@kilic.dev/pulumi-k8s-crds 1.6.5 → 1.7.0

package/dist/types/output.d.ts

@@ -28,9 +28,9 @@ export declare namespace acme {
              */
             authorizationURL: string;
             /**
-             * dnsName is the identifier that this challenge is for, e.g. example.com.
+             * dnsName is the identifier that this challenge is for, e.g., example.com.
              * If the requested DNSName is a 'wildcard', this field MUST be set to the
-             * non-wildcard domain, e.g. for `*.example.com`, it must be `example.com`.
+             * non-wildcard domain, e.g., for `*.example.com`, it must be `example.com`.
              */
             dnsName: string;
             issuerRef: outputs.acme.v1.ChallengeSpecIssuerRef;
@@ -115,9 +115,9 @@ export declare namespace acme {
              */
             authorizationURL: string;
             /**
-             * dnsName is the identifier that this challenge is for, e.g. example.com.
+             * dnsName is the identifier that this challenge is for, e.g., example.com.
              * If the requested DNSName is a 'wildcard', this field MUST be set to the
-             * non-wildcard domain, e.g. for `*.example.com`, it must be `example.com`.
+             * non-wildcard domain, e.g., for `*.example.com`, it must be `example.com`.
              */
             dnsName: string;
             issuerRef: outputs.acme.v1.ChallengeSpecIssuerRefPatch;
@@ -1052,7 +1052,7 @@ export declare namespace acme {
              * when challenges are processed.
              * This can contain arbitrary JSON data.
              * Secret values should not be specified in this stanza.
-             * If secret values are needed (e.g. credentials for a DNS service), you
+             * If secret values are needed (e.g., credentials for a DNS service), you
              * should use a SecretKeySelector to reference a Secret resource.
              * For details on the schema of this field, consult the webhook provider
              * implementation's documentation.
@@ -1070,7 +1070,7 @@ export declare namespace acme {
             /**
              * The name of the solver to use, as defined in the webhook provider
              * implementation.
-             * This will typically be the name of the provider, e.g. 'cloudflare'.
+             * This will typically be the name of the provider, e.g., 'cloudflare'.
              */
             solverName: string;
         }
@@ -1084,7 +1084,7 @@ export declare namespace acme {
              * when challenges are processed.
              * This can contain arbitrary JSON data.
              * Secret values should not be specified in this stanza.
-             * If secret values are needed (e.g. credentials for a DNS service), you
+             * If secret values are needed (e.g., credentials for a DNS service), you
              * should use a SecretKeySelector to reference a Secret resource.
              * For details on the schema of this field, consult the webhook provider
              * implementation's documentation.
@@ -1102,7 +1102,7 @@ export declare namespace acme {
             /**
              * The name of the solver to use, as defined in the webhook provider
              * implementation.
-             * This will typically be the name of the provider, e.g. 'cloudflare'.
+             * This will typically be the name of the provider, e.g., 'cloudflare'.
              */
             solverName: string;
         }
@@ -1110,7 +1110,7 @@ export declare namespace acme {
          * Configures cert-manager to attempt to complete authorizations by
          * performing the HTTP01 challenge flow.
          * It is not possible to obtain certificates for wildcard domain names
-         * (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
+         * (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
          */
         interface ChallengeSpecSolverHttp01 {
             gatewayHTTPRoute: outputs.acme.v1.ChallengeSpecSolverHttp01GatewayHTTPRoute;
@@ -5624,7 +5624,7 @@ export declare namespace acme {
          * Configures cert-manager to attempt to complete authorizations by
          * performing the HTTP01 challenge flow.
          * It is not possible to obtain certificates for wildcard domain names
-         * (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
+         * (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
          */
         interface ChallengeSpecSolverHttp01Patch {
             gatewayHTTPRoute: outputs.acme.v1.ChallengeSpecSolverHttp01GatewayHTTPRoutePatch;
@@ -5995,7 +5995,7 @@ export declare namespace acme {
              */
             token: string;
             /**
-             * Type is the type of challenge being offered, e.g. 'http-01', 'dns-01',
+             * Type is the type of challenge being offered, e.g., 'http-01', 'dns-01',
              * 'tls-sni-01', etc.
              * This is the raw value retrieved from the ACME server.
              * Only 'http-01' and 'dns-01' are supported by cert-manager, other values
@@ -6020,7 +6020,7 @@ export declare namespace acme {
              */
             token: string;
             /**
-             * Type is the type of challenge being offered, e.g. 'http-01', 'dns-01',
+             * Type is the type of challenge being offered, e.g., 'http-01', 'dns-01',
              * 'tls-sni-01', etc.
              * This is the raw value retrieved from the ACME server.
              * Only 'http-01' and 'dns-01' are supported by cert-manager, other values
@@ -6536,6 +6536,10 @@ export declare namespace argoproj {
              * Clusters contains a list of clusters that the window will apply to
              */
             clusters: string[];
+            /**
+             * Description of the sync that will be applied to the schedule, can be used to add any information such as a ticket number for example
+             */
+            description: string;
             /**
              * Duration is the amount of time the sync window will be open
              */
@@ -6577,6 +6581,10 @@ export declare namespace argoproj {
              * Clusters contains a list of clusters that the window will apply to
              */
             clusters: string[];
+            /**
+             * Description of the sync that will be applied to the schedule, can be used to add any information such as a ticket number for example
+             */
+            description: string;
             /**
              * Duration is the amount of time the sync window will be open
              */
@@ -9771,9 +9779,11 @@ export declare namespace argoproj {
             path: string;
         }
         interface ApplicationSetSpecGeneratorsGitFiles {
+            exclude: boolean;
             path: string;
         }
         interface ApplicationSetSpecGeneratorsGitFilesPatch {
+            exclude: boolean;
             path: string;
         }
         interface ApplicationSetSpecGeneratorsGitPatch {
@@ -12611,9 +12621,11 @@ export declare namespace argoproj {
             path: string;
         }
         interface ApplicationSetSpecGeneratorsMatrixGeneratorsGitFiles {
+            exclude: boolean;
             path: string;
         }
         interface ApplicationSetSpecGeneratorsMatrixGeneratorsGitFilesPatch {
+            exclude: boolean;
             path: string;
         }
         interface ApplicationSetSpecGeneratorsMatrixGeneratorsGitPatch {
@@ -14861,6 +14873,7 @@ export declare namespace argoproj {
         interface ApplicationSetSpecGeneratorsMatrixGeneratorsPullRequestGitea {
             api: string;
             insecure: boolean;
+            labels: string[];
             owner: string;
             repo: string;
             tokenRef: outputs.argoproj.v1alpha1.ApplicationSetSpecGeneratorsMatrixGeneratorsPullRequestGiteaTokenRef;
@@ -14868,6 +14881,7 @@ export declare namespace argoproj {
         interface ApplicationSetSpecGeneratorsMatrixGeneratorsPullRequestGiteaPatch {
             api: string;
             insecure: boolean;
+            labels: string[];
             owner: string;
             repo: string;
             tokenRef: outputs.argoproj.v1alpha1.ApplicationSetSpecGeneratorsMatrixGeneratorsPullRequestGiteaTokenRefPatch;
@@ -18706,9 +18720,11 @@ export declare namespace argoproj {
             path: string;
         }
         interface ApplicationSetSpecGeneratorsMergeGeneratorsGitFiles {
+            exclude: boolean;
             path: string;
         }
         interface ApplicationSetSpecGeneratorsMergeGeneratorsGitFilesPatch {
+            exclude: boolean;
             path: string;
         }
         interface ApplicationSetSpecGeneratorsMergeGeneratorsGitPatch {
@@ -20956,6 +20972,7 @@ export declare namespace argoproj {
         interface ApplicationSetSpecGeneratorsMergeGeneratorsPullRequestGitea {
             api: string;
             insecure: boolean;
+            labels: string[];
             owner: string;
             repo: string;
             tokenRef: outputs.argoproj.v1alpha1.ApplicationSetSpecGeneratorsMergeGeneratorsPullRequestGiteaTokenRef;
@@ -20963,6 +20980,7 @@ export declare namespace argoproj {
         interface ApplicationSetSpecGeneratorsMergeGeneratorsPullRequestGiteaPatch {
             api: string;
             insecure: boolean;
+            labels: string[];
             owner: string;
             repo: string;
             tokenRef: outputs.argoproj.v1alpha1.ApplicationSetSpecGeneratorsMergeGeneratorsPullRequestGiteaTokenRefPatch;
@@ -24207,6 +24225,7 @@ export declare namespace argoproj {
         interface ApplicationSetSpecGeneratorsPullRequestGitea {
             api: string;
             insecure: boolean;
+            labels: string[];
             owner: string;
             repo: string;
             tokenRef: outputs.argoproj.v1alpha1.ApplicationSetSpecGeneratorsPullRequestGiteaTokenRef;
@@ -24214,6 +24233,7 @@ export declare namespace argoproj {
         interface ApplicationSetSpecGeneratorsPullRequestGiteaPatch {
             api: string;
             insecure: boolean;
+            labels: string[];
             owner: string;
             repo: string;
             tokenRef: outputs.argoproj.v1alpha1.ApplicationSetSpecGeneratorsPullRequestGiteaTokenRefPatch;
@@ -28559,10 +28579,12 @@ export declare namespace argoproj {
             lastTransitionTime: string;
             /**
              * Message is a human-readable informational message describing the health status
+             *
+             * Deprecated: this field is not used and will be removed in a future release.
              */
             message: string;
             /**
-             * Status holds the status code of the application or resource
+             * Status holds the status code of the application
              */
             status: string;
         }
@@ -28576,10 +28598,12 @@ export declare namespace argoproj {
             lastTransitionTime: string;
             /**
              * Message is a human-readable informational message describing the health status
+             *
+             * Deprecated: this field is not used and will be removed in a future release.
              */
             message: string;
             /**
-             * Status holds the status code of the application or resource
+             * Status holds the status code of the application
              */
             status: string;
         }
@@ -31804,6 +31828,10 @@ export declare namespace argoproj {
              * HookType specifies the type of the hook. Empty for non-hook resources
              */
             hookType: string;
+            /**
+             * Images contains the images related to the ResourceResult
+             */
+            images: string[];
             /**
              * Kind specifies the API kind of the resource
              */
@@ -31850,6 +31878,10 @@ export declare namespace argoproj {
              * HookType specifies the type of the hook. Empty for non-hook resources
              */
             hookType: string;
+            /**
+             * Images contains the images related to the ResourceResult
+             */
+            images: string[];
             /**
              * Kind specifies the API kind of the resource
              */
@@ -33335,6 +33367,8 @@ export declare namespace argoproj {
         interface ApplicationStatusResourcesHealth {
             /**
              * LastTransitionTime is the time the HealthStatus was set or updated
+             *
+             * Deprecated: this field is not used and will be removed in a future release.
