Managers know the importance of employee recognition in maintaining the morale, productivity and continuity of staff. It is a critical component of staff management. When your team understands that their work is valued and appreciated, they are motivated to perform at higher levels.
What are some of the best ways to acknowledge your team members? The People Puzzle: Building and Retaining a Talented Accounting and Finance Team from Robert Half and the American Institute of CPAs (AICPA) offers five strategies — both common sense and creative.
Research for The People Puzzle shows most accounting professionals prefer to be recognized for stellar performance with a salary increase. Higher compensation is a clear statement of value from the company. It also is the primary factor in employee retention.
Monitor salary levels using industry resources such as the 2018 Robert Half Salary Guide to help plan for these increases. If offering a raise isn't possible for your firm right now, consider a onetime bonus to recognize exemplary work on a particular project.
Promotion to a more senior position can be an exciting reward, if the option is there and the employee is ready for their next career challenge. If not, single out the employee to be groomed for a leadership role, or connect them with other valuable professional development opportunities.
Don't underestimate the positive impact of well-placed public kudos. Recognizing your highest-performing accounting and finance professionals — at a corporate event, department meeting or in an all-company email, for example — will make them feel highly valued.
Sometimes the best reward is the gift of time. In The People Puzzle, the ability to work flexible hours was cited as one of the top three nonmonetary contributors to job satisfaction. For CPAs at small companies, it was the No. 1 factor.
Consider giving staff a few extra vacation days or allow them to telecommute a day or two each week. You also can let team members off of work early on occasion, particularly following busy periods and major projects. All of the above can help your team achieve better work-life balance.
Besides money and time, there are many ways to let your employees know how much you appreciate their work. Many are easy to do and won't break the bank, but are still meaningful.
For instance, you might send a top-performing employee a handwritten letter of appreciation, send a car to drive them to work for a day, or give them a gift certificate to their favorite restaurant. There are endless possibilities, big and small, for showing your most valued team members the business would not be the same without them.
Looking for additional insights on employee recognition and staff management?


French gatefold sleeve issue from 1975, featuring musicians David Liebman, Richie Beirach, John Abercrombie, Frank Tusa, Charlie Haden, Jeff Williams, Badal Roy, Don Alias & Arooj Lazewal. Compositions include 'Dr. Faustus', 'Dark Lady', 'Sweet Hand Roy', 'Ashirbad', 'Within You Without You', 'Napanoch' and 'Leane'.


text:
Insider: Despite Lower COVID Numbers Dial Adjustment Not Coming
ST. PAUL -- It has been a few weeks since bars and restaurants and other businesses have been allowed to reopen for in-person service, however, they still have to close by 10:00 p.m.
Political Insider Blois Olson says he's not expecting any changes to the dials this week, despite the fact that we've had our lowest COVID-19 numbers in the state since September.
I think the pressure will be building from republicans and businesses to begin to look at what an adjustment of the dials might look like, but I also think the governor is going to make the case that the longer we can keep the cases low with these new variants the better for schools.
Olson says there is a lot of anxiety over a possible surge in cases with several new COVID-19 variants now confirmed in the United States, including the Brazilian variant that was first detected here in Minnesota.
Some of the tightest restrictions that are in place right now include social settings capped at two households with a 10 person maximum indoors, entertainment venues and gyms at 25 percent capacity, and wedding receptions are capped at 10 people.
Current COVID-19 Restrictions
Filed Under: blois olson

redpajama_set_name: RedPajamaCommonCrawl


text:
About the State
The West Virginia Edge
Interactive Data
Chemicals & Polymers
Technology & Information Services
Investment in WV
Trade Missions & Shows
West Virginia is located in the heart of Appalachia, strategically located and connected to major metropolitan areas up and down the Eastern U.S. and Canada. Learn how our low cost of living and pro-business tax climate coupled with a high quality of life make life better here.
West Virginia's diverse economy has moved beyond our history of resource extraction to include a robust array of products and services. Learn about the key industries that have taken a foothold here and learn why leading companies make their home in the Mountain State.
The West Virginia Development Office works hard to make the process of locating in West Virginia smooth and seamless. Our team walks with businesses every step of the way to locate a new site, expand facilities, export goods, train to employees, and much more.
West Virginia is home to more than 130 businesses representing 27 countries from around the world, and West Virginia businesses export goods and services to more than 95 countries. Learn how our international team works out of three worldwide office to foster global engagement.
Growing natural gas production in West Virginia
MarkWest Energy Partners and Antero Midstream form joint venture.
Natural gas production continues to grow at The Sherwood Complex in Doddridge County, West Virginia.
The growth of the Sherwood gas processing facility is due to the joint venture formed by MarkWest Energy Partners and Antero...
"WV Exports" (2)
west virginia development office (2)
Follow our social channels for our
(304) 558-22341900 Kanawha Boulevard, East
The WEST VIRGINIA DEVELOPMENT OFFICE is an agency of the West Virginia Department of Commerce. WestVirginia.gov is the business recruitment site for the West Virginia Department of Commerce and is maintained by the Business & Industrial and International divisions of the West Virginia Development Office.


Christmastime wouldn't be complete without a nice cup of Old-Fashioned Homemade Eggnog, now would it? This eggnog recipe will leave you with the perfect holiday treat: light, velvety, smooth, and delicious! This holiday season, don't ask yourself where you can buy eggnog. Skip the grocery store lines and make it yourself!
Growing up, I couldn't stand eggnog. I loved milk products, but around Christmas my step-dad would come home from the grocery store just beaming. I knew it was because he had in those brown bags his favorite drink of all time, the infamous Barber's Eggnog. It was thick, like a milkshake, or even worse, a melted milkshake. I couldn't understand the obsession.
As an adult making pretty much everything from scratch, eggnog is now one of my all-time favorite drinks as well. If you are in my kitchen when I am preparing it, you will see me beam too. This version is light, airy, flavorful, and, well, just exceptional.
By incorporating air into the egg whites and whipped cream and folding them into the rich egg yolk mixture, you end up with a texture that is velvety and super light. It is not overladen with cloves – I don't even add that to my recipe. I sprinkle nutmeg very lightly into the mixture and over the final product. It gives just the perfect amount of flavor.
Often, people shy away from homemade eggnog because of the raw eggs. If you use the freshest of eggs (or eggs from your own chickens), you most likely will never have a problem. Don't let this stop you from making homemade eggnog! You can temper the eggs and cook them just enough that food-borne illness will never be a problem.
For spiked eggnog, add 3 ounces of bourbon, cognac, rum, or all three! If you add liquor, your eggnog will be thicker. The more liquor you use, the longer it will keep in the refrigerator. If you don't use liquor, consume the eggnog within one day. Adding alcohol will allow your eggnog to keep longer in the fridge while sterilizing your eggs (and therefore killing any harmful bacteria)!
Using a stand mixer with a whisk attachment, beat the egg yolks until they are lemon-colored. Slowly add the 1/3 cup of sugar until dissolved. Turn the mixer down to medium speed and add the milk, vanilla, and nutmeg until thoroughly mixed. Remove mixture to a large bowl.
Combine the cream and 1 tablespoon of sugar in a new bowl and whisk until the cream forms soft peaks. Fold the whipped cream into the bowl with the eggnog mixture.
Clean the bowl, making sure to remove any moisture, and beat the egg whites in the clean bowl until soft peaks form. Gradually add in the last tablespoon of sugar and beat until stiff peaks form. Gently fold the egg whites into the mixture. Cover and refrigerate for at least one hour.
Transfer the eggnog to a punch bowl. Serve in individual glasses or mugs with a pinch of nutmeg over the top. I use a microplane to grate fresh nutmeg.


text:
Laurie McCabe's Blog
Perspectives on the SMB Technology Market
SMB, Tech trends
Zoho Ups the Ante on Data Privacy
Date: February 10, 2020Author: lauriemccabe
Most people are well aware that we are actually paying for the "free" applications we use with our data. From Facebook to Google to Pinterest, vendors monetize user data through advertising and by tracking and selling our data to third parties.
But many people are not aware of the increasing scope of these practices. In November, for instance, The Wall Street Journal reported that Google had covertly gathered "tens of millions" of medical records"—patient names, lab results, diagnoses, hospitalization records, and prescriptions—from more than 2,600 hospitals as part of a machine-learning project code-named Nightingale—without notifying Ascension doctors and patients about the project. It's not a one-off. For instance, WebMD's symptom checker shares information with Facebook , and Google and Mastercard cut a deal to track retail sales.
Even fewer people realize that many B2B companies are allowing surveillance companies to track their paying users on their sites. That's right—even if you are spending a small fortune on business software, many of the big names in the industry are trading user data for products and services from companies such as Google, Twitter and LinkedIn.
For instance, in exchange for the free use of Google Analytics, a software vendor might embed Google code on its homepage. If the vendor invests in Google AdWords, the embedded code is a way for it to see whether its AdWords spend has resulted in new visitors to its site. The catch is that through the code, Google now has that visitor or business user's usage data—what they've clicked on, how they're building dashboards, and other general user actions. Google can then leverage that information to target ads to that user based on their usage data acquired through the embedded code.
Zoho's 20 Year Commitment to Privacy
At Zoho's 2020 Analyst Day, Raju Vegesna, Zoho's Chief Evangelist, underscored the company's 20-plus year commitment to protect user privacy—yet another example of Zoho's convictions. Zoho has never sold customer data, or made a single dollar from advertising revenue—even in the free editions of its products. This allows Zoho to avoid the conflicts of interest inherent in these practices.
The company's privacy policy spells out in great detail what information Zoho gathers from customers and users, how Zoho will and won't use that information, and how it will not.
For instance, Zoho's policy clearly states that users own their service data, that Zoho protects and limits access to it, and only processes it according to user instructions. The policy also stipulates that Zoho will automatically delete user data from its active database within 6 months of termination, and from its backups within 3 months after that.
Zoho's Latest Privacy Pledge
Now, Zoho is taking this commitment a step further with a pre-emptive strike against what it calls "adjunct surveillance," meaning the surreptitious act by B2B vendors of trading customer-usage data to Google or Twitter or Facebook in exchange for the free use of their services. Through this tactic, surveillance companies are gathering information about users' data from adjunct properties without their permission.
According to Vegesna, while this practice is a legally acceptable business practice, it's not morally acceptable because user data is very valuable. As a result, Zoho has decided to block adjunct surveillance on its properties to protect the privacy of its users.
The company has removed all third-party codes on its website. Users won't see embedded 'like' or 'share' buttons, and removed trackers from all ad companies. However, users will still be able to share a page on social media either directly or by using a tool such as Zoho Social.
Since Zoho runs on its own cloud infrastructure—instead of on public clouds such as AWS or Google, that also have ad-based businesses—they can't track Zoho user behavior either.
As a result, Zoho users can gain the peace of mind that their data—and their customers' data—is where it belongs, and that it's not being shared without their knowledge.
Zoho's decision to remove third-party trackers from its sites isn't a one-off or gimmick, but an extension of its long-standing commitment to privacy.
But it doesn't come without a cost: The move means that Zoho will have access to less user data for its own marketing efforts than it would have if it kept these trackers in place. But over the long haul, the move should pay off in terms of helping Zoho build its brand as a trustworthy company.
By getting out in front of this issue, Zoho can also challenge others in the B2B software industry to follow suit. Since it owns the technology entire stack, from the data center on up, it may be easier for Zoho to execute on this than it would be for many of its competitors. But by raising the bar—and the issue—Zoho is helping to elevate awareness and reshape directions in this increasingly important area.
© SMB Group
data privacysecurityuser datazoho
Published by lauriemccabe
Laurie McCabe is currently a Partner at the SMB Group, where she enjoys helping clients understand and meet the requirements of SMB customer	View all posts by lauriemccabe
Previous Previous post: Life in the Fast Lane: Acumatica's Cloud ERP
Next Next post: Zoho's Big Plans for Small Businesses
One thought on "Zoho Ups the Ante on Data Privacy"
Pingback: My Top Posts from 2020–and Best Wishes for 2021 – Laurie McCabe's Blog
SMB Group's experience through the pandemic, and perspectives on how to adapt
Follow Laurie McCabe's Blog on WordPress.com
SMB Group
accounting acumatica analytics appliance app store BI big data Boomi business intelligence Business One channel cloud Cloud Computing collaboration Covid-19 CRM Dell Digital Transformation dreamforce economic email marketing entrepreneur ERP financials financing Google green IT HCM hubspot IBM IMG Infusionsoft Intacct integration Intuit IoT LotusLive managed services marketing marketing automation Microsoft midmarket Mobile mobile apps mobile commerce MSP NetSuite on demand partner QuickBooks reachlocal SaaS Sage sales Salesforce SAP security small business Small Business Computing smarter commerce SMB social business social media social networking social software statistics survey technology technology trends Tech trends top 10 trends trends Twitter virtualization zoho
Archives Select Month January 2021 December 2020 November 2020 October 2020 September 2020 August 2020 July 2020 June 2020 May 2020 April 2020 March 2020 February 2020 January 2020 December 2019 November 2019 October 2019 September 2019 August 2019 July 2019 June 2019 May 2019 April 2019 March 2019 January 2019 December 2018 November 2018 October 2018 September 2018 August 2018 July 2018 June 2018 May 2018 April 2018 March 2018 February 2018 January 2018 December 2017 November 2017 October 2017 September 2017 August 2017 July 2017 May 2017 April 2017 March 2017 January 2017 December 2016 November 2016 October 2016 September 2016 August 2016 July 2016 June 2016 May 2016 April 2016 March 2016 February 2016 January 2016 December 2015 November 2015 October 2015 September 2015 August 2015 July 2015 June 2015 May 2015 April 2015 March 2015 February 2015 January 2015 December 2014 November 2014 October 2014 September 2014 August 2014 July 2014 June 2014 May 2014 April 2014 March 2014 February 2014 January 2014 December 2013 November 2013 October 2013 September 2013 August 2013 July 2013 June 2013 May 2013 April 2013 March 2013 February 2013 January 2013 December 2012 November 2012 October 2012 September 2012 August 2012 July 2012 June 2012 May 2012 April 2012 March 2012 February 2012 January 2012 December 2011 November 2011 October 2011 September 2011 August 2011 July 2011 June 2011 May 2011 April 2011 March 2011 February 2011 January 2011 December 2010 November 2010 October 2010 September 2010 August 2010 July 2010 June 2010 May 2010 April 2010 March 2010 February 2010 January 2010 December 2009 November 2009 October 2009 September 2009 August 2009 July 2009 June 2009 May 2009 April 2009 March 2009 February 2009 January 2009
© 2021 Laurie McCabe's Blog


