From 5dbd7cb03ba069bb641077fa032cb07b635725e1 Mon Sep 17 00:00:00 2001
From: Sayan Paul <saypaul@redhat.com>
Date: Mon, 11 Sep 2023 16:12:18 +0530
Subject: [PATCH] add fiot variant for fedora-iot v1_0 is compatible with
 ignition 3.4.0 v1_1_exp is experimental version compatible with ignition
 3.5.0 docs added for fiot

Signed-off-by: Sayan Paul <saypaul@redhat.com>
---
 config/config.go                       |   4 +
 config/fiot/v1_0/schema.go             |  23 ++++
 config/fiot/v1_0/translate.go          |  54 ++++++++
 config/fiot/v1_0/translate_test.go     | 180 +++++++++++++++++++++++++
 config/fiot/v1_1_exp/schema.go         |  23 ++++
 config/fiot/v1_1_exp/translate.go      |  54 ++++++++
 config/fiot/v1_1_exp/translate_test.go | 180 +++++++++++++++++++++++++
 docs/config-fiot-v1_0.md               | 146 ++++++++++++++++++++
 docs/config-fiot-v1_1-exp.md           | 148 ++++++++++++++++++++
 docs/release-notes.md                  |   1 +
 internal/doc/main.go                   |  11 ++
 11 files changed, 824 insertions(+)
 create mode 100644 config/fiot/v1_0/schema.go
 create mode 100644 config/fiot/v1_0/translate.go
 create mode 100644 config/fiot/v1_0/translate_test.go
 create mode 100644 config/fiot/v1_1_exp/schema.go
 create mode 100644 config/fiot/v1_1_exp/translate.go
 create mode 100644 config/fiot/v1_1_exp/translate_test.go
 create mode 100644 docs/config-fiot-v1_0.md
 create mode 100644 docs/config-fiot-v1_1-exp.md

diff --git a/config/config.go b/config/config.go
index 7d1c02a8..01d1f949 100644
--- a/config/config.go
+++ b/config/config.go
@@ -28,6 +28,8 @@ import (
 	flatcar1_0 "github.com/coreos/butane/config/flatcar/v1_0"
 	flatcar1_1 "github.com/coreos/butane/config/flatcar/v1_1"
 	flatcar1_2_exp "github.com/coreos/butane/config/flatcar/v1_2_exp"
+	fiot1_0 "github.com/coreos/butane/config/fiot/v1_0"
+	fiot1_1_exp "github.com/coreos/butane/config/fiot/v1_1_exp"
 	openshift4_10 "github.com/coreos/butane/config/openshift/v4_10"
 	openshift4_11 "github.com/coreos/butane/config/openshift/v4_11"
 	openshift4_12 "github.com/coreos/butane/config/openshift/v4_12"
@@ -75,6 +77,8 @@ func init() {
 	RegisterTranslator("r4e", "1.0.0", r4e1_0.ToIgn3_3Bytes)
 	RegisterTranslator("r4e", "1.1.0", r4e1_1.ToIgn3_4Bytes)
 	RegisterTranslator("r4e", "1.2.0-experimental", r4e1_2_exp.ToIgn3_5Bytes)
+	RegisterTranslator("fiot", "1.0.0", fiot1_0.ToIgn3_4Bytes)
+	RegisterTranslator("fiot", "1.1.0-experimental", fiot1_1_exp.ToIgn3_5Bytes)
 	RegisterTranslator("rhcos", "0.1.0", unsupportedRhcosVariant)
 }
 
diff --git a/config/fiot/v1_0/schema.go b/config/fiot/v1_0/schema.go
new file mode 100644
index 00000000..d9c6f0dc
--- /dev/null
+++ b/config/fiot/v1_0/schema.go
@@ -0,0 +1,23 @@
+// Copyright 2022 Red Hat, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.)
+
+package v1_0
+
+import (
+	base "github.com/coreos/butane/base/v0_5"
+)
+
+type Config struct {
+	base.Config `yaml:",inline"`
+}
diff --git a/config/fiot/v1_0/translate.go b/config/fiot/v1_0/translate.go
new file mode 100644
index 00000000..529629ed
--- /dev/null
+++ b/config/fiot/v1_0/translate.go
@@ -0,0 +1,54 @@
+// Copyright 2022 Red Hat, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.)
+
+package v1_0
+
+import (
+	"github.com/coreos/butane/config/common"
+	cutil "github.com/coreos/butane/config/util"
+
+	"github.com/coreos/ignition/v2/config/v3_4/types"
+	"github.com/coreos/vcontext/report"
+)
+
+var (
+	fieldFilters = cutil.NewFilters(types.Config{}, cutil.FilterMap{
+		"kernelArguments":     common.ErrGeneralKernelArgumentSupport,
+		"storage.disks":       common.ErrDiskSupport,
+		"storage.filesystems": common.ErrFilesystemSupport,
+		"storage.luks":        common.ErrLuksSupport,
+		"storage.raid":        common.ErrRaidSupport,
+	})
+)
+
+// Return FieldFilters for this spec.
+func (c Config) FieldFilters() *cutil.FieldFilters {
+	return &fieldFilters
+}
+
+// ToIgn3_4 translates the config to an Ignition config. It returns a
+// report of any errors or warnings in the source and resultant config. If
+// the report has fatal errors or it encounters other problems translating,
+// an error is returned.
+func (c Config) ToIgn3_4(options common.TranslateOptions) (types.Config, report.Report, error) {
+	cfg, r, err := cutil.Translate(c, "ToIgn3_4Unvalidated", options)
+	return cfg.(types.Config), r, err
+}
+
+// ToIgn3_4Bytes translates from a v1.1 Butane config to a v3.4.0 Ignition config. It returns a report of any errors or
+// warnings in the source and resultant config. If the report has fatal errors or it encounters other problems
+// translating, an error is returned.
+func ToIgn3_4Bytes(input []byte, options common.TranslateBytesOptions) ([]byte, report.Report, error) {
+	return cutil.TranslateBytes(input, &Config{}, "ToIgn3_4", options)
+}
diff --git a/config/fiot/v1_0/translate_test.go b/config/fiot/v1_0/translate_test.go
new file mode 100644
index 00000000..15e6be37
--- /dev/null
+++ b/config/fiot/v1_0/translate_test.go
@@ -0,0 +1,180 @@
+// Copyright 2022 Red Hat, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.)
