@kilic.dev/pulumi-k8s-crds 1.6.6 → 1.7.0

package/dist/types/input.d.ts

@@ -29,9 +29,9 @@ export declare namespace acme {
              */
             authorizationURL?: pulumi.Input<string>;
             /**
-             * dnsName is the identifier that this challenge is for, e.g. example.com.
+             * dnsName is the identifier that this challenge is for, e.g., example.com.
              * If the requested DNSName is a 'wildcard', this field MUST be set to the
-             * non-wildcard domain, e.g. for `*.example.com`, it must be `example.com`.
+             * non-wildcard domain, e.g., for `*.example.com`, it must be `example.com`.
              */
             dnsName?: pulumi.Input<string>;
             issuerRef?: pulumi.Input<inputs.acme.v1.ChallengeSpecIssuerRef>;
@@ -116,9 +116,9 @@ export declare namespace acme {
              */
             authorizationURL?: pulumi.Input<string>;
             /**
-             * dnsName is the identifier that this challenge is for, e.g. example.com.
+             * dnsName is the identifier that this challenge is for, e.g., example.com.
              * If the requested DNSName is a 'wildcard', this field MUST be set to the
-             * non-wildcard domain, e.g. for `*.example.com`, it must be `example.com`.
+             * non-wildcard domain, e.g., for `*.example.com`, it must be `example.com`.
              */
             dnsName?: pulumi.Input<string>;
             issuerRef?: pulumi.Input<inputs.acme.v1.ChallengeSpecIssuerRefPatch>;
@@ -1053,7 +1053,7 @@ export declare namespace acme {
              * when challenges are processed.
              * This can contain arbitrary JSON data.
              * Secret values should not be specified in this stanza.
-             * If secret values are needed (e.g. credentials for a DNS service), you
+             * If secret values are needed (e.g., credentials for a DNS service), you
              * should use a SecretKeySelector to reference a Secret resource.
              * For details on the schema of this field, consult the webhook provider
              * implementation's documentation.
@@ -1071,7 +1071,7 @@ export declare namespace acme {
             /**
              * The name of the solver to use, as defined in the webhook provider
              * implementation.
-             * This will typically be the name of the provider, e.g. 'cloudflare'.
+             * This will typically be the name of the provider, e.g., 'cloudflare'.
              */
             solverName?: pulumi.Input<string>;
         }
@@ -1085,7 +1085,7 @@ export declare namespace acme {
              * when challenges are processed.
              * This can contain arbitrary JSON data.
              * Secret values should not be specified in this stanza.
-             * If secret values are needed (e.g. credentials for a DNS service), you
+             * If secret values are needed (e.g., credentials for a DNS service), you
              * should use a SecretKeySelector to reference a Secret resource.
              * For details on the schema of this field, consult the webhook provider
              * implementation's documentation.
@@ -1103,7 +1103,7 @@ export declare namespace acme {
             /**
              * The name of the solver to use, as defined in the webhook provider
              * implementation.
-             * This will typically be the name of the provider, e.g. 'cloudflare'.
+             * This will typically be the name of the provider, e.g., 'cloudflare'.
              */
             solverName?: pulumi.Input<string>;
         }
@@ -1111,7 +1111,7 @@ export declare namespace acme {
          * Configures cert-manager to attempt to complete authorizations by
          * performing the HTTP01 challenge flow.
          * It is not possible to obtain certificates for wildcard domain names
-         * (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
+         * (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
          */
         interface ChallengeSpecSolverHttp01 {
             gatewayHTTPRoute?: pulumi.Input<inputs.acme.v1.ChallengeSpecSolverHttp01GatewayHTTPRoute>;
@@ -5625,7 +5625,7 @@ export declare namespace acme {
          * Configures cert-manager to attempt to complete authorizations by
          * performing the HTTP01 challenge flow.
          * It is not possible to obtain certificates for wildcard domain names
-         * (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
+         * (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
          */
         interface ChallengeSpecSolverHttp01Patch {
             gatewayHTTPRoute?: pulumi.Input<inputs.acme.v1.ChallengeSpecSolverHttp01GatewayHTTPRoutePatch>;
@@ -5966,7 +5966,7 @@ export declare namespace acme {
              */
             token?: pulumi.Input<string>;
             /**
-             * Type is the type of challenge being offered, e.g. 'http-01', 'dns-01',
+             * Type is the type of challenge being offered, e.g., 'http-01', 'dns-01',
              * 'tls-sni-01', etc.
              * This is the raw value retrieved from the ACME server.
              * Only 'http-01' and 'dns-01' are supported by cert-manager, other values
@@ -6399,6 +6399,10 @@ export declare namespace argoproj {
              * Clusters contains a list of clusters that the window will apply to
              */
             clusters?: pulumi.Input<pulumi.Input<string>[]>;
+            /**
+             * Description of the sync that will be applied to the schedule, can be used to add any information such as a ticket number for example
+             */
+            description?: pulumi.Input<string>;
             /**
              * Duration is the amount of time the sync window will be open
              */
@@ -6440,6 +6444,10 @@ export declare namespace argoproj {
              * Clusters contains a list of clusters that the window will apply to
              */
             clusters?: pulumi.Input<pulumi.Input<string>[]>;
+            /**
+             * Description of the sync that will be applied to the schedule, can be used to add any information such as a ticket number for example
+             */
+            description?: pulumi.Input<string>;
             /**
              * Duration is the amount of time the sync window will be open
              */
@@ -9621,9 +9629,11 @@ export declare namespace argoproj {
             path?: pulumi.Input<string>;
         }
         interface ApplicationSetSpecGeneratorsGitFiles {
+            exclude?: pulumi.Input<boolean>;
             path?: pulumi.Input<string>;
         }
         interface ApplicationSetSpecGeneratorsGitFilesPatch {
+            exclude?: pulumi.Input<boolean>;
             path?: pulumi.Input<string>;
         }
         interface ApplicationSetSpecGeneratorsGitPatch {
@@ -12461,9 +12471,11 @@ export declare namespace argoproj {
             path?: pulumi.Input<string>;
         }
         interface ApplicationSetSpecGeneratorsMatrixGeneratorsGitFiles {
+            exclude?: pulumi.Input<boolean>;
             path?: pulumi.Input<string>;
         }
