let _concerns_lib = import "schemas/lib/concerns.ncl" in

{
  ETCDEndpoint = {
    prot | String,
    name | String | optional,
    addr | String | optional,
    port | Number,
  },

  Kubernetes = {
    name | String,
    version | String,
    major_version | String,
    cri
      | String
      | doc "Container runtime interface: crio or containerd",
    runtime_default
      | String
      | doc "Default OCI runtime (crun, runc, youki)",
    runtimes
      | String
      | doc "Comma-separated list of enabled OCI runtimes",
    cni | String,
    cni_version | String,
    bind_port | Number,
    timeout_cp | String,
    certs_dir | String,
    auth_mode | String,
    taints_effect | String,
    pull_policy | String,
    addons | String,
    tpl | String,
    repo | String,
    dns_domain | String,
    pod_net | String,
    service_net | String,
    cert_sans | Array Dyn,
    external_ips | Array Dyn,
    cluster_name | String,
    hostname | String,
    cp_ip | String | optional,
    cp_name | String,
    ip | String,
    mode
      | std.enum.TagOrString
      | doc "Node role: controlplane or worker",
    cmd_task | String,
    admin_user | String,
    target_path | String,
    taint_node | Bool,
    etcd_mode
      | std.enum.TagOrString
      | doc "etcd topology: stacked (embedded) or external",
    etcd_prefix | String,
    etcd_endpoints | Array Dyn,
    etcd_ca_path | String,
    etcd_cert_path | String,
    etcd_key_path | String,
    etcd_cluster_name | String,
    etcd_peers | String,
    prov_etcd_path | String,
    etcd_certs_path | String,
    install_log_path | String,
    work_path | String,
    skip_phases
      | Array Dyn
      | doc "kubeadm phases to skip, e.g. [\"addon/kube-proxy\"] when cilium replaces kube-proxy",
    node_roles
      | Array String
      | doc "Role labels applied post-join via node-role.kubernetes.io/<role>=. Worker nodes SSH to K8S_MASTER to apply since admin.conf is only on the control-plane."
      | default = [],
    sysctl | {
      disable_ipv6 | Bool,
    },

    # ServiceConcerns umbrella (ADR-008). Kubernetes control plane / kubelet —
    # state lives in etcd (captured by SystemBackupDef.etcd) and PKI files
    # captured by SystemBackupDef.k8s_certs.
    concerns | _concerns_lib.ServiceConcerns | optional,

    ..
  },
}