+
+package v1_0
+
+import (
+	"fmt"
+	"testing"
+
+	baseutil "github.com/coreos/butane/base/util"
+	base "github.com/coreos/butane/base/v0_5"
+	"github.com/coreos/butane/config/common"
+	confutil "github.com/coreos/butane/config/util"
+	"github.com/coreos/ignition/v2/config/util"
+	"github.com/coreos/vcontext/path"
+	"github.com/coreos/vcontext/report"
+	"github.com/stretchr/testify/assert"
+)
+
+// Test that we error on unsupported fields for r4e
+func TestTranslateInvalid(t *testing.T) {
+	type InvalidEntry struct {
+		Kind report.EntryKind
+		Err  error
+		Path path.ContextPath
+	}
+	tests := []struct {
+		In      Config
+		Entries []InvalidEntry
+	}{
+		// we don't support setting kernel arguments
+		{
+			Config{
+				Config: base.Config{
+					KernelArguments: base.KernelArguments{
+						ShouldExist: []base.KernelArgument{
+							"test",
+						},
+					},
+				},
+			},
+			[]InvalidEntry{
+				{
+					report.Error,
+					common.ErrGeneralKernelArgumentSupport,
+					path.New("yaml", "kernel_arguments"),
+				},
+			},
+		},
+		// we don't support unsetting kernel arguments either
+		{
+			Config{
+				Config: base.Config{
+					KernelArguments: base.KernelArguments{
+						ShouldNotExist: []base.KernelArgument{
+							"another-test",
+						},
+					},
+				},
+			},
+			[]InvalidEntry{
+				{
+					report.Error,
+					common.ErrGeneralKernelArgumentSupport,
+					path.New("yaml", "kernel_arguments"),
+				},
+			},
+		},
+		// disk customizations are made in Image Builder, r4e doesn't support this via ignition
+		{
+			Config{
+				Config: base.Config{
+					Storage: base.Storage{
+						Disks: []base.Disk{
+							{
+								Device: "some-device",
+							},
+						},
+					},
+				},
+			},
+			[]InvalidEntry{
+				{
+					report.Error,
+					common.ErrDiskSupport,
+					path.New("yaml", "storage", "disks"),
+				},
+			},
+		},
+		// filesystem customizations are made in Image Builder, r4e doesn't support this via ignition
+		{
+			Config{
+				Config: base.Config{
+					Storage: base.Storage{
+						Filesystems: []base.Filesystem{
+							{
+								Device: "/dev/disk/by-label/TEST",
+								Path:   util.StrToPtr("/var"),
+							},
+						},
+					},
+				},
+			},
+			[]InvalidEntry{
+				{
+					report.Error,
+					common.ErrFilesystemSupport,
+					path.New("yaml", "storage", "filesystems"),
+				},
+			},
+		},
+		// default luks configuration is made in Image Builder for r4e, we don't support this via ignition
+		{
+			Config{
+				Config: base.Config{
+					Storage: base.Storage{
+						Luks: []base.Luks{
+							{
+								Label: util.StrToPtr("some-label"),
+							},
+						},
+					},
+				},
+			},
+			[]InvalidEntry{
+				{
+					report.Error,
+					common.ErrLuksSupport,
+					path.New("yaml", "storage", "luks"),
+				},
+			},
+		},
+		// we don't support configuring raid via ignition
+		{
+			Config{
+				Config: base.Config{
+					Storage: base.Storage{
+						Raid: []base.Raid{
+							{
+								Name: "some-name",
+							},
+						},
+					},
+				},
+			},
+			[]InvalidEntry{
+				{
+					report.Error,
+					common.ErrRaidSupport,
+					path.New("yaml", "storage", "raid"),
+				},
+			},
+		},
+	}
+	for i, test := range tests {
+		t.Run(fmt.Sprintf("translate %d", i), func(t *testing.T) {
+			var expectedReport report.Report
+			for _, entry := range test.Entries {
+				expectedReport.AddOnError(entry.Path, entry.Err)
+			}
+			actual, translations, r := test.In.ToIgn3_4Unvalidated(common.TranslateOptions{})
+			r.Merge(fieldFilters.Verify(actual))
+			r = confutil.TranslateReportPaths(r, translations)
+			baseutil.VerifyReport(t, test.In, r)
+			assert.Equal(t, expectedReport, r, "report mismatch")
+			assert.NoError(t, translations.DebugVerifyCoverage(actual), "incomplete TranslationSet coverage")
+		})
+	}
+}
diff --git a/config/fiot/v1_1_exp/schema.go b/config/fiot/v1_1_exp/schema.go
new file mode 100644
index 00000000..e8e5c415
--- /dev/null
+++ b/config/fiot/v1_1_exp/schema.go
@@ -0,0 +1,23 @@
+// Copyright 2022 Red Hat, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.)
+
+package v1_1_exp
+
+import (
+	base "github.com/coreos/butane/base/v0_6_exp"
+)
+
+type Config struct {
+	base.Config `yaml:",inline"`
+}
diff --git a/config/fiot/v1_1_exp/translate.go b/config/fiot/v1_1_exp/translate.go
new file mode 100644
index 00000000..9ecac218
--- /dev/null
+++ b/config/fiot/v1_1_exp/translate.go
@@ -0,0 +1,54 @@
+// Copyright 2022 Red Hat, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.)
+
+package v1_1_exp
+
+import (
+	"github.com/coreos/butane/config/common"
+	cutil "github.com/coreos/butane/config/util"
+
+	"github.com/coreos/ignition/v2/config/v3_5_experimental/types"
+	"github.com/coreos/vcontext/report"
+)
+
+var (
+	fieldFilters = cutil.NewFilters(types.Config{}, cutil.FilterMap{
+		"kernelArguments":     common.ErrGeneralKernelArgumentSupport,
+		"storage.disks":       common.ErrDiskSupport,
+		"storage.filesystems": common.ErrFilesystemSupport,
+		"storage.luks":        common.ErrLuksSupport,
+		"storage.raid":        common.ErrRaidSupport,
+	})
+)
+
+// Return FieldFilters for this spec.
+func (c Config) FieldFilters() *cutil.FieldFilters {
+	return &fieldFilters
+}
+
+// ToIgn3_5 translates the config to an Ignition config. It returns a
+// report of any errors or warnings in the source and resultant config. If
+// the report has fatal errors or it encounters other problems translating,
+// an error is returned.
+func (c Config) ToIgn3_5(options common.TranslateOptions) (types.Config, report.Report, error) {
+	cfg, r, err := cutil.Translate(c, "ToIgn3_5Unvalidated", options)
+	return cfg.(types.Config), r, err
+}
+
+// ToIgn3_5Bytes translates from a v1.2 Butane config to a v3.5.0 Ignition config. It returns a report of any errors or
+// warnings in the source and resultant config. If the report has fatal errors or it encounters other problems
+// translating, an error is returned.