Singapore Hawker centres are the best place to find amazing street food in Singapore. They're more like organised markets, but you can't go wrong with the grilled tiger prawns, chilli crab covered in a hotter-than-hell garlic paste, the delicious laksa, which is a spicy noodle soup from China and Malaysia, and a few sticks of chicken satay.... Health promotion messages. Both nationally and on a state level, health promotion campaigns are running, providing resources and support for an active lifestyle, weight loss and healthy food choices.
You don't have to go to the gym to stay active. Turn your chore into a fun workout by adding music and busting some moves! Do some bhangra with the mop and burn extra calories while you clean.... Give you direction how to reach Health Promotion Board (HPB), travel with cars, taxi, bus and MRT from and to Health Promotion Board (HPB).
Health Promotion. There are Health Promotion and Improvement Offices serving all counties. You can find the contact details below. Most have people working in the following areas. how to fix spring sound in mechanical keyboard Singapore Hawker centres are the best place to find amazing street food in Singapore. They're more like organised markets, but you can't go wrong with the grilled tiger prawns, chilli crab covered in a hotter-than-hell garlic paste, the delicious laksa, which is a spicy noodle soup from China and Malaysia, and a few sticks of chicken satay.
Abstract. The Health Promotion Board (HPB) has developed the Clinical Practice Guidelines (CPG) on Obesity to provide health professionals in Singapore with recommendations for evidence-based interventions for obesity.
Lead an 820-strong Government Statutory Board with a $260M operating budget. Tasked to lead a team of senior medical experts and other healthcare professionals to take policy and operational leadership in Government efforts in Preventive Health.
Health Promotion Board / 30 Aug 2018 The table/figure shows the age-standardised incidence rate (per 100,000 population) of the top three cancers among men and women in Singapore. The rates are expressed as per 100,000 residential population and standardised to the Segi World Population.
This post is about where to find the really useful books (but hard to find) from HPB (Health Promotion Board) which provides parents very useful guides on pregnancy, newborn, kids and the healthbooklet.


There are download files available for school-openerp-module.
school-openerp-module has 12 active branches owned by 6 people and 1 team. There were 0 commits in the last month.
102. [FIX] Minor bugs fixed.
5. [IMP] school_base: Improved some views.
[IMP] school_base: Improved some views.
- Improved ca and es translations.
- Added import of human resources (teachers) and school classes.
[FIX] school_saga: Fixed import of gender field.
[IMP] school_base_extension: Improvements in IWL (impartition week line). Reorder the menues.
[FIX] school_base_extension: Fixed user permissions, access paths to report files and installation order of XML files.
[IMP] ALERT! IWL very important updates.
-- Change seances. Go to measure the time interval of "start and duration"to "start and end "
-- Change impartition_week_line. Go to measure the time interval of "beginning and end" to "start and duration"
lp:~xplai/school-base-openerp-module/aula 2 Mature 2010-07-15 15:42:35 UTC 2010-07-15 This branch has not been pushed to yet.
You can't create new branches for school-openerp-module.


According to independent consumer surveys of satellite TV providers and cable companies in Hamshire, TX, DISH TV has earned the title of best TV service provider in Hamshire.
Are you wondering which of the satellite TV or cable companies in Hamshire, TX is considered to be the best TV service provider? Finding cable companies and other television services available in your area and comparing what they offer is easier with information from independent consumer surveys. And research shows that the top-rated provider in Hamshire is DISH TV.
You need to think about more than cost when selecting the best cable company in Hamshire, TX. Price is important, but it's also important to consider which channels are available in each package. Well-known networks are included in most areas, but the availability of local channels often depends on area, meaning that TV packages in Hamshire may offer a completely different selection of smaller networks from packages in the next town over. We give you quick and easy access to the important details you need, so you can differentiate among the highest rated providers available in Hamshire. That way, you'll know which providers offer premier packages with the extra channels and features you need to ensure you never miss your favorite show, movie, or the latest or Dallas Cowboys game.
If you are looking for the best cable company in Hamshire, TX, CableTV.com provides all the help you need. Our ratings not only include information on pricing and packages, but also reveal which TV providers have the most reliable service and the fastest, friendliest customer support.
Of the Internet service providers available in Hamshire, TX, Spectrum Cable Internet happens to be the top-ranked.Depending on where you live in Hamshire, TX, the speed available from each Internet provider can vary. That's why it's important to compare each Internet provider's speed to Texas's average speed of 33 Mbps before you make a decision. Comparing speeds will ensure you're getting the fastest, most reliable Internet service available for your home.
TV and Internet bundles can help you keep more of your hard-earned income. In fact, when you sign up for Internet service through your cable TV package provider, you could save up to $100 or more on your home services each year. Of course, to ensure that you're getting the best deal on Internet and TV bundles available in Hamshire, be sure to research all your options on CableTV.com before you buy.
There's no better jumping-off point than CableTV.com when you're looking for TV provider options in Hamshire, TX. With our in-depth rating and comparison tools, we make it easy to find the TV service that's best for your home. Of course, we don't just provide reviews on TV services in Hamshire—we also rate Internet providers. On CableTV.com, you can easily find information on pricing, packages, reviews, promotions, and everything else you need to make an informed decision on what's right for your household.
Sorry, no stores were found near zip code 77622 for the provider selected.


text:
Archie Christmas Classics
The special holiday editions of Archie comic books have always been extremely popular with Archie fans of all ages, and this quintessential collection of favorite Christmas stories from the '50s, '60s and '70s is destined to be a favorite under many a Christmas tree! This giant, full-color 192-page edition sports an iconic cover by artist Harry Lucey, and hilarious and heartwarming stories by such legendary Archie artists and writers as Dan DeCarlo, Stan Goldberg, Al Hartley, Bob Bolling, Bob White, Bill Vigoda, Tom Moore, Frank Doyle and George Gladir.
Bob Bolling Frank Doyle George Gladir Al Hartley Tomm Moore Bill Vigoda
Dan DeCarlo Stan Goldberg Bob White
Leading Ladies Slice of Life Drama Comedy
Archie Comics Graphic Novels
From the biggest storylines to the funniest compilations, the Archie Comics Graphic Novel series has it all! These books give you the most bang for your buck -- and there are several new editions popping up every month! Be sure to stay tuned for the next awesome collection starring Archie, Jughead, Betty & Veronica and even Sabrina the Teenage Witch!
Archie Americana Series
Get set for a second heaping helping of classic Archie stories from the sensational seventies! This volume features more of the best stories of the 1970s collected into one, high-grade volume. Witness as Archie and his friends get involved in one hysterical situation after another, and enjoy the fads and fashions of the decade.
The Best of Archie Comics
For 70 years, Archie Comics has been a vital and constant presence in American entertainment and pop culture, selling over 1.5 billion comic books. The Best of Archie Comics features classic tales from some of the biggest creative names in the company's history, including Bob Montana, Harry Lucey, Dan DeCarlo, Sam Schwartz, Stan Goldberg, Dan Parent, and more. Hand-picked by Archie historians and
PEP Digital
Looking for super-sized specials only found on digital platforms? Seasonal collections starring your favorite Archie characters are added monthly! Make sure to check out these excellent exclusives!
Betty & Veronica Comics Double Digest
Nothing's better than 100+ pages of laughs and love triangles! Read some of the best stories from best "frenemies" Betty and Veronica!


text:
Disallow the use of type aliases.

In TypeScript, type aliases serve three purposes:

- Aliasing other types so that we can refer to them using a simpler name.

```ts
// this...
type Person = {
    firstName: string,
    lastName: string,
    age: number
};

function addPerson(person : Person) { ... }

// is easier to read than this...
function addPerson(person : { firstName: string, lastName: string, age: number}) { ... }
```

- Act sort of like an interface, providing a set of methods and properties that must exist
  in the objects implementing the type.

```ts
type Person = {
    firstName: string,
    lastName: string,
    age: number,
    walk: () => void,
    talk: () => void
};

// you know person will have 3 properties and 2 methods,
// because the structure has already been defined.
var person : Person = { ... }

// so we can be sure that this will work
person.walk();
```

- Act like mapping tools between types to allow quick modifications.

```ts
type Immutable<T> = { readonly [P in keyof T]: T[P] };

type Person = {
  name: string;
  age: number;
};

type ImmutablePerson = Immutable<Person>;

var person: ImmutablePerson = { name: 'John', age: 30 };
person.name = 'Brad'; // error, readonly property
```

When aliasing, the type alias does not create a new type, it just creates a new name
to refer to the original type. So aliasing primitives and other simple types, tuples, unions
or intersections can some times be redundant.

```ts
// this doesn't make much sense
type myString = string;
```

On the other hand, using a type alias as an interface can limit your ability to:

- Reuse your code: interfaces can be extended or implemented by other types. Type aliases cannot.
- Debug your code: interfaces create a new name, so is easy to identify the base type of an object
  while debugging the application.

Finally, mapping types is an advanced technique and leaving it open can quickly become a pain point
in your application.

## Rule Details

This rule disallows the use of type aliases in favor of interfaces
and simplified types (primitives, tuples, unions, intersections, etc).

## Options

This rule, in its default state, does not require any argument. If you would like to enable one
or more of the following you may pass an object with the options set as follows:

- `allowAliases` set to `"always"` will allow you to do aliasing (Defaults to `"never"`).
- `allowCallbacks` set to `"always"` will allow you to use type aliases with callbacks (Defaults to `"never"`)
- `allowConditionalTypes` set to `"always"` will allow you to use type aliases with conditional types (Defaults to `"never"`)
- `allowConstructors` set to `"always"` will allow you to use type aliases with constructors (Defaults to `"never"`)
- `allowLiterals` set to `"always"` will allow you to use type aliases with literal objects (Defaults to `"never"`)
- `allowMappedTypes` set to `"always"` will allow you to use type aliases as mapping tools (Defaults to `"never"`)
- `allowTupleTypes` set to `"always"` will allow you to use type aliases with tuples (Defaults to `"never"`)
- `allowGenerics` set to `"always"` will allow you to use type aliases with generics (Defaults to `"never"`)

### `allowAliases`

This applies to primitive types and reference types.

The setting accepts the following values:

- `"always"` or `"never"` to active or deactivate the feature.
- `"in-unions"`, allows aliasing in union statements, e.g. `type Foo = string | string[];`
- `"in-intersections"`, allows aliasing in intersection statements, e.g. `type Foo = string & string[];`
- `"in-unions-and-intersections"`, allows aliasing in union and/or intersection statements.