              */
             lastTransitionTime: string;
             /**
@@ -33342,7 +33376,7 @@ export declare namespace argoproj {
              */
             message: string;
             /**
-             * Status holds the status code of the application or resource
+             * Status holds the status code of the resource
              */
             status: string;
         }
@@ -33352,6 +33386,8 @@ export declare namespace argoproj {
         interface ApplicationStatusResourcesHealthPatch {
             /**
              * LastTransitionTime is the time the HealthStatus was set or updated
+             *
+             * Deprecated: this field is not used and will be removed in a future release.
              */
             lastTransitionTime: string;
             /**
@@ -33359,7 +33395,7 @@ export declare namespace argoproj {
              */
             message: string;
             /**
-             * Status holds the status code of the application or resource
+             * Status holds the status code of the resource
              */
             status: string;
         }
@@ -35595,10 +35631,6 @@ export declare namespace cert_manager {
             /**
              * Defines extra output formats of the private key and signed certificate chain
              * to be written to this Certificate's target Secret.
-             *
-             * This is a Beta Feature enabled by default. It can be disabled with the
-             * `--feature-gates=AdditionalCertificateOutputFormats=false` option set on both
-             * the controller and webhook components.
              */
             additionalOutputFormats: outputs.cert_manager.v1.CertificateSpecAdditionalOutputFormats[];
             /**
@@ -35962,7 +35994,7 @@ export declare namespace cert_manager {
              * `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.
              * `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.
              * `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms
-             * (eg. because of company policy). Please note that the security of the algorithm is not that important
+             * (e.g., because of company policy). Please note that the security of the algorithm is not that important
              * in reality, because the unencrypted certificate and private key are also stored in the Secret.
              */
             profile: string;
@@ -36037,7 +36069,7 @@ export declare namespace cert_manager {
              * `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.
              * `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.
              * `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms
-             * (eg. because of company policy). Please note that the security of the algorithm is not that important
+             * (e.g., because of company policy). Please note that the security of the algorithm is not that important
              * in reality, because the unencrypted certificate and private key are also stored in the Secret.
              */
             profile: string;
@@ -36200,10 +36232,6 @@ export declare namespace cert_manager {
             /**
              * Defines extra output formats of the private key and signed certificate chain
              * to be written to this Certificate's target Secret.
-             *
-             * This is a Beta Feature enabled by default. It can be disabled with the
-             * `--feature-gates=AdditionalCertificateOutputFormats=false` option set on both
-             * the controller and webhook components.
              */
             additionalOutputFormats: outputs.cert_manager.v1.CertificateSpecAdditionalOutputFormatsPatch[];
             /**
@@ -36390,7 +36418,11 @@ export declare namespace cert_manager {
              * to await user intervention.
              * If set to `Always`, a private key matching the specified requirements
              * will be generated whenever a re-issuance occurs.
-             * Default is `Never` for backward compatibility.
+             * Default is `Always`.
+             * The default was changed from `Never` to `Always` in cert-manager >=v1.18.0.
+             * The new default can be disabled by setting the
+             * `--feature-gates=DefaultPrivateKeyRotationPolicyAlways=false` option on
+             * the controller component.
              */
             rotationPolicy: string;
             /**
@@ -36440,7 +36472,11 @@ export declare namespace cert_manager {
              * to await user intervention.
              * If set to `Always`, a private key matching the specified requirements
              * will be generated whenever a re-issuance occurs.
-             * Default is `Never` for backward compatibility.
+             * Default is `Always`.
+             * The default was changed from `Never` to `Always` in cert-manager >=v1.18.0.
+             * The new default can be disabled by setting the
+             * `--feature-gates=DefaultPrivateKeyRotationPolicyAlways=false` option on
+             * the controller component.
              */
             rotationPolicy: string;
             /**
@@ -38008,7 +38044,7 @@ export declare namespace cert_manager {
              * when challenges are processed.
              * This can contain arbitrary JSON data.
              * Secret values should not be specified in this stanza.
-             * If secret values are needed (e.g. credentials for a DNS service), you
+             * If secret values are needed (e.g., credentials for a DNS service), you
              * should use a SecretKeySelector to reference a Secret resource.
              * For details on the schema of this field, consult the webhook provider
              * implementation's documentation.
@@ -38026,7 +38062,7 @@ export declare namespace cert_manager {
             /**
              * The name of the solver to use, as defined in the webhook provider
              * implementation.
-             * This will typically be the name of the provider, e.g. 'cloudflare'.
+             * This will typically be the name of the provider, e.g., 'cloudflare'.
              */
             solverName: string;
         }
@@ -38040,7 +38076,7 @@ export declare namespace cert_manager {
              * when challenges are processed.
              * This can contain arbitrary JSON data.
              * Secret values should not be specified in this stanza.
-             * If secret values are needed (e.g. credentials for a DNS service), you
+             * If secret values are needed (e.g., credentials for a DNS service), you
              * should use a SecretKeySelector to reference a Secret resource.
              * For details on the schema of this field, consult the webhook provider
              * implementation's documentation.
@@ -38058,7 +38094,7 @@ export declare namespace cert_manager {
             /**
              * The name of the solver to use, as defined in the webhook provider
              * implementation.
-             * This will typically be the name of the provider, e.g. 'cloudflare'.
+             * This will typically be the name of the provider, e.g., 'cloudflare'.
              */
             solverName: string;
         }
@@ -38066,7 +38102,7 @@ export declare namespace cert_manager {
          * Configures cert-manager to attempt to complete authorizations by
          * performing the HTTP01 challenge flow.
          * It is not possible to obtain certificates for wildcard domain names
-         * (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
+         * (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
          */
         interface ClusterIssuerSpecAcmeSolversHttp01 {
             gatewayHTTPRoute: outputs.cert_manager.v1.ClusterIssuerSpecAcmeSolversHttp01GatewayHTTPRoute;
@@ -42580,7 +42616,7 @@ export declare namespace cert_manager {
          * Configures cert-manager to attempt to complete authorizations by
          * performing the HTTP01 challenge flow.
          * It is not possible to obtain certificates for wildcard domain names
-         * (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
+         * (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
          */
         interface ClusterIssuerSpecAcmeSolversHttp01Patch {
             gatewayHTTPRoute: outputs.cert_manager.v1.ClusterIssuerSpecAcmeSolversHttp01GatewayHTTPRoutePatch;
@@ -44786,7 +44822,7 @@ export declare namespace cert_manager {
              * when challenges are processed.
              * This can contain arbitrary JSON data.
              * Secret values should not be specified in this stanza.
-             * If secret values are needed (e.g. credentials for a DNS service), you
+             * If secret values are needed (e.g., credentials for a DNS service), you
              * should use a SecretKeySelector to reference a Secret resource.
              * For details on the schema of this field, consult the webhook provider
              * implementation's documentation.
@@ -44804,7 +44840,7 @@ export declare namespace cert_manager {
             /**
              * The name of the solver to use, as defined in the webhook provider
              * implementation.
-             * This will typically be the name of the provider, e.g. 'cloudflare'.
+             * This will typically be the name of the provider, e.g., 'cloudflare'.
              */
             solverName: string;
         }
@@ -44818,7 +44854,7 @@ export declare namespace cert_manager {
              * when challenges are processed.
              * This can contain arbitrary JSON data.
              * Secret values should not be specified in this stanza.
-             * If secret values are needed (e.g. credentials for a DNS service), you
+             * If secret values are needed (e.g., credentials for a DNS service), you
              * should use a SecretKeySelector to reference a Secret resource.
              * For details on the schema of this field, consult the webhook provider
              * implementation's documentation.
@@ -44836,7 +44872,7 @@ export declare namespace cert_manager {
             /**
              * The name of the solver to use, as defined in the webhook provider
              * implementation.
-             * This will typically be the name of the provider, e.g. 'cloudflare'.
+             * This will typically be the name of the provider, e.g., 'cloudflare'.
              */
             solverName: string;
         }
@@ -44844,7 +44880,7 @@ export declare namespace cert_manager {
          * Configures cert-manager to attempt to complete authorizations by
          * performing the HTTP01 challenge flow.
          * It is not possible to obtain certificates for wildcard domain names
-         * (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
+         * (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
          */
         interface IssuerSpecAcmeSolversHttp01 {
             gatewayHTTPRoute: outputs.cert_manager.v1.IssuerSpecAcmeSolversHttp01GatewayHTTPRoute;
@@ -49358,7 +49394,7 @@ export declare namespace cert_manager {
          * Configures cert-manager to attempt to complete authorizations by
          * performing the HTTP01 challenge flow.