+func ToIgn3_5Bytes(input []byte, options common.TranslateBytesOptions) ([]byte, report.Report, error) {
+	return cutil.TranslateBytes(input, &Config{}, "ToIgn3_5", options)
+}
diff --git a/config/fiot/v1_1_exp/translate_test.go b/config/fiot/v1_1_exp/translate_test.go
new file mode 100644
index 00000000..32336c54
--- /dev/null
+++ b/config/fiot/v1_1_exp/translate_test.go
@@ -0,0 +1,180 @@
+// Copyright 2022 Red Hat, Inc
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.)
+
+package v1_1_exp
+
+import (
+	"fmt"
+	"testing"
+
+	baseutil "github.com/coreos/butane/base/util"
+	base "github.com/coreos/butane/base/v0_6_exp"
+	"github.com/coreos/butane/config/common"
+	confutil "github.com/coreos/butane/config/util"
+	"github.com/coreos/ignition/v2/config/util"
+	"github.com/coreos/vcontext/path"
+	"github.com/coreos/vcontext/report"
+	"github.com/stretchr/testify/assert"
+)
+
+// Test that we error on unsupported fields for r4e
+func TestTranslateInvalid(t *testing.T) {
+	type InvalidEntry struct {
+		Kind report.EntryKind
+		Err  error
+		Path path.ContextPath
+	}
+	tests := []struct {
+		In      Config
+		Entries []InvalidEntry
+	}{
+		// we don't support setting kernel arguments
+		{
+			Config{
+				Config: base.Config{
+					KernelArguments: base.KernelArguments{
+						ShouldExist: []base.KernelArgument{
+							"test",
+						},
+					},
+				},
+			},
+			[]InvalidEntry{
+				{
+					report.Error,
+					common.ErrGeneralKernelArgumentSupport,
+					path.New("yaml", "kernel_arguments"),
+				},
+			},
+		},
+		// we don't support unsetting kernel arguments either
+		{
+			Config{
+				Config: base.Config{
+					KernelArguments: base.KernelArguments{
+						ShouldNotExist: []base.KernelArgument{
+							"another-test",
+						},
+					},
+				},
+			},
+			[]InvalidEntry{
+				{
+					report.Error,
+					common.ErrGeneralKernelArgumentSupport,
+					path.New("yaml", "kernel_arguments"),
+				},
+			},
+		},
+		// disk customizations are made in Image Builder, r4e doesn't support this via ignition
+		{
+			Config{
+				Config: base.Config{
+					Storage: base.Storage{
+						Disks: []base.Disk{
+							{
+								Device: "some-device",
+							},
+						},
+					},
+				},
+			},
+			[]InvalidEntry{
+				{
+					report.Error,
+					common.ErrDiskSupport,
+					path.New("yaml", "storage", "disks"),
+				},
+			},
+		},
+		// filesystem customizations are made in Image Builder, r4e doesn't support this via ignition
+		{
+			Config{
+				Config: base.Config{
+					Storage: base.Storage{
+						Filesystems: []base.Filesystem{
+							{
+								Device: "/dev/disk/by-label/TEST",
+								Path:   util.StrToPtr("/var"),
+							},
+						},
+					},
+				},
+			},
+			[]InvalidEntry{
+				{
+					report.Error,
+					common.ErrFilesystemSupport,
+					path.New("yaml", "storage", "filesystems"),
+				},
+			},
+		},
+		// default luks configuration is made in Image Builder for r4e, we don't support this via ignition
+		{
+			Config{
+				Config: base.Config{
+					Storage: base.Storage{
+						Luks: []base.Luks{
+							{
+								Label: util.StrToPtr("some-label"),
+							},
+						},
+					},
+				},
+			},
+			[]InvalidEntry{
+				{
+					report.Error,
+					common.ErrLuksSupport,
+					path.New("yaml", "storage", "luks"),
+				},
+			},
+		},
+		// we don't support configuring raid via ignition
+		{
+			Config{
+				Config: base.Config{
+					Storage: base.Storage{
+						Raid: []base.Raid{
+							{
+								Name: "some-name",
+							},
+						},
+					},
+				},
+			},
+			[]InvalidEntry{
+				{
+					report.Error,
+					common.ErrRaidSupport,
+					path.New("yaml", "storage", "raid"),
+				},
+			},
+		},
+	}
+	for i, test := range tests {
+		t.Run(fmt.Sprintf("translate %d", i), func(t *testing.T) {
+			var expectedReport report.Report
+			for _, entry := range test.Entries {
+				expectedReport.AddOnError(entry.Path, entry.Err)
+			}
+			actual, translations, r := test.In.ToIgn3_5Unvalidated(common.TranslateOptions{})
+			r.Merge(fieldFilters.Verify(actual))
+			r = confutil.TranslateReportPaths(r, translations)
+			baseutil.VerifyReport(t, test.In, r)
+			assert.Equal(t, expectedReport, r, "report mismatch")
+			assert.NoError(t, translations.DebugVerifyCoverage(actual), "incomplete TranslationSet coverage")
+		})
+	}
+}
diff --git a/docs/config-fiot-v1_0.md b/docs/config-fiot-v1_0.md
new file mode 100644
index 00000000..de214dd6
--- /dev/null
+++ b/docs/config-fiot-v1_0.md
@@ -0,0 +1,146 @@
+---
+# This file is automatically generated from internal/doc and Ignition's
+# config/doc.  Do not edit.
+title: Fedora-iot v1.0.0
+parent: Configuration specifications
+nav_order: 249
+---
+
+# Fedora-iot Specification v1.0.0
+
+The Fedora-iot configuration is a YAML document conforming to the following specification, with **_italicized_** entries being optional:
+
+<div id="spec-docs"></div>
+
+* **variant** (string): used to differentiate configs for different operating systems. Must be `%VARIANT%` for this specification.
+* **version** (string): the semantic version of the spec for this document. This document is for version `%VERSION%` and generates Ignition configs with version `3.4.0`.
+* **_ignition_** (object): metadata about the configuration itself.
+  * **_config_** (object): options related to the configuration.
+    * **_merge_** (list of objects): a list of the configs to be merged to the current config.
+      * **_source_** (string): the URL of the config. Supported schemes are `http`, `https`, `tftp`, `s3`, `arn`, `gs`, and [`data`](https://tools.ietf.org/html/rfc2397). When using `http`, it is advisable to use the verification option to ensure the contents haven't been modified. Mutually exclusive with `inline` and `local`.