Examples of **correct** code for the `{ "allowAliases": "always" }` options:

```ts
// primitives
type Foo = 'a';

type Foo = 'a' | 'b';

type Foo = string;

type Foo = string | string[];

type Foo = string & string[];

// reference types
interface Bar {}
class Baz implements Bar {}

type Foo = Bar;

type Foo = Bar | Baz;

type Foo = Bar & Baz;
```

Examples of **incorrect** code for the `{ "allowAliases": "in-unions" }` option:

```ts
// primitives
type Foo = 'a';

type Foo = string;

type Foo = string & string[];

// reference types
interface Bar {}
class Baz implements Bar {}

type Foo = Bar;

type Foo = Bar & Baz;
```

Examples of **correct** code for the `{ "allowAliases": "in-unions" }` option:

```ts
// primitives
type Foo = 'a' | 'b';

type Foo = string | string[];

// reference types
interface Bar {}
class Baz implements Bar {}

type Foo = Bar | Baz;
```

Examples of **incorrect** code for the `{ "allowAliases": "in-intersections" }` option:

```ts
// primitives
type Foo = 'a';

type Foo = 'a' | 'b';

type Foo = string;

type Foo = string | string[];

// reference types
interface Bar {}
class Baz implements Bar {}

type Foo = Bar;

type Foo = Bar | Baz;
```

Examples of **correct** code for the `{ "allowAliases": "in-intersections" }` option:

```ts
// primitives
type Foo = string & string[];

// reference types
interface Bar {}
class Baz implements Bar {}

type Foo = Bar & Baz;
```

Examples of **incorrect** code for the `{ "allowAliases": "in-unions-and-intersections" }` option:

```ts
// primitives
type Foo = 'a';

type Foo = string;

// reference types
interface Bar {}
class Baz implements Bar {}

type Foo = Bar;
```

Examples of **correct** code for the `{ "allowAliases": "in-unions-and-intersections" }` option:

```ts
// primitives
type Foo = 'a' | 'b';

type Foo = string | string[];

type Foo = string & string[];

// reference types
interface Bar {}
class Baz implements Bar {}

type Foo = Bar | Baz;

type Foo = Bar & Baz;
```

### `allowCallbacks`

This applies to function types.

The setting accepts the following values:

- `"always"` or `"never"` to active or deactivate the feature.

Examples of **correct** code for the `{ "allowCallbacks": "always" }` option:

```ts
type Foo = () => void;

type Foo = (name: string) => string;

class Person {}

type Foo = (name: string, age: number) => string | Person;

type Foo = (name: string, age: number) => string & Person;
```

### `allowConditionalTypes`

This applies to conditional types.

Examples of **correct** code for the `{ "allowConditionalTypes": "always" }` option:

```ts
type Foo<T> = T extends number ? number : null;
```

### `allowConstructors`

This applies to constructor types.

The setting accepts the following values:

- `"always"` or `"never"` to active or deactivate the feature.

Examples of **correct** code for the `{ "allowConstructors": "always" }` option:

```ts
type Foo = new () => void;
```

### `allowLiterals`

This applies to literal types (`type Foo = { ... }`).

The setting accepts the following options:

- `"always"` or `"never"` to active or deactivate the feature.
- `"in-unions"`, allows literals in union statements, e.g. `type Foo = string | string[];`
- `"in-intersections"`, allows literals in intersection statements, e.g. `type Foo = string & string[];`
- `"in-unions-and-intersections"`, allows literals in union and/or intersection statements.

Examples of **correct** code for the `{ "allowLiterals": "always" }` options:

```ts
type Foo = {};

type Foo = {
  name: string;
  age: number;
};

type Foo = {
  name: string;
  age: number;
  walk: (miles: number) => void;
};

type Foo = { name: string } | { age: number };

type Foo = { name: string } & { age: number };
```

Examples of **incorrect** code for the `{ "allowLiterals": "in-unions" }` option:

```ts
type Foo = {};

type Foo = {
  name: string;
  age: number;
};

type Foo = {
  name: string;
  age: number;
  walk: (miles: number) => void;
};

type Foo = { name: string } & { age: number };
```

Examples of **correct** code for the `{ "allowLiterals": "in-unions" }` option:

```ts
type Foo = { name: string } | { age: number };
```

Examples of **incorrect** code for the `{ "allowLiterals": "in-intersections" }` option:

```ts
type Foo = {};

type Foo = {
  name: string;
  age: number;
};

type Foo = {
  name: string;
  age: number;
  walk: (miles: number) => void;
};

type Foo = { name: string } | { age: number };
```

Examples of **correct** code for the `{ "allowLiterals": "in-intersections" }` option:

```ts
type Foo = { name: string } & { age: number };
```

Examples of **incorrect** code for the `{ "allowLiterals": "in-unions-and-intersections" }` option:

```ts
type Foo = {};

type Foo = {
  name: string;
  age: number;
};

type Foo = {
  name: string;
  age: number;
  walk: (miles: number) => void;
};
```

Examples of **correct** code for the `{ "allowLiterals": "in-unions-and-intersections" }` option:

```ts
type Foo = { name: string } | { age: number };

type Foo = { name: string } & { age: number };
```

### `allowMappedTypes`

This applies to literal types.

The setting accepts the following values:

- `"always"` or `"never"` to active or deactivate the feature.
- `"in-unions"`, allows aliasing in union statements, e.g. `type Foo = string | string[];`
- `"in-intersections"`, allows aliasing in intersection statements, e.g. `type Foo = string & string[];`
- `"in-unions-and-intersections"`, allows aliasing in union and/or intersection statements.

Examples of **correct** code for the `{ "allowMappedTypes": "always" }` options:

```ts
type Foo<T> = { readonly [P in keyof T]: T[P] };

type Foo<T> = { [P in keyof T]?: T[P] };

type Foo<T, U> =
  | { readonly [P in keyof T]: T[P] }
  | { readonly [P in keyof U]: U[P] };

type Foo<T, U> = { [P in keyof T]?: T[P] } | { [P in keyof U]?: U[P] };

type Foo<T, U> = { readonly [P in keyof T]: T[P] } & {
  readonly [P in keyof U]: U[P];
};

type Foo<T, U> = { [P in keyof T]?: T[P] } & { [P in keyof U]?: U[P] };
```

Examples of **incorrect** code for the `{ "allowMappedTypes": "in-unions" }` option:

```ts
type Foo<T> = { readonly [P in keyof T]: T[P] };

type Foo<T> = { [P in keyof T]?: T[P] };

type Foo<T, U> = { readonly [P in keyof T]: T[P] } & {
  readonly [P in keyof U]: U[P];
};

type Foo<T, U> = { [P in keyof T]?: T[P] } & { [P in keyof U]?: U[P] };
```

Examples of **correct** code for the `{ "allowMappedTypes": "in-unions" }` option:

```ts
type Foo<T, U> =
  | { readonly [P in keyof T]: T[P] }
  | { readonly [P in keyof U]: U[P] };

type Foo<T, U> = { [P in keyof T]?: T[P] } | { [P in keyof U]?: U[P] };
```

Examples of **incorrect** code for the `{ "allowMappedTypes": "in-intersections" }` option:

```ts
type Foo<T> = { readonly [P in keyof T]: T[P] };

type Foo<T> = { [P in keyof T]?: T[P] };

type Foo<T, U> =
  | { readonly [P in keyof T]: T[P] }
  | { readonly [P in keyof U]: U[P] };

type Foo<T, U> = { [P in keyof T]?: T[P] } | { [P in keyof U]?: U[P] };
```

Examples of **correct** code for the `{ "allowMappedTypes": "in-intersections" }` option:

```ts
type Foo<T, U> = { readonly [P in keyof T]: T[P] } & {
  readonly [P in keyof U]: U[P];
};

type Foo<T, U> = { [P in keyof T]?: T[P] } & { [P in keyof U]?: U[P] };
```

Examples of **incorrect** code for the `{ "allowMappedTypes": "in-unions-and-intersections" }` option:

```ts
type Foo<T> = { readonly [P in keyof T]: T[P] };

type Foo<T> = { [P in keyof T]?: T[P] };
```

Examples of **correct** code for the `{ "allowMappedTypes": "in-unions-and-intersections" }` option:

```ts
type Foo<T, U> =
  | { readonly [P in keyof T]: T[P] }
  | { readonly [P in keyof U]: U[P] };

type Foo<T, U> = { [P in keyof T]?: T[P] } | { [P in keyof U]?: U[P] };

type Foo<T, U> = { readonly [P in keyof T]: T[P] } & {
  readonly [P in keyof U]: U[P];
};

type Foo<T, U> = { [P in keyof T]?: T[P] } & { [P in keyof U]?: U[P] };
```

### `allowTupleTypes`

This applies to tuple types (`type Foo = [number]`).

The setting accepts the following options:

- `"always"` or `"never"` to active or deactivate the feature.
- `"in-unions"`, allows tuples in union statements, e.g. `type Foo = [string] | [string, string];`
- `"in-intersections"`, allows tuples in intersection statements, e.g. `type Foo = [string] & [string, string];`
- `"in-unions-and-intersections"`, allows tuples in union and/or intersection statements.

Examples of **correct** code for the `{ "allowTupleTypes": "always" }` options:

```ts
type Foo = [number];

type Foo = [number] | [number, number];

type Foo = [number] & [number, number];

type Foo = [number] | ([number, number] & [string, string]);
```

Examples of **incorrect** code for the `{ "allowTupleTypes": "in-unions" }` option:

```ts
type Foo = [number];

type Foo = [number] & [number, number];

type Foo = [string] & [number];
```

Examples of **correct** code for the `{ "allowTupleTypes": "in-unions" }` option:

```ts
type Foo = [number] | [number, number];

type Foo = [string] | [number];
```

Examples of **incorrect** code for the `{ "allowTupleTypes": "in-intersections" }` option:

```ts
type Foo = [number];

type Foo = [number] | [number, number];

type Foo = [string] | [number];
```

Examples of **correct** code for the `{ "allowTupleTypes": "in-intersections" }` option:

```ts
type Foo = [number] & [number, number];

type Foo = [string] & [number];
```

Examples of **incorrect** code for the `{ "allowTupleTypes": "in-unions-and-intersections" }` option:

```ts
type Foo = [number];

type Foo = [string];
```

Examples of **correct** code for the `{ "allowLiterals": "in-unions-and-intersections" }` option:

```ts
type Foo = [number] & [number, number];

type Foo = [string] | [number];
```

### `allowGenerics`

This applies to generic types, including TypeScript provided global utility types (`type Foo = Record<string, number>`).

The setting accepts the following options:

- `"always"` or `"never"` to active or deactivate the feature.

Examples of **correct** code for the `{ "allowGenerics": "always" }` options:

```ts
type Foo = Bar<string>;

type Foo = Record<string, number>;

type Foo = Readonly<Bar>;

type Foo = Partial<Bar>;

type Foo = Omit<Bar, 'a' | 'b'>;
```

## When Not To Use It

When you can't express some shape with an interface or you need to use a union, tuple type,
callback, etc. that would cause the code to be unreadable or impractical.

