A bootable USB stick that provisions a bare metal node into a self-bootstrapping Kubernetes seed cluster with integrated routing.
- Boots from USB and installs Flatcar Linux to disk
- Configures Gateway (choose your mode):
- Strata Router (default): Native Flatcar routing (~270MB RAM) ⭐ Recommended
- VyOS on KubeVirt: VM-based routing (~4GB RAM)
- Runs Strata to provision your infrastructure from
topology.yaml - Pivots the controller to Layer 1 and goes dormant
┌─────────────────────────────────────────────────────────────────────────┐
│ Flatcar USB Seed │
├─────────────────────────────────────────────────────────────────────────┤
│ │
│ ┌─────────────────────────────────────────────────────────────────┐ │
│ │ Gateway Mode Selection │ │
│ │ (select-gateway-mode.sh) │ │
│ └─────────────────────┬───────────────────────┬───────────────────┘ │
│ │ │ │
│ ┌─────────────▼─────────────┐ ┌────▼────────────────────┐ │
│ │ Strata Router Mode │ │ VyOS Mode │ │
│ │ (Recommended) │ │ (Legacy) │ │
│ │ ┌─────────────────────┐ │ │ ┌────────────────────┐ │ │
│ │ │ systemd-networkd │ │ │ │ k0s Cluster │ │ │
│ │ │ nftables │ │ │ │ KubeVirt │ │ │
│ │ │ FRR (container) │ │ │ │ VyOS VM │ │ │
│ │ │ CoreDNS (container)│ │ │ └────────────────────┘ │ │
│ │ └─────────────────────┘ │ │ │ │
│ │ RAM: ~270MB │ │ RAM: ~4GB │ │
│ │ Boot: ~10s │ │ Boot: ~60s │ │
│ └───────────────────────────┘ └─────────────────────────┘ │
│ │ │ │
│ └───────────┬───────────┘ │
│ ▼ │
│ ┌───────────────────────────────┐ │
│ │ Strata Provisioner │ │
│ │ (provisions Layer 1+) │ │
│ └───────────────────────────────┘ │
│ │
└─────────────────────────────────────────────────────────────────────────┘
| Feature | Strata Router | VyOS on KubeVirt |
|---|---|---|
| RAM Usage | ~270MB | ~4GB |
| Boot Time | ~10s | ~60s |
| Throughput | ~40Gbps | ~10Gbps |
| Dependencies | None | k0s + KubeVirt |
| Complexity | Low | High |
| Migration | New standard | Legacy support |
Native Flatcar routing using Linux networking primitives:
- systemd-networkd — Interface configuration, VLANs, VXLAN
- nftables — Stateful firewall and NAT
- FRR — BGP/OSPF routing (containerized)
- CoreDNS — DNS resolver and caching (containerized)
# config/seed-config.yaml
gateway_mode: "strata-router"
strata_router:
wan:
interface: "eth1"
ip: "10.100.0.1/24"
gateway: "10.100.0.254"
lan:
interface: "eth2"
ip: "10.100.1.1/24"
bgp:
asn: 65001
neighbors:
- ip: "10.100.0.254"
asn: 65000Runs VyOS as a KubeVirt virtual machine. Use this for:
- Compatibility with existing VyOS configurations
- Features not yet in Strata Router (IPsec, advanced firewall rules)
# config/seed-config.yaml
gateway_mode: "vyos"
vyos:
bgp_asn: 65001
bgp_neighbor: "192.168.1.254"
bgp_neighbor_asn: 65000# 1. Clone the repo
git clone https://github.com/your-org/flatcar-usb-seed.git
cd flatcar-usb-seed
# 2. Check dependencies
make deps
# 3. Customize configuration
cp config/seed-config.example.yaml config/seed-config.yaml
cp config/ssh_authorized_keys.example config/ssh_authorized_keys
vim config/seed-config.yaml
# 4. Validate and Generate config
make validate
make generate-templates
# 5. (Optional) Embed the Strata provisioner
make embed-provisioner
# 5. Build the USB image
make usb GATEWAY_MODE=strata-router
# 6. Write to USB stick
sudo dd if=build/seed-usb.img of=/dev/sdX bs=4M status=progress
# 7. Plug USB into your seed node and boot from itRequired tools on the build machine:
- butane — Transpiles Butane YAML to Ignition JSON
- coreos-installer — Customizes ISO with Ignition
- jq — JSON processing (for Ignition merging)
- curl — Download Flatcar ISO
- python3 — Config validation (requires PyYAML)
- yq (optional) or python3 — Template generation