+      * **_inline_** (string): the contents of the config. Mutually exclusive with `source` and `local`.
+      * **_local_** (string): a local path to the contents of the config, relative to the directory specified by the `--files-dir` command-line argument. Mutually exclusive with `source` and `inline`.
+      * **_compression_** (string): the type of compression used on the config (null or gzip). Compression cannot be used with S3.
+      * **_http_headers_** (list of objects): a list of HTTP headers to be added to the request. Available for `http` and `https` source schemes only.
+        * **name** (string): the header name.
+        * **_value_** (string): the header contents.
+      * **_verification_** (object): options related to the verification of the config.
+        * **_hash_** (string): the hash of the config, in the form `<type>-<value>` where type is either `sha512` or `sha256`. If `compression` is specified, the hash describes the decompressed config.
+    * **_replace_** (object): the config that will replace the current.
+      * **_source_** (string): the URL of the config. Supported schemes are `http`, `https`, `tftp`, `s3`, `arn`, `gs`, and [`data`](https://tools.ietf.org/html/rfc2397). When using `http`, it is advisable to use the verification option to ensure the contents haven't been modified. Mutually exclusive with `inline` and `local`.
+      * **_inline_** (string): the contents of the config. Mutually exclusive with `source` and `local`.
+      * **_local_** (string): a local path to the contents of the config, relative to the directory specified by the `--files-dir` command-line argument. Mutually exclusive with `source` and `inline`.
+      * **_compression_** (string): the type of compression used on the config (null or gzip). Compression cannot be used with S3.
+      * **_http_headers_** (list of objects): a list of HTTP headers to be added to the request. Available for `http` and `https` source schemes only.
+        * **name** (string): the header name.
+        * **_value_** (string): the header contents.
+      * **_verification_** (object): options related to the verification of the config.
+        * **_hash_** (string): the hash of the config, in the form `<type>-<value>` where type is either `sha512` or `sha256`. If `compression` is specified, the hash describes the decompressed config.
+  * **_timeouts_** (object): options relating to `http` timeouts when fetching files over `http` or `https`.
+    * **_http_response_headers_** (integer): the time to wait (in seconds) for the server's response headers (but not the body) after making a request. 0 indicates no timeout. Default is 10 seconds.
+    * **_http_total_** (integer): the time limit (in seconds) for the operation (connection, request, and response), including retries. 0 indicates no timeout. Default is 0.
+  * **_security_** (object): options relating to network security.
+    * **_tls_** (object): options relating to TLS when fetching resources over `https`.
+      * **_certificate_authorities_** (list of objects): the list of additional certificate authorities (in addition to the system authorities) to be used for TLS verification when fetching over `https`. All certificate authorities must have a unique `source`, `inline`, or `local`.
+        * **_source_** (string): the URL of the certificate bundle (in PEM format). The bundle can contain multiple concatenated certificates. Supported schemes are `http`, `https`, `tftp`, `s3`, `arn`, `gs`, and [`data`](https://tools.ietf.org/html/rfc2397). When using `http`, it is advisable to use the verification option to ensure the contents haven't been modified. Mutually exclusive with `inline` and `local`.
+        * **_inline_** (string): the contents of the certificate bundle (in PEM format). The bundle can contain multiple concatenated certificates. Mutually exclusive with `source` and `local`.
+        * **_local_** (string): a local path to the contents of the certificate bundle (in PEM format), relative to the directory specified by the `--files-dir` command-line argument. The bundle can contain multiple concatenated certificates. Mutually exclusive with `source` and `inline`.
+        * **_compression_** (string): the type of compression used on the certificate bundle (null or gzip). Compression cannot be used with S3.
+        * **_http_headers_** (list of objects): a list of HTTP headers to be added to the request. Available for `http` and `https` source schemes only.
+          * **name** (string): the header name.
+          * **_value_** (string): the header contents.
+        * **_verification_** (object): options related to the verification of the certificate bundle.
+          * **_hash_** (string): the hash of the certificate bundle, in the form `<type>-<value>` where type is either `sha512` or `sha256`. If `compression` is specified, the hash describes the decompressed certificate bundle.
+  * **_proxy_** (object): options relating to setting an `HTTP(S)` proxy when fetching resources.
+    * **_http_proxy_** (string): will be used as the proxy URL for HTTP requests and HTTPS requests unless overridden by `https_proxy` or `no_proxy`.
+    * **_https_proxy_** (string): will be used as the proxy URL for HTTPS requests unless overridden by `no_proxy`.
+    * **_no_proxy_** (list of strings): specifies a list of strings to hosts that should be excluded from proxying. Each value is represented by an `IP address prefix (1.2.3.4)`, `an IP address prefix in CIDR notation (1.2.3.4/8)`, `a domain name`, or `a special DNS label (*)`. An IP address prefix and domain name can also include a literal port number `(1.2.3.4:80)`. A domain name matches that name and all subdomains. A domain name with a leading `.` matches subdomains only. For example `foo.com` matches `foo.com` and `bar.foo.com`; `.y.com` matches `x.y.com` but not `y.com`. A single asterisk `(*)` indicates that no proxying should be done.
+* **_storage_** (object): describes the desired state of the system's storage devices.
+  * **_files_** (list of objects): the list of files to be written. Every file, directory and link must have a unique `path`.
+    * **path** (string): the absolute path to the file.
+    * **_overwrite_** (boolean): whether to delete preexisting nodes at the path. `contents` must be specified if `overwrite` is true. Defaults to false.
+    * **_contents_** (object): options related to the contents of the file.
+      * **_source_** (string): the URL of the file. Supported schemes are `http`, `https`, `tftp`, `s3`, `arn`, `gs`, and [`data`](https://tools.ietf.org/html/rfc2397). When using `http`, it is advisable to use the verification option to ensure the contents haven't been modified. If source is omitted and a regular file already exists at the path, Ignition will do nothing. If source is omitted and no file exists, an empty file will be created. Mutually exclusive with `inline` and `local`.
+      * **_inline_** (string): the contents of the file. Mutually exclusive with `source` and `local`.
+      * **_local_** (string): a local path to the contents of the file, relative to the directory specified by the `--files-dir` command-line argument. Mutually exclusive with `source` and `inline`.
+      * **_compression_** (string): the type of compression used on the file (null or gzip). Compression cannot be used with S3.
+      * **_http_headers_** (list of objects): a list of HTTP headers to be added to the request. Available for `http` and `https` source schemes only.
