let mp = import "schemas/lib/manifest_plan.ncl" in

{
  manifest_plan | mp.ManifestPlan = {
    init = [
      { file = "pool",    action = 'apply, skip_if_exists = true },
      { file = "gateway", action = 'apply },
    ],
    update = [
      # Pool is infra-stable (CIDR + owning-gateway selector); skip if it already
      # exists. Re-applying the CiliumLoadBalancerIPPool (cilium.io/v2) trips a
      # kubectl client-side-merge openapi fetch that 404s on k0s, which would abort
      # the plan before the gateway is reconciled. Gateway apply (the part that
      # re-emits the declarative HTTPS listeners) is unaffected.
      { file = "pool",    action = 'apply, skip_if_exists = true },
      { file = "gateway", action = 'apply },
    ],
    delete = [
      { file = "gateway", action = 'delete },
      { file = "pool",    action = 'delete },
    ],
  },
}