let _concerns_lib = import "schemas/lib/concerns.ncl" in

{
  HetznerCSI = {
    version
      | String
      | doc "Hetzner CSI driver version (github.com/hetznercloud/csi-driver releases)"
      | default = "2.21.2",

    storage_class_name
      | String
      | doc "Name for the provisioned StorageClass"
      | default = "hcloud-volumes",

    default_fs_type
      | std.enum.TagOrString
      | doc "Default filesystem type for new volumes: ext4 or xfs"
      | default = 'ext4,

    reclaim_policy
      | std.enum.TagOrString
      | doc "PersistentVolume reclaim policy: Retain keeps the Hetzner Volume on PVC delete, Delete removes it"
      | default = 'Retain,

    allow_volume_expansion
      | Bool
      | doc "Allow online resize via kubectl patch pvc — only grow, never shrink"
      | default = true,

    token_secret_name
      | String
      | doc "Name of the K8s Secret in kube-system holding the HCLOUD_TOKEN key"
      | default = "hcloud",

    enable_snapshot_class
      | Bool
      | doc "Deploy external-snapshotter CRDs + controller and VolumeSnapshotClass for K8s-native PVC snapshots. Requires Hetzner CSI >= 2.0. Off by default — enable when applications need VolumeSnapshot support."
      | default = false,

    kubelet_dir
      | String
      | doc "Host kubelet data directory the csi-node DaemonSet binds for NodeStage/NodePublish and plugin registration. MUST match the distro: kubeadm uses /var/lib/kubelet (default); k0s uses /var/lib/data/k0s/kubelet. A wrong value makes NodeStage mount into a path kubelet never reads, so every PVC silently falls back to an empty local dir (data on node root fs, not the volume) — see qa hcloud-csi-node-k0s-kubeletdir."
      | default = "/var/lib/kubelet",

    # ServiceConcerns umbrella (ADR-008). CSI driver — infrastructure_glue preset.
    concerns | _concerns_lib.ServiceConcerns | optional,

    ..
  },
}