+        * **name** (string): the header name.
+        * **_value_** (string): the header contents.
+      * **_verification_** (object): options related to the verification of the file.
+        * **_hash_** (string): the hash of the file, in the form `<type>-<value>` where type is either `sha512` or `sha256`. If `compression` is specified, the hash describes the decompressed file.
+    * **_append_** (list of objects): list of fragments to be appended to the file. Follows the same structure as `contents`.
+      * **_source_** (string): the URL of the fragment. Supported schemes are `http`, `https`, `tftp`, `s3`, `arn`, `gs`, and [`data`](https://tools.ietf.org/html/rfc2397). When using `http`, it is advisable to use the verification option to ensure the contents haven't been modified. Mutually exclusive with `inline` and `local`.
+      * **_inline_** (string): the contents of the fragment. Mutually exclusive with `source` and `local`.
+      * **_local_** (string): a local path to the contents of the fragment, relative to the directory specified by the `--files-dir` command-line argument. Mutually exclusive with `source` and `inline`.
+      * **_compression_** (string): the type of compression used on the fragment (null or gzip). Compression cannot be used with S3.
+      * **_http_headers_** (list of objects): a list of HTTP headers to be added to the request. Available for `http` and `https` source schemes only.
+        * **name** (string): the header name.
+        * **_value_** (string): the header contents.
+      * **_verification_** (object): options related to the verification of the fragment.
+        * **_hash_** (string): the hash of the fragment, in the form `<type>-<value>` where type is either `sha512` or `sha256`. If `compression` is specified, the hash describes the decompressed fragment.
+    * **_mode_** (integer): the file's permission mode. Setuid/setgid/sticky bits are supported. If not specified, the permission mode for files defaults to 0644 or the existing file's permissions if `overwrite` is false, `contents` is unspecified, and a file already exists at the path.
+    * **_user_** (object): specifies the file's owner.
+      * **_id_** (integer): the user ID of the owner.
+      * **_name_** (string): the user name of the owner.
+    * **_group_** (object): specifies the file's group.
+      * **_id_** (integer): the group ID of the group.
+      * **_name_** (string): the group name of the group.
+  * **_directories_** (list of objects): the list of directories to be created. Every file, directory, and link must have a unique `path`.
+    * **path** (string): the absolute path to the directory.
+    * **_overwrite_** (boolean): whether to delete preexisting nodes at the path. If false and a directory already exists at the path, Ignition will only set its permissions. If false and a non-directory exists at that path, Ignition will fail. Defaults to false.
+    * **_mode_** (integer): the directory's permission mode. Setuid/setgid/sticky bits are supported. If not specified, the permission mode for directories defaults to 0755 or the mode of an existing directory if `overwrite` is false and a directory already exists at the path.
+    * **_user_** (object): specifies the directory's owner.
+      * **_id_** (integer): the user ID of the owner.
+      * **_name_** (string): the user name of the owner.
+    * **_group_** (object): specifies the directory's group.
+      * **_id_** (integer): the group ID of the group.
+      * **_name_** (string): the group name of the group.
+  * **_links_** (list of objects): the list of links to be created. Every file, directory, and link must have a unique `path`.
+    * **path** (string): the absolute path to the link
+    * **_overwrite_** (boolean): whether to delete preexisting nodes at the path. If overwrite is false and a matching link exists at the path, Ignition will only set the owner and group. Defaults to false.
+    * **_user_** (object): specifies the owner for a symbolic link. Ignored for hard links.
+      * **_id_** (integer): the user ID of the owner.
+      * **_name_** (string): the user name of the owner.
+    * **_group_** (object): specifies the group for a symbolic link. Ignored for hard links.
+      * **_id_** (integer): the group ID of the group.
+      * **_name_** (string): the group name of the group.
+    * **target** (string): the target path of the link
+    * **_hard_** (boolean): a symbolic link is created if this is false, a hard one if this is true.
+  * **_trees_** (list of objects): a list of local directory trees to be embedded in the config. Ownership is not preserved. File modes are set to 0755 if the local file is executable or 0644 otherwise. Attributes of files, directories, and symlinks can be overridden by creating a corresponding entry in the `files`, `directories`, or `links` section; such `files` entries must omit `contents` and such `links` entries must omit `target`.
+    * **local** (string): the base of the local directory tree, relative to the directory specified by the `--files-dir` command-line argument.
+    * **_path_** (string): the path of the tree within the target system. Defaults to `/`.
+* **_systemd_** (object): describes the desired state of the systemd units.
+  * **_units_** (list of objects): the list of systemd units. Every unit must have a unique `name`.
+    * **name** (string): the name of the unit. This must be suffixed with a valid unit type (e.g. "thing.service").
+    * **_enabled_** (boolean): whether or not the service shall be enabled. When true, the service is enabled. When false, the service is disabled. When omitted, the service is unmodified. In order for this to have any effect, the unit must have an install section.
+    * **_mask_** (boolean): whether or not the service shall be masked. When true, the service is masked by symlinking it to `/dev/null`. When false, the service is unmasked by deleting the symlink to `/dev/null` if it exists.
+    * **_contents_** (string): the contents of the unit. Mutually exclusive with `contents_local`.
+    * **_contents_local_** (string): a local path to the contents of the unit, relative to the directory specified by the `--files-dir` command-line argument. Mutually exclusive with `contents`.
+    * **_dropins_** (list of objects): the list of drop-ins for the unit. Every drop-in must have a unique `name`.
+      * **name** (string): the name of the drop-in. This must be suffixed with ".conf".
+      * **_contents_** (string): the contents of the drop-in. Mutually exclusive with `contents_local`.
+      * **_contents_local_** (string): a local path to the contents of the drop-in, relative to the directory specified by the `--files-dir` command-line argument. Mutually exclusive with `contents`.
+* **_passwd_** (object): describes the desired additions to the passwd database.
+  * **_users_** (list of objects): the list of accounts that shall exist. All users must have a unique `name`.
+    * **name** (string): the username for the account.
+    * **_password_hash_** (string): the hashed password for the account.
+    * **_ssh_authorized_keys_** (list of strings): a list of SSH keys to be added as an SSH key fragment at `.ssh/authorized_keys.d/ignition` in the user's home directory. All SSH keys must be unique.
+    * **_ssh_authorized_keys_local_** (list of strings): a list of local paths to SSH key files, relative to the directory specified by the `--files-dir` command-line argument, to be added as SSH key fragments at `.ssh/authorized_keys.d/ignition` in the user's home directory. All SSH keys must be unique. Each file may contain multiple SSH keys, one per line.