          * It is not possible to obtain certificates for wildcard domain names
-         * (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
+         * (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
          */
         interface IssuerSpecAcmeSolversHttp01Patch {
             gatewayHTTPRoute: outputs.cert_manager.v1.IssuerSpecAcmeSolversHttp01GatewayHTTPRoutePatch;
@@ -52174,7 +52210,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -52201,7 +52237,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -52630,7 +52666,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -52660,7 +52696,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -52724,8 +52760,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumClusterwideNetworkPolicySpecEgressToPortsRulesHttpHeaderMatches {
@@ -52749,8 +52785,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumClusterwideNetworkPolicySpecEgressToPortsRulesHttpHeaderMatchesPatch {
@@ -55274,7 +55310,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -55304,7 +55340,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -55368,8 +55404,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumClusterwideNetworkPolicySpecIngressToPortsRulesHttpHeaderMatches {
@@ -55393,8 +55429,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumClusterwideNetworkPolicySpecIngressToPortsRulesHttpHeaderMatchesPatch {
@@ -57476,7 +57512,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -57503,7 +57539,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -57932,7 +57968,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -57962,7 +57998,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -58026,8 +58062,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumClusterwideNetworkPolicySpecsEgressToPortsRulesHttpHeaderMatches {
@@ -58051,8 +58087,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumClusterwideNetworkPolicySpecsEgressToPortsRulesHttpHeaderMatchesPatch {
@@ -60576,7 +60612,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -60606,7 +60642,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -60670,8 +60706,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumClusterwideNetworkPolicySpecsIngressToPortsRulesHttpHeaderMatches {
@@ -60695,8 +60731,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumClusterwideNetworkPolicySpecsIngressToPortsRulesHttpHeaderMatchesPatch {
@@ -64030,7 +64066,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -64057,7 +64093,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -64486,7 +64522,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -64516,7 +64552,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -64580,8 +64616,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumNetworkPolicySpecEgressToPortsRulesHttpHeaderMatches {
@@ -64605,8 +64641,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumNetworkPolicySpecEgressToPortsRulesHttpHeaderMatchesPatch {
@@ -67130,7 +67166,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -67160,7 +67196,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -67224,8 +67260,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumNetworkPolicySpecIngressToPortsRulesHttpHeaderMatches {
@@ -67249,8 +67285,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumNetworkPolicySpecIngressToPortsRulesHttpHeaderMatchesPatch {
@@ -69332,7 +69368,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -69359,7 +69395,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -69788,7 +69824,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -69818,7 +69854,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -69882,8 +69918,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumNetworkPolicySpecsEgressToPortsRulesHttpHeaderMatches {
@@ -69907,8 +69943,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumNetworkPolicySpecsEgressToPortsRulesHttpHeaderMatchesPatch {
@@ -72432,7 +72468,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -72462,7 +72498,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -72526,8 +72562,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumNetworkPolicySpecsIngressToPortsRulesHttpHeaderMatches {
@@ -72551,8 +72587,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumNetworkPolicySpecsIngressToPortsRulesHttpHeaderMatchesPatch {
@@ -74797,6 +74833,7 @@ export declare namespace external_secrets {
             kubernetes: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderKubernetes;
             onboardbase: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderOnboardbase;
             onepassword: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderOnepassword;
+            onepasswordSDK: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderOnepasswordSDK;
             oracle: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderOracle;
             passbolt: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderPassbolt;
             passworddepot: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderPassworddepot;
@@ -78672,6 +78709,106 @@ export declare namespace external_secrets {
                 [key: string]: number;
             };
         }
+        /**
+         * OnePasswordSDK configures this store to use 1Password's new Go SDK to sync secrets.
+         */
+        interface ClusterSecretStoreSpecProviderOnepasswordSDK {
+            auth: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderOnepasswordSDKAuth;
+            integrationInfo: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderOnepasswordSDKIntegrationInfo;
+            /**
+             * Vault defines the vault's name to access. Do NOT add op:// prefix. This will be done automatically.
+             */
+            vault: string;
+        }
+        /**
+         * Auth defines the information necessary to authenticate against OnePassword API.
+         */
+        interface ClusterSecretStoreSpecProviderOnepasswordSDKAuth {
+            serviceAccountSecretRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderOnepasswordSDKAuthServiceAccountSecretRef;
+        }
+        /**
+         * Auth defines the information necessary to authenticate against OnePassword API.
+         */
+        interface ClusterSecretStoreSpecProviderOnepasswordSDKAuthPatch {
+            serviceAccountSecretRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderOnepasswordSDKAuthServiceAccountSecretRefPatch;
+        }
+        /**
+         * ServiceAccountSecretRef points to the secret containing the token to access 1Password vault.
+         */
+        interface ClusterSecretStoreSpecProviderOnepasswordSDKAuthServiceAccountSecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * ServiceAccountSecretRef points to the secret containing the token to access 1Password vault.
+         */
+        interface ClusterSecretStoreSpecProviderOnepasswordSDKAuthServiceAccountSecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * IntegrationInfo specifies the name and version of the integration built using the 1Password Go SDK.
+         * If you don't know which name and version to use, use `DefaultIntegrationName` and `DefaultIntegrationVersion`, respectively.
+         */
+        interface ClusterSecretStoreSpecProviderOnepasswordSDKIntegrationInfo {
+            /**
+             * Name defaults to "1Password SDK".
+             */
+            name: string;
+            /**
+             * Version defaults to "v1.0.0".
+             */
+            version: string;
+        }
+        /**
+         * IntegrationInfo specifies the name and version of the integration built using the 1Password Go SDK.
+         * If you don't know which name and version to use, use `DefaultIntegrationName` and `DefaultIntegrationVersion`, respectively.
+         */
+        interface ClusterSecretStoreSpecProviderOnepasswordSDKIntegrationInfoPatch {
+            /**
+             * Name defaults to "1Password SDK".
+             */
+            name: string;
+            /**
+             * Version defaults to "v1.0.0".
+             */
+            version: string;
+        }
+        /**
+         * OnePasswordSDK configures this store to use 1Password's new Go SDK to sync secrets.
+         */
+        interface ClusterSecretStoreSpecProviderOnepasswordSDKPatch {
+            auth: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderOnepasswordSDKAuthPatch;
+            integrationInfo: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderOnepasswordSDKIntegrationInfoPatch;
+            /**
+             * Vault defines the vault's name to access. Do NOT add op:// prefix. This will be done automatically.
+             */
+            vault: string;
+        }
         /**
          * Oracle configures this store to sync secrets using Oracle Vault provider
          */
@@ -79115,6 +79252,7 @@ export declare namespace external_secrets {
             kubernetes: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderKubernetesPatch;
             onboardbase: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderOnboardbasePatch;
             onepassword: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderOnepasswordPatch;
+            onepasswordSDK: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderOnepasswordSDKPatch;
             oracle: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderOraclePatch;
             passbolt: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderPassboltPatch;
             passworddepot: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderPassworddepotPatch;
@@ -80946,6 +81084,7 @@ export declare namespace external_secrets {
          * Webhook configures this store to sync secrets using a generic templated webhook
          */
         interface ClusterSecretStoreSpecProviderWebhook {
+            auth: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderWebhookAuth;
             /**
              * Body
              */
@@ -80983,6 +81122,112 @@ export declare namespace external_secrets {
              */
             url: string;
         }
+        /**
+         * Auth specifies a authorization protocol. Only one protocol may be set.
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuth {
+            ntlm: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderWebhookAuthNtlm;
+        }
+        /**
+         * NTLMProtocol configures the store to use NTLM for auth
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthNtlm {
+            passwordSecret: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderWebhookAuthNtlmPasswordSecret;
+            usernameSecret: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderWebhookAuthNtlmUsernameSecret;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthNtlmPasswordSecret {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthNtlmPasswordSecretPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * NTLMProtocol configures the store to use NTLM for auth
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthNtlmPatch {
+            passwordSecret: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderWebhookAuthNtlmPasswordSecretPatch;
+            usernameSecret: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderWebhookAuthNtlmUsernameSecretPatch;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthNtlmUsernameSecret {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthNtlmUsernameSecretPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * Auth specifies a authorization protocol. Only one protocol may be set.
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthPatch {
+            ntlm: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderWebhookAuthNtlmPatch;
+        }
         /**
          * The provider for the CA bundle to use to validate webhook server certificate.
          */
@@ -81029,6 +81274,7 @@ export declare namespace external_secrets {
          * Webhook configures this store to sync secrets using a generic templated webhook
          */
         interface ClusterSecretStoreSpecProviderWebhookPatch {
+            auth: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderWebhookAuthPatch;
             /**
              * Body
              */
@@ -82451,6 +82697,7 @@ export declare namespace external_secrets {
             kubernetes: outputs.external_secrets.v1.SecretStoreSpecProviderKubernetes;
             onboardbase: outputs.external_secrets.v1.SecretStoreSpecProviderOnboardbase;
             onepassword: outputs.external_secrets.v1.SecretStoreSpecProviderOnepassword;
+            onepasswordSDK: outputs.external_secrets.v1.SecretStoreSpecProviderOnepasswordSDK;
             oracle: outputs.external_secrets.v1.SecretStoreSpecProviderOracle;
             passbolt: outputs.external_secrets.v1.SecretStoreSpecProviderPassbolt;
             passworddepot: outputs.external_secrets.v1.SecretStoreSpecProviderPassworddepot;
@@ -86326,6 +86573,106 @@ export declare namespace external_secrets {
                 [key: string]: number;
             };
         }
+        /**
+         * OnePasswordSDK configures this store to use 1Password's new Go SDK to sync secrets.
+         */
+        interface SecretStoreSpecProviderOnepasswordSDK {
+            auth: outputs.external_secrets.v1.SecretStoreSpecProviderOnepasswordSDKAuth;
+            integrationInfo: outputs.external_secrets.v1.SecretStoreSpecProviderOnepasswordSDKIntegrationInfo;
+            /**
+             * Vault defines the vault's name to access. Do NOT add op:// prefix. This will be done automatically.
+             */
+            vault: string;
+        }
+        /**
+         * Auth defines the information necessary to authenticate against OnePassword API.
+         */
+        interface SecretStoreSpecProviderOnepasswordSDKAuth {
+            serviceAccountSecretRef: outputs.external_secrets.v1.SecretStoreSpecProviderOnepasswordSDKAuthServiceAccountSecretRef;
+        }
+        /**
+         * Auth defines the information necessary to authenticate against OnePassword API.
+         */
+        interface SecretStoreSpecProviderOnepasswordSDKAuthPatch {
+            serviceAccountSecretRef: outputs.external_secrets.v1.SecretStoreSpecProviderOnepasswordSDKAuthServiceAccountSecretRefPatch;
+        }
+        /**
+         * ServiceAccountSecretRef points to the secret containing the token to access 1Password vault.
+         */
+        interface SecretStoreSpecProviderOnepasswordSDKAuthServiceAccountSecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * ServiceAccountSecretRef points to the secret containing the token to access 1Password vault.
+         */
+        interface SecretStoreSpecProviderOnepasswordSDKAuthServiceAccountSecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * IntegrationInfo specifies the name and version of the integration built using the 1Password Go SDK.
+         * If you don't know which name and version to use, use `DefaultIntegrationName` and `DefaultIntegrationVersion`, respectively.
+         */
+        interface SecretStoreSpecProviderOnepasswordSDKIntegrationInfo {
+            /**
+             * Name defaults to "1Password SDK".
+             */
+            name: string;
+            /**
+             * Version defaults to "v1.0.0".
+             */
+            version: string;
+        }
+        /**
+         * IntegrationInfo specifies the name and version of the integration built using the 1Password Go SDK.
+         * If you don't know which name and version to use, use `DefaultIntegrationName` and `DefaultIntegrationVersion`, respectively.
+         */
+        interface SecretStoreSpecProviderOnepasswordSDKIntegrationInfoPatch {
+            /**
+             * Name defaults to "1Password SDK".
+             */
+            name: string;
+            /**
+             * Version defaults to "v1.0.0".
+             */
+            version: string;
+        }
+        /**
+         * OnePasswordSDK configures this store to use 1Password's new Go SDK to sync secrets.
