let mp = import "schemas/lib/manifest_plan.ncl" in

{
  manifest_plan | mp.ManifestPlan = {
    init = [
      # Credentials first: controller cannot start without the token.
      { action = 'create-credentials },

      { file = "serviceaccount",    action = 'apply },
      { file = "clusterrole",       action = 'apply },
      { file = "clusterrolebinding", action = 'apply },
      { file = "configmap",         action = 'apply },

      # DaemonSet before controller — alias agent must be running on every
      # node before the first FIP migration can be attempted.
      { file = "daemonset",         action = 'apply },
      { file = "deployment",        action = 'apply },

      { action = 'wait-ready },
    ],

    update = [
      { file = "configmap",  action = 'apply },
      { action = 'create-credentials },
      {
        file   = "deployment",
        action = 'rollout-restart,
        delay  = 3,
        post   = [
          { action = 'wait-ready },
        ],
      },
    ],

    delete = [
      { file = "deployment",         action = 'delete },
      { file = "daemonset",          action = 'delete },
      { file = "configmap",          action = 'delete },
      { action = 'delete-credentials },
      { file = "clusterrolebinding", action = 'delete },
      { file = "clusterrole",        action = 'delete },
      { file = "serviceaccount",     action = 'delete },
    ],

    restart = [
      {
        file   = "deployment",
        action = 'rollout-restart,
        post   = [
          { action = 'wait-ready },
        ],
      },
    ],
  },
}