         interface ApplicationSetSpecGeneratorsMatrixGeneratorsGitFilesPatch {
+            exclude?: pulumi.Input<boolean>;
             path?: pulumi.Input<string>;
         }
         interface ApplicationSetSpecGeneratorsMatrixGeneratorsGitPatch {
@@ -14711,6 +14723,7 @@ export declare namespace argoproj {
         interface ApplicationSetSpecGeneratorsMatrixGeneratorsPullRequestGitea {
             api?: pulumi.Input<string>;
             insecure?: pulumi.Input<boolean>;
+            labels?: pulumi.Input<pulumi.Input<string>[]>;
             owner?: pulumi.Input<string>;
             repo?: pulumi.Input<string>;
             tokenRef?: pulumi.Input<inputs.argoproj.v1alpha1.ApplicationSetSpecGeneratorsMatrixGeneratorsPullRequestGiteaTokenRef>;
@@ -14718,6 +14731,7 @@ export declare namespace argoproj {
         interface ApplicationSetSpecGeneratorsMatrixGeneratorsPullRequestGiteaPatch {
             api?: pulumi.Input<string>;
             insecure?: pulumi.Input<boolean>;
+            labels?: pulumi.Input<pulumi.Input<string>[]>;
             owner?: pulumi.Input<string>;
             repo?: pulumi.Input<string>;
             tokenRef?: pulumi.Input<inputs.argoproj.v1alpha1.ApplicationSetSpecGeneratorsMatrixGeneratorsPullRequestGiteaTokenRefPatch>;
@@ -18556,9 +18570,11 @@ export declare namespace argoproj {
             path?: pulumi.Input<string>;
         }
         interface ApplicationSetSpecGeneratorsMergeGeneratorsGitFiles {
+            exclude?: pulumi.Input<boolean>;
             path?: pulumi.Input<string>;
         }
         interface ApplicationSetSpecGeneratorsMergeGeneratorsGitFilesPatch {
+            exclude?: pulumi.Input<boolean>;
             path?: pulumi.Input<string>;
         }
         interface ApplicationSetSpecGeneratorsMergeGeneratorsGitPatch {
@@ -20806,6 +20822,7 @@ export declare namespace argoproj {
         interface ApplicationSetSpecGeneratorsMergeGeneratorsPullRequestGitea {
             api?: pulumi.Input<string>;
             insecure?: pulumi.Input<boolean>;
+            labels?: pulumi.Input<pulumi.Input<string>[]>;
             owner?: pulumi.Input<string>;
             repo?: pulumi.Input<string>;
             tokenRef?: pulumi.Input<inputs.argoproj.v1alpha1.ApplicationSetSpecGeneratorsMergeGeneratorsPullRequestGiteaTokenRef>;
@@ -20813,6 +20830,7 @@ export declare namespace argoproj {
         interface ApplicationSetSpecGeneratorsMergeGeneratorsPullRequestGiteaPatch {
             api?: pulumi.Input<string>;
             insecure?: pulumi.Input<boolean>;
+            labels?: pulumi.Input<pulumi.Input<string>[]>;
             owner?: pulumi.Input<string>;
             repo?: pulumi.Input<string>;
             tokenRef?: pulumi.Input<inputs.argoproj.v1alpha1.ApplicationSetSpecGeneratorsMergeGeneratorsPullRequestGiteaTokenRefPatch>;
@@ -24057,6 +24075,7 @@ export declare namespace argoproj {
         interface ApplicationSetSpecGeneratorsPullRequestGitea {
             api?: pulumi.Input<string>;
             insecure?: pulumi.Input<boolean>;
+            labels?: pulumi.Input<pulumi.Input<string>[]>;
             owner?: pulumi.Input<string>;
             repo?: pulumi.Input<string>;
             tokenRef?: pulumi.Input<inputs.argoproj.v1alpha1.ApplicationSetSpecGeneratorsPullRequestGiteaTokenRef>;
@@ -24064,6 +24083,7 @@ export declare namespace argoproj {
         interface ApplicationSetSpecGeneratorsPullRequestGiteaPatch {
             api?: pulumi.Input<string>;
             insecure?: pulumi.Input<boolean>;
+            labels?: pulumi.Input<pulumi.Input<string>[]>;
             owner?: pulumi.Input<string>;
             repo?: pulumi.Input<string>;
             tokenRef?: pulumi.Input<inputs.argoproj.v1alpha1.ApplicationSetSpecGeneratorsPullRequestGiteaTokenRefPatch>;
@@ -28354,10 +28374,12 @@ export declare namespace argoproj {
             lastTransitionTime?: pulumi.Input<string>;
             /**
              * Message is a human-readable informational message describing the health status
+             *
+             * Deprecated: this field is not used and will be removed in a future release.
              */
             message?: pulumi.Input<string>;
             /**
-             * Status holds the status code of the application or resource
+             * Status holds the status code of the application
              */
             status?: pulumi.Input<string>;
         }
@@ -29980,6 +30002,10 @@ export declare namespace argoproj {
              * HookType specifies the type of the hook. Empty for non-hook resources
              */
             hookType?: pulumi.Input<string>;
+            /**
+             * Images contains the images related to the ResourceResult
+             */
+            images?: pulumi.Input<pulumi.Input<string>[]>;
             /**
              * Kind specifies the API kind of the resource
              */
@@ -30740,6 +30766,8 @@ export declare namespace argoproj {
         interface ApplicationStatusResourcesHealth {
             /**
              * LastTransitionTime is the time the HealthStatus was set or updated
+             *
+             * Deprecated: this field is not used and will be removed in a future release.
              */
             lastTransitionTime?: pulumi.Input<string>;
             /**
@@ -30747,7 +30775,7 @@ export declare namespace argoproj {
              */
             message?: pulumi.Input<string>;
             /**
-             * Status holds the status code of the application or resource
+             * Status holds the status code of the resource
              */
             status?: pulumi.Input<string>;
         }
@@ -31967,10 +31995,6 @@ export declare namespace cert_manager {
             /**
              * Defines extra output formats of the private key and signed certificate chain
              * to be written to this Certificate's target Secret.
-             *
-             * This is a Beta Feature enabled by default. It can be disabled with the
-             * `--feature-gates=AdditionalCertificateOutputFormats=false` option set on both
-             * the controller and webhook components.
              */
             additionalOutputFormats?: pulumi.Input<pulumi.Input<inputs.cert_manager.v1.CertificateSpecAdditionalOutputFormats>[]>;
             /**
@@ -32334,7 +32358,7 @@ export declare namespace cert_manager {
              * `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.
              * `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.
              * `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms
-             * (eg. because of company policy). Please note that the security of the algorithm is not that important
+             * (e.g., because of company policy). Please note that the security of the algorithm is not that important
              * in reality, because the unencrypted certificate and private key are also stored in the Secret.
              */
             profile?: pulumi.Input<string>;
@@ -32409,7 +32433,7 @@ export declare namespace cert_manager {
              * `LegacyRC2`: Deprecated. Not supported by default in OpenSSL 3 or Java 20.
