let _presets = (import "schemas/lib/concerns_presets.ncl").presets in

{
  kubernetes | default = {
    name            | default = "kubernetes",
    cmd_task        | default = "install",
    version         | default = "1.35.3",
    major_version   | default = "1.35",
    cri             | default = "crio",
    runtime_default | default = "crun",
    runtimes        | default = "crun,runc",
    cni             | default = "cilium",
    cni_version     | default = "",
    bind_port       | default = 6443,
    timeout_cp      | default = "4m0s",
    certs_dir       | default = "/etc/kubernetes/pki",
    auth_mode       | default = "Node,RBAC",
    taints_effect   | default = "PreferNoSchedule",
    pull_policy     | default = "IfNotPresent",
    addons          | default = "",
    tpl             | default = "kubeadm-config.yaml.j2",
    repo            | default = "registry.k8s.io",
    dns_domain      | default = "cluster.local",
    pod_net         | default = "10.244.0.0/16",
    service_net     | default = "10.96.0.0/12",
    cert_sans       | default = ["{{hostname}}", "{{cluster_name}}", "127.0.0.1"],
    external_ips    | default = [],
    cluster_name    | default = "k8s-cluster",
    hostname        | default = "k8s-node",
    cp_ip           | default = null,
    cp_name         | default = "controlplane",
    ip              | default = "10.0.0.1",
    mode            | default = "controlplane",
    admin_user      | default = "root",
    target_path     | default = "/opt/kubernetes",
    taint_node      | default = true,
    etcd_mode       | default = "stacked",
    etcd_prefix     | default = "",
    etcd_endpoints  | default = [],
    etcd_ca_path    | default = "/etc/kubernetes/pki/etcd/ca.crt",
    etcd_cert_path  | default = "/etc/kubernetes/pki/apiserver-etcd-client.crt",
    etcd_key_path   | default = "/etc/kubernetes/pki/apiserver-etcd-client.key",
    etcd_cluster_name | default = "",
    etcd_peers      | default = "",
    prov_etcd_path  | default = "etcdcerts",
    etcd_certs_path | default = "etcd_certs",
    install_log_path | default = "/tmp/k8s.log",
    work_path       | default = "/opt/kubernetes/$cluster_name",
    skip_phases     | default = [],
    node_roles      | default = [],
    sysctl | default = {
      disable_ipv6 | default = false,
    },
    operations | default = {
      install   = true,
      reinstall = true,
      delete    = true,
      health    = true,
    },
    # Default live_check is for control-plane profile (k8s_api).
    # Worker profile overrides this in the workspace NCL:
    #   live_check = { strategy = 'k8s_nodes, scope = 'workers_only }
    live_check | default = {
      strategy = 'k8s_api,
      scope    = 'cp_only,
    },

    # ServiceConcerns default — Kubernetes; stateless preset with custom tls/certs/backup reasons.
    concerns | default = _presets.stateless & {
      tls    | force = { kind = 'disabled, reason = "kubelet/apiserver TLS managed by kubeadm; PKI captured by SystemBackupDef.k8s_certs" },
      certs  | force = { kind = 'disabled, reason = "ACME issuance handled by cert-manager component, not kubeadm" },
      backup | force = { kind = 'disabled, reason = "stateless at component level: cluster state in etcd (SystemBackupDef.etcd), PKI files in SystemBackupDef.k8s_certs" },
    },
  },
}