## Further Reading

- [Advance Types](https://www.typescriptlang.org/docs/handbook/advanced-types.html)

## Related To

- TSLint: [interface-over-type-literal](https://palantir.github.io/tslint/rules/interface-over-type-literal/)

## Attributes

- [ ] ✅ Recommended
- [ ] 🔧 Fixable
- [ ] 💭 Requires type information

redpajama_set_name: RedPajamaGithub


text:
Ontario continues to outpace other provinces with 423 ZEBs, 413 of which are battery-electric buses (BEBs) and 10 of which are fuel cell electric buses (FCEBs).
January 5, 2022	by CM Staff
PASADENA — CALSTART released its second annual inventory of Canada's zero-emission bus (ZEB) adoption in its "Zeroing in on ZEBs" report that tracks the growth of ZEB deployment in the U.S. and Canada. Ontario continues to outpace other provinces with 423 ZEBs, 413 of which are battery-electric buses (BEBs) and 10 of which are fuel cell electric buses (FCEBs). There are 606 total ZEBs nationally, with adoption expected to grow as Canada moves to achieve its net-zero emissions goal by 2050.
"Ontario is an early adopter, and its transit agencies are primed to scale operations with the additional investment pledged by the government," said Jared Schnader, director of Bus Programs at CALSTART. "With the stated goal of 5,000 ZEBs by 2025 nationally, we expect to see significant growth across the provinces."
BEBs still vastly outnumber FCEBs in Canada, with only 10 FCEBs and those being only in Ontario. However, FCEBs had a significant increase in the United States last year, doubling from 87 in 2020 to 169 in the current inventory. Long routes and operational needs can drive this choice as one FCEB can meet the operational needs of two battery-electric buses. Additional factors such as infrastructure, cost, and owner/operator preference also influence the choice in technology.
The report provides an inventory of U.S. ZEBs as well, noting a 27% increase in full-size ZEBs in the U.S. to total 3,533. The majority of the ZEBs (1371) are in California, which has advanced clean air and emissions regulations as well as specific funding programs.
The data collected on the Canadian transit market was obtained by analyzing media reports and press releases. CALSTART also confirmed these figures with the Canadian Urban Transit Research & Innovation Consortium's (CUTRIC) ZEB Database™.
NFI receives additional order of hybrid-electric buses from New York's Westchester County
Nova Bus electric buses begin operations in Brampton
Milwaukee County Transit System selects Nova Bus to supply 15 electric buses
The Canada Infrastructure Bank invests up to $30M in zero-emission school bus project
Walter Surface Technologies acquires Allegro Industries
TerrAscend Corp. announces new President and Chief Operating Officer
BlackBerry's new collaboration with PATEO


Dar Phoenix 3 Light Ceiling Light Black/Copper.
The Phoenix 3 Light Ceiling Light is a striking fitting from Dar Lighting. Suspended by a chain from a round ceiling plate, the large piece is spherical in shape, formed by matt black looped wiring. Each light bulb housed within the decorative shade is supported by polished copper detailing.
The Phoenix Ceiling Light has a maximum drop of 1500mm and is 380mm in diameter. It requires 3 x SES Candle light bulbs with a maximum wattage of 40w.


Flossing can seem like a real pain, especially to kids that are always on the go. Did you know that as soon as your child has two teeth that touch each other that he should be flossing in between them? Brushing alone is not enough!
While even the best brushing technique can get a majority of the bacteria and food debris out of a child's mouth, it is impossible for it to get the bacteria that lie in between those touching teeth or even behind them. Flossing is the only way to remove 100% of the bacteria in your child's mouth.
Many people mistakenly think that only adults, mostly seniors, are prone to gingivitis, but that is not true; anyone can get it! This means that your child does not floss could have an accumulation of plaque in his mouth that is putting the integrity of his gums at risk. Do you want him to enter adulthood with problematic teeth or would you rather he had a healthy mouth to pave the way for good overall health?
Younger kids will need help flossing. We can teach them in the office, but regular help at home will be essential. Talk to your kids about the importance of flossing and monitor their technique, providing your help whenever necessary. The younger that you start your kids on the habit of flossing, the easier it will become a natural part of life; one that they will not skip even as they become independent teenagers and adults!
Does your child need a check-up? Please call us for an appointment today!


He wasn't making any predictions for the future.
Here are our predictions for next year's fashions.
Karen didn't believe Roger's prediction that the team would win the match.
His prediction is that people will holiday in space.
No one believed her prediction that the world would end on 12 November. The storm is predicted to reach the Florida coast tomorrow morning.
Some predictions are that one day we will live on other planets.
We are not yet able to make accurate predictions about earthquakes.


My rabbit (1 yr old mini lop) has been eating significantly less although he is eating throughout the day(carrots, hay and pellets). We did just move a few days ago however it is a house that he has been to before. There is a dog here as well that does come up to his cage that was not here before. I was wondering could it be the change affecting his appetite or should I bring him in?
Rabbits can certainly have a decrease in appetite due to stress such as moving. Other causes such as dental disease, underlying discomfort or pain, etc. can also cause a decrease in appetite. I would always advise a physical exam with a veterinarian experienced with rabbits if your bunny is eating less to ensure there are no other causes for his dietary changes. At the minimum, I recommend adding in additional syringe feeding of a complete diet made for rabbits with decreased appetite (Oxbow Critical Care) to prevent further issues. If a rabbit's food intake decreases, the motility( movement) of the gut decreases. If the intestinal tract slows down too much, GI bacteria normally in the gut can overgrow to levels that can make the rabbit more ill, and can potentially be fatal. In most cases, supportive care such as feeding and additional fluids to rehydrate the rabbit can help resolve the problem, but some rabbits may need more aggressive treatment and tests.
I are always happy to see your bun to ensure he is doing well and help with his further care. Please call if you would like to schedule an appointment.
next question: I just adopted a new morkie puppy. He is 6 weeks old. He keeps scratching by his ears a lot. Is this normal?
previous question: I have a parakeet who's poop is the color of chalk. What would cause that?


text:
1. Generate tokens
    KUBELET_TOKEN=$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64 | tr -d "=+/" | dd bs=32 count=1 2>/dev/null)
    KUBE_PROXY_TOKEN=$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | base64 | tr -d "=+/" | dd bs=32 count=1 2>/dev/null)
2. Detect master image
3. Detect worker image
4. Detect root device
5. Find Kubernetes release tars
6. Make temp dir
7. Create bootstrap script
8. Upload server tars and bootstrap script to S3
9. Create master/worker IAM profiles
10. Generate basicauth admin:randompassword
11. Generate random bearer token
12. Generate SSH key $AWS_SSH_KEY if it doesn't already exist
13. Generate $AWS_SSH_KEY_FINGERPRINT from $AWS_SSH_KEY
14. Import SSH public key to AWS
15. Set up VPC
    1. Get VPC ID:
            $AWS_CMD describe-vpcs \
            --filters Name=tag:Name,Values=kubernetes-vpc \
            Name=tag:KubernetesCluster,Values=${CLUSTER_ID} \
            --query Vpcs[].VpcId

    2. Create VPC if VPC ID wasn't found:
            VPC_ID=$($AWS_CMD create-vpc --cidr-block ${VPC_CIDR} --query Vpc.VpcId)
            $AWS_CMD modify-vpc-attribute --vpc-id $VPC_ID --enable-dns-support '{"Value": true}' > $LOG
            $AWS_CMD modify-vpc-attribute --vpc-id $VPC_ID --enable-dns-hostnames '{"Value": true}' > $LOG
            add-tag $VPC_ID Name kubernetes-vpc
            add-tag $VPC_ID KubernetesCluster ${CLUSTER_ID}
16. Create DHCP option set
  1. Get DHCP_OPTION_SET_ID:
            DHCP_OPTION_SET_ID=$($AWS_CMD create-dhcp-options --dhcp-configuration \
            Key=domain-name,Values=${AWS_REGION}.compute.internal Key=domain-name-servers,\
            Values=AmazonProvidedDNS --query DhcpOptions.DhcpOptionsId)
  2. Tag DHCP option set:
            $AWS_CMD create-tags --resources $DHCP_OPTION_SET_ID --tags \
            Key=Name,Value=kubernetes-dhcp-option-set
            $AWS_CMD create-tags --resources $DHCP_OPTION_SET_ID --tags \
            Key=KubernetesCluster,Value=${CLUSTER_ID}
  3. `$AWS_CMD associate-dhcp-options --dhcp-options-id ${DHCP_OPTION_SET_ID} --vpc-id ${VPC_ID}`
17. Set up subnet
  1. Get $SUBNET_ID:
            $AWS_CMD describe-subnets \
           --filters Name=tag:KubernetesCluster,Values=${CLUSTER_ID} \
                     Name=availabilityZone,Values=${ZONE} \
                     Name=vpc-id,Values=${VPC_ID} \
           --query Subnets[].SubnetId
  2. Create subnet if it doesn't already exist:
            SUBNET_ID=$($AWS_CMD create-subnet --cidr-block ${SUBNET_CIDR} --vpc-id $VPC_ID \
            --availability-zone ${ZONE} --query Subnet.SubnetId)
            $AWS_CMD create-tags --resources $SUBNET_ID --tags \
            Key=KubernetesCluster,Value=${CLUSTER_ID}
18. Attach Internet gateway
  1. Get $IGW_ID:
            $AWS_CMD describe-internet-gateways \
            --filters Name=attachment.vpc-id,Values=${VPC_ID} \
            --query InternetGateways[].InternetGatewayId
  2. If not already existant, create Internet gateway $IGW_ID:
            IGW_ID=$($AWS_CMD create-internet-gateway --query InternetGateway.InternetGatewayId)
            $AWS_CMD attach-internet-gateway --internet-gateway-id $IGW_ID --vpc-id $VPC_ID
  3. Associate route table:
            ROUTE_TABLE_ID=$($AWS_CMD describe-route-tables \
            --filters Name=vpc-id,Values=${VPC_ID} \
            Name=tag:KubernetesCluster,Values=${CLUSTER_ID} \
            --query RouteTables[].RouteTableId)
            if [[ -z "${ROUTE_TABLE_ID}" ]]; then
              echo "Creating route table"
              ROUTE_TABLE_ID=$($AWS_CMD create-route-table \
              --vpc-id=${VPC_ID} \
              --query RouteTable.RouteTableId)
              $AWS_CMD create-tags --resources $ROUTE_TABLE_ID --tags \
              Key=KubernetesCluster,Value=$CLUSTER_ID
            fi

            $AWS_CMD associate-route-table --route-table-id $ROUTE_TABLE_ID --subnet-id $SUBNET_ID
            $AWS_CMD create-route --route-table-id $ROUTE_TABLE_ID --destination-cidr-block 0.0.0.0/0 --gateway-id $IGW_ID
19. Create security groups
            MASTER_SG_ID=$(get_security_group_id "kubernetes-master-${CLUSTER_ID}")
            if [[ -z "${MASTER_SG_ID}" ]]; then
              echo "Creating master security group."
              create-security-group "kubernetes-master-${CLUSTER_ID}" \
              "Kubernetes security group applied to master nodes"
            fi
            NODE_SG_ID=$(get_security_group_id "kubernetes-minion-${CLUSTER_ID}")
            if [[ -z "${NODE_SG_ID}" ]]; then
              echo "Creating minion security group."
              create-security-group "kubernetes-minion-${CLUSTER_ID}" \
              "Kubernetes security group applied to minion nodes"
            fi
            MASTER_SG_ID=$(get_security_group_id "kubernetes-master-${CLUSTER_ID}")
            NODE_SG_ID=$(get_security_group_id "kubernetes-minion-${CLUSTER_ID}")
20. Configure security groups:
            $AWS_CMD authorize-security-group-ingress --group-id "${MASTER_SG_ID}" --source-group \
            ${MASTER_SG_ID} --protocol all
            $AWS_CMD authorize-security-group-ingress --group-id "${NODE_SG_ID}" --source-group \
            ${NODE_SG_ID} --protocol all
            $AWS_CMD authorize-security-group-ingress --group-id "${MASTER_SG_ID}" --source-group \
            ${NODE_SG_ID} --protocol all
            $AWS_CMD authorize-security-group-ingress --group-id "${NODE_SG_ID}" --source-group \
            ${MASTER_SG_ID} --protocol all
            $AWS_CMD authorize-security-group-ingress --group-id "${MASTER_SG_ID}" \
            --protocol tcp --port 22 --cidr 0.0.0.0/0
            $AWS_CMD authorize-security-group-ingress --group-id "${NODE_SG_ID}" \
            --protocol tcp --port 22 --cidr 0.0.0.0/0
            $AWS_CMD authorize-security-group-ingress --group-id "${MASTER_SG_ID}" \
            --protocol tcp --port 443 --cidr 0.0.0.0/0
21. Start master:
  1. Ensure master persistent volume:
            local name=${MASTER_NAME}-pd
            if [[ -z "${MASTER_DISK_ID}" ]]; then
              MASTER_DISK_ID=`$AWS_CMD describe-volumes \
              --filters Name=availability-zone,Values=${ZONE} \
              Name=tag:Name,Values=${name} \
              Name=tag:KubernetesCluster,Values=${CLUSTER_ID} \
              --query Volumes[].VolumeId`
            fi
            if [[ -z "${MASTER_DISK_ID}" ]]; then
              MASTER_DISK_ID=`$AWS_CMD create-volume --availability-zone ${ZONE} \
              --volume-type ${MASTER_DISK_TYPE} --size ${MASTER_DISK_SIZE} --query VolumeId`
              $AWS_CMD create-tags --resources $MASTER_DISK_ID --tags \
              Key=NAME,Value=${name}
              $AWS_CMD create-tags --resources $MASTER_DISK_ID --tags \
              Key=KubernetesCluster,Value=${CLUSTER_ID}
            fi
  2. Ensure master elastic IP
            if [[ -n "${MASTER_DISK_ID:-}" ]]; then
              $AWS_CMD describe-tags --filters Name=resource-id,Values=${MASTER_DISK_ID} \
              Name=key,Values=${TAG_KEY_MASTER_IP} \
              --query Tags[].Value
            fi
            if [[ -z "${KUBE_MASTER_IP:-}" ]]; then
              # Check if MASTER_RESERVED_IP looks like an IPv4 address
              # Note that we used to only allocate an elastic IP when MASTER_RESERVED_IP=auto
              # So be careful changing the IPV4 test, to be sure that 'auto' => 'allocate'
              if [[ "${MASTER_RESERVED_IP}" =~ ^[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
                KUBE_MASTER_IP="${MASTER_RESERVED_IP}"
              else
                KUBE_MASTER_IP=`$AWS_CMD allocate-address --domain vpc --query PublicIp`
              fi