              * `LegacyDES`: Less secure algorithm. Use this option for maximal compatibility.
              * `Modern2023`: Secure algorithm. Use this option in case you have to always use secure algorithms
-             * (eg. because of company policy). Please note that the security of the algorithm is not that important
+             * (e.g., because of company policy). Please note that the security of the algorithm is not that important
              * in reality, because the unencrypted certificate and private key are also stored in the Secret.
              */
             profile?: pulumi.Input<string>;
@@ -32572,10 +32596,6 @@ export declare namespace cert_manager {
             /**
              * Defines extra output formats of the private key and signed certificate chain
              * to be written to this Certificate's target Secret.
-             *
-             * This is a Beta Feature enabled by default. It can be disabled with the
-             * `--feature-gates=AdditionalCertificateOutputFormats=false` option set on both
-             * the controller and webhook components.
              */
             additionalOutputFormats?: pulumi.Input<pulumi.Input<inputs.cert_manager.v1.CertificateSpecAdditionalOutputFormatsPatch>[]>;
             /**
@@ -32762,7 +32782,11 @@ export declare namespace cert_manager {
              * to await user intervention.
              * If set to `Always`, a private key matching the specified requirements
              * will be generated whenever a re-issuance occurs.
-             * Default is `Never` for backward compatibility.
+             * Default is `Always`.
+             * The default was changed from `Never` to `Always` in cert-manager >=v1.18.0.
+             * The new default can be disabled by setting the
+             * `--feature-gates=DefaultPrivateKeyRotationPolicyAlways=false` option on
+             * the controller component.
              */
             rotationPolicy?: pulumi.Input<string>;
             /**
@@ -32812,7 +32836,11 @@ export declare namespace cert_manager {
              * to await user intervention.
              * If set to `Always`, a private key matching the specified requirements
              * will be generated whenever a re-issuance occurs.
-             * Default is `Never` for backward compatibility.
+             * Default is `Always`.
+             * The default was changed from `Never` to `Always` in cert-manager >=v1.18.0.
+             * The new default can be disabled by setting the
+             * `--feature-gates=DefaultPrivateKeyRotationPolicyAlways=false` option on
+             * the controller component.
              */
             rotationPolicy?: pulumi.Input<string>;
             /**
@@ -34273,7 +34301,7 @@ export declare namespace cert_manager {
              * when challenges are processed.
              * This can contain arbitrary JSON data.
              * Secret values should not be specified in this stanza.
-             * If secret values are needed (e.g. credentials for a DNS service), you
+             * If secret values are needed (e.g., credentials for a DNS service), you
              * should use a SecretKeySelector to reference a Secret resource.
              * For details on the schema of this field, consult the webhook provider
              * implementation's documentation.
@@ -34291,7 +34319,7 @@ export declare namespace cert_manager {
             /**
              * The name of the solver to use, as defined in the webhook provider
              * implementation.
-             * This will typically be the name of the provider, e.g. 'cloudflare'.
+             * This will typically be the name of the provider, e.g., 'cloudflare'.
              */
             solverName?: pulumi.Input<string>;
         }
@@ -34305,7 +34333,7 @@ export declare namespace cert_manager {
              * when challenges are processed.
              * This can contain arbitrary JSON data.
              * Secret values should not be specified in this stanza.
-             * If secret values are needed (e.g. credentials for a DNS service), you
+             * If secret values are needed (e.g., credentials for a DNS service), you
              * should use a SecretKeySelector to reference a Secret resource.
              * For details on the schema of this field, consult the webhook provider
              * implementation's documentation.
@@ -34323,7 +34351,7 @@ export declare namespace cert_manager {
             /**
              * The name of the solver to use, as defined in the webhook provider
              * implementation.
-             * This will typically be the name of the provider, e.g. 'cloudflare'.
+             * This will typically be the name of the provider, e.g., 'cloudflare'.
              */
             solverName?: pulumi.Input<string>;
         }
@@ -34331,7 +34359,7 @@ export declare namespace cert_manager {
          * Configures cert-manager to attempt to complete authorizations by
          * performing the HTTP01 challenge flow.
          * It is not possible to obtain certificates for wildcard domain names
-         * (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
+         * (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
          */
         interface ClusterIssuerSpecAcmeSolversHttp01 {
             gatewayHTTPRoute?: pulumi.Input<inputs.cert_manager.v1.ClusterIssuerSpecAcmeSolversHttp01GatewayHTTPRoute>;
@@ -38845,7 +38873,7 @@ export declare namespace cert_manager {
          * Configures cert-manager to attempt to complete authorizations by
          * performing the HTTP01 challenge flow.
          * It is not possible to obtain certificates for wildcard domain names
-         * (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
+         * (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
          */
         interface ClusterIssuerSpecAcmeSolversHttp01Patch {
             gatewayHTTPRoute?: pulumi.Input<inputs.cert_manager.v1.ClusterIssuerSpecAcmeSolversHttp01GatewayHTTPRoutePatch>;
@@ -40980,7 +41008,7 @@ export declare namespace cert_manager {
              * when challenges are processed.
              * This can contain arbitrary JSON data.
              * Secret values should not be specified in this stanza.
-             * If secret values are needed (e.g. credentials for a DNS service), you
+             * If secret values are needed (e.g., credentials for a DNS service), you
              * should use a SecretKeySelector to reference a Secret resource.
              * For details on the schema of this field, consult the webhook provider
              * implementation's documentation.
@@ -40998,7 +41026,7 @@ export declare namespace cert_manager {
             /**
              * The name of the solver to use, as defined in the webhook provider
              * implementation.
-             * This will typically be the name of the provider, e.g. 'cloudflare'.
+             * This will typically be the name of the provider, e.g., 'cloudflare'.
              */
             solverName?: pulumi.Input<string>;
         }
@@ -41012,7 +41040,7 @@ export declare namespace cert_manager {
              * when challenges are processed.
              * This can contain arbitrary JSON data.
              * Secret values should not be specified in this stanza.
-             * If secret values are needed (e.g. credentials for a DNS service), you
+             * If secret values are needed (e.g., credentials for a DNS service), you
              * should use a SecretKeySelector to reference a Secret resource.
              * For details on the schema of this field, consult the webhook provider
              * implementation's documentation.
@@ -41030,7 +41058,7 @@ export declare namespace cert_manager {
             /**
              * The name of the solver to use, as defined in the webhook provider
              * implementation.
-             * This will typically be the name of the provider, e.g. 'cloudflare'.
+             * This will typically be the name of the provider, e.g., 'cloudflare'.