Install on Fedora/RHEL:
sudo dnf install butane coreos-installer jq curl python3 python3-pyyamlflatcar-usb-seed/
├── butane/ # Butane (Ignition) configs
│ ├── seed.bu # Base config (common to all modes)
│ ├── strata-router.bu # Strata Router mode additions
│ └── vyos.bu # VyOS mode additions
├── scripts/ # Build and runtime scripts
│ ├── select-gateway-mode.sh # Chooses gateway at boot
│ ├── configure-strata-router.sh
│ ├── install-k0s.sh
│ ├── install-kubevirt.sh
│ ├── deploy-vyos.sh
│ └── run-provisioner.sh
├── templates/ # Configuration templates
│ ├── nftables.conf # Firewall rules
│ ├── frr.conf # FRR routing config
│ └── Corefile # CoreDNS config
├── manifests/ # Kubernetes manifests
│ ├── kubevirt-operator.yaml
│ ├── vyos-vm.yaml
│ └── multus-bridge.yaml
├── config/ # User configuration
│ ├── seed-config.example.yaml
│ └── ssh_authorized_keys.example
├── embed/ # Embedded binaries
│ ├── strata # Strata provisioner (fetched via fetch-provisioner.sh)
│ └── topology.yaml # Infrastructure definition
├── Makefile # Build system
└── build/ # Output directory (gitignored)
This is the main configuration file. Key sections:
| Section | Description |
|---|---|
gateway_mode |
strata-router or vyos |
network |
Management interface settings |
strata_router |
WAN/LAN interfaces, BGP, DNS |
vyos |
VyOS-specific BGP and DHCP settings |
provisioner |
Strata provisioner settings |
See config/seed-config.example.yaml for all options.
Defines the infrastructure that Strata will provision. This file is embedded in the USB image and used by the Strata provisioner to deploy your datacenter.
See embed/topology.yaml for an example.
USB Boot → Flatcar Install → Ignition
│
├── select-gateway-mode.sh
│ └── Creates /opt/seed/.strata-router-mode
│
├── sysctl-router.service
│ └── Enable IP forwarding
│
├── nftables.service
│ └── Load firewall rules
│
├── frr.service (Quadlet)
│ └── Start FRR container (BGP/OSPF)
│
├── coredns.service (Quadlet)
│ └── Start CoreDNS container
│
├── strata-router-gateway.service
│ └── Verify all components
│
└── seed-provisioner.service
└── Run Strata to provision Layer 1+
USB Boot → Flatcar Install → Ignition
│
├── select-gateway-mode.sh
│ └── Creates /opt/seed/.vyos-mode
│
├── seed-k0s-install.service
│ └── Install k0s single-node cluster
│
├── seed-kubevirt-install.service
│ └── Install KubeVirt operator
│
├── seed-vyos-deploy.service
│ └── Deploy VyOS VM
│
└── seed-provisioner.service
└── Run Strata to provision Layer 1+
ssh core@<seed-ip>
# Which mode is active?
ls /opt/seed/.*-mode
# /opt/seed/.strata-router-mode OR /opt/seed/.vyos-mode
# Check running services
systemctl status strata-router-gateway.service # Strata Router
systemctl status seed-vyos-deploy.service # VyOS# Check FRR BGP neighbors
sudo podman exec -it systemd-frr vtysh -c "show bgp summary"
# Check nftables rules
sudo nft list ruleset
# Check CoreDNS
dig @10.100.1.1 example.com
# Check resource usage (should be ~200-300MB)
free -h
# View container logs
sudo podman logs systemd-frr
sudo podman logs systemd-coredns# Check k0s status
k0s status
# Check KubeVirt
kubectl --kubeconfig=/var/lib/k0s/pki/admin.conf get kubevirt -n kubevirt
# Check VyOS VM
kubectl --kubeconfig=/var/lib/k0s/pki/admin.conf get vmi -A
# Access VyOS console
virtctl console vyos-gateway -n defaultThis repository provides the bootable USB image that deploys a seed node. The seed node runs the Strata provisioner which then provisions additional infrastructure layers.
flatcar-usb-seed → Provisions seed node
│
└──→ strata → Provisions Layer 1, 2, 3...
See Strata documentation for topology configuration and provisioning details.
Apache 2.0