              # We can't tag elastic ips.  Instead we put the tag on the persistent disk.
              # It is a little weird, perhaps, but it sort of makes sense...
              # The master mounts the master PD, and whoever mounts the master PD should also
              # have the master IP
              $AWS_CMD create-tags --resources $MASTER_DISK_ID --tags \
              Key=${TAG_KEY_MASTER_IP},Value=${KUBE_MASTER_IP}
            fi
  3. Create certificates
            create-certs "${KUBE_MASTER_IP}" "${MASTER_INTERNAL_IP}"
  4. Write master environment
            local master=true
            local file="${KUBE_TEMP}/master-kube-env.yaml"

            rm -f ${file}
            cat >$file <<EOF
            ENV_TIMESTAMP: $(yaml-quote $(date -u +%Y-%m-%dT%T%z))
            INSTANCE_PREFIX: $(yaml-quote ${INSTANCE_PREFIX})
            NODE_INSTANCE_PREFIX: $(yaml-quote ${NODE_INSTANCE_PREFIX})
            CLUSTER_IP_RANGE: $(yaml-quote ${CLUSTER_IP_RANGE:-10.244.0.0/16})
            SERVER_BINARY_TAR_URL: $(yaml-quote ${SERVER_BINARY_TAR_URL})
            SERVER_BINARY_TAR_HASH: $(yaml-quote ${SERVER_BINARY_TAR_HASH})
            SALT_TAR_URL: $(yaml-quote ${SALT_TAR_URL})
            SALT_TAR_HASH: $(yaml-quote ${SALT_TAR_HASH})
            SERVICE_CLUSTER_IP_RANGE: $(yaml-quote ${SERVICE_CLUSTER_IP_RANGE})
            KUBERNETES_MASTER_NAME: $(yaml-quote ${MASTER_NAME})
            ALLOCATE_NODE_CIDRS: $(yaml-quote ${ALLOCATE_NODE_CIDRS:-false})
            ENABLE_CLUSTER_MONITORING: $(yaml-quote ${ENABLE_CLUSTER_MONITORING:-none})
            ENABLE_L7_LOADBALANCING: $(yaml-quote ${ENABLE_L7_LOADBALANCING:-none})
            ENABLE_CLUSTER_LOGGING: $(yaml-quote ${ENABLE_CLUSTER_LOGGING:-false})
            ENABLE_CLUSTER_UI: $(yaml-quote ${ENABLE_CLUSTER_UI:-false})
            ENABLE_NODE_LOGGING: $(yaml-quote ${ENABLE_NODE_LOGGING:-false})
            LOGGING_DESTINATION: $(yaml-quote ${LOGGING_DESTINATION:-})
            ELASTICSEARCH_LOGGING_REPLICAS: $(yaml-quote ${ELASTICSEARCH_LOGGING_REPLICAS:-})
            ENABLE_CLUSTER_DNS: $(yaml-quote ${ENABLE_CLUSTER_DNS:-false})
            ENABLE_CLUSTER_REGISTRY: $(yaml-quote ${ENABLE_CLUSTER_REGISTRY:-false})
            CLUSTER_REGISTRY_DISK: $(yaml-quote ${CLUSTER_REGISTRY_DISK:-})
            CLUSTER_REGISTRY_DISK_SIZE: $(yaml-quote ${CLUSTER_REGISTRY_DISK_SIZE:-})
            DNS_REPLICAS: $(yaml-quote ${DNS_REPLICAS:-})
            DNS_SERVER_IP: $(yaml-quote ${DNS_SERVER_IP:-})
            DNS_DOMAIN: $(yaml-quote ${DNS_DOMAIN:-})
            KUBELET_TOKEN: $(yaml-quote ${KUBELET_TOKEN:-})
            KUBE_PROXY_TOKEN: $(yaml-quote ${KUBE_PROXY_TOKEN:-})
            ADMISSION_CONTROL: $(yaml-quote ${ADMISSION_CONTROL:-})
            MASTER_IP_RANGE: $(yaml-quote ${MASTER_IP_RANGE})
            RUNTIME_CONFIG: $(yaml-quote ${RUNTIME_CONFIG})
            CA_CERT: $(yaml-quote ${CA_CERT_BASE64:-})
            KUBELET_CERT: $(yaml-quote ${KUBELET_CERT_BASE64:-})
            KUBELET_KEY: $(yaml-quote ${KUBELET_KEY_BASE64:-})
            NETWORK_PROVIDER: $(yaml-quote ${NETWORK_PROVIDER:-})
            HAIRPIN_MODE: $(yaml-quote ${HAIRPIN_MODE:-})
            OPENCONTRAIL_TAG: $(yaml-quote ${OPENCONTRAIL_TAG:-})
            OPENCONTRAIL_KUBERNETES_TAG: $(yaml-quote ${OPENCONTRAIL_KUBERNETES_TAG:-})
            OPENCONTRAIL_PUBLIC_SUBNET: $(yaml-quote ${OPENCONTRAIL_PUBLIC_SUBNET:-})
            E2E_STORAGE_TEST_ENVIRONMENT: $(yaml-quote ${E2E_STORAGE_TEST_ENVIRONMENT:-})
            KUBE_IMAGE_TAG: $(yaml-quote ${KUBE_IMAGE_TAG:-})
            KUBE_DOCKER_REGISTRY: $(yaml-quote ${KUBE_DOCKER_REGISTRY:-})
            KUBE_ADDON_REGISTRY: $(yaml-quote ${KUBE_ADDON_REGISTRY:-})
            MULTIZONE: $(yaml-quote ${MULTIZONE:-})
            NON_MASQUERADE_CIDR: $(yaml-quote ${NON_MASQUERADE_CIDR:-})
            EOF
            if [ -n "${KUBELET_PORT:-}" ]; then
              cat >>$file <<EOF
            KUBELET_PORT: $(yaml-quote ${KUBELET_PORT})
            EOF
            fi
            if [ -n "${KUBE_APISERVER_REQUEST_TIMEOUT:-}" ]; then
              cat >>$file <<EOF
            KUBE_APISERVER_REQUEST_TIMEOUT: $(yaml-quote ${KUBE_APISERVER_REQUEST_TIMEOUT})
            EOF
            fi
            if [ -n "${TERMINATED_POD_GC_THRESHOLD:-}" ]; then
              cat >>$file <<EOF
            TERMINATED_POD_GC_THRESHOLD: $(yaml-quote ${TERMINATED_POD_GC_THRESHOLD})
            EOF
            fi
            if [[ "${OS_DISTRIBUTION}" == "trusty" ]]; then
              cat >>$file <<EOF
            KUBE_MANIFESTS_TAR_URL: $(yaml-quote ${KUBE_MANIFESTS_TAR_URL})
            KUBE_MANIFESTS_TAR_HASH: $(yaml-quote ${KUBE_MANIFESTS_TAR_HASH})
            EOF
            fi
            if [ -n "${TEST_CLUSTER:-}" ]; then
              cat >>$file <<EOF
            TEST_CLUSTER: $(yaml-quote ${TEST_CLUSTER})
            EOF
            fi
            if [ -n "${KUBELET_TEST_ARGS:-}" ]; then
              cat >>$file <<EOF
            KUBELET_TEST_ARGS: $(yaml-quote ${KUBELET_TEST_ARGS})
            EOF
            fi
            if [ -n "${KUBELET_TEST_LOG_LEVEL:-}" ]; then
              cat >>$file <<EOF
            KUBELET_TEST_LOG_LEVEL: $(yaml-quote ${KUBELET_TEST_LOG_LEVEL})
            EOF
            fi
            if [ -n "${DOCKER_TEST_LOG_LEVEL:-}" ]; then
              cat >>$file <<EOF
            DOCKER_TEST_LOG_LEVEL: $(yaml-quote ${DOCKER_TEST_LOG_LEVEL})
            EOF
            fi
            if [ -n "${ENABLE_CUSTOM_METRICS:-}" ]; then
              cat >>$file <<EOF
            ENABLE_CUSTOM_METRICS: $(yaml-quote ${ENABLE_CUSTOM_METRICS})
            EOF
            fi
            if [[ "${master}" == "true" ]]; then
              # Master-only env vars.
              cat >>$file <<EOF
            KUBERNETES_MASTER: $(yaml-quote "true")
            KUBE_USER: $(yaml-quote ${KUBE_USER})
            KUBE_PASSWORD: $(yaml-quote ${KUBE_PASSWORD})
            KUBE_BEARER_TOKEN: $(yaml-quote ${KUBE_BEARER_TOKEN})
            MASTER_CERT: $(yaml-quote ${MASTER_CERT_BASE64:-})
            MASTER_KEY: $(yaml-quote ${MASTER_KEY_BASE64:-})
            KUBECFG_CERT: $(yaml-quote ${KUBECFG_CERT_BASE64:-})
            KUBECFG_KEY: $(yaml-quote ${KUBECFG_KEY_BASE64:-})
            KUBELET_APISERVER: $(yaml-quote ${KUBELET_APISERVER:-})
            ENABLE_MANIFEST_URL: $(yaml-quote ${ENABLE_MANIFEST_URL:-false})
            MANIFEST_URL: $(yaml-quote ${MANIFEST_URL:-})
            MANIFEST_URL_HEADER: $(yaml-quote ${MANIFEST_URL_HEADER:-})
            NUM_NODES: $(yaml-quote ${NUM_NODES})
            EOF
            if [ -n "${APISERVER_TEST_ARGS:-}" ]; then
              cat >>$file <<EOF
            APISERVER_TEST_ARGS: $(yaml-quote ${APISERVER_TEST_ARGS})
            EOF
            fi
            if [ -n "${APISERVER_TEST_LOG_LEVEL:-}" ]; then
              cat >>$file <<EOF
            APISERVER_TEST_LOG_LEVEL: $(yaml-quote ${APISERVER_TEST_LOG_LEVEL})
            EOF
            fi
            if [ -n "${CONTROLLER_MANAGER_TEST_ARGS:-}" ]; then
              cat >>$file <<EOF
            CONTROLLER_MANAGER_TEST_ARGS: $(yaml-quote ${CONTROLLER_MANAGER_TEST_ARGS})
            EOF
            fi
            if [ -n "${CONTROLLER_MANAGER_TEST_LOG_LEVEL:-}" ]; then
              cat >>$file <<EOF
            CONTROLLER_MANAGER_TEST_LOG_LEVEL: $(yaml-quote ${CONTROLLER_MANAGER_TEST_LOG_LEVEL})
            EOF
            fi
            if [ -n "${SCHEDULER_TEST_ARGS:-}" ]; then
              cat >>$file <<EOF
            SCHEDULER_TEST_ARGS: $(yaml-quote ${SCHEDULER_TEST_ARGS})
            EOF
            fi
            if [ -n "${SCHEDULER_TEST_LOG_LEVEL:-}" ]; then
              cat >>$file <<EOF
            SCHEDULER_TEST_LOG_LEVEL: $(yaml-quote ${SCHEDULER_TEST_LOG_LEVEL})
            EOF
            fi
            else
            # Node-only env vars.
            cat >>$file <<EOF
            KUBERNETES_MASTER: $(yaml-quote "false")
            ZONE: $(yaml-quote ${ZONE})
            EXTRA_DOCKER_OPTS: $(yaml-quote ${EXTRA_DOCKER_OPTS:-})
            EOF
            if [ -n "${KUBEPROXY_TEST_ARGS:-}" ]; then
              cat >>$file <<EOF
            KUBEPROXY_TEST_ARGS: $(yaml-quote ${KUBEPROXY_TEST_ARGS})
            EOF
            fi
            if [ -n "${KUBEPROXY_TEST_LOG_LEVEL:-}" ]; then
              cat >>$file <<EOF
            KUBEPROXY_TEST_LOG_LEVEL: $(yaml-quote ${KUBEPROXY_TEST_LOG_LEVEL})
            EOF
            fi
            fi
            if [ -n "${NODE_LABELS:-}" ]; then
              cat >>$file <<EOF
            NODE_LABELS: $(yaml-quote ${NODE_LABELS})
            EOF
            fi
            if [[ "${OS_DISTRIBUTION}" == "coreos" ]]; then
              # CoreOS-only env vars. TODO(yifan): Make them available on other distros.
              cat >>$file <<EOF
            KUBE_MANIFESTS_TAR_URL: $(yaml-quote ${KUBE_MANIFESTS_TAR_URL})
            KUBE_MANIFESTS_TAR_HASH: $(yaml-quote ${KUBE_MANIFESTS_TAR_HASH})
            KUBERNETES_CONTAINER_RUNTIME: $(yaml-quote ${CONTAINER_RUNTIME:-docker})
            RKT_VERSION: $(yaml-quote ${RKT_VERSION:-})
            RKT_PATH: $(yaml-quote ${RKT_PATH:-})
            KUBERNETES_CONFIGURE_CBR0: $(yaml-quote ${KUBERNETES_CONFIGURE_CBR0:-true})
            EOF
            fi
  5. Write master user data:
            (
              # We pipe this to the ami as a startup script in the user-data field. Requires a
              # compatible ami
              echo "#! /bin/bash"
              echo "mkdir -p /var/cache/kubernetes-install"
              echo "cd /var/cache/kubernetes-install"