+         */
+        interface SecretStoreSpecProviderOnepasswordSDKPatch {
+            auth: outputs.external_secrets.v1.SecretStoreSpecProviderOnepasswordSDKAuthPatch;
+            integrationInfo: outputs.external_secrets.v1.SecretStoreSpecProviderOnepasswordSDKIntegrationInfoPatch;
+            /**
+             * Vault defines the vault's name to access. Do NOT add op:// prefix. This will be done automatically.
+             */
+            vault: string;
+        }
         /**
          * Oracle configures this store to sync secrets using Oracle Vault provider
          */
@@ -86769,6 +87116,7 @@ export declare namespace external_secrets {
             kubernetes: outputs.external_secrets.v1.SecretStoreSpecProviderKubernetesPatch;
             onboardbase: outputs.external_secrets.v1.SecretStoreSpecProviderOnboardbasePatch;
             onepassword: outputs.external_secrets.v1.SecretStoreSpecProviderOnepasswordPatch;
+            onepasswordSDK: outputs.external_secrets.v1.SecretStoreSpecProviderOnepasswordSDKPatch;
             oracle: outputs.external_secrets.v1.SecretStoreSpecProviderOraclePatch;
             passbolt: outputs.external_secrets.v1.SecretStoreSpecProviderPassboltPatch;
             passworddepot: outputs.external_secrets.v1.SecretStoreSpecProviderPassworddepotPatch;
@@ -88600,6 +88948,7 @@ export declare namespace external_secrets {
          * Webhook configures this store to sync secrets using a generic templated webhook
          */
         interface SecretStoreSpecProviderWebhook {
+            auth: outputs.external_secrets.v1.SecretStoreSpecProviderWebhookAuth;
             /**
              * Body
              */
@@ -88637,6 +88986,112 @@ export declare namespace external_secrets {
              */
             url: string;
         }
+        /**
+         * Auth specifies a authorization protocol. Only one protocol may be set.
+         */
+        interface SecretStoreSpecProviderWebhookAuth {
+            ntlm: outputs.external_secrets.v1.SecretStoreSpecProviderWebhookAuthNtlm;
+        }
+        /**
+         * NTLMProtocol configures the store to use NTLM for auth
+         */
+        interface SecretStoreSpecProviderWebhookAuthNtlm {
+            passwordSecret: outputs.external_secrets.v1.SecretStoreSpecProviderWebhookAuthNtlmPasswordSecret;
+            usernameSecret: outputs.external_secrets.v1.SecretStoreSpecProviderWebhookAuthNtlmUsernameSecret;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface SecretStoreSpecProviderWebhookAuthNtlmPasswordSecret {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface SecretStoreSpecProviderWebhookAuthNtlmPasswordSecretPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * NTLMProtocol configures the store to use NTLM for auth
+         */
+        interface SecretStoreSpecProviderWebhookAuthNtlmPatch {
+            passwordSecret: outputs.external_secrets.v1.SecretStoreSpecProviderWebhookAuthNtlmPasswordSecretPatch;
+            usernameSecret: outputs.external_secrets.v1.SecretStoreSpecProviderWebhookAuthNtlmUsernameSecretPatch;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface SecretStoreSpecProviderWebhookAuthNtlmUsernameSecret {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface SecretStoreSpecProviderWebhookAuthNtlmUsernameSecretPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * Auth specifies a authorization protocol. Only one protocol may be set.
+         */
+        interface SecretStoreSpecProviderWebhookAuthPatch {
+            ntlm: outputs.external_secrets.v1.SecretStoreSpecProviderWebhookAuthNtlmPatch;
+        }
         /**
          * The provider for the CA bundle to use to validate webhook server certificate.
          */
@@ -88683,6 +89138,7 @@ export declare namespace external_secrets {
          * Webhook configures this store to sync secrets using a generic templated webhook
          */
         interface SecretStoreSpecProviderWebhookPatch {
+            auth: outputs.external_secrets.v1.SecretStoreSpecProviderWebhookAuthPatch;
             /**
              * Body
              */
@@ -91238,8 +91694,7 @@ export declare namespace external_secrets {
             name: string;
         }
         /**
-         * The labels to select by to find the Namespaces to create the ExternalSecrets in.
-         * Deprecated: Use NamespaceSelectors instead.
+         * The labels to select by to find the Namespaces to create the ExternalSecrets in
          */
         interface ClusterExternalSecretSpecNamespaceSelector {
             /**
@@ -91300,8 +91755,7 @@ export declare namespace external_secrets {
             values: string[];
         }
         /**
-         * The labels to select by to find the Namespaces to create the ExternalSecrets in.
-         * Deprecated: Use NamespaceSelectors instead.
+         * The labels to select by to find the Namespaces to create the ExternalSecrets in
          */
         interface ClusterExternalSecretSpecNamespaceSelectorPatch {
             /**
@@ -97840,6 +98294,7 @@ export declare namespace external_secrets {
          * Webhook configures this store to sync secrets using a generic templated webhook
          */
         interface ClusterSecretStoreSpecProviderWebhook {
+            auth: outputs.external_secrets.v1beta1.ClusterSecretStoreSpecProviderWebhookAuth;
             /**
              * Body
              */
@@ -97877,6 +98332,112 @@ export declare namespace external_secrets {
              */
             url: string;
         }
+        /**
+         * Auth specifies a authorization protocol. Only one protocol may be set.
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuth {
+            ntlm: outputs.external_secrets.v1beta1.ClusterSecretStoreSpecProviderWebhookAuthNtlm;
+        }
+        /**
+         * NTLMProtocol configures the store to use NTLM for auth
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthNtlm {
+            passwordSecret: outputs.external_secrets.v1beta1.ClusterSecretStoreSpecProviderWebhookAuthNtlmPasswordSecret;
+            usernameSecret: outputs.external_secrets.v1beta1.ClusterSecretStoreSpecProviderWebhookAuthNtlmUsernameSecret;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthNtlmPasswordSecret {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthNtlmPasswordSecretPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * NTLMProtocol configures the store to use NTLM for auth
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthNtlmPatch {
+            passwordSecret: outputs.external_secrets.v1beta1.ClusterSecretStoreSpecProviderWebhookAuthNtlmPasswordSecretPatch;
+            usernameSecret: outputs.external_secrets.v1beta1.ClusterSecretStoreSpecProviderWebhookAuthNtlmUsernameSecretPatch;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthNtlmUsernameSecret {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthNtlmUsernameSecretPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * Auth specifies a authorization protocol. Only one protocol may be set.
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthPatch {
+            ntlm: outputs.external_secrets.v1beta1.ClusterSecretStoreSpecProviderWebhookAuthNtlmPatch;
+        }
         /**
          * The provider for the CA bundle to use to validate webhook server certificate.
          */
@@ -97923,6 +98484,7 @@ export declare namespace external_secrets {
          * Webhook configures this store to sync secrets using a generic templated webhook
          */
         interface ClusterSecretStoreSpecProviderWebhookPatch {
+            auth: outputs.external_secrets.v1beta1.ClusterSecretStoreSpecProviderWebhookAuthPatch;
             /**
              * Body
              */
@@ -105494,6 +106056,7 @@ export declare namespace external_secrets {
          * Webhook configures this store to sync secrets using a generic templated webhook
          */
         interface SecretStoreSpecProviderWebhook {
+            auth: outputs.external_secrets.v1beta1.SecretStoreSpecProviderWebhookAuth;
             /**
              * Body
              */
@@ -105531,6 +106094,112 @@ export declare namespace external_secrets {
              */
             url: string;
         }
+        /**
+         * Auth specifies a authorization protocol. Only one protocol may be set.
+         */
+        interface SecretStoreSpecProviderWebhookAuth {
+            ntlm: outputs.external_secrets.v1beta1.SecretStoreSpecProviderWebhookAuthNtlm;
+        }
+        /**
+         * NTLMProtocol configures the store to use NTLM for auth
+         */
+        interface SecretStoreSpecProviderWebhookAuthNtlm {
+            passwordSecret: outputs.external_secrets.v1beta1.SecretStoreSpecProviderWebhookAuthNtlmPasswordSecret;
+            usernameSecret: outputs.external_secrets.v1beta1.SecretStoreSpecProviderWebhookAuthNtlmUsernameSecret;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface SecretStoreSpecProviderWebhookAuthNtlmPasswordSecret {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface SecretStoreSpecProviderWebhookAuthNtlmPasswordSecretPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * NTLMProtocol configures the store to use NTLM for auth
+         */
+        interface SecretStoreSpecProviderWebhookAuthNtlmPatch {
+            passwordSecret: outputs.external_secrets.v1beta1.SecretStoreSpecProviderWebhookAuthNtlmPasswordSecretPatch;
+            usernameSecret: outputs.external_secrets.v1beta1.SecretStoreSpecProviderWebhookAuthNtlmUsernameSecretPatch;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface SecretStoreSpecProviderWebhookAuthNtlmUsernameSecret {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface SecretStoreSpecProviderWebhookAuthNtlmUsernameSecretPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * Auth specifies a authorization protocol. Only one protocol may be set.
+         */
+        interface SecretStoreSpecProviderWebhookAuthPatch {
+            ntlm: outputs.external_secrets.v1beta1.SecretStoreSpecProviderWebhookAuthNtlmPatch;
+        }
         /**
          * The provider for the CA bundle to use to validate webhook server certificate.
          */
@@ -105577,6 +106246,7 @@ export declare namespace external_secrets {
          * Webhook configures this store to sync secrets using a generic templated webhook
          */
         interface SecretStoreSpecProviderWebhookPatch {
+            auth: outputs.external_secrets.v1beta1.SecretStoreSpecProviderWebhookAuthPatch;
             /**
              * Body
              */
@@ -114876,6 +115546,10 @@ export declare namespace gateway {
             fqdn: outputs.gateway.v1alpha1.BackendSpecEndpointsFqdn;
             ip: outputs.gateway.v1alpha1.BackendSpecEndpointsIp;
             unix: outputs.gateway.v1alpha1.BackendSpecEndpointsUnix;
+            /**
+             * Zone defines the service zone of the backend endpoint.
+             */
+            zone: string;
         }
         /**
          * FQDN defines a FQDN endpoint
@@ -114939,6 +115613,10 @@ export declare namespace gateway {
             fqdn: outputs.gateway.v1alpha1.BackendSpecEndpointsFqdnPatch;
             ip: outputs.gateway.v1alpha1.BackendSpecEndpointsIpPatch;
             unix: outputs.gateway.v1alpha1.BackendSpecEndpointsUnixPatch;
+            /**
+             * Zone defines the service zone of the backend endpoint.
