{
  inputs,
  pkgs,
  paths,
  elib,
  lib,
  ...
}: let
  inherit
    (lib)
    mkMerge
    filterAttrs
    mapAttrs
    recursiveUpdate
    ;
in {
  resource."kubernetes_manifest"."gateway-crd" = {
    manifest = lib.filterAttrs (n: v: n != "status") (import ./crds/gateway.nix);
  };

  resource."kubernetes_manifest"."http-route-crd" = {
    manifest = lib.filterAttrs (n: v: n != "status") (import ./crds/http-route.nix);
  };

  resource."kubernetes_manifest"."reference-grant-crd" = {
    manifest = lib.filterAttrs (n: v: n != "status") (import ./crds/reference-grant.nix);
  };

  resource."kubernetes_manifest"."gateway-class-crd" = {
    manifest = lib.filterAttrs (n: v: n != "status") (import ./crds/gateway-class.nix);
  };

  resource."kubernetes_manifest"."tls-route-crd" = {
    manifest = lib.filterAttrs (n: v: n != "status") (import ./crds/tls-route.nix);
  };

  resource."kubernetes_manifest"."grpc-route-crd" = {
    manifest = lib.filterAttrs (n: v: n != "status") (import ./crds/grpc-route.nix);
  };

  resource."kubernetes_manifest"."udp-route-crd" = {
    manifest = lib.filterAttrs (n: v: n != "status") (import ./crds/udp-route.nix);
  };

  resource."kubernetes_manifest"."tcp-route-crd" = {
    manifest = lib.filterAttrs (n: v: n != "status") (import ./crds/tcp-route.nix);
  };

  resource."kubernetes_manifest"."backend-tls-policy-crd" = {
    manifest = lib.filterAttrs (n: v: n != "status") (import ./crds/backend-tls-policy.nix);
  };

  resource."kubernetes_namespace"."metallb-system" = {
    metadata = {
      name = "metallb-system";
    };
  };

  resource."kubernetes_namespace"."istio-system" = {
    metadata = {
      name = "istio-system";

      # has to be kept in sync with `main` profile
      labels = {
        "istio.io/rev" = "1-20-2";
      };
    };
  };

  imports = [
    (elib.terraformModule {
      name = "kubernetes";
      source = {config, ...}: {
        imports = [
          (inputs.uk3s-nix.legacyPackages.${pkgs.stdenv.system}.helm2nix2terraform {
            path = "${paths.root}/terranix/prepare/kubernetes";
            predicate = chart: name: manifest:
              manifest.kind == "CustomResourceDefinition";
            mapper = resource:
              if resource.manifest.kind == "CustomResourceDefinition"
              then
                (resource
                  // {
                    manifest =
                      resource.manifest
                      // {
                        metadata = filterAttrs (n: _: n != "creationTimestamp") resource.manifest.metadata;
                      };
                  })
              else resource;
          })
        ];

        resource."kubernetes_manifest" = {
          "default_CustomResourceDefinition_bgppeers_metallb_io" = {
            computed_fields = [
              "spec.conversion.webhook.clientConfig.caBundle"
            ];
          };
        };
      };
    })
  ];
}