              echo "cat > kube_env.yaml << __EOF_MASTER_KUBE_ENV_YAML"
              cat ${KUBE_TEMP}/master-kube-env.yaml
              echo "AUTO_UPGRADE: 'true'"
              # TODO: get rid of these exceptions / harmonize with common or GCE
              echo "DOCKER_STORAGE: $(yaml-quote ${DOCKER_STORAGE:-})"
              echo "API_SERVERS: $(yaml-quote ${MASTER_INTERNAL_IP:-})"
              echo "__EOF_MASTER_KUBE_ENV_YAML"
              echo ""
              echo "wget -O bootstrap ${BOOTSTRAP_SCRIPT_URL}"
              echo "chmod +x bootstrap"
              echo "mkdir -p /etc/kubernetes"
              echo "mv kube_env.yaml /etc/kubernetes"
              echo "mv bootstrap /etc/kubernetes/"
              echo "cat > /etc/rc.local << EOF_RC_LOCAL"
              echo "#!/bin/sh -e"
              # We want to be sure that we don't pass an argument to bootstrap
              echo "/etc/kubernetes/bootstrap"
              echo "exit 0"
              echo "EOF_RC_LOCAL"
              echo "/etc/kubernetes/bootstrap"
            ) > "${KUBE_TEMP}/master-user-data"

            # Compress the data to fit under the 16KB limit (cloud-init accepts compressed data)
            gzip "${KUBE_TEMP}/master-user-data"
  6. Start master
            master_id=$($AWS_CMD run-instances \
            --image-id $AWS_IMAGE \
            --iam-instance-profile Name=$IAM_PROFILE_MASTER \
            --instance-type $MASTER_SIZE \
            --subnet-id $SUBNET_ID \
            --private-ip-address $MASTER_INTERNAL_IP \
            --key-name ${AWS_SSH_KEY_NAME} \
            --security-group-ids ${MASTER_SG_ID} \
            --associate-public-ip-address \
            --block-device-mappings "${MASTER_BLOCK_DEVICE_MAPPINGS}" \
            --user-data fileb://${KUBE_TEMP}/master-user-data.gz \
            --query Instances[].InstanceId)
            $AWS_CMD create-tags --resources $master_id --tags \
            Key=Name,Value=$MASTER_NAME
            $AWS_CMD create-tags --resources $master_id --tags \
            Key=Role,Value=$MASTER_TAG
            $AWS_CMD create-tags --resources $master_id --tags \
            Key=KubernetesCluster,Value=$CLUSTER_ID

            local attempt=0
            while true; do
              echo -n Attempt "$(($attempt+1))" to check for master node
              local ip=$(get_instance_public_ip ${master_id})
              if [[ -z "${ip}" ]]; then
                if (( attempt > 30 )); then
                  echo
                  echo -e "${color_red}master failed to start. Your cluster is unlikely" >&2
                  echo "to work correctly. Please run ./cluster/kube-down.sh and re-create the" >&2
                  echo -e "cluster. (sorry!)${color_norm}" >&2
                  exit 1
                fi
              else
                # We are not able to add an elastic ip, a route or volume to the instance until that instance is in "running" state.
                wait-for-instance-state ${master_id} "running"

                KUBE_MASTER=${MASTER_NAME}
                echo -e " ${color_green}[master running]${color_norm}"

                attach-ip-to-instance ${KUBE_MASTER_IP} ${master_id}

                # This is a race between instance start and volume attachment.  There appears to be no way to start an AWS instance with a volume attached.
                # To work around this, we wait for volume to be ready in setup-master-pd.sh
                echo "Attaching persistent data volume (${MASTER_DISK_ID}) to master"
                $AWS_CMD attach-volume --volume-id ${MASTER_DISK_ID} --device /dev/sdb --instance-id ${master_id}

                sleep 10
                $AWS_CMD create-route --route-table-id $ROUTE_TABLE_ID --destination-cidr-block ${MASTER_IP_RANGE} --instance-id $master_id > $LOG

                break
              fi
              echo -e " ${color_yellow}[master not working yet]${color_norm}"
              attempt=$(($attempt+1))
              sleep 10
            done
  7. Write kubeconfig
            local kubectl="${KUBE_ROOT}/cluster/kubectl.sh"

            export KUBECONFIG=${KUBECONFIG:-$DEFAULT_KUBECONFIG}
            # KUBECONFIG determines the file we write to, but it may not exist yet
            if [[ ! -e "${KUBECONFIG}" ]]; then
            mkdir -p $(dirname "${KUBECONFIG}")
            touch "${KUBECONFIG}"
            fi
            local cluster_args=(
            "--server=${KUBE_SERVER:-https://${KUBE_MASTER_IP}}"
            )
            if [[ -z "${CA_CERT:-}" ]]; then
            cluster_args+=("--insecure-skip-tls-verify=true")
            else
            cluster_args+=(
            "--certificate-authority=${CA_CERT}"
            "--embed-certs=true"
            )
            fi

            local user_args=()
            if [[ ! -z "${KUBE_BEARER_TOKEN:-}" ]]; then
            user_args+=(
            "--token=${KUBE_BEARER_TOKEN}"
            )
            elif [[ ! -z "${KUBE_USER:-}" && ! -z "${KUBE_PASSWORD:-}" ]]; then
            user_args+=(
            "--username=${KUBE_USER}"
            "--password=${KUBE_PASSWORD}"
            )
            fi
            if [[ ! -z "${KUBE_CERT:-}" && ! -z "${KUBE_KEY:-}" ]]; then
            user_args+=(
            "--client-certificate=${KUBE_CERT}"
            "--client-key=${KUBE_KEY}"
            "--embed-certs=true"
            )
            fi

            "${kubectl}" config set-cluster "${CONTEXT}" "${cluster_args[@]}"
            if [[ -n "${user_args[@]:-}" ]]; then
            "${kubectl}" config set-credentials "${CONTEXT}" "${user_args[@]}"
            fi
            "${kubectl}" config set-context "${CONTEXT}" --cluster="${CONTEXT}" --user="${CONTEXT}"
            "${kubectl}" config use-context "${CONTEXT}"  --cluster="${CONTEXT}"

            # If we have a bearer token, also create a credential entry with basic auth
            # so that it is easy to discover the basic auth password for your cluster
            # to use in a web browser.
            if [[ ! -z "${KUBE_BEARER_TOKEN:-}" && ! -z "${KUBE_USER:-}" && ! -z "${KUBE_PASSWORD:-}" ]]; then
            "${kubectl}" config set-credentials "${CONTEXT}-basic-auth" "--username=${KUBE_USER}" "--password=${KUBE_PASSWORD}"
            fi
  8. Start minions
    1. Write node env
            local master=false
            local file=${KUBE_TEMP}/node-kube-env.yaml