+             */
+            zone: string;
         }
         /**
          * Unix defines the unix domain socket endpoint
@@ -114946,6 +115624,7 @@ export declare namespace gateway {
         interface BackendSpecEndpointsUnix {
             /**
              * Path defines the unix domain socket path of the backend endpoint.
+             * The path length must not exceed 108 characters.
              */
             path: string;
         }
@@ -114955,6 +115634,7 @@ export declare namespace gateway {
         interface BackendSpecEndpointsUnixPatch {
             /**
              * Path defines the unix domain socket path of the backend endpoint.
+             * The path length must not exceed 108 characters.
              */
             path: string;
         }
@@ -115614,6 +116294,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses: number[];
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname: string;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -115669,6 +116354,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses: number[];
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname: string;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -116216,12 +116906,6 @@ export declare namespace gateway {
              * to rate limit the request.
              */
             rules: outputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitGlobalRules[];
-            /**
-             * Shared determines whether the rate limit rules apply across all the policy targets.
-             * If set to true, the rule is treated as a common bucket and is shared across all policy targets (xRoutes).
-             * Default: false.
-             */
-            shared: boolean;
         }
         /**
          * Global defines global rate limit configuration.
@@ -116238,12 +116922,6 @@ export declare namespace gateway {
              * to rate limit the request.
              */
             rules: outputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitGlobalRulesPatch[];
-            /**
-             * Shared determines whether the rate limit rules apply across all the policy targets.
-             * If set to true, the rule is treated as a common bucket and is shared across all policy targets (xRoutes).
-             * Default: false.
-             */
-            shared: boolean;
         }
         /**
          * RateLimitRule defines the semantics for matching attributes
@@ -116267,6 +116945,12 @@ export declare namespace gateway {
             clientSelectors: outputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitGlobalRulesClientSelectors[];
             cost: outputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitGlobalRulesCost;
             limit: outputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitGlobalRulesLimit;
+            /**
+             * Shared determines whether this rate limit rule applies across all the policy targets.
+             * If set to true, the rule is treated as a common bucket and is shared across all policy targets (xRoutes).
+             * Default: false.
+             */
+            shared: boolean;
         }
         /**
          * RateLimitSelectCondition specifies the attributes within the traffic flow that can
@@ -116594,6 +117278,12 @@ export declare namespace gateway {
             clientSelectors: outputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitGlobalRulesClientSelectorsPatch[];
             cost: outputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitGlobalRulesCostPatch;
             limit: outputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitGlobalRulesLimitPatch;
+            /**
+             * Shared determines whether this rate limit rule applies across all the policy targets.
+             * If set to true, the rule is treated as a common bucket and is shared across all policy targets (xRoutes).
+             * Default: false.
+             */
+            shared: boolean;
         }
         /**
          * Local defines local rate limit configuration.
@@ -116641,6 +117331,12 @@ export declare namespace gateway {
             clientSelectors: outputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitLocalRulesClientSelectors[];
             cost: outputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitLocalRulesCost;
             limit: outputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitLocalRulesLimit;
+            /**
+             * Shared determines whether this rate limit rule applies across all the policy targets.
+             * If set to true, the rule is treated as a common bucket and is shared across all policy targets (xRoutes).
+             * Default: false.
+             */
+            shared: boolean;
         }
         /**
          * RateLimitSelectCondition specifies the attributes within the traffic flow that can
@@ -116968,6 +117664,12 @@ export declare namespace gateway {
             clientSelectors: outputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitLocalRulesClientSelectorsPatch[];
             cost: outputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitLocalRulesCostPatch;
             limit: outputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitLocalRulesLimitPatch;
+            /**
+             * Shared determines whether this rate limit rule applies across all the policy targets.
+             * If set to true, the rule is treated as a common bucket and is shared across all policy targets (xRoutes).
+             * Default: false.
+             */
+            shared: boolean;
         }
         /**
          * RateLimit allows the user to limit the number of incoming requests
@@ -120680,6 +121382,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses: number[];
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname: string;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -120735,6 +121442,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses: number[];
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname: string;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -124924,7 +125636,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys: string[];
             /**
@@ -124936,7 +125647,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys: string[];
             namespaceSelector: outputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDaemonSetPodAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelector;
@@ -125058,7 +125768,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys: string[];
             /**
@@ -125070,7 +125779,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys: string[];
             namespaceSelector: outputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDaemonSetPodAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelector;
@@ -125225,7 +125933,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys: string[];
             /**
@@ -125237,7 +125944,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys: string[];
             namespaceSelector: outputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDaemonSetPodAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelector;
@@ -125359,7 +126065,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys: string[];
             /**
@@ -125371,7 +126076,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys: string[];
             namespaceSelector: outputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDaemonSetPodAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelector;
@@ -125816,7 +126520,6 @@ export declare namespace gateway {
              * - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
              *
              * If this value is nil, the behavior is equivalent to the Honor policy.
-             * This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
              */
             nodeAffinityPolicy: string;
             /**
@@ -125827,7 +126530,6 @@ export declare namespace gateway {
              * - Ignore: node taints are ignored. All nodes are included.
              *
              * If this value is nil, the behavior is equivalent to the Ignore policy.
-             * This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
              */
             nodeTaintsPolicy: string;
             /**
@@ -126773,7 +127475,7 @@ export declare namespace gateway {
          * The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
          * The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
          * The volume will be mounted read-only (ro) and non-executable files (noexec).
-         * Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath).
+         * Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
          * The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDaemonSetPodVolumesImage {
@@ -128218,12 +128920,12 @@ export declare namespace gateway {
             valueFrom: outputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDeploymentInitContainersEnvValueFrom;
         }
         /**
-         * EnvFromSource represents the source of a set of ConfigMaps
+         * EnvFromSource represents the source of a set of ConfigMaps or Secrets
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDeploymentInitContainersEnvFrom {
             configMapRef: outputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDeploymentInitContainersEnvFromConfigMapRef;
             /**
-             * An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
+             * Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
              */
             prefix: string;
             secretRef: outputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDeploymentInitContainersEnvFromSecretRef;
@@ -128352,6 +129054,12 @@ export declare namespace gateway {
         interface EnvoyProxySpecProviderKubernetesEnvoyDeploymentInitContainersLifecycle {
             postStart: outputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDeploymentInitContainersLifecyclePostStart;
             preStop: outputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDeploymentInitContainersLifecyclePreStop;
+            /**
+             * StopSignal defines which signal will be sent to a container when it is being stopped.
+             * If not specified, the default is defined by the container runtime in use.
+             * StopSignal can only be set for Pods with a non-empty .spec.os.name
+             */
+            stopSignal: string;
         }
         /**
          * PostStart is called immediately after a container is created. If the handler fails,
@@ -129608,7 +130316,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys: string[];
             /**
@@ -129620,7 +130327,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys: string[];
             namespaceSelector: outputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDeploymentPodAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelector;
@@ -129742,7 +130448,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys: string[];
             /**
@@ -129754,7 +130459,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys: string[];
             namespaceSelector: outputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDeploymentPodAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelector;
@@ -129909,7 +130613,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys: string[];
             /**
@@ -129921,7 +130624,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys: string[];
             namespaceSelector: outputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDeploymentPodAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelector;
@@ -130043,7 +130745,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys: string[];
             /**
@@ -130055,7 +130756,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys: string[];
             namespaceSelector: outputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDeploymentPodAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelector;
@@ -130500,7 +131200,6 @@ export declare namespace gateway {
              * - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
              *
              * If this value is nil, the behavior is equivalent to the Honor policy.
-             * This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
              */
             nodeAffinityPolicy: string;
             /**
@@ -130511,7 +131210,6 @@ export declare namespace gateway {
              * - Ignore: node taints are ignored. All nodes are included.
              *
              * If this value is nil, the behavior is equivalent to the Ignore policy.
-             * This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
              */
             nodeTaintsPolicy: string;
             /**
@@ -131457,7 +132155,7 @@ export declare namespace gateway {
          * The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
          * The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
          * The volume will be mounted read-only (ro) and non-executable files (noexec).
-         * Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath).
+         * Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
          * The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDeploymentPodVolumesImage {
@@ -132311,7 +133009,9 @@ export declare namespace gateway {
         interface EnvoyProxySpecProviderKubernetesEnvoyHpaBehaviorScaleDown {
             /**
              * policies is a list of potential scaling polices which can be used during scaling.
-             * At least one policy must be specified, otherwise the HPAScalingRules will be discarded as invalid
+             * If not set, use the default values:
+             * - For scale up: allow doubling the number of pods, or an absolute change of 4 pods in a 15s window.
+             * - For scale down: allow all pods to be removed in a 15s window.
              */
             policies: outputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyHpaBehaviorScaleDownPolicies[];
             /**
@@ -132328,6 +133028,20 @@ export declare namespace gateway {
              * - For scale down: 300 (i.e. the stabilization window is 300 seconds long).
              */
             stabilizationWindowSeconds: number;
+            /**
+             * tolerance is the tolerance on the ratio between the current and desired
+             * metric value under which no updates are made to the desired number of
+             * replicas (e.g. 0.01 for 1%). Must be greater than or equal to zero. If not
+             * set, the default cluster-wide tolerance is applied (by default 10%).
+             *
+             * For example, if autoscaling is configured with a memory consumption target of 100Mi,
+             * and scale-down and scale-up tolerances of 5% and 1% respectively, scaling will be
+             * triggered when the actual consumption falls below 95Mi or exceeds 101Mi.
+             *
+             * This is an alpha field and requires enabling the HPAConfigurableTolerance
+             * feature gate.
+             */
+            tolerance: number | string;
         }
         /**
          * HPAScalingPolicy is a single policy which must hold true for a specified past interval.
@@ -132358,7 +133072,9 @@ export declare namespace gateway {
         interface EnvoyProxySpecProviderKubernetesEnvoyHpaBehaviorScaleUp {
             /**
              * policies is a list of potential scaling polices which can be used during scaling.
-             * At least one policy must be specified, otherwise the HPAScalingRules will be discarded as invalid
+             * If not set, use the default values:
+             * - For scale up: allow doubling the number of pods, or an absolute change of 4 pods in a 15s window.
+             * - For scale down: allow all pods to be removed in a 15s window.
              */
             policies: outputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyHpaBehaviorScaleUpPolicies[];
             /**
@@ -132375,6 +133091,20 @@ export declare namespace gateway {
              * - For scale down: 300 (i.e. the stabilization window is 300 seconds long).
