerbell.Config) {
+				c.Name = ""
+			},
+			expectError: true,
+		},
+		"require DNS zone": {
+			mutatingF: func(c *tinkerbell.Config) {
+				c.DNSZone = ""
+			},
+			expectError: true,
+		},
+		"require SSH public key": {
+			mutatingF: func(c *tinkerbell.Config) {
+				c.SSHPublicKeys = []string{}
+			},
+			expectError: true,
+		},
+		"allow no worker pools": {
+			mutatingF: func(c *tinkerbell.Config) {
+				c.WorkerPools = nil
+			},
+		},
+		"require worker pool name": {
+			mutatingF: func(c *tinkerbell.Config) {
+				c.WorkerPools[0].PoolName = ""
+			},
+			expectError: true,
+		},
+		"require worker pool IP address": {
+			mutatingF: func(c *tinkerbell.Config) {
+				c.WorkerPools[0].IPAddresses = []string{}
+			},
+			expectError: true,
+		},
+		"require sandbox hosts CIDR": {
+			mutatingF: func(c *tinkerbell.Config) {
+				c.Sandbox.HostsCIDR = ""
+			},
+			expectError: true,
+		},
+		"require sandbox Flatcar image path": {
+			mutatingF: func(c *tinkerbell.Config) {
+				c.Sandbox.FlatcarImagePath = ""
+			},
+			expectError: true,
+		},
+		"require sandbox pool path": {
+			mutatingF: func(c *tinkerbell.Config) {
+				c.Sandbox.PoolPath = ""
+			},
+			expectError: true,
+		},
+	}
+
+	for n, spec := range cases {
+		spec := spec
+
+		t.Run(n, func(t *testing.T) {
+			c := baseConfig()
+			spec.mutatingF(c)
+
+			diags := c.Validate()
+
+			if spec.expectError && !diags.HasErrors() {
+				t.Fatalf("Expected validation error")
+			}
+
+			if !spec.expectError && diags.HasErrors() {
+				t.Fatalf("Unexpected validation error: %v", diags)
+			}
+		})
+	}
+}
+
+func loadConfigFromString(t *testing.T, c string) (*tinkerbell.Config, hcl.Diagnostics) {
+	p := hclparse.NewParser()
+
+	f, d := p.ParseHCL([]byte(c), "x.lokocfg")
+	if d.HasErrors() {
+		t.Fatalf("parsing HCL should succeed, got: %v", d)
+	}
+
+	configBody := hcl.MergeFiles([]*hcl.File{f})
+
+	var rootConfig lokoconfig.RootConfig
+
+	if d := gohcl.DecodeBody(configBody, nil, &rootConfig); d.HasErrors() {
+		t.Fatalf("decoding root config should succeed, got: %v", d)
+	}
+
+	cc := &tinkerbell.Config{}
+
+	return cc, cc.LoadConfig(&rootConfig.Cluster.Config, &hcl.EvalContext{})
+}
+
+func TestLoadConfigEmpty(t *testing.T) {
+	c := `cluster "tinkerbell" {}`
+
+	if _, d := loadConfigFromString(t, c); !d.HasErrors() {
+		t.Fatalf("empty config should not be valid")
+	}
+}
+
+func TestLoadConfigTrimSSHKeys(t *testing.T) {
+	c := `
+cluster "tinkerbell" {
+  asset_dir       = "foo"
+  ssh_public_keys = [<<EOF
+key
+
+
+EOF
+		,
+	]
+
+  # Tinkerbell hardware entry must exist with this IP address.
+  controller_ip_addresses = [
+    "10.17.3.4",
+  ]
+
+  name = "tink"
+
+  dns_zone = "example.com"
+
+  worker_pool "foo" {
+    ip_addresses = [
+      "10.17.3.5"
+    ]
+
+    ssh_public_keys = [<<EOF
+key
+
+EOF
+			,
+		]
+  }
+}
+`
+
+	cc, d := loadConfigFromString(t, c)
+	if d.HasErrors() {
+		t.Fatalf("valid config should not return error, got: %v", d)
+	}
+
+	if !reflect.DeepEqual(cc.SSHPublicKeys, []string{"key"}) {
+		t.Errorf("Controllers SSH public keys should be trimmed from whitespace to ensure right Terraform rendering")
+	}
+
+	if !reflect.DeepEqual(cc.WorkerPools[0].SSHPublicKeys, []string{"key"}) {
+		t.Errorf("Worker pools SSH public keys should be trimmed from whitespace to ensure right Terraform rendering")
+	}
+}
+
+func TestMeta(t *testing.T) {
+	assetDir := "foo"
+
+	c := &tinkerbell.Config{
+		AssetDir:              assetDir,
+		ControllerIPAddresses: []string{"foo", "bar"},
+		WorkerPools: []tinkerbell.WorkerPool{
+			{
+				IPAddresses: []string{"foo"},
+			},
+			{
+				IPAddresses: []string{"foo", "bar", "baz"},
+			},
+		},
+	}
+
+	m := c.Meta()
+
+	if m.AssetDir != assetDir {
+		t.Errorf("Expected asset dir %q, got %q", assetDir, m.AssetDir)
+	}
+
+	expectedNodes := 6
+	if m.ExpectedNodes != expectedNodes {
+		t.Errorf("Expected %d nodes, got %d", expectedNodes, m.ExpectedNodes)
+	}
+}
+
+func TestInitialize(t *testing.T) {
+	tmpDir, err := ioutil.TempDir("", "lokoctl-tests-")
+	if err != nil {
+		t.Fatalf("Creating tmp dir should succeed, got: %v", err)
+	}
+
+	t.Cleanup(func() {
+		if err := os.RemoveAll(tmpDir); err != nil {
+			t.Logf("Failed to remove temp dir %q: %v", tmpDir, err)
+		}
+	})
+
+	c := baseConfig()
+	c.AssetDir = tmpDir
+
+	path := filepath.Join(tmpDir, "terraform")
+	if err := os.MkdirAll(path, 0o700); err != nil {
+		t.Fatalf("Failed creating directory %q: %v", path, err)
+	}
+
+	if err := c.Initialize(nil); err != nil {
+		t.Fatalf("Initializing should work, got: %v", err)
+	}
+
+	tfDir := terraform.GetTerraformRootDir(tmpDir)
+
+	content, err := ioutil.ReadFile(filepath.Join(tfDir, "cluster.tf")) // #nosec G304
+	if err != nil {
+		t.Fatalf("Reading Terraform source file: %v", err)
+	}
+
+	if len(content) == 0 {
+		t.Fatal("Terraform source file should not be empty")
+	}
+
+	path = filepath.Join(tmpDir, "cluster-assets", "charts", "kube-system")
+
+	dirs, err := ioutil.ReadDir(path)
+	if err != nil {
+		t.Fatalf("Listing files in %q: %v", path, err)
+	}
+
+	if len(dirs) == 0 {
+		t.Fatalf("Initialize should extract control plane helm charts, no files found in %q", dirs)
+	}
+}