+    * **_uid_** (integer): the user ID of the account.
+    * **_gecos_** (string): the GECOS field of the account.
+    * **_home_dir_** (string): the home directory of the account.
+    * **_no_create_home_** (boolean): whether or not to create the user's home directory. This only has an effect if the account doesn't exist yet.
+    * **_primary_group_** (string): the name of the primary group of the account.
+    * **_groups_** (list of strings): the list of supplementary groups of the account.
+    * **_no_user_group_** (boolean): whether or not to create a group with the same name as the user. This only has an effect if the account doesn't exist yet.
+    * **_no_log_init_** (boolean): whether or not to add the user to the lastlog and faillog databases. This only has an effect if the account doesn't exist yet.
+    * **_shell_** (string): the login shell of the new account.
+    * **_should_exist_** (boolean): whether or not the user with the specified `name` should exist. If omitted, it defaults to true. If false, then Ignition will delete the specified user.
+    * **_system_** (boolean): whether or not this account should be a system account. This only has an effect if the account doesn't exist yet.
+  * **_groups_** (list of objects): the list of groups to be added. All groups must have a unique `name`.
+    * **name** (string): the name of the group.
+    * **_gid_** (integer): the group ID of the new group.
+    * **_password_hash_** (string): the hashed password of the new group.
+    * **_should_exist_** (boolean): whether or not the group with the specified `name` should exist. If omitted, it defaults to true. If false, then Ignition will delete the specified group.
+    * **_system_** (boolean): whether or not the group should be a system group. This only has an effect if the group doesn't exist yet.
diff --git a/docs/config-fiot-v1_1-exp.md b/docs/config-fiot-v1_1-exp.md
new file mode 100644
index 00000000..45ba165b
--- /dev/null
+++ b/docs/config-fiot-v1_1-exp.md
@@ -0,0 +1,148 @@
+---
+# This file is automatically generated from internal/doc and Ignition's
+# config/doc.  Do not edit.
+title: Fedora-iot v1.1.0-experimental
+parent: Configuration specifications
+nav_order: 250
+---
+
+# Fedora-iot Specification v1.1.0-experimental
+
+**Note: This configuration is experimental and has not been stabilized. It is subject to change without warning or announcement.**
+
+The Fedora-iot configuration is a YAML document conforming to the following specification, with **_italicized_** entries being optional:
+
+<div id="spec-docs"></div>
+
+* **variant** (string): used to differentiate configs for different operating systems. Must be `%VARIANT%` for this specification.
+* **version** (string): the semantic version of the spec for this document. This document is for version `%VERSION%` and generates Ignition configs with version `3.5.0-experimental`.
+* **_ignition_** (object): metadata about the configuration itself.
+  * **_config_** (object): options related to the configuration.
+    * **_merge_** (list of objects): a list of the configs to be merged to the current config.
+      * **_source_** (string): the URL of the config. Supported schemes are `http`, `https`, `tftp`, `s3`, `arn`, `gs`, and [`data`](https://tools.ietf.org/html/rfc2397). When using `http`, it is advisable to use the verification option to ensure the contents haven't been modified. Mutually exclusive with `inline` and `local`.
+      * **_inline_** (string): the contents of the config. Mutually exclusive with `source` and `local`.
+      * **_local_** (string): a local path to the contents of the config, relative to the directory specified by the `--files-dir` command-line argument. Mutually exclusive with `source` and `inline`.
+      * **_compression_** (string): the type of compression used on the config (null or gzip). Compression cannot be used with S3.
+      * **_http_headers_** (list of objects): a list of HTTP headers to be added to the request. Available for `http` and `https` source schemes only.
+        * **name** (string): the header name.
+        * **_value_** (string): the header contents.
+      * **_verification_** (object): options related to the verification of the config.
+        * **_hash_** (string): the hash of the config, in the form `<type>-<value>` where type is either `sha512` or `sha256`. If `compression` is specified, the hash describes the decompressed config.
+    * **_replace_** (object): the config that will replace the current.
+      * **_source_** (string): the URL of the config. Supported schemes are `http`, `https`, `tftp`, `s3`, `arn`, `gs`, and [`data`](https://tools.ietf.org/html/rfc2397). When using `http`, it is advisable to use the verification option to ensure the contents haven't been modified. Mutually exclusive with `inline` and `local`.
+      * **_inline_** (string): the contents of the config. Mutually exclusive with `source` and `local`.
+      * **_local_** (string): a local path to the contents of the config, relative to the directory specified by the `--files-dir` command-line argument. Mutually exclusive with `source` and `inline`.
+      * **_compression_** (string): the type of compression used on the config (null or gzip). Compression cannot be used with S3.
+      * **_http_headers_** (list of objects): a list of HTTP headers to be added to the request. Available for `http` and `https` source schemes only.
+        * **name** (string): the header name.
+        * **_value_** (string): the header contents.
+      * **_verification_** (object): options related to the verification of the config.
+        * **_hash_** (string): the hash of the config, in the form `<type>-<value>` where type is either `sha512` or `sha256`. If `compression` is specified, the hash describes the decompressed config.
+  * **_timeouts_** (object): options relating to `http` timeouts when fetching files over `http` or `https`.
+    * **_http_response_headers_** (integer): the time to wait (in seconds) for the server's response headers (but not the body) after making a request. 0 indicates no timeout. Default is 10 seconds.
+    * **_http_total_** (integer): the time limit (in seconds) for the operation (connection, request, and response), including retries. 0 indicates no timeout. Default is 0.
+  * **_security_** (object): options relating to network security.
+    * **_tls_** (object): options relating to TLS when fetching resources over `https`.
+      * **_certificate_authorities_** (list of objects): the list of additional certificate authorities (in addition to the system authorities) to be used for TLS verification when fetching over `https`. All certificate authorities must have a unique `source`, `inline`, or `local`.
+        * **_source_** (string): the URL of the certificate bundle (in PEM format). The bundle can contain multiple concatenated certificates. Supported schemes are `http`, `https`, `tftp`, `s3`, `arn`, `gs`, and [`data`](https://tools.ietf.org/html/rfc2397). When using `http`, it is advisable to use the verification option to ensure the contents haven't been modified. Mutually exclusive with `inline` and `local`.
+        * **_inline_** (string): the contents of the certificate bundle (in PEM format). The bundle can contain multiple concatenated certificates. Mutually exclusive with `source` and `local`.
+        * **_local_** (string): a local path to the contents of the certificate bundle (in PEM format), relative to the directory specified by the `--files-dir` command-line argument. The bundle can contain multiple concatenated certificates. Mutually exclusive with `source` and `inline`.