              */
             stabilizationWindowSeconds: number;
+            /**
+             * tolerance is the tolerance on the ratio between the current and desired
+             * metric value under which no updates are made to the desired number of
+             * replicas (e.g. 0.01 for 1%). Must be greater than or equal to zero. If not
+             * set, the default cluster-wide tolerance is applied (by default 10%).
+             *
+             * For example, if autoscaling is configured with a memory consumption target of 100Mi,
+             * and scale-down and scale-up tolerances of 5% and 1% respectively, scaling will be
+             * triggered when the actual consumption falls below 95Mi or exceeds 101Mi.
+             *
+             * This is an alpha field and requires enabling the HPAConfigurableTolerance
+             * feature gate.
+             */
+            tolerance: number | string;
         }
         /**
          * HPAScalingPolicy is a single policy which must hold true for a specified past interval.
@@ -133614,6 +134344,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses: number[];
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname: string;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -133669,6 +134404,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses: number[];
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname: string;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -134944,6 +135684,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses: number[];
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname: string;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -134999,6 +135744,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses: number[];
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname: string;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -136402,6 +137152,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses: number[];
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname: string;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -136457,6 +137212,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses: number[];
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname: string;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -137750,6 +138510,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses: number[];
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname: string;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -137805,6 +138570,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses: number[];
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname: string;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -140198,6 +140968,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses: number[];
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname: string;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -140253,6 +141028,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses: number[];
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname: string;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -141471,6 +142251,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses: number[];
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname: string;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -141526,6 +142311,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses: number[];
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname: string;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -143066,6 +143856,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses: number[];
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname: string;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -143121,6 +143916,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses: number[];
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname: string;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -143869,6 +144669,7 @@ export declare namespace gateway {
              * OAuth flow will fail.
              */
             defaultTokenTTL: string;
+            denyRedirect: outputs.gateway.v1alpha1.SecurityPolicySpecOidcDenyRedirect;
             /**
              * ForwardAccessToken indicates whether the Envoy should forward the access token
              * via the Authorization header Bearer scheme to the upstream.
@@ -143881,6 +144682,16 @@ export declare namespace gateway {
              * If not specified, uses a default logout path "/logout"
              */
             logoutPath: string;
+            /**
+             * Skips OIDC authentication when the request contains a header that will be extracted by the JWT filter. Unless
+             * explicitly stated otherwise in the extractFrom field, this will be the "Authorization: Bearer ..." header.
+             *
+             * The passThroughAuthHeader option is typically used for non-browser clients that may not be able to handle OIDC
+             * redirects and wish to directly supply a token instead.
+             *
+             * If not specified, defaults to false.
+             */
+            passThroughAuthHeader: boolean;
             provider: outputs.gateway.v1alpha1.SecurityPolicySpecOidcProvider;
             /**
              * The redirect URL to be used in the OIDC
@@ -144016,6 +144827,60 @@ export declare namespace gateway {
              */
             idToken: string;
         }
+        /**
+         * Any request that matches any of the provided matchers (with either tokens that are expired or missing tokens) will not be redirected to the OIDC Provider.
+         * This behavior can be useful for AJAX or machine requests.
+         */
+        interface SecurityPolicySpecOidcDenyRedirect {
+            /**
+             * Defines the headers to match against the request to deny redirect to the OIDC Provider.
+             */
+            headers: outputs.gateway.v1alpha1.SecurityPolicySpecOidcDenyRedirectHeaders[];
+        }
+        /**
+         * OIDCDenyRedirectHeader defines how a header is matched
+         */
+        interface SecurityPolicySpecOidcDenyRedirectHeaders {
+            /**
+             * Specifies the name of the header in the request.
+             */
+            name: string;
+            /**
+             * Type specifies how to match against a string.
+             */
+            type: string;
+            /**
+             * Value specifies the string value that the match must have.
+             */
+            value: string;
+        }
+        /**
+         * OIDCDenyRedirectHeader defines how a header is matched
+         */
+        interface SecurityPolicySpecOidcDenyRedirectHeadersPatch {
+            /**
+             * Specifies the name of the header in the request.
+             */
+            name: string;
+            /**
+             * Type specifies how to match against a string.
+             */
+            type: string;
+            /**
+             * Value specifies the string value that the match must have.
+             */
+            value: string;
+        }
+        /**
+         * Any request that matches any of the provided matchers (with either tokens that are expired or missing tokens) will not be redirected to the OIDC Provider.
+         * This behavior can be useful for AJAX or machine requests.
+         */
+        interface SecurityPolicySpecOidcDenyRedirectPatch {
+            /**
+             * Defines the headers to match against the request to deny redirect to the OIDC Provider.
+             */
+            headers: outputs.gateway.v1alpha1.SecurityPolicySpecOidcDenyRedirectHeadersPatch[];
+        }
         /**
          * OIDC defines the configuration for the OpenID Connect (OIDC) authentication.
          */
@@ -144054,6 +144919,7 @@ export declare namespace gateway {
              * OAuth flow will fail.
              */
             defaultTokenTTL: string;
+            denyRedirect: outputs.gateway.v1alpha1.SecurityPolicySpecOidcDenyRedirectPatch;
             /**
              * ForwardAccessToken indicates whether the Envoy should forward the access token
              * via the Authorization header Bearer scheme to the upstream.
@@ -144066,6 +144932,16 @@ export declare namespace gateway {
              * If not specified, uses a default logout path "/logout"
              */
             logoutPath: string;
+            /**
+             * Skips OIDC authentication when the request contains a header that will be extracted by the JWT filter. Unless
+             * explicitly stated otherwise in the extractFrom field, this will be the "Authorization: Bearer ..." header.
+             *
+             * The passThroughAuthHeader option is typically used for non-browser clients that may not be able to handle OIDC
+             * redirects and wish to directly supply a token instead.
+             *
+             * If not specified, defaults to false.
+             */
+            passThroughAuthHeader: boolean;
             provider: outputs.gateway.v1alpha1.SecurityPolicySpecOidcProviderPatch;
             /**
              * The redirect URL to be used in the OIDC
@@ -144603,6 +145479,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses: number[];
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname: string;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -144658,6 +145539,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses: number[];
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname: string;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -240985,7 +241871,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys: string[];
             /**
@@ -240997,7 +241882,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys: string[];
             namespaceSelector: outputs.postgresql.v1.ClusterSpecAffinityAdditionalPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelector;
@@ -241197,7 +242081,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys: string[];
             /**
@@ -241209,7 +242092,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys: string[];
             namespaceSelector: outputs.postgresql.v1.ClusterSpecAffinityAdditionalPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelectorPatch;
@@ -241248,7 +242130,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys: string[];
             /**
@@ -241260,7 +242141,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys: string[];
             namespaceSelector: outputs.postgresql.v1.ClusterSpecAffinityAdditionalPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelector;
@@ -241465,7 +242345,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys: string[];
             /**
@@ -241477,7 +242356,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys: string[];
             namespaceSelector: outputs.postgresql.v1.ClusterSpecAffinityAdditionalPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelectorPatch;
@@ -241589,7 +242467,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys: string[];
             /**
@@ -241601,7 +242478,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys: string[];
             namespaceSelector: outputs.postgresql.v1.ClusterSpecAffinityAdditionalPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelector;
@@ -241801,7 +242677,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys: string[];
             /**
@@ -241813,7 +242688,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys: string[];
             namespaceSelector: outputs.postgresql.v1.ClusterSpecAffinityAdditionalPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelectorPatch;
@@ -241852,7 +242726,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys: string[];
             /**
@@ -241864,7 +242737,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys: string[];
             namespaceSelector: outputs.postgresql.v1.ClusterSpecAffinityAdditionalPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelector;
@@ -242069,7 +242941,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys: string[];
             /**
@@ -242081,7 +242952,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys: string[];
             namespaceSelector: outputs.postgresql.v1.ClusterSpecAffinityAdditionalPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelectorPatch;
@@ -244497,12 +245367,12 @@ export declare namespace postgresql {
             valueFrom: outputs.postgresql.v1.ClusterSpecEnvValueFrom;
         }
         /**
-         * EnvFromSource represents the source of a set of ConfigMaps
+         * EnvFromSource represents the source of a set of ConfigMaps or Secrets
          */
         interface ClusterSpecEnvFrom {
             configMapRef: outputs.postgresql.v1.ClusterSpecEnvFromConfigMapRef;
             /**
-             * An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
+             * Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
              */
             prefix: string;
             secretRef: outputs.postgresql.v1.ClusterSpecEnvFromSecretRef;
@@ -244542,12 +245412,12 @@ export declare namespace postgresql {
             optional: boolean;
         }
         /**
-         * EnvFromSource represents the source of a set of ConfigMaps
+         * EnvFromSource represents the source of a set of ConfigMaps or Secrets
          */
         interface ClusterSpecEnvFromPatch {
             configMapRef: outputs.postgresql.v1.ClusterSpecEnvFromConfigMapRefPatch;
             /**
-             * An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
+             * Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
              */
             prefix: string;
             secretRef: outputs.postgresql.v1.ClusterSpecEnvFromSecretRefPatch;
@@ -246805,13 +247675,12 @@ export declare namespace postgresql {
             sessionAffinity: string;
             sessionAffinityConfig: outputs.postgresql.v1.ClusterSpecManagedServicesAdditionalServiceTemplateSpecSessionAffinityConfig;
             /**
-             * TrafficDistribution offers a way to express preferences for how traffic is
-             * distributed to Service endpoints. Implementations can use this field as a
-             * hint, but are not required to guarantee strict adherence. If the field is
-             * not set, the implementation will apply its default routing strategy. If set
-             * to "PreferClose", implementations should prioritize endpoints that are
-             * topologically close (e.g., same zone).
-             * This is a beta field and requires enabling ServiceTrafficDistribution feature.
+             * TrafficDistribution offers a way to express preferences for how traffic
+             * is distributed to Service endpoints. Implementations can use this field
+             * as a hint, but are not required to guarantee strict adherence. If the
+             * field is not set, the implementation will apply its default routing
+             * strategy. If set to "PreferClose", implementations should prioritize
+             * endpoints that are in the same zone.