              */
             solverName?: pulumi.Input<string>;
         }
@@ -41038,7 +41066,7 @@ export declare namespace cert_manager {
          * Configures cert-manager to attempt to complete authorizations by
          * performing the HTTP01 challenge flow.
          * It is not possible to obtain certificates for wildcard domain names
-         * (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
+         * (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
          */
         interface IssuerSpecAcmeSolversHttp01 {
             gatewayHTTPRoute?: pulumi.Input<inputs.cert_manager.v1.IssuerSpecAcmeSolversHttp01GatewayHTTPRoute>;
@@ -45552,7 +45580,7 @@ export declare namespace cert_manager {
          * Configures cert-manager to attempt to complete authorizations by
          * performing the HTTP01 challenge flow.
          * It is not possible to obtain certificates for wildcard domain names
-         * (e.g. `*.example.com`) using the HTTP01 challenge mechanism.
+         * (e.g., `*.example.com`) using the HTTP01 challenge mechanism.
          */
         interface IssuerSpecAcmeSolversHttp01Patch {
             gatewayHTTPRoute?: pulumi.Input<inputs.cert_manager.v1.IssuerSpecAcmeSolversHttp01GatewayHTTPRoutePatch>;
@@ -48297,7 +48325,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -48324,7 +48352,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -48753,7 +48781,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -48783,7 +48811,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -48847,8 +48875,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumClusterwideNetworkPolicySpecEgressToPortsRulesHttpHeaderMatches {
@@ -48872,8 +48900,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumClusterwideNetworkPolicySpecEgressToPortsRulesHttpHeaderMatchesPatch {
@@ -51397,7 +51425,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -51427,7 +51455,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -51491,8 +51519,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumClusterwideNetworkPolicySpecIngressToPortsRulesHttpHeaderMatches {
@@ -51516,8 +51544,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumClusterwideNetworkPolicySpecIngressToPortsRulesHttpHeaderMatchesPatch {
@@ -53599,7 +53627,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -53626,7 +53654,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -54055,7 +54083,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -54085,7 +54113,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -54149,8 +54177,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumClusterwideNetworkPolicySpecsEgressToPortsRulesHttpHeaderMatches {
@@ -54174,8 +54202,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumClusterwideNetworkPolicySpecsEgressToPortsRulesHttpHeaderMatchesPatch {
@@ -56699,7 +56727,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -56729,7 +56757,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -56793,8 +56821,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumClusterwideNetworkPolicySpecsIngressToPortsRulesHttpHeaderMatches {
@@ -56818,8 +56846,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumClusterwideNetworkPolicySpecsIngressToPortsRulesHttpHeaderMatchesPatch {
@@ -60105,7 +60133,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -60132,7 +60160,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -60561,7 +60589,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -60591,7 +60619,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -60655,8 +60683,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumNetworkPolicySpecEgressToPortsRulesHttpHeaderMatches {
@@ -60680,8 +60708,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumNetworkPolicySpecEgressToPortsRulesHttpHeaderMatchesPatch {
@@ -63205,7 +63233,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -63235,7 +63263,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -63299,8 +63327,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumNetworkPolicySpecIngressToPortsRulesHttpHeaderMatches {
@@ -63324,8 +63352,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumNetworkPolicySpecIngressToPortsRulesHttpHeaderMatchesPatch {
@@ -65407,7 +65435,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -65434,7 +65462,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -65863,7 +65891,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -65893,7 +65921,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -65957,8 +65985,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumNetworkPolicySpecsEgressToPortsRulesHttpHeaderMatches {
@@ -65982,8 +66010,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumNetworkPolicySpecsEgressToPortsRulesHttpHeaderMatchesPatch {
@@ -68507,7 +68535,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -68537,7 +68565,7 @@ export declare namespace cilium {
              * A trailing "." is automatically added when missing.
              *
              * Examples:
-             * `*.cilium.io` matches subdomains of cilium at that level
+             * `*.cilium.io` matches subomains of cilium at that level
              *   www.cilium.io and blog.cilium.io match, cilium.io and google.com do not
              * `*cilium.io` matches cilium.io and all subdomains ends with "cilium.io"
              *   except those containing "." separator, subcilium.io and sub-cilium.io match,
@@ -68601,8 +68629,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumNetworkPolicySpecsIngressToPortsRulesHttpHeaderMatches {
@@ -68626,8 +68654,8 @@ export declare namespace cilium {
         }
         /**
          * HeaderMatch extends the HeaderValue for matching requirement of a
-         * named header field against an immediate string or a secret value.
-         * If none of the optional fields is present, then the
+         * named header field against an immediate string, a secret value, or
+         * a regex.  If none of the optional fields is present, then the
          * header value is not matched, only presence of the header is enough.
          */
         interface CiliumNetworkPolicySpecsIngressToPortsRulesHttpHeaderMatchesPatch {
@@ -70749,6 +70777,7 @@ export declare namespace external_secrets {
             kubernetes?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderKubernetes>;
             onboardbase?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderOnboardbase>;
             onepassword?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderOnepassword>;
+            onepasswordSDK?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderOnepasswordSDK>;
             oracle?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderOracle>;
             passbolt?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderPassbolt>;
             passworddepot?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderPassworddepot>;
@@ -74624,6 +74653,106 @@ export declare namespace external_secrets {
                 [key: string]: pulumi.Input<number>;
             }>;
         }
+        /**
+         * OnePasswordSDK configures this store to use 1Password's new Go SDK to sync secrets.
+         */
+        interface ClusterSecretStoreSpecProviderOnepasswordSDK {
+            auth?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderOnepasswordSDKAuth>;
+            integrationInfo?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderOnepasswordSDKIntegrationInfo>;
+            /**
+             * Vault defines the vault's name to access. Do NOT add op:// prefix. This will be done automatically.
+             */
+            vault?: pulumi.Input<string>;
+        }
+        /**
+         * Auth defines the information necessary to authenticate against OnePassword API.
+         */
+        interface ClusterSecretStoreSpecProviderOnepasswordSDKAuth {
+            serviceAccountSecretRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderOnepasswordSDKAuthServiceAccountSecretRef>;
+        }
+        /**
+         * Auth defines the information necessary to authenticate against OnePassword API.
+         */
+        interface ClusterSecretStoreSpecProviderOnepasswordSDKAuthPatch {
+            serviceAccountSecretRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderOnepasswordSDKAuthServiceAccountSecretRefPatch>;
+        }
+        /**
+         * ServiceAccountSecretRef points to the secret containing the token to access 1Password vault.
+         */
+        interface ClusterSecretStoreSpecProviderOnepasswordSDKAuthServiceAccountSecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string>;
+        }
+        /**
+         * ServiceAccountSecretRef points to the secret containing the token to access 1Password vault.