+        * **_compression_** (string): the type of compression used on the certificate bundle (null or gzip). Compression cannot be used with S3.
+        * **_http_headers_** (list of objects): a list of HTTP headers to be added to the request. Available for `http` and `https` source schemes only.
+          * **name** (string): the header name.
+          * **_value_** (string): the header contents.
+        * **_verification_** (object): options related to the verification of the certificate bundle.
+          * **_hash_** (string): the hash of the certificate bundle, in the form `<type>-<value>` where type is either `sha512` or `sha256`. If `compression` is specified, the hash describes the decompressed certificate bundle.
+  * **_proxy_** (object): options relating to setting an `HTTP(S)` proxy when fetching resources.
+    * **_http_proxy_** (string): will be used as the proxy URL for HTTP requests and HTTPS requests unless overridden by `https_proxy` or `no_proxy`.
+    * **_https_proxy_** (string): will be used as the proxy URL for HTTPS requests unless overridden by `no_proxy`.
+    * **_no_proxy_** (list of strings): specifies a list of strings to hosts that should be excluded from proxying. Each value is represented by an `IP address prefix (1.2.3.4)`, `an IP address prefix in CIDR notation (1.2.3.4/8)`, `a domain name`, or `a special DNS label (*)`. An IP address prefix and domain name can also include a literal port number `(1.2.3.4:80)`. A domain name matches that name and all subdomains. A domain name with a leading `.` matches subdomains only. For example `foo.com` matches `foo.com` and `bar.foo.com`; `.y.com` matches `x.y.com` but not `y.com`. A single asterisk `(*)` indicates that no proxying should be done.
+* **_storage_** (object): describes the desired state of the system's storage devices.
+  * **_files_** (list of objects): the list of files to be written. Every file, directory and link must have a unique `path`.
+    * **path** (string): the absolute path to the file.
+    * **_overwrite_** (boolean): whether to delete preexisting nodes at the path. `contents` must be specified if `overwrite` is true. Defaults to false.
+    * **_contents_** (object): options related to the contents of the file.
+      * **_source_** (string): the URL of the file. Supported schemes are `http`, `https`, `tftp`, `s3`, `arn`, `gs`, and [`data`](https://tools.ietf.org/html/rfc2397). When using `http`, it is advisable to use the verification option to ensure the contents haven't been modified. If source is omitted and a regular file already exists at the path, Ignition will do nothing. If source is omitted and no file exists, an empty file will be created. Mutually exclusive with `inline` and `local`.
+      * **_inline_** (string): the contents of the file. Mutually exclusive with `source` and `local`.
+      * **_local_** (string): a local path to the contents of the file, relative to the directory specified by the `--files-dir` command-line argument. Mutually exclusive with `source` and `inline`.
+      * **_compression_** (string): the type of compression used on the file (null or gzip). Compression cannot be used with S3.
+      * **_http_headers_** (list of objects): a list of HTTP headers to be added to the request. Available for `http` and `https` source schemes only.
+        * **name** (string): the header name.
+        * **_value_** (string): the header contents.
+      * **_verification_** (object): options related to the verification of the file.
+        * **_hash_** (string): the hash of the file, in the form `<type>-<value>` where type is either `sha512` or `sha256`. If `compression` is specified, the hash describes the decompressed file.
+    * **_append_** (list of objects): list of fragments to be appended to the file. Follows the same structure as `contents`.
+      * **_source_** (string): the URL of the fragment. Supported schemes are `http`, `https`, `tftp`, `s3`, `arn`, `gs`, and [`data`](https://tools.ietf.org/html/rfc2397). When using `http`, it is advisable to use the verification option to ensure the contents haven't been modified. Mutually exclusive with `inline` and `local`.
+      * **_inline_** (string): the contents of the fragment. Mutually exclusive with `source` and `local`.
+      * **_local_** (string): a local path to the contents of the fragment, relative to the directory specified by the `--files-dir` command-line argument. Mutually exclusive with `source` and `inline`.
+      * **_compression_** (string): the type of compression used on the fragment (null or gzip). Compression cannot be used with S3.
+      * **_http_headers_** (list of objects): a list of HTTP headers to be added to the request. Available for `http` and `https` source schemes only.
+        * **name** (string): the header name.
+        * **_value_** (string): the header contents.
+      * **_verification_** (object): options related to the verification of the fragment.
+        * **_hash_** (string): the hash of the fragment, in the form `<type>-<value>` where type is either `sha512` or `sha256`. If `compression` is specified, the hash describes the decompressed fragment.
+    * **_mode_** (integer): the file's permission mode. Setuid/setgid/sticky bits are supported. If not specified, the permission mode for files defaults to 0644 or the existing file's permissions if `overwrite` is false, `contents` is unspecified, and a file already exists at the path.
+    * **_user_** (object): specifies the file's owner.
+      * **_id_** (integer): the user ID of the owner.
+      * **_name_** (string): the user name of the owner.
+    * **_group_** (object): specifies the file's group.
+      * **_id_** (integer): the group ID of the group.
+      * **_name_** (string): the group name of the group.
+  * **_directories_** (list of objects): the list of directories to be created. Every file, directory, and link must have a unique `path`.
+    * **path** (string): the absolute path to the directory.
+    * **_overwrite_** (boolean): whether to delete preexisting nodes at the path. If false and a directory already exists at the path, Ignition will only set its permissions. If false and a non-directory exists at that path, Ignition will fail. Defaults to false.
+    * **_mode_** (integer): the directory's permission mode. Setuid/setgid/sticky bits are supported. If not specified, the permission mode for directories defaults to 0755 or the mode of an existing directory if `overwrite` is false and a directory already exists at the path.
+    * **_user_** (object): specifies the directory's owner.
+      * **_id_** (integer): the user ID of the owner.
+      * **_name_** (string): the user name of the owner.
+    * **_group_** (object): specifies the directory's group.
+      * **_id_** (integer): the group ID of the group.
+      * **_name_** (string): the group name of the group.
+  * **_links_** (list of objects): the list of links to be created. Every file, directory, and link must have a unique `path`.
+    * **path** (string): the absolute path to the link
+    * **_overwrite_** (boolean): whether to delete preexisting nodes at the path. If overwrite is false and a matching link exists at the path, Ignition will only set the owner and group. Defaults to false.
+    * **_user_** (object): specifies the owner for a symbolic link. Ignored for hard links.
+      * **_id_** (integer): the user ID of the owner.
+      * **_name_** (string): the user name of the owner.