              */
             trafficDistribution: string;
             /**
@@ -247043,13 +247912,12 @@ export declare namespace postgresql {
             sessionAffinity: string;
             sessionAffinityConfig: outputs.postgresql.v1.ClusterSpecManagedServicesAdditionalServiceTemplateSpecSessionAffinityConfigPatch;
             /**
-             * TrafficDistribution offers a way to express preferences for how traffic is
-             * distributed to Service endpoints. Implementations can use this field as a
-             * hint, but are not required to guarantee strict adherence. If the field is
-             * not set, the implementation will apply its default routing strategy. If set
-             * to "PreferClose", implementations should prioritize endpoints that are
-             * topologically close (e.g., same zone).
-             * This is a beta field and requires enabling ServiceTrafficDistribution feature.
+             * TrafficDistribution offers a way to express preferences for how traffic
+             * is distributed to Service endpoints. Implementations can use this field
+             * as a hint, but are not required to guarantee strict adherence. If the
+             * field is not set, the implementation will apply its default routing
+             * strategy. If set to "PreferClose", implementations should prioritize
+             * endpoints that are in the same zone.
              */
             trafficDistribution: string;
             /**
@@ -250479,7 +251347,6 @@ export declare namespace postgresql {
              * - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
              *
              * If this value is nil, the behavior is equivalent to the Honor policy.
-             * This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
              */
             nodeAffinityPolicy: string;
             /**
@@ -250490,7 +251357,6 @@ export declare namespace postgresql {
              * - Ignore: node taints are ignored. All nodes are included.
              *
              * If this value is nil, the behavior is equivalent to the Ignore policy.
-             * This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
              */
             nodeTaintsPolicy: string;
             /**
@@ -250677,7 +251543,6 @@ export declare namespace postgresql {
              * - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
              *
              * If this value is nil, the behavior is equivalent to the Honor policy.
-             * This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
              */
             nodeAffinityPolicy: string;
             /**
@@ -250688,7 +251553,6 @@ export declare namespace postgresql {
              * - Ignore: node taints are ignored. All nodes are included.
              *
              * If this value is nil, the behavior is equivalent to the Ignore policy.
-             * This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
              */
             nodeTaintsPolicy: string;
             /**
@@ -251254,16 +252118,12 @@ export declare namespace postgresql {
              * ID of the latest generated node (used to avoid node name clashing)
              */
             latestGeneratedNode: number;
-            /**
-             * MajorVersionUpgradeFromImage contains the image that was
-             * running before the major version upgrade started.
-             */
-            majorVersionUpgradeFromImage: string;
             managedRolesStatus: outputs.postgresql.v1.ClusterStatusManagedRolesStatus;
             /**
              * OnlineUpdateEnabled shows if the online upgrade is enabled inside the cluster
              */
             onlineUpdateEnabled: boolean;
+            pgDataImageInfo: outputs.postgresql.v1.ClusterStatusPgDataImageInfo;
             /**
              * Current phase of the cluster
              */
@@ -251732,16 +252592,12 @@ export declare namespace postgresql {
              * ID of the latest generated node (used to avoid node name clashing)
              */
             latestGeneratedNode: number;
-            /**
-             * MajorVersionUpgradeFromImage contains the image that was
-             * running before the major version upgrade started.
-             */
-            majorVersionUpgradeFromImage: string;
             managedRolesStatus: outputs.postgresql.v1.ClusterStatusManagedRolesStatusPatch;
             /**
              * OnlineUpdateEnabled shows if the online upgrade is enabled inside the cluster
              */
             onlineUpdateEnabled: boolean;
+            pgDataImageInfo: outputs.postgresql.v1.ClusterStatusPgDataImageInfoPatch;
             /**
              * Current phase of the cluster
              */
@@ -251800,6 +252656,32 @@ export declare namespace postgresql {
              */
             writeService: string;
         }
+        /**
+         * PGDataImageInfo contains the details of the latest image that has run on the current data directory.
+         */
+        interface ClusterStatusPgDataImageInfo {
+            /**
+             * Image is the image name
+             */
+            image: string;
+            /**
+             * MajorVersion is the major version of the image
+             */
+            majorVersion: number;
+        }
+        /**
+         * PGDataImageInfo contains the details of the latest image that has run on the current data directory.
+         */
+        interface ClusterStatusPgDataImageInfoPatch {
+            /**
+             * Image is the image name
+             */
+            image: string;
+            /**
+             * MajorVersion is the major version of the image
+             */
+            majorVersion: number;
+        }
         /**
          * PluginStatus is the status of a loaded plugin
          */
@@ -252990,13 +253872,12 @@ export declare namespace postgresql {
             sessionAffinity: string;
             sessionAffinityConfig: outputs.postgresql.v1.PoolerSpecServiceTemplateSpecSessionAffinityConfig;
             /**
-             * TrafficDistribution offers a way to express preferences for how traffic is
-             * distributed to Service endpoints. Implementations can use this field as a
-             * hint, but are not required to guarantee strict adherence. If the field is
-             * not set, the implementation will apply its default routing strategy. If set
-             * to "PreferClose", implementations should prioritize endpoints that are
-             * topologically close (e.g., same zone).
-             * This is a beta field and requires enabling ServiceTrafficDistribution feature.
+             * TrafficDistribution offers a way to express preferences for how traffic
+             * is distributed to Service endpoints. Implementations can use this field
+             * as a hint, but are not required to guarantee strict adherence. If the
+             * field is not set, the implementation will apply its default routing
+             * strategy. If set to "PreferClose", implementations should prioritize
+             * endpoints that are in the same zone.
              */
             trafficDistribution: string;
             /**
@@ -253228,13 +254109,12 @@ export declare namespace postgresql {
             sessionAffinity: string;
             sessionAffinityConfig: outputs.postgresql.v1.PoolerSpecServiceTemplateSpecSessionAffinityConfigPatch;
             /**
-             * TrafficDistribution offers a way to express preferences for how traffic is
-             * distributed to Service endpoints. Implementations can use this field as a
-             * hint, but are not required to guarantee strict adherence. If the field is
-             * not set, the implementation will apply its default routing strategy. If set
-             * to "PreferClose", implementations should prioritize endpoints that are
-             * topologically close (e.g., same zone).
-             * This is a beta field and requires enabling ServiceTrafficDistribution feature.
+             * TrafficDistribution offers a way to express preferences for how traffic
+             * is distributed to Service endpoints. Implementations can use this field
+             * as a hint, but are not required to guarantee strict adherence. If the
+             * field is not set, the implementation will apply its default routing
+             * strategy. If set to "PreferClose", implementations should prioritize
+             * endpoints that are in the same zone.
              */
             trafficDistribution: string;
             /**
@@ -253586,7 +254466,7 @@ export declare namespace postgresql {
              * Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes.
              * The resourceRequirements of an init container are taken into account during scheduling
              * by finding the highest request/limit for each resource type, and then using the max of
-             * of that value or the sum of the normal containers. Limits are applied to init containers
+             * that value or the sum of the normal containers. Limits are applied to init containers
              * in a similar fashion.
              * Init containers cannot currently be added or removed.
              * Cannot be updated.
@@ -254182,7 +255062,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys: string[];
             /**
@@ -254194,7 +255073,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys: string[];
             namespaceSelector: outputs.postgresql.v1.PoolerSpecTemplateSpecAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelector;
@@ -254394,7 +255272,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys: string[];
             /**
@@ -254406,7 +255283,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys: string[];
             namespaceSelector: outputs.postgresql.v1.PoolerSpecTemplateSpecAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelectorPatch;
@@ -254445,7 +255321,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys: string[];
             /**
@@ -254457,7 +255332,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys: string[];
             namespaceSelector: outputs.postgresql.v1.PoolerSpecTemplateSpecAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelector;
@@ -254662,7 +255536,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys: string[];
             /**
@@ -254674,7 +255547,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys: string[];
             namespaceSelector: outputs.postgresql.v1.PoolerSpecTemplateSpecAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelectorPatch;
@@ -254784,7 +255656,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys: string[];
             /**
@@ -254796,7 +255667,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys: string[];
             namespaceSelector: outputs.postgresql.v1.PoolerSpecTemplateSpecAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelector;
@@ -254996,7 +255866,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys: string[];
             /**
@@ -255008,7 +255877,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys: string[];
             namespaceSelector: outputs.postgresql.v1.PoolerSpecTemplateSpecAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelectorPatch;
@@ -255047,7 +255915,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys: string[];
             /**
@@ -255059,7 +255926,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys: string[];
             namespaceSelector: outputs.postgresql.v1.PoolerSpecTemplateSpecAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelector;
@@ -255264,7 +256130,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys: string[];
             /**
@@ -255276,7 +256141,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys: string[];
             namespaceSelector: outputs.postgresql.v1.PoolerSpecTemplateSpecAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelectorPatch;
@@ -255476,12 +256340,12 @@ export declare namespace postgresql {
             valueFrom: outputs.postgresql.v1.PoolerSpecTemplateSpecContainersEnvValueFrom;
         }
         /**
-         * EnvFromSource represents the source of a set of ConfigMaps
+         * EnvFromSource represents the source of a set of ConfigMaps or Secrets
          */
         interface PoolerSpecTemplateSpecContainersEnvFrom {
             configMapRef: outputs.postgresql.v1.PoolerSpecTemplateSpecContainersEnvFromConfigMapRef;
             /**
-             * An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
+             * Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
              */
             prefix: string;
             secretRef: outputs.postgresql.v1.PoolerSpecTemplateSpecContainersEnvFromSecretRef;
@@ -255521,12 +256385,12 @@ export declare namespace postgresql {
             optional: boolean;
         }
         /**
-         * EnvFromSource represents the source of a set of ConfigMaps
+         * EnvFromSource represents the source of a set of ConfigMaps or Secrets
          */
         interface PoolerSpecTemplateSpecContainersEnvFromPatch {
             configMapRef: outputs.postgresql.v1.PoolerSpecTemplateSpecContainersEnvFromConfigMapRefPatch;
             /**
-             * An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
+             * Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
              */
             prefix: string;
             secretRef: outputs.postgresql.v1.PoolerSpecTemplateSpecContainersEnvFromSecretRefPatch;
@@ -255760,6 +256624,12 @@ export declare namespace postgresql {
         interface PoolerSpecTemplateSpecContainersLifecycle {
             postStart: outputs.postgresql.v1.PoolerSpecTemplateSpecContainersLifecyclePostStart;
             preStop: outputs.postgresql.v1.PoolerSpecTemplateSpecContainersLifecyclePreStop;
+            /**
+             * StopSignal defines which signal will be sent to a container when it is being stopped.
+             * If not specified, the default is defined by the container runtime in use.
+             * StopSignal can only be set for Pods with a non-empty .spec.os.name
+             */
+            stopSignal: string;
         }
         /**
          * Actions that the management system should take in response to container lifecycle events.