            build-runtime-config

            rm -f ${file}
            cat >$file <<EOF
            ENV_TIMESTAMP: $(yaml-quote $(date -u +%Y-%m-%dT%T%z))
            INSTANCE_PREFIX: $(yaml-quote ${INSTANCE_PREFIX})
            NODE_INSTANCE_PREFIX: $(yaml-quote ${NODE_INSTANCE_PREFIX})
            CLUSTER_IP_RANGE: $(yaml-quote ${CLUSTER_IP_RANGE:-10.244.0.0/16})
            SERVER_BINARY_TAR_URL: $(yaml-quote ${SERVER_BINARY_TAR_URL})
            SERVER_BINARY_TAR_HASH: $(yaml-quote ${SERVER_BINARY_TAR_HASH})
            SALT_TAR_URL: $(yaml-quote ${SALT_TAR_URL})
            SALT_TAR_HASH: $(yaml-quote ${SALT_TAR_HASH})
            SERVICE_CLUSTER_IP_RANGE: $(yaml-quote ${SERVICE_CLUSTER_IP_RANGE})
            KUBERNETES_MASTER_NAME: $(yaml-quote ${MASTER_NAME})
            ALLOCATE_NODE_CIDRS: $(yaml-quote ${ALLOCATE_NODE_CIDRS:-false})
            ENABLE_CLUSTER_MONITORING: $(yaml-quote ${ENABLE_CLUSTER_MONITORING:-none})
            ENABLE_L7_LOADBALANCING: $(yaml-quote ${ENABLE_L7_LOADBALANCING:-none})
            ENABLE_CLUSTER_LOGGING: $(yaml-quote ${ENABLE_CLUSTER_LOGGING:-false})
            ENABLE_CLUSTER_UI: $(yaml-quote ${ENABLE_CLUSTER_UI:-false})
            ENABLE_NODE_LOGGING: $(yaml-quote ${ENABLE_NODE_LOGGING:-false})
            LOGGING_DESTINATION: $(yaml-quote ${LOGGING_DESTINATION:-})
            ELASTICSEARCH_LOGGING_REPLICAS: $(yaml-quote ${ELASTICSEARCH_LOGGING_REPLICAS:-})
            ENABLE_CLUSTER_DNS: $(yaml-quote ${ENABLE_CLUSTER_DNS:-false})
            ENABLE_CLUSTER_REGISTRY: $(yaml-quote ${ENABLE_CLUSTER_REGISTRY:-false})
            CLUSTER_REGISTRY_DISK: $(yaml-quote ${CLUSTER_REGISTRY_DISK:-})
            CLUSTER_REGISTRY_DISK_SIZE: $(yaml-quote ${CLUSTER_REGISTRY_DISK_SIZE:-})
            DNS_REPLICAS: $(yaml-quote ${DNS_REPLICAS:-})
            DNS_SERVER_IP: $(yaml-quote ${DNS_SERVER_IP:-})
            DNS_DOMAIN: $(yaml-quote ${DNS_DOMAIN:-})
            KUBELET_TOKEN: $(yaml-quote ${KUBELET_TOKEN:-})
            KUBE_PROXY_TOKEN: $(yaml-quote ${KUBE_PROXY_TOKEN:-})
            ADMISSION_CONTROL: $(yaml-quote ${ADMISSION_CONTROL:-})
            MASTER_IP_RANGE: $(yaml-quote ${MASTER_IP_RANGE})
            RUNTIME_CONFIG: $(yaml-quote ${RUNTIME_CONFIG})
            CA_CERT: $(yaml-quote ${CA_CERT_BASE64:-})
            KUBELET_CERT: $(yaml-quote ${KUBELET_CERT_BASE64:-})
            KUBELET_KEY: $(yaml-quote ${KUBELET_KEY_BASE64:-})
            NETWORK_PROVIDER: $(yaml-quote ${NETWORK_PROVIDER:-})
            HAIRPIN_MODE: $(yaml-quote ${HAIRPIN_MODE:-})
            OPENCONTRAIL_TAG: $(yaml-quote ${OPENCONTRAIL_TAG:-})
            OPENCONTRAIL_KUBERNETES_TAG: $(yaml-quote ${OPENCONTRAIL_KUBERNETES_TAG:-})
            OPENCONTRAIL_PUBLIC_SUBNET: $(yaml-quote ${OPENCONTRAIL_PUBLIC_SUBNET:-})
            E2E_STORAGE_TEST_ENVIRONMENT: $(yaml-quote ${E2E_STORAGE_TEST_ENVIRONMENT:-})
            KUBE_IMAGE_TAG: $(yaml-quote ${KUBE_IMAGE_TAG:-})
            KUBE_DOCKER_REGISTRY: $(yaml-quote ${KUBE_DOCKER_REGISTRY:-})
            KUBE_ADDON_REGISTRY: $(yaml-quote ${KUBE_ADDON_REGISTRY:-})
            MULTIZONE: $(yaml-quote ${MULTIZONE:-})
            NON_MASQUERADE_CIDR: $(yaml-quote ${NON_MASQUERADE_CIDR:-})
            EOF
            if [ -n "${KUBELET_PORT:-}" ]; then
            cat >>$file <<EOF
            KUBELET_PORT: $(yaml-quote ${KUBELET_PORT})
            EOF
            fi
            if [ -n "${KUBE_APISERVER_REQUEST_TIMEOUT:-}" ]; then
            cat >>$file <<EOF
            KUBE_APISERVER_REQUEST_TIMEOUT: $(yaml-quote ${KUBE_APISERVER_REQUEST_TIMEOUT})
            EOF
            fi
            if [ -n "${TERMINATED_POD_GC_THRESHOLD:-}" ]; then
            cat >>$file <<EOF
            TERMINATED_POD_GC_THRESHOLD: $(yaml-quote ${TERMINATED_POD_GC_THRESHOLD})
            EOF
            fi
            if [[ "${OS_DISTRIBUTION}" == "trusty" ]]; then
            cat >>$file <<EOF
            KUBE_MANIFESTS_TAR_URL: $(yaml-quote ${KUBE_MANIFESTS_TAR_URL})
            KUBE_MANIFESTS_TAR_HASH: $(yaml-quote ${KUBE_MANIFESTS_TAR_HASH})
            EOF
            fi
            if [ -n "${TEST_CLUSTER:-}" ]; then
            cat >>$file <<EOF
            TEST_CLUSTER: $(yaml-quote ${TEST_CLUSTER})
            EOF
            fi
            if [ -n "${KUBELET_TEST_ARGS:-}" ]; then
            cat >>$file <<EOF
            KUBELET_TEST_ARGS: $(yaml-quote ${KUBELET_TEST_ARGS})
            EOF
            fi
            if [ -n "${KUBELET_TEST_LOG_LEVEL:-}" ]; then
            cat >>$file <<EOF
            KUBELET_TEST_LOG_LEVEL: $(yaml-quote ${KUBELET_TEST_LOG_LEVEL})
            EOF
            fi
            if [ -n "${DOCKER_TEST_LOG_LEVEL:-}" ]; then
            cat >>$file <<EOF
            DOCKER_TEST_LOG_LEVEL: $(yaml-quote ${DOCKER_TEST_LOG_LEVEL})
            EOF
            fi
            if [ -n "${ENABLE_CUSTOM_METRICS:-}" ]; then
            cat >>$file <<EOF
            ENABLE_CUSTOM_METRICS: $(yaml-quote ${ENABLE_CUSTOM_METRICS})
            EOF
            fi
            if [[ "${master}" == "true" ]]; then
            # Master-only env vars.
            cat >>$file <<EOF
            KUBERNETES_MASTER: $(yaml-quote "true")
            KUBE_USER: $(yaml-quote ${KUBE_USER})
            KUBE_PASSWORD: $(yaml-quote ${KUBE_PASSWORD})
            KUBE_BEARER_TOKEN: $(yaml-quote ${KUBE_BEARER_TOKEN})
            MASTER_CERT: $(yaml-quote ${MASTER_CERT_BASE64:-})
            MASTER_KEY: $(yaml-quote ${MASTER_KEY_BASE64:-})
            KUBECFG_CERT: $(yaml-quote ${KUBECFG_CERT_BASE64:-})
            KUBECFG_KEY: $(yaml-quote ${KUBECFG_KEY_BASE64:-})
            KUBELET_APISERVER: $(yaml-quote ${KUBELET_APISERVER:-})
            ENABLE_MANIFEST_URL: $(yaml-quote ${ENABLE_MANIFEST_URL:-false})
            MANIFEST_URL: $(yaml-quote ${MANIFEST_URL:-})
            MANIFEST_URL_HEADER: $(yaml-quote ${MANIFEST_URL_HEADER:-})
            NUM_NODES: $(yaml-quote ${NUM_NODES})
            EOF
            if [ -n "${APISERVER_TEST_ARGS:-}" ]; then
            cat >>$file <<EOF
            APISERVER_TEST_ARGS: $(yaml-quote ${APISERVER_TEST_ARGS})
            EOF
            fi
            if [ -n "${APISERVER_TEST_LOG_LEVEL:-}" ]; then
            cat >>$file <<EOF
            APISERVER_TEST_LOG_LEVEL: $(yaml-quote ${APISERVER_TEST_LOG_LEVEL})
            EOF
            fi
            if [ -n "${CONTROLLER_MANAGER_TEST_ARGS:-}" ]; then
            cat >>$file <<EOF
            CONTROLLER_MANAGER_TEST_ARGS: $(yaml-quote ${CONTROLLER_MANAGER_TEST_ARGS})
            EOF
            fi
            if [ -n "${CONTROLLER_MANAGER_TEST_LOG_LEVEL:-}" ]; then
            cat >>$file <<EOF
            CONTROLLER_MANAGER_TEST_LOG_LEVEL: $(yaml-quote ${CONTROLLER_MANAGER_TEST_LOG_LEVEL})
            EOF
            fi
            if [ -n "${SCHEDULER_TEST_ARGS:-}" ]; then
            cat >>$file <<EOF
            SCHEDULER_TEST_ARGS: $(yaml-quote ${SCHEDULER_TEST_ARGS})
            EOF
            fi
            if [ -n "${SCHEDULER_TEST_LOG_LEVEL:-}" ]; then
            cat >>$file <<EOF
            SCHEDULER_TEST_LOG_LEVEL: $(yaml-quote ${SCHEDULER_TEST_LOG_LEVEL})
            EOF
            fi
            else
            # Node-only env vars.
            cat >>$file <<EOF
            KUBERNETES_MASTER: $(yaml-quote "false")
            ZONE: $(yaml-quote ${ZONE})
            EXTRA_DOCKER_OPTS: $(yaml-quote ${EXTRA_DOCKER_OPTS:-})
            EOF
            if [ -n "${KUBEPROXY_TEST_ARGS:-}" ]; then
            cat >>$file <<EOF
            KUBEPROXY_TEST_ARGS: $(yaml-quote ${KUBEPROXY_TEST_ARGS})
            EOF
            fi
            if [ -n "${KUBEPROXY_TEST_LOG_LEVEL:-}" ]; then
            cat >>$file <<EOF
            KUBEPROXY_TEST_LOG_LEVEL: $(yaml-quote ${KUBEPROXY_TEST_LOG_LEVEL})
            EOF
            fi
            fi
            if [ -n "${NODE_LABELS:-}" ]; then
            cat >>$file <<EOF
            NODE_LABELS: $(yaml-quote ${NODE_LABELS})
            EOF
            fi
            if [[ "${OS_DISTRIBUTION}" == "coreos" ]]; then
            # CoreOS-only env vars. TODO(yifan): Make them available on other distros.
            cat >>$file <<EOF
            KUBE_MANIFESTS_TAR_URL: $(yaml-quote ${KUBE_MANIFESTS_TAR_URL})
            KUBE_MANIFESTS_TAR_HASH: $(yaml-quote ${KUBE_MANIFESTS_TAR_HASH})
            KUBERNETES_CONTAINER_RUNTIME: $(yaml-quote ${CONTAINER_RUNTIME:-docker})
            RKT_VERSION: $(yaml-quote ${RKT_VERSION:-})
            RKT_PATH: $(yaml-quote ${RKT_PATH:-})
            KUBERNETES_CONFIGURE_CBR0: $(yaml-quote ${KUBERNETES_CONFIGURE_CBR0:-true})
            EOF
            fi
    2. Start minions with user data
            (
              # We pipe this to the ami as a startup script in the user-data field.  Requires a compatible ami
              echo "#! /bin/bash"
              echo "mkdir -p /var/cache/kubernetes-install"
              echo "cd /var/cache/kubernetes-install"
              echo "cat > kube_env.yaml << __EOF_KUBE_ENV_YAML"
              cat ${KUBE_TEMP}/node-kube-env.yaml
              echo "AUTO_UPGRADE: 'true'"
              # TODO: get rid of these exceptions / harmonize with common or GCE
              echo "DOCKER_STORAGE: $(yaml-quote ${DOCKER_STORAGE:-})"
              echo "API_SERVERS: $(yaml-quote ${MASTER_INTERNAL_IP:-})"
              echo "__EOF_KUBE_ENV_YAML"
              echo ""
              echo "wget -O bootstrap ${BOOTSTRAP_SCRIPT_URL}"
              echo "chmod +x bootstrap"
              echo "mkdir -p /etc/kubernetes"
              echo "mv kube_env.yaml /etc/kubernetes"
              echo "mv bootstrap /etc/kubernetes/"
              echo "cat > /etc/rc.local << EOF_RC_LOCAL"
              echo "#!/bin/sh -e"
              # We want to be sure that we don't pass an argument to bootstrap
              echo "/etc/kubernetes/bootstrap"
              echo "exit 0"
              echo "EOF_RC_LOCAL"
              echo "/etc/kubernetes/bootstrap"
            ) > "${KUBE_TEMP}/node-user-data"

            # Compress the data to fit under the 16KB limit (cloud-init accepts compressed data)
            gzip "${KUBE_TEMP}/node-user-data"

            local public_ip_option
            if [[ "${ENABLE_NODE_PUBLIC_IP}" == "true" ]]; then
              public_ip_option="--associate-public-ip-address"
            else
              public_ip_option="--no-associate-public-ip-address"
            fi
            local spot_price_option
            if [[ -n "${NODE_SPOT_PRICE:-}" ]]; then
              spot_price_option="--spot-price ${NODE_SPOT_PRICE}"
            else
              spot_price_option=""
            fi
            ${AWS_ASG_CMD} create-launch-configuration \
                --launch-configuration-name ${ASG_NAME} \
                --image-id $KUBE_NODE_IMAGE \
                --iam-instance-profile ${IAM_PROFILE_NODE} \
                --instance-type $NODE_SIZE \
                --key-name ${AWS_SSH_KEY_NAME} \
                --security-groups ${NODE_SG_ID} \
                ${public_ip_option} \
                ${spot_price_option} \
                --block-device-mappings "${NODE_BLOCK_DEVICE_MAPPINGS}" \
                --user-data "fileb://${KUBE_TEMP}/node-user-data.gz"

            echo "Creating autoscaling group"
            ${AWS_ASG_CMD} create-auto-scaling-group \
                --auto-scaling-group-name ${ASG_NAME} \
                --launch-configuration-name ${ASG_NAME} \
                --min-size ${NUM_NODES} \
                --max-size ${NUM_NODES} \
                --vpc-zone-identifier ${SUBNET_ID} \
                --tags ResourceId=${ASG_NAME},ResourceType=auto-scaling-group,Key=Name,Value=${NODE_INSTANCE_PREFIX} \
                       ResourceId=${ASG_NAME},ResourceType=auto-scaling-group,Key=Role,Value=${NODE_TAG} \
                       ResourceId=${ASG_NAME},ResourceType=auto-scaling-group,Key=KubernetesCluster,Value=${CLUSTER_ID}