+         */
+        interface ClusterSecretStoreSpecProviderOnepasswordSDKAuthServiceAccountSecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string>;
+        }
+        /**
+         * IntegrationInfo specifies the name and version of the integration built using the 1Password Go SDK.
+         * If you don't know which name and version to use, use `DefaultIntegrationName` and `DefaultIntegrationVersion`, respectively.
+         */
+        interface ClusterSecretStoreSpecProviderOnepasswordSDKIntegrationInfo {
+            /**
+             * Name defaults to "1Password SDK".
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * Version defaults to "v1.0.0".
+             */
+            version?: pulumi.Input<string>;
+        }
+        /**
+         * IntegrationInfo specifies the name and version of the integration built using the 1Password Go SDK.
+         * If you don't know which name and version to use, use `DefaultIntegrationName` and `DefaultIntegrationVersion`, respectively.
+         */
+        interface ClusterSecretStoreSpecProviderOnepasswordSDKIntegrationInfoPatch {
+            /**
+             * Name defaults to "1Password SDK".
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * Version defaults to "v1.0.0".
+             */
+            version?: pulumi.Input<string>;
+        }
+        /**
+         * OnePasswordSDK configures this store to use 1Password's new Go SDK to sync secrets.
+         */
+        interface ClusterSecretStoreSpecProviderOnepasswordSDKPatch {
+            auth?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderOnepasswordSDKAuthPatch>;
+            integrationInfo?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderOnepasswordSDKIntegrationInfoPatch>;
+            /**
+             * Vault defines the vault's name to access. Do NOT add op:// prefix. This will be done automatically.
+             */
+            vault?: pulumi.Input<string>;
+        }
         /**
          * Oracle configures this store to sync secrets using Oracle Vault provider
          */
@@ -75067,6 +75196,7 @@ export declare namespace external_secrets {
             kubernetes?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderKubernetesPatch>;
             onboardbase?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderOnboardbasePatch>;
             onepassword?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderOnepasswordPatch>;
+            onepasswordSDK?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderOnepasswordSDKPatch>;
             oracle?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderOraclePatch>;
             passbolt?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderPassboltPatch>;
             passworddepot?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderPassworddepotPatch>;
@@ -76898,6 +77028,7 @@ export declare namespace external_secrets {
          * Webhook configures this store to sync secrets using a generic templated webhook
          */
         interface ClusterSecretStoreSpecProviderWebhook {
+            auth?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderWebhookAuth>;
             /**
              * Body
              */
@@ -76935,6 +77066,112 @@ export declare namespace external_secrets {
              */
             url?: pulumi.Input<string>;
         }
+        /**
+         * Auth specifies a authorization protocol. Only one protocol may be set.
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuth {
+            ntlm?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderWebhookAuthNtlm>;
+        }
+        /**
+         * NTLMProtocol configures the store to use NTLM for auth
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthNtlm {
+            passwordSecret?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderWebhookAuthNtlmPasswordSecret>;
+            usernameSecret?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderWebhookAuthNtlmUsernameSecret>;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthNtlmPasswordSecret {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string>;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthNtlmPasswordSecretPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string>;
+        }
+        /**
+         * NTLMProtocol configures the store to use NTLM for auth
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthNtlmPatch {
+            passwordSecret?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderWebhookAuthNtlmPasswordSecretPatch>;
+            usernameSecret?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderWebhookAuthNtlmUsernameSecretPatch>;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthNtlmUsernameSecret {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string>;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthNtlmUsernameSecretPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string>;
+        }
+        /**
+         * Auth specifies a authorization protocol. Only one protocol may be set.
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthPatch {
+            ntlm?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderWebhookAuthNtlmPatch>;
+        }
         /**
          * The provider for the CA bundle to use to validate webhook server certificate.
          */
@@ -76981,6 +77218,7 @@ export declare namespace external_secrets {
          * Webhook configures this store to sync secrets using a generic templated webhook
          */
         interface ClusterSecretStoreSpecProviderWebhookPatch {
+            auth?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderWebhookAuthPatch>;
             /**
              * Body
              */
@@ -78353,6 +78591,7 @@ export declare namespace external_secrets {
             kubernetes?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderKubernetes>;
             onboardbase?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderOnboardbase>;
             onepassword?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderOnepassword>;
+            onepasswordSDK?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderOnepasswordSDK>;
             oracle?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderOracle>;
             passbolt?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderPassbolt>;
             passworddepot?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderPassworddepot>;
@@ -82228,6 +82467,106 @@ export declare namespace external_secrets {
                 [key: string]: pulumi.Input<number>;
             }>;
         }
+        /**
+         * OnePasswordSDK configures this store to use 1Password's new Go SDK to sync secrets.
+         */
+        interface SecretStoreSpecProviderOnepasswordSDK {
+            auth?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderOnepasswordSDKAuth>;
+            integrationInfo?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderOnepasswordSDKIntegrationInfo>;
+            /**
+             * Vault defines the vault's name to access. Do NOT add op:// prefix. This will be done automatically.
+             */
+            vault?: pulumi.Input<string>;
+        }
+        /**
+         * Auth defines the information necessary to authenticate against OnePassword API.
+         */
+        interface SecretStoreSpecProviderOnepasswordSDKAuth {
+            serviceAccountSecretRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderOnepasswordSDKAuthServiceAccountSecretRef>;
+        }
+        /**
+         * Auth defines the information necessary to authenticate against OnePassword API.
+         */
+        interface SecretStoreSpecProviderOnepasswordSDKAuthPatch {
+            serviceAccountSecretRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderOnepasswordSDKAuthServiceAccountSecretRefPatch>;
+        }
+        /**
+         * ServiceAccountSecretRef points to the secret containing the token to access 1Password vault.
+         */
+        interface SecretStoreSpecProviderOnepasswordSDKAuthServiceAccountSecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string>;
+        }
+        /**
+         * ServiceAccountSecretRef points to the secret containing the token to access 1Password vault.
+         */
+        interface SecretStoreSpecProviderOnepasswordSDKAuthServiceAccountSecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string>;
+        }
+        /**
+         * IntegrationInfo specifies the name and version of the integration built using the 1Password Go SDK.
+         * If you don't know which name and version to use, use `DefaultIntegrationName` and `DefaultIntegrationVersion`, respectively.
+         */
+        interface SecretStoreSpecProviderOnepasswordSDKIntegrationInfo {
+            /**
+             * Name defaults to "1Password SDK".
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * Version defaults to "v1.0.0".