+    * **_group_** (object): specifies the group for a symbolic link. Ignored for hard links.
+      * **_id_** (integer): the group ID of the group.
+      * **_name_** (string): the group name of the group.
+    * **target** (string): the target path of the link
+    * **_hard_** (boolean): a symbolic link is created if this is false, a hard one if this is true.
+  * **_trees_** (list of objects): a list of local directory trees to be embedded in the config. Ownership is not preserved. File modes are set to 0755 if the local file is executable or 0644 otherwise. Attributes of files, directories, and symlinks can be overridden by creating a corresponding entry in the `files`, `directories`, or `links` section; such `files` entries must omit `contents` and such `links` entries must omit `target`.
+    * **local** (string): the base of the local directory tree, relative to the directory specified by the `--files-dir` command-line argument.
+    * **_path_** (string): the path of the tree within the target system. Defaults to `/`.
+* **_systemd_** (object): describes the desired state of the systemd units.
+  * **_units_** (list of objects): the list of systemd units. Every unit must have a unique `name`.
+    * **name** (string): the name of the unit. This must be suffixed with a valid unit type (e.g. "thing.service").
+    * **_enabled_** (boolean): whether or not the service shall be enabled. When true, the service is enabled. When false, the service is disabled. When omitted, the service is unmodified. In order for this to have any effect, the unit must have an install section.
+    * **_mask_** (boolean): whether or not the service shall be masked. When true, the service is masked by symlinking it to `/dev/null`. When false, the service is unmasked by deleting the symlink to `/dev/null` if it exists.
+    * **_contents_** (string): the contents of the unit. Mutually exclusive with `contents_local`.
+    * **_contents_local_** (string): a local path to the contents of the unit, relative to the directory specified by the `--files-dir` command-line argument. Mutually exclusive with `contents`.
+    * **_dropins_** (list of objects): the list of drop-ins for the unit. Every drop-in must have a unique `name`.
+      * **name** (string): the name of the drop-in. This must be suffixed with ".conf".
+      * **_contents_** (string): the contents of the drop-in. Mutually exclusive with `contents_local`.
+      * **_contents_local_** (string): a local path to the contents of the drop-in, relative to the directory specified by the `--files-dir` command-line argument. Mutually exclusive with `contents`.
+* **_passwd_** (object): describes the desired additions to the passwd database.
+  * **_users_** (list of objects): the list of accounts that shall exist. All users must have a unique `name`.
+    * **name** (string): the username for the account.
+    * **_password_hash_** (string): the hashed password for the account.
+    * **_ssh_authorized_keys_** (list of strings): a list of SSH keys to be added as an SSH key fragment at `.ssh/authorized_keys.d/ignition` in the user's home directory. All SSH keys must be unique.
+    * **_ssh_authorized_keys_local_** (list of strings): a list of local paths to SSH key files, relative to the directory specified by the `--files-dir` command-line argument, to be added as SSH key fragments at `.ssh/authorized_keys.d/ignition` in the user's home directory. All SSH keys must be unique. Each file may contain multiple SSH keys, one per line.
+    * **_uid_** (integer): the user ID of the account.
+    * **_gecos_** (string): the GECOS field of the account.
+    * **_home_dir_** (string): the home directory of the account.
+    * **_no_create_home_** (boolean): whether or not to create the user's home directory. This only has an effect if the account doesn't exist yet.
+    * **_primary_group_** (string): the name of the primary group of the account.
+    * **_groups_** (list of strings): the list of supplementary groups of the account.
+    * **_no_user_group_** (boolean): whether or not to create a group with the same name as the user. This only has an effect if the account doesn't exist yet.
+    * **_no_log_init_** (boolean): whether or not to add the user to the lastlog and faillog databases. This only has an effect if the account doesn't exist yet.
+    * **_shell_** (string): the login shell of the new account.
+    * **_should_exist_** (boolean): whether or not the user with the specified `name` should exist. If omitted, it defaults to true. If false, then Ignition will delete the specified user.
+    * **_system_** (boolean): whether or not this account should be a system account. This only has an effect if the account doesn't exist yet.
+  * **_groups_** (list of objects): the list of groups to be added. All groups must have a unique `name`.
+    * **name** (string): the name of the group.
+    * **_gid_** (integer): the group ID of the new group.
+    * **_password_hash_** (string): the hashed password of the new group.
+    * **_should_exist_** (boolean): whether or not the group with the specified `name` should exist. If omitted, it defaults to true. If false, then Ignition will delete the specified group.
+    * **_system_** (boolean): whether or not the group should be a system group. This only has an effect if the group doesn't exist yet.
diff --git a/docs/release-notes.md b/docs/release-notes.md
index f7596971..d0c2591f 100644
--- a/docs/release-notes.md
+++ b/docs/release-notes.md
@@ -21,6 +21,7 @@ key](https://getfedora.org/security/).
   openshift 4.14.0-exp)_
 - Require `storage.filesystems.path` to start with `/etc` or `/var` if
   `with_mount_unit` is true _(fcos 1.6.0-exp, openshift 4.14.0-exp)_
+- Add new variant `fiot` for fedora-iot
 
 ### Bug fixes
 
diff --git a/internal/doc/main.go b/internal/doc/main.go
index 31d8f5de..df9ac6f0 100644
--- a/internal/doc/main.go
+++ b/internal/doc/main.go
@@ -45,6 +45,8 @@ import (
 	flatcar1_0 "github.com/coreos/butane/config/flatcar/v1_0"
 	flatcar1_1 "github.com/coreos/butane/config/flatcar/v1_1"
 	flatcar1_2_exp "github.com/coreos/butane/config/flatcar/v1_2_exp"
+	fiot1_0 "github.com/coreos/butane/config/fiot/v1_0"
+	fiot1_1_exp "github.com/coreos/butane/config/fiot/v1_1_exp"
 	openshift4_10 "github.com/coreos/butane/config/openshift/v4_10"
 	openshift4_11 "github.com/coreos/butane/config/openshift/v4_11"
 	openshift4_12 "github.com/coreos/butane/config/openshift/v4_12"
@@ -139,6 +141,15 @@ func generate(dir string) error {
 				{"1.1.0", r4e1_1.Config{}},
 			},
 		},
+		{
+			"Fedora-iot",
+			"fiot",
+			[]version{
+				// inverse order of website navbar
+				{"1.1.0-experimental", fiot1_1_exp.Config{}},
+				{"1.0.0", fiot1_0.Config{}},
+			},
+		},
 	}
 
 	// parse and snakify Ignition components