{
  fip_controller | default = {
    name                  | default = "fip-controller",
    namespace             | default = "kube-system",
    catalog_ref           | default = "fip_controller",

    image                 | default = "daoreg.librecloud.online/solera/fip-controller",
    image_tag             | default = "0.1.0",

    alias_agent_image     | default = "daoreg.librecloud.online/solera/fip-alias-agent",
    alias_agent_image_tag | default = "0.1.0",

    alias_agent_namespace | default = "kube-system",
    alias_agent_selector  | default = "app.kubernetes.io/name=fip-alias-agent",

    # Hard node-label constraints applied to the controller Deployment only (the
    # alias-agent DaemonSet is multi-arch and must run on every node). Empty =>
    # no nodeSelector emitted. Used to pin the single-arch (arm64) controller
    # image away from mixed-arch (x86_64) nodes until it ships a multi-arch manifest.
    node_selector         | default = {},

    # Array of FIP configurations. Each entry is one of:
    #   { mode = 'follow_pod, fip_name = "...", pod_label_selector = "...", pod_namespace = "...",
    #     node_eligible_label = "can_use_fip.rvprxy=true" }   -- optional
    #   { mode = 'pinned,      fip_name = "...", pinned_node = "libre-wuji-wrk-0" }
    fips                  | default = [],

    operations | default = {
      install = true,
      update  = true,
      delete  = true,
      restart = true,
    },

    live_check | default = {
      strategy = 'k8s_pods,
      scope    = 'cp_only,
    },
  },
}