# Cilium TaskServ Contracts - Type Definitions
# Migrated from: provisioning/extensions/taskservs/networking/cilium/kcl/cilium.k

let _concerns_lib = import "schemas/lib/concerns.ncl" in

{
  # Main Cilium CNI configuration
  Cilium = {
    name | String,
    version | String,
    cluster_name
      | String
      | doc "Kubernetes cluster name passed to cilium install --cluster-name"
      | default = "",
    cluster_id
      | Number
      | doc "Numeric cluster ID used for ClusterMesh identity (0 = disabled)"
      | default = 0,
    enable_ingress_controller
      | Bool
      | doc "Enable Cilium's built-in L7 Ingress controller"
      | default = false,
    ingress_lb_mode
      | std.enum.TagOrString
      | doc "LoadBalancer mode for the ingress controller: shared (one LB per cluster) or dedicated (one LB per Ingress)"
      | default = 'shared,
    kube_proxy_replacement
      | Bool
      | doc "Replace kube-proxy with Cilium eBPF datapath. Requires kubeadm skip_phases = [\"addon/kube-proxy\"]"
      | default = false,
    socket_lb
      | Bool
      | doc "Enable socket-level load balancing (eBPF hooks at socket layer). Disable if it interferes with host-network connections (e.g. apiserver→etcd gRPC)"
      | default = true,
    envoy_enabled
      | Bool
      | doc "Deploy cilium-envoy DaemonSet (required for L7 policies and Gateway API). Must be true when enable_gateway_api=true"
      | default = true,
    enable_gateway_api
      | Bool
      | doc "Enable Kubernetes Gateway API support. Requires envoy_enabled=true and Gateway API CRDs pre-installed. Installs standard-channel CRDs automatically."
      | default = false,
    gateway_api_version
      | String
      | doc "Gateway API CRDs version to install when enable_gateway_api=true"
      | default = "v1.2.1",
    k8s_service_host
      | String
      | doc "Control-plane IP for kubeProxyReplacement init. Empty = auto-detect from KUBECONFIG. Required when kube_proxy_replacement=true on kubeadm clusters (workers cannot reach 127.0.0.1:6443)"
      | default = "",
    k8s_service_port
      | Number
      | doc "Control-plane API port paired with k8s_service_host"
      | default = 6443,

    public_fip
      | String
      | doc "Public IP for the cluster-level Gateway. When set and enable_gateway_api=true, install-cilium.sh creates a CiliumLoadBalancerIPPool and a Gateway named gateway_name in kube-system. For HCCM-managed clusters (wuji), this is the Cilium LB pool IP; for direct FIP clusters (daoshi), this is the Hetzner FIP IP."
      | optional,
    gateway_name
      | String
      | doc "Name of the cluster-level Gateway resource created when public_fip is set. Defaults to cluster_name."
      | optional,
    gateway_sharing_key
      | String
      | doc "When set, the cluster-level Gateway is created with lbipam.cilium.io/sharing-key annotation so multiple Gateways can share the same LB IP. Required on HCCM clusters where multiple services share a single FIP."
      | optional,
    private_fip
      | String
      | doc "Internal/VPN IP for an optional cluster-level private Gateway. When set and enable_gateway_api=true, install-cilium.sh creates a CiliumLoadBalancerIPPool and a Gateway named private_gateway_name in kube-system. Useful for VPN-only services that share an internal LB IP (e.g. Longhorn dashboard, internal Odoo)."
      | optional,
    private_gateway_name
      | String
      | doc "Name for the private Gateway resource created when private_fip is set. Defaults to 'private-gateway' to match the catalog component convention."
      | optional,

    enable_l2_announcement
      | Bool
      | doc "Enable Cilium L2 Announcements (ARP-based VIP advertisement on L2 segments). Requires enable_l2_neigh_discovery=true. Needed for LB-IPAM VIPs to be reachable from external hosts on the same Hetzner private network segment."
      | default = false,
    enable_l2_neigh_discovery
      | Bool
      | doc "Enable Cilium L2 neighbor discovery. Prerequisite for enable_l2_announcement. When true, Cilium detects L2 neighbors and can respond to ARP for LB-IPAM VIPs."
      | default = false,

    # ServiceConcerns umbrella (ADR-008). CNI controller — state in K8s API.
    concerns | _concerns_lib.ServiceConcerns | optional,

    ..
  },
}