@@ -255768,6 +256638,12 @@ export declare namespace postgresql {
         interface PoolerSpecTemplateSpecContainersLifecyclePatch {
             postStart: outputs.postgresql.v1.PoolerSpecTemplateSpecContainersLifecyclePostStartPatch;
             preStop: outputs.postgresql.v1.PoolerSpecTemplateSpecContainersLifecyclePreStopPatch;
+            /**
+             * StopSignal defines which signal will be sent to a container when it is being stopped.
+             * If not specified, the default is defined by the container runtime in use.
+             * StopSignal can only be set for Pods with a non-empty .spec.os.name
+             */
+            stopSignal: string;
         }
         /**
          * PostStart is called immediately after a container is created. If the handler fails,
@@ -258112,12 +258988,12 @@ export declare namespace postgresql {
             valueFrom: outputs.postgresql.v1.PoolerSpecTemplateSpecEphemeralContainersEnvValueFrom;
         }
         /**
-         * EnvFromSource represents the source of a set of ConfigMaps
+         * EnvFromSource represents the source of a set of ConfigMaps or Secrets
          */
         interface PoolerSpecTemplateSpecEphemeralContainersEnvFrom {
             configMapRef: outputs.postgresql.v1.PoolerSpecTemplateSpecEphemeralContainersEnvFromConfigMapRef;
             /**
-             * An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
+             * Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
              */
             prefix: string;
             secretRef: outputs.postgresql.v1.PoolerSpecTemplateSpecEphemeralContainersEnvFromSecretRef;
@@ -258157,12 +259033,12 @@ export declare namespace postgresql {
             optional: boolean;
         }
         /**
-         * EnvFromSource represents the source of a set of ConfigMaps
+         * EnvFromSource represents the source of a set of ConfigMaps or Secrets
          */
         interface PoolerSpecTemplateSpecEphemeralContainersEnvFromPatch {
             configMapRef: outputs.postgresql.v1.PoolerSpecTemplateSpecEphemeralContainersEnvFromConfigMapRefPatch;
             /**
-             * An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
+             * Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
              */
             prefix: string;
             secretRef: outputs.postgresql.v1.PoolerSpecTemplateSpecEphemeralContainersEnvFromSecretRefPatch;
@@ -258395,6 +259271,12 @@ export declare namespace postgresql {
         interface PoolerSpecTemplateSpecEphemeralContainersLifecycle {
             postStart: outputs.postgresql.v1.PoolerSpecTemplateSpecEphemeralContainersLifecyclePostStart;
             preStop: outputs.postgresql.v1.PoolerSpecTemplateSpecEphemeralContainersLifecyclePreStop;
+            /**
+             * StopSignal defines which signal will be sent to a container when it is being stopped.
+             * If not specified, the default is defined by the container runtime in use.
+             * StopSignal can only be set for Pods with a non-empty .spec.os.name
+             */
+            stopSignal: string;
         }
         /**
          * Lifecycle is not allowed for ephemeral containers.
@@ -258402,6 +259284,12 @@ export declare namespace postgresql {
         interface PoolerSpecTemplateSpecEphemeralContainersLifecyclePatch {
             postStart: outputs.postgresql.v1.PoolerSpecTemplateSpecEphemeralContainersLifecyclePostStartPatch;
             preStop: outputs.postgresql.v1.PoolerSpecTemplateSpecEphemeralContainersLifecyclePreStopPatch;
+            /**
+             * StopSignal defines which signal will be sent to a container when it is being stopped.
+             * If not specified, the default is defined by the container runtime in use.
+             * StopSignal can only be set for Pods with a non-empty .spec.os.name
+             */
+            stopSignal: string;
         }
         /**
          * PostStart is called immediately after a container is created. If the handler fails,
@@ -260694,12 +261582,12 @@ export declare namespace postgresql {
             valueFrom: outputs.postgresql.v1.PoolerSpecTemplateSpecInitContainersEnvValueFrom;
         }
         /**
-         * EnvFromSource represents the source of a set of ConfigMaps
+         * EnvFromSource represents the source of a set of ConfigMaps or Secrets
          */
         interface PoolerSpecTemplateSpecInitContainersEnvFrom {
             configMapRef: outputs.postgresql.v1.PoolerSpecTemplateSpecInitContainersEnvFromConfigMapRef;
             /**
-             * An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
+             * Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
              */
             prefix: string;
             secretRef: outputs.postgresql.v1.PoolerSpecTemplateSpecInitContainersEnvFromSecretRef;
@@ -260739,12 +261627,12 @@ export declare namespace postgresql {
             optional: boolean;
         }
         /**
-         * EnvFromSource represents the source of a set of ConfigMaps
+         * EnvFromSource represents the source of a set of ConfigMaps or Secrets
          */
         interface PoolerSpecTemplateSpecInitContainersEnvFromPatch {
             configMapRef: outputs.postgresql.v1.PoolerSpecTemplateSpecInitContainersEnvFromConfigMapRefPatch;
             /**
-             * An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
+             * Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
              */
             prefix: string;
             secretRef: outputs.postgresql.v1.PoolerSpecTemplateSpecInitContainersEnvFromSecretRefPatch;
@@ -260978,6 +261866,12 @@ export declare namespace postgresql {
         interface PoolerSpecTemplateSpecInitContainersLifecycle {
             postStart: outputs.postgresql.v1.PoolerSpecTemplateSpecInitContainersLifecyclePostStart;
             preStop: outputs.postgresql.v1.PoolerSpecTemplateSpecInitContainersLifecyclePreStop;
+            /**
+             * StopSignal defines which signal will be sent to a container when it is being stopped.
+             * If not specified, the default is defined by the container runtime in use.
+             * StopSignal can only be set for Pods with a non-empty .spec.os.name
+             */
+            stopSignal: string;
         }
         /**
          * Actions that the management system should take in response to container lifecycle events.
@@ -260986,6 +261880,12 @@ export declare namespace postgresql {
         interface PoolerSpecTemplateSpecInitContainersLifecyclePatch {
             postStart: outputs.postgresql.v1.PoolerSpecTemplateSpecInitContainersLifecyclePostStartPatch;
             preStop: outputs.postgresql.v1.PoolerSpecTemplateSpecInitContainersLifecyclePreStopPatch;
+            /**
+             * StopSignal defines which signal will be sent to a container when it is being stopped.
+             * If not specified, the default is defined by the container runtime in use.
+             * StopSignal can only be set for Pods with a non-empty .spec.os.name
+             */
+            stopSignal: string;
         }
         /**
          * PostStart is called immediately after a container is created. If the handler fails,
@@ -263257,7 +264157,7 @@ export declare namespace postgresql {
              * Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes.
              * The resourceRequirements of an init container are taken into account during scheduling
              * by finding the highest request/limit for each resource type, and then using the max of
-             * of that value or the sum of the normal containers. Limits are applied to init containers
+             * that value or the sum of the normal containers. Limits are applied to init containers
              * in a similar fashion.
              * Init containers cannot currently be added or removed.
              * Cannot be updated.
@@ -264244,7 +265144,6 @@ export declare namespace postgresql {
              * - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
              *
              * If this value is nil, the behavior is equivalent to the Honor policy.
-             * This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
              */
             nodeAffinityPolicy: string;
             /**
@@ -264255,7 +265154,6 @@ export declare namespace postgresql {
              * - Ignore: node taints are ignored. All nodes are included.
              *
              * If this value is nil, the behavior is equivalent to the Ignore policy.
-             * This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
              */
             nodeTaintsPolicy: string;
             /**
@@ -264442,7 +265340,6 @@ export declare namespace postgresql {
              * - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
              *
              * If this value is nil, the behavior is equivalent to the Honor policy.
-             * This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
              */
             nodeAffinityPolicy: string;
             /**
@@ -264453,7 +265350,6 @@ export declare namespace postgresql {
              * - Ignore: node taints are ignored. All nodes are included.
              *
              * If this value is nil, the behavior is equivalent to the Ignore policy.
-             * This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
              */
             nodeTaintsPolicy: string;
             /**
@@ -266171,7 +267067,7 @@ export declare namespace postgresql {
          * The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
          * The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
          * The volume will be mounted read-only (ro) and non-executable files (noexec).
-         * Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath).
+         * Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
          * The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
          */
         interface PoolerSpecTemplateSpecVolumesImage {
@@ -266206,7 +267102,7 @@ export declare namespace postgresql {
          * The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
          * The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
          * The volume will be mounted read-only (ro) and non-executable files (noexec).
-         * Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath).
+         * Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
          * The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
          */
         interface PoolerSpecTemplateSpecVolumesImagePatch {
@@ -268587,6 +269483,10 @@ export declare namespace velero {
              */
             ttl: string;
             uploaderConfig: outputs.velero.v1.BackupSpecUploaderConfig;
+            /**
+             * VolumeGroupSnapshotLabelKey specifies the label key to group PVCs under a VGS.
+             */
+            volumeGroupSnapshotLabelKey: string;
             /**
              * VolumeSnapshotLocations is a list containing names of VolumeSnapshotLocations associated with this backup.
              */
@@ -269181,6 +270081,10 @@ export declare namespace velero {
              */
             ttl: string;
             uploaderConfig: outputs.velero.v1.BackupSpecUploaderConfigPatch;
+            /**
+             * VolumeGroupSnapshotLabelKey specifies the label key to group PVCs under a VGS.
+             */
+            volumeGroupSnapshotLabelKey: string;
             /**
              * VolumeSnapshotLocations is a list containing names of VolumeSnapshotLocations associated with this backup.
              */
@@ -271492,6 +272396,10 @@ export declare namespace velero {
              */
             ttl: string;
             uploaderConfig: outputs.velero.v1.ScheduleSpecTemplateUploaderConfig;
+            /**
+             * VolumeGroupSnapshotLabelKey specifies the label key to group PVCs under a VGS.
+             */
+            volumeGroupSnapshotLabelKey: string;
             /**
              * VolumeSnapshotLocations is a list containing names of VolumeSnapshotLocations associated with this backup.
              */
@@ -272087,6 +272995,10 @@ export declare namespace velero {
              */
             ttl: string;
             uploaderConfig: outputs.velero.v1.ScheduleSpecTemplateUploaderConfigPatch;
+            /**
+             * VolumeGroupSnapshotLabelKey specifies the label key to group PVCs under a VGS.
+             */
+            volumeGroupSnapshotLabelKey: string;
             /**
              * VolumeSnapshotLocations is a list containing names of VolumeSnapshotLocations associated with this backup.
              */