            # Wait for the minions to be running
            # TODO(justinsb): This is really not needed any more
            local attempt=0
            local max_attempts=30
            # Spot instances are slower to launch
            if [[ -n "${NODE_SPOT_PRICE:-}" ]]; then
              max_attempts=90
            fi
            while true; do
              find-running-minions > $LOG
              if [[ ${#NODE_IDS[@]} == ${NUM_NODES} ]]; then
                echo -e " ${color_green}${#NODE_IDS[@]} minions started; ready${color_norm}"
                break
              fi

              if (( attempt > max_attempts )); then
                echo
                echo "Expected number of minions did not start in time"
                echo
                echo -e "${color_red}Expected number of minions failed to start.  Your cluster is unlikely" >&2
                echo "to work correctly. Please run ./cluster/kube-down.sh and re-create the" >&2
                echo -e "cluster. (sorry!)${color_norm}" >&2
                exit 1
              fi

              echo -e " ${color_yellow}${#NODE_IDS[@]} minions started; waiting${color_norm}"
              attempt=$(($attempt+1))
              sleep 10
            done
  9. Wait for master
            find-master-pd
            if [[ -n "${MASTER_DISK_ID:-}" ]]; then
              KUBE_MASTER_IP=$(get-tag ${MASTER_DISK_ID} ${TAG_KEY_MASTER_IP})
            fi
            KUBE_MASTER=${MASTER_NAME}
            if [[ -z "${KUBE_MASTER_IP:-}" ]]; then
              echo "Could not detect Kubernetes master node IP.  Make sure you've launched a cluster with 'kube-up.sh'"
              exit 1
            fi
            until $(curl --insecure --user ${KUBE_USER}:${KUBE_PASSWORD} --max-time 5 \
              --fail --output $LOG --silent https://${KUBE_MASTER_IP}/healthz); do
              printf "."
              sleep 2
            done
  10. Check cluster
            sleep 5

            detect-nodes > $LOG

            # Don't bail on errors, we want to be able to print some info.
            set +e

            # Basic sanity checking
            # TODO(justinsb): This is really not needed any more
            local rc # Capture return code without exiting because of errexit bash option
            for (( i=0; i<${#KUBE_NODE_IP_ADDRESSES[@]}; i++)); do
              # Make sure docker is installed and working.
              local attempt=0
              while true; do
                local minion_ip=${KUBE_NODE_IP_ADDRESSES[$i]}
                echo -n "Attempt $(($attempt+1)) to check Docker on node @ ${minion_ip} ..."
                local output=`check-minion ${minion_ip}`
                echo $output
                if [[ "${output}" != "working" ]]; then
                  if (( attempt > 9 )); then
                    echo
                    echo -e "${color_red}Your cluster is unlikely to work correctly." >&2
                    echo "Please run ./cluster/kube-down.sh and re-create the" >&2
                    echo -e "cluster. (sorry!)${color_norm}" >&2
                    exit 1
                  fi
                else
                  break
                fi
                attempt=$(($attempt+1))
                sleep 30
              done
            done


Inside the past few years, our business absorbed and digested advanced technologies equally at home and abroad. Meanwhile, our corporation staffs a workforce of experts devoted to your progress of White Kidney Bean , White Kidney Beans , Navy White Kidney Beans , We welcome you to visit our factory and look forward to establishing friendly business relationships with customers at home and abroad in the near future.
"In the past few years, our company absorbed and digested advanced technologies both at home and abroad. Meanwhile, our company staffs a team of experts devoted to the development of White Kidney Bean , White Kidney Beans , Navy White Kidney Beans , Our company always concentrate on the development of the international market. We now have a lot of customers in Russia European countries the USA the Middle East countries and Africa countries. We always follow that quality is foundation while service is guarantee to meet all customers.


text:
Q: How easy is to crack the following copy protection? I am trying to copy-protect some work, which is a bootable SD card booting a Linux kernel on ARM device (Raspberry Pi). I am using this approach:

*

*The approach uses an initrd to mount an encrypted root filesystem.

*The initrd generates the filesystems' password according to the CID of the SD card. (a hash function is used, did not decide yet over md5 or sha1). Initrd will try to mount the filesystem using that generated password.

*Now here is the most interesting/suspect part: The initrd itself is encrypted using a custom C function, basically each byte is XOR'ed using a custom made pseudo random generator.
Kernel is modified to have the same encrypting function, which works as decryptor.

*The system itself is stripped down so there is no way to use a keyboard or external storage. A single app runs full-screen.

So after the bootloader loads kernel and initrd, the kernel decrypts the initrd and executes its init script, which will generate the password and mount the root filesystem.
My question is: How easy it would be to break this setup (to decrypt the root filesystem and make it boot from any SD card)? What are the most weakest parts? How easy is to decompile the kernel and find those custom encrypting functions?
EDIT: Here are some corrections so you don't waste time with the obvious things:

*

*The root device will be encrypted with LUKS (aes256) and the key will be generated by some HMAC function using SD card's CID and some salt.

*The pseudo random algorithm for initramfs encrypting will be in fact RC4, just the key will be generated using some custom function, because if I just store the key in a byte array it makes it dead simple to retrieve it (yeah this is security through obscurity but there seem no other way).

*I understand that if using a SD card emulator someone can make a copy of this system start but this is OK with me, because its pretty difficult and not anyone can do this.(also not anyone will want to deal with emulators)

A:
How easy it would be to break this setup (to decrypt the root
  filesystem and make it boot from any sd card)?

How hard it is to "break" your setup depends on the number of bits of entropy in whatever method you're using to sign/encrypt the filesystem itself (as this determines the total number of unique combinations that can be used to brute-force the password).

What are the most weakest parts?

Without a doubt, using a predefined CID as a password, as well as using a custom pseudo-random number generation function.
The CID of an SD card is only supposed to be read-only, but it's not uncommon to find non-compliant flash memory devices in this day and age.  Some people have even demonstrated the ability to overwrite the CID with certain SD cards.  This would make it easier to brute-force the password, especially if one is just emulating an SD card after cloning yours (which is something else you might want to consider).
Finally, using any kind of pseudo-random number generator already has some intrinsic flaws, precisely because it's not random - there is a reason it's called pseudo-random.  It might be better to use a pre-made encrypted bootloader (like TrueCrypt or LUKS, which both work on the Raspberry Pi) and avoid having to make any manual kernel modifications.

How easy is to decompile the kernel and find those custom encrypting
  functions?

It's very difficult to decompile anything.  Conversely, de-assembly of a compiled application is often trivial, and there are many tools which can be used to assist with reverse engineering assembly back into another higher-level language.  If an attacker has access even to a compiled kernel, analyzing something like a pseudo-random number generator is probably trivial unless the code is obfuscated on purpose.

TL,DR: Don't re-invent the wheel when it comes to encryption and security, stick with the tried and true.  There are several full-disk encryption options that are already available and have been demonstrated to work just fine on the Raspberry Pi.  I would avoid using the CID of the SD card as a kind of "password" - even if it cannot be changed, there are ways to spoof this value.
Copy protection is already included in the SD card specification as CPRM.

A: Someone skilled wouldn't have much trouble cracking this. It'd be relatively easy to boot the SD card under an emulator, and then just read the keys out of RAM. Then they post a version without the copy protection to the Pirate Bay (etc.), and that's that.
Alternatively, use the emulator to inject shellcode into the running emulated system. Then use the running system to copy the decrypted rootfs off (or read the keys using dmsetup table --showkeys, etc.)
A quick search turns up the existence of Raspberry Pi emulators, so part of the work has already been done.
You've got another problem, in particular this:

Kernel is modified to have the same encrypting function, which works as decryptor.

Anyone you distribute this to is entitled to the kernel source code, under the terms of the GPL. So you wouldn't need to disassemble it, you could just use diff to find the extra function.
(Not that finding it through disassembly would be that hard, as you can e.g., check vs. a stock kernel)
I'm not completely familiar with the Raspberry Pi boot code, but if you can reflash the bootloader with an embedded crypto key (that is then passed to the kernel), that'd at least not be on the SD card, so it'd foil an attempt to get it to boot in an emulator.

redpajama_set_name: RedPajamaStackExchange


I recently received an order from Bello Modo (one of my favorite online bead stores) with some pretty new beads called Fiesta and thought they might be a nice addition to these colors.
The pinkish color looked really pretty outlining the flower shapes and for some extra punch, I filled in the diamond shapes with shimmery blue beads. I also made some macrame earrings to match the bracelet and added starfish dangles.
The earrings were so cute, I had to make a pair in tan and turquoise, too.
The weather here has been cold and rainy and miserable, so working with these colors keeps me dreaming of sun and sandy beaches! I'm thinking I might have to make a necklace next. What do you think?
If you'd like to try your hand at making micro macrame jewelry pieces like these, you'll find the bracelet pattern in the Hydrangeas Micro Macrame Bracelet Tutorial in my Etsy shop. Both the earrings and bracelet are covered in the Hydrangeas Micro Macrame Bracelet and Earrings Class on CraftArtEdu.com if you prefer that format.


In the first phase of the show, a girl came specifically for a boy on the scene. The girl boldly expressed love to the boy. The boy squatted for a moment and did not know how to respond. The girl understood his true intentions from the boy's hesitation, and then he explained to him: Then you will sing a song for me, then accompany me to the exit. They did not succeed in the end. The guest teachers at the scene expressed their appreciation for the courage of the girl, and lamented that in the face of love, the girls can take the initiative to express their confession, not much. Suddenly remembered a sentence I saw a few days ago: the children only confessed, adults are directly seduce. The confession is derived from a shameful and unsure love, and seduce, from the illusory desires, is totally different [url=www.designerindex.net/marlboro]Wholesale Cigarettes Free Shipping[/url]. The more love is, the more embarrassing it is. The more hungry the tiger is, the more it decides to decide, but the more it has nothing to do with love. Zhu Yingtai and Liang Shanbo spent the same three years at the same table. They had long been in love, but they were sent in eighteen miles, and eighteen temptations were used. The word of love could not be said. "There are branches of wood and eucalyptus. I don't know if I am happy." If Zhu Yingtai can express his words to Liang Shanbo earlier [url=www.prideconcept.com/marlboro]Marlboro Lights Online[/url], will they finally end up with a butterfly ending? Throwing hydrangea should be an important way for ancient women to express their love. Wang Baozheng was the prime minister of the government. In the same year, he chose the protagonist, and firmly used the hydrangea to smash the poor boy Xue Pinggui, who did not hesitate to break with his family. In the 18 years of the cold kiln, it was only exchanged for 18 days of reunion. If she really knows what to do, I don��t know if she would regret the original choice. A broken kite accidentally fell into the backyard of Zhan��s house, and she was picked up by Ms. On the kite, there is a sensation of spring wounds and poems written by Han Shixun, a scholar, and Shujuan loves the talents of the scholars, and he is ashamed of rhyming rhyme. After several twists and turns, it is finally a lover. A "Kite Mistake" tells you that the dragon and the phoenix match, the snake and the rat have a nest, the so-called karma, only you boldly confession, everything is possible. Zhang Ailing met Hu Lancheng, and a lonely heart was defeated in an instant. All the affection was only made into one sentence: Oh, you are here too! And Hu Lancheng��s confession seems to be more gentle and beautiful. He said: May The years are quiet, and the world is stable! However, how can Ailing know that his years are quiet and he will use a lot of disappointment to arrive. "The wind and the flowers will be old, and the best will continue. The unconcerned people, the empty knots Xue Tao, a talented woman in the Tang Dynasty, made her own peach blossoms and loved her poems. She hoped to find someone who truly understood her. It��s a pity that the genius of the genius is more affectionate. They just admire her glamorous and talented women��s fame. The customs are hidden in the dust, Xue Tao still can only guard the love in the poetry, coveted alone. Qin Guan's sentence "If the two emotions are long, they are squatting in the dynasty." "The confession of love has evolved into a kind of waiting for forbearance. However, "10,000 years is too long, just for the evening." What I appreciate more is the kind of love that can be said. Red �� falls in love with Li Jing. From the time of the night, I sang the woman, and I sang the rivers and lakes. I passed down the ages and talked about "I want to be one heart, and the white head is not separated." "Zhu Wenjun loves the boss Ma Xiangru, and a song "Feng Qiu Huang" is their best confession of love. From now on, even if the person around you is enough, Lin Yongjian is in love with Zhou Dongqi, still not The eye-catching supporting role actor, finally plucked up the courage to come out to eat in the winter, if there was a stomach, I wanted to confess to her, but for a long time, I only asked: Do you want to marry me? A man in the mountain fell in love with the village. A girl, but she didn't know how to confess to her [url=www.wholesalenewport.com]Cheap Newport 100[/url]. She just took a morning dew to the mountain and picked up a big, red mountain pomegranate and quietly placed it on the girl's window sill. Then she turned and left without saying a word. Finally one day. The girl pushed open the window and shouted at the back that she wanted to sneak away [url=www.webvipsmoking.com]Buying Marlboro Cigarettes Online[/url]. Hey, do you want me to marry this mountain pomegranate? Even though there is a mountain-like tsunami-like love, if you don��t say it, how about her? Can understand. So, if you love, please say it out loud, in the river. I am a lady, a gentleman is good at him, but I don��t see it in a day, like March! He Xiao Xiao, one day is not seen. Such as the three autumn "poetry There are too many verses that boldly express love in the scriptures. It is as simple as vernacular, but it is also the most beautiful language about love. It brings out the red beans of the South [url=www.designerindex.net/marlboro]Marlboro 100S Carton[/url], and finally opens a tree of Acacia. In your life, you will always wait for that life. The love of people who confess to you.