+             */
+            version?: pulumi.Input<string>;
+        }
+        /**
+         * IntegrationInfo specifies the name and version of the integration built using the 1Password Go SDK.
+         * If you don't know which name and version to use, use `DefaultIntegrationName` and `DefaultIntegrationVersion`, respectively.
+         */
+        interface SecretStoreSpecProviderOnepasswordSDKIntegrationInfoPatch {
+            /**
+             * Name defaults to "1Password SDK".
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * Version defaults to "v1.0.0".
+             */
+            version?: pulumi.Input<string>;
+        }
+        /**
+         * OnePasswordSDK configures this store to use 1Password's new Go SDK to sync secrets.
+         */
+        interface SecretStoreSpecProviderOnepasswordSDKPatch {
+            auth?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderOnepasswordSDKAuthPatch>;
+            integrationInfo?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderOnepasswordSDKIntegrationInfoPatch>;
+            /**
+             * Vault defines the vault's name to access. Do NOT add op:// prefix. This will be done automatically.
+             */
+            vault?: pulumi.Input<string>;
+        }
         /**
          * Oracle configures this store to sync secrets using Oracle Vault provider
          */
@@ -82671,6 +83010,7 @@ export declare namespace external_secrets {
             kubernetes?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderKubernetesPatch>;
             onboardbase?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderOnboardbasePatch>;
             onepassword?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderOnepasswordPatch>;
+            onepasswordSDK?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderOnepasswordSDKPatch>;
             oracle?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderOraclePatch>;
             passbolt?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderPassboltPatch>;
             passworddepot?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderPassworddepotPatch>;
@@ -84502,6 +84842,7 @@ export declare namespace external_secrets {
          * Webhook configures this store to sync secrets using a generic templated webhook
          */
         interface SecretStoreSpecProviderWebhook {
+            auth?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderWebhookAuth>;
             /**
              * Body
              */
@@ -84539,6 +84880,112 @@ export declare namespace external_secrets {
              */
             url?: pulumi.Input<string>;
         }
+        /**
+         * Auth specifies a authorization protocol. Only one protocol may be set.
+         */
+        interface SecretStoreSpecProviderWebhookAuth {
+            ntlm?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderWebhookAuthNtlm>;
+        }
+        /**
+         * NTLMProtocol configures the store to use NTLM for auth
+         */
+        interface SecretStoreSpecProviderWebhookAuthNtlm {
+            passwordSecret?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderWebhookAuthNtlmPasswordSecret>;
+            usernameSecret?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderWebhookAuthNtlmUsernameSecret>;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface SecretStoreSpecProviderWebhookAuthNtlmPasswordSecret {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string>;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface SecretStoreSpecProviderWebhookAuthNtlmPasswordSecretPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string>;
+        }
+        /**
+         * NTLMProtocol configures the store to use NTLM for auth
+         */
+        interface SecretStoreSpecProviderWebhookAuthNtlmPatch {
+            passwordSecret?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderWebhookAuthNtlmPasswordSecretPatch>;
+            usernameSecret?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderWebhookAuthNtlmUsernameSecretPatch>;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface SecretStoreSpecProviderWebhookAuthNtlmUsernameSecret {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string>;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface SecretStoreSpecProviderWebhookAuthNtlmUsernameSecretPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string>;
+        }
+        /**
+         * Auth specifies a authorization protocol. Only one protocol may be set.
+         */
+        interface SecretStoreSpecProviderWebhookAuthPatch {
+            ntlm?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderWebhookAuthNtlmPatch>;
+        }
         /**
          * The provider for the CA bundle to use to validate webhook server certificate.
          */
@@ -84585,6 +85032,7 @@ export declare namespace external_secrets {
          * Webhook configures this store to sync secrets using a generic templated webhook
          */
         interface SecretStoreSpecProviderWebhookPatch {
+            auth?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderWebhookAuthPatch>;
             /**
              * Body
              */
@@ -87046,8 +87494,7 @@ export declare namespace external_secrets {
             name?: pulumi.Input<string>;
         }
         /**
-         * The labels to select by to find the Namespaces to create the ExternalSecrets in.
-         * Deprecated: Use NamespaceSelectors instead.
+         * The labels to select by to find the Namespaces to create the ExternalSecrets in
          */
         interface ClusterExternalSecretSpecNamespaceSelector {
             /**
@@ -87108,8 +87555,7 @@ export declare namespace external_secrets {
             values?: pulumi.Input<pulumi.Input<string>[]>;
         }
         /**
-         * The labels to select by to find the Namespaces to create the ExternalSecrets in.
-         * Deprecated: Use NamespaceSelectors instead.
+         * The labels to select by to find the Namespaces to create the ExternalSecrets in
          */
         interface ClusterExternalSecretSpecNamespaceSelectorPatch {
             /**
@@ -93612,6 +94058,7 @@ export declare namespace external_secrets {
          * Webhook configures this store to sync secrets using a generic templated webhook
          */
         interface ClusterSecretStoreSpecProviderWebhook {
+            auth?: pulumi.Input<inputs.external_secrets.v1beta1.ClusterSecretStoreSpecProviderWebhookAuth>;
             /**
              * Body
              */
@@ -93649,6 +94096,112 @@ export declare namespace external_secrets {
              */
             url?: pulumi.Input<string>;
         }
+        /**
+         * Auth specifies a authorization protocol. Only one protocol may be set.
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuth {
+            ntlm?: pulumi.Input<inputs.external_secrets.v1beta1.ClusterSecretStoreSpecProviderWebhookAuthNtlm>;
+        }
+        /**
+         * NTLMProtocol configures the store to use NTLM for auth
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthNtlm {
+            passwordSecret?: pulumi.Input<inputs.external_secrets.v1beta1.ClusterSecretStoreSpecProviderWebhookAuthNtlmPasswordSecret>;
+            usernameSecret?: pulumi.Input<inputs.external_secrets.v1beta1.ClusterSecretStoreSpecProviderWebhookAuthNtlmUsernameSecret>;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthNtlmPasswordSecret {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string>;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthNtlmPasswordSecretPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string>;
+        }
+        /**
+         * NTLMProtocol configures the store to use NTLM for auth
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthNtlmPatch {
+            passwordSecret?: pulumi.Input<inputs.external_secrets.v1beta1.ClusterSecretStoreSpecProviderWebhookAuthNtlmPasswordSecretPatch>;
+            usernameSecret?: pulumi.Input<inputs.external_secrets.v1beta1.ClusterSecretStoreSpecProviderWebhookAuthNtlmUsernameSecretPatch>;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthNtlmUsernameSecret {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string>;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthNtlmUsernameSecretPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string>;
+        }
+        /**
+         * Auth specifies a authorization protocol. Only one protocol may be set.
+         */
+        interface ClusterSecretStoreSpecProviderWebhookAuthPatch {
+            ntlm?: pulumi.Input<inputs.external_secrets.v1beta1.ClusterSecretStoreSpecProviderWebhookAuthNtlmPatch>;
+        }
         /**
          * The provider for the CA bundle to use to validate webhook server certificate.
          */
@@ -93695,6 +94248,7 @@ export declare namespace external_secrets {
          * Webhook configures this store to sync secrets using a generic templated webhook
          */
         interface ClusterSecretStoreSpecProviderWebhookPatch {
+            auth?: pulumi.Input<inputs.external_secrets.v1beta1.ClusterSecretStoreSpecProviderWebhookAuthPatch>;
             /**
              * Body
              */
@@ -101216,6 +101770,7 @@ export declare namespace external_secrets {
          * Webhook configures this store to sync secrets using a generic templated webhook
          */
         interface SecretStoreSpecProviderWebhook {
+            auth?: pulumi.Input<inputs.external_secrets.v1beta1.SecretStoreSpecProviderWebhookAuth>;
             /**
              * Body
              */
@@ -101253,6 +101808,112 @@ export declare namespace external_secrets {
              */
             url?: pulumi.Input<string>;
         }
+        /**
+         * Auth specifies a authorization protocol. Only one protocol may be set.
+         */
+        interface SecretStoreSpecProviderWebhookAuth {
+            ntlm?: pulumi.Input<inputs.external_secrets.v1beta1.SecretStoreSpecProviderWebhookAuthNtlm>;
+        }
+        /**
+         * NTLMProtocol configures the store to use NTLM for auth
+         */
+        interface SecretStoreSpecProviderWebhookAuthNtlm {
+            passwordSecret?: pulumi.Input<inputs.external_secrets.v1beta1.SecretStoreSpecProviderWebhookAuthNtlmPasswordSecret>;
+            usernameSecret?: pulumi.Input<inputs.external_secrets.v1beta1.SecretStoreSpecProviderWebhookAuthNtlmUsernameSecret>;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface SecretStoreSpecProviderWebhookAuthNtlmPasswordSecret {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string>;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface SecretStoreSpecProviderWebhookAuthNtlmPasswordSecretPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string>;
+        }
+        /**
+         * NTLMProtocol configures the store to use NTLM for auth
+         */
+        interface SecretStoreSpecProviderWebhookAuthNtlmPatch {
+            passwordSecret?: pulumi.Input<inputs.external_secrets.v1beta1.SecretStoreSpecProviderWebhookAuthNtlmPasswordSecretPatch>;
+            usernameSecret?: pulumi.Input<inputs.external_secrets.v1beta1.SecretStoreSpecProviderWebhookAuthNtlmUsernameSecretPatch>;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface SecretStoreSpecProviderWebhookAuthNtlmUsernameSecret {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string>;
+        }
+        /**
+         * A reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface SecretStoreSpecProviderWebhookAuthNtlmUsernameSecretPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string>;
+        }
+        /**
+         * Auth specifies a authorization protocol. Only one protocol may be set.
+         */
+        interface SecretStoreSpecProviderWebhookAuthPatch {
+            ntlm?: pulumi.Input<inputs.external_secrets.v1beta1.SecretStoreSpecProviderWebhookAuthNtlmPatch>;
+        }
         /**
          * The provider for the CA bundle to use to validate webhook server certificate.
          */
@@ -101299,6 +101960,7 @@ export declare namespace external_secrets {
          * Webhook configures this store to sync secrets using a generic templated webhook
          */
         interface SecretStoreSpecProviderWebhookPatch {
+            auth?: pulumi.Input<inputs.external_secrets.v1beta1.SecretStoreSpecProviderWebhookAuthPatch>;
             /**
              * Body
              */
@@ -109938,6 +110600,10 @@ export declare namespace gateway {
             fqdn?: pulumi.Input<inputs.gateway.v1alpha1.BackendSpecEndpointsFqdn>;
             ip?: pulumi.Input<inputs.gateway.v1alpha1.BackendSpecEndpointsIp>;
             unix?: pulumi.Input<inputs.gateway.v1alpha1.BackendSpecEndpointsUnix>;
+            /**
+             * Zone defines the service zone of the backend endpoint.
+             */
+            zone?: pulumi.Input<string>;
         }
         /**
          * FQDN defines a FQDN endpoint
@@ -110001,6 +110667,10 @@ export declare namespace gateway {
             fqdn?: pulumi.Input<inputs.gateway.v1alpha1.BackendSpecEndpointsFqdnPatch>;
             ip?: pulumi.Input<inputs.gateway.v1alpha1.BackendSpecEndpointsIpPatch>;
             unix?: pulumi.Input<inputs.gateway.v1alpha1.BackendSpecEndpointsUnixPatch>;
+            /**
+             * Zone defines the service zone of the backend endpoint.
+             */
+            zone?: pulumi.Input<string>;
         }
         /**
          * Unix defines the unix domain socket endpoint
@@ -110008,6 +110678,7 @@ export declare namespace gateway {
         interface BackendSpecEndpointsUnix {
             /**
              * Path defines the unix domain socket path of the backend endpoint.
+             * The path length must not exceed 108 characters.
              */
             path?: pulumi.Input<string>;
         }
@@ -110017,6 +110688,7 @@ export declare namespace gateway {
         interface BackendSpecEndpointsUnixPatch {
             /**
              * Path defines the unix domain socket path of the backend endpoint.
+             * The path length must not exceed 108 characters.
              */
             path?: pulumi.Input<string>;
         }
@@ -110630,6 +111302,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses?: pulumi.Input<pulumi.Input<number>[]>;
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname?: pulumi.Input<string>;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -110685,6 +111362,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses?: pulumi.Input<pulumi.Input<number>[]>;
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname?: pulumi.Input<string>;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -111232,12 +111914,6 @@ export declare namespace gateway {
              * to rate limit the request.
              */
             rules?: pulumi.Input<pulumi.Input<inputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitGlobalRules>[]>;
-            /**
-             * Shared determines whether the rate limit rules apply across all the policy targets.
-             * If set to true, the rule is treated as a common bucket and is shared across all policy targets (xRoutes).
-             * Default: false.
-             */
-            shared?: pulumi.Input<boolean>;
         }
         /**
          * Global defines global rate limit configuration.
@@ -111254,12 +111930,6 @@ export declare namespace gateway {
              * to rate limit the request.
              */
             rules?: pulumi.Input<pulumi.Input<inputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitGlobalRulesPatch>[]>;
-            /**
-             * Shared determines whether the rate limit rules apply across all the policy targets.
-             * If set to true, the rule is treated as a common bucket and is shared across all policy targets (xRoutes).
-             * Default: false.
-             */
-            shared?: pulumi.Input<boolean>;
         }
         /**
          * RateLimitRule defines the semantics for matching attributes
@@ -111283,6 +111953,12 @@ export declare namespace gateway {
             clientSelectors?: pulumi.Input<pulumi.Input<inputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitGlobalRulesClientSelectors>[]>;
             cost?: pulumi.Input<inputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitGlobalRulesCost>;
             limit?: pulumi.Input<inputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitGlobalRulesLimit>;
+            /**
+             * Shared determines whether this rate limit rule applies across all the policy targets.
+             * If set to true, the rule is treated as a common bucket and is shared across all policy targets (xRoutes).
+             * Default: false.
+             */
+            shared?: pulumi.Input<boolean>;
         }
         /**
          * RateLimitSelectCondition specifies the attributes within the traffic flow that can
@@ -111610,6 +112286,12 @@ export declare namespace gateway {
             clientSelectors?: pulumi.Input<pulumi.Input<inputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitGlobalRulesClientSelectorsPatch>[]>;
             cost?: pulumi.Input<inputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitGlobalRulesCostPatch>;
             limit?: pulumi.Input<inputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitGlobalRulesLimitPatch>;
+            /**
+             * Shared determines whether this rate limit rule applies across all the policy targets.
+             * If set to true, the rule is treated as a common bucket and is shared across all policy targets (xRoutes).
+             * Default: false.
+             */
+            shared?: pulumi.Input<boolean>;
         }
         /**
          * Local defines local rate limit configuration.
@@ -111657,6 +112339,12 @@ export declare namespace gateway {
             clientSelectors?: pulumi.Input<pulumi.Input<inputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitLocalRulesClientSelectors>[]>;
             cost?: pulumi.Input<inputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitLocalRulesCost>;
             limit?: pulumi.Input<inputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitLocalRulesLimit>;
+            /**
+             * Shared determines whether this rate limit rule applies across all the policy targets.
+             * If set to true, the rule is treated as a common bucket and is shared across all policy targets (xRoutes).
+             * Default: false.
+             */
+            shared?: pulumi.Input<boolean>;
         }
         /**
          * RateLimitSelectCondition specifies the attributes within the traffic flow that can
@@ -111984,6 +112672,12 @@ export declare namespace gateway {
             clientSelectors?: pulumi.Input<pulumi.Input<inputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitLocalRulesClientSelectorsPatch>[]>;
             cost?: pulumi.Input<inputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitLocalRulesCostPatch>;
             limit?: pulumi.Input<inputs.gateway.v1alpha1.BackendTrafficPolicySpecRateLimitLocalRulesLimitPatch>;
+            /**
+             * Shared determines whether this rate limit rule applies across all the policy targets.
+             * If set to true, the rule is treated as a common bucket and is shared across all policy targets (xRoutes).
+             * Default: false.
+             */
+            shared?: pulumi.Input<boolean>;
         }
         /**
          * RateLimit allows the user to limit the number of incoming requests
@@ -115204,6 +115898,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses?: pulumi.Input<pulumi.Input<number>[]>;
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname?: pulumi.Input<string>;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -115259,6 +115958,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses?: pulumi.Input<pulumi.Input<number>[]>;
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname?: pulumi.Input<string>;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -118956,7 +119660,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             /**
@@ -118968,7 +119671,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             namespaceSelector?: pulumi.Input<inputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDaemonSetPodAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelector>;
@@ -119090,7 +119792,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             /**
@@ -119102,7 +119803,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             namespaceSelector?: pulumi.Input<inputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDaemonSetPodAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelector>;
@@ -119257,7 +119957,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             /**
@@ -119269,7 +119968,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             namespaceSelector?: pulumi.Input<inputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDaemonSetPodAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelector>;
@@ -119391,7 +120089,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             /**
@@ -119403,7 +120100,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             namespaceSelector?: pulumi.Input<inputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDaemonSetPodAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelector>;
@@ -119848,7 +120544,6 @@ export declare namespace gateway {
              * - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
              *
              * If this value is nil, the behavior is equivalent to the Honor policy.
-             * This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
              */
             nodeAffinityPolicy?: pulumi.Input<string>;
             /**
@@ -119859,7 +120554,6 @@ export declare namespace gateway {
              * - Ignore: node taints are ignored. All nodes are included.
              *
              * If this value is nil, the behavior is equivalent to the Ignore policy.
-             * This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
              */
             nodeTaintsPolicy?: pulumi.Input<string>;
             /**
@@ -120805,7 +121499,7 @@ export declare namespace gateway {
          * The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
          * The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
          * The volume will be mounted read-only (ro) and non-executable files (noexec).
-         * Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath).
+         * Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
          * The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDaemonSetPodVolumesImage {
@@ -122250,12 +122944,12 @@ export declare namespace gateway {
             valueFrom?: pulumi.Input<inputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDeploymentInitContainersEnvValueFrom>;
         }
         /**
-         * EnvFromSource represents the source of a set of ConfigMaps
+         * EnvFromSource represents the source of a set of ConfigMaps or Secrets
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDeploymentInitContainersEnvFrom {
             configMapRef?: pulumi.Input<inputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDeploymentInitContainersEnvFromConfigMapRef>;
             /**
-             * An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
+             * Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
              */
             prefix?: pulumi.Input<string>;
             secretRef?: pulumi.Input<inputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDeploymentInitContainersEnvFromSecretRef>;
@@ -122384,6 +123078,12 @@ export declare namespace gateway {
         interface EnvoyProxySpecProviderKubernetesEnvoyDeploymentInitContainersLifecycle {
             postStart?: pulumi.Input<inputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDeploymentInitContainersLifecyclePostStart>;
             preStop?: pulumi.Input<inputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDeploymentInitContainersLifecyclePreStop>;
+            /**
+             * StopSignal defines which signal will be sent to a container when it is being stopped.
+             * If not specified, the default is defined by the container runtime in use.
+             * StopSignal can only be set for Pods with a non-empty .spec.os.name
+             */
+            stopSignal?: pulumi.Input<string>;
         }
         /**
          * PostStart is called immediately after a container is created. If the handler fails,
@@ -123640,7 +124340,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             /**
@@ -123652,7 +124351,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             namespaceSelector?: pulumi.Input<inputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDeploymentPodAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelector>;
@@ -123774,7 +124472,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             /**
@@ -123786,7 +124483,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             namespaceSelector?: pulumi.Input<inputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDeploymentPodAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelector>;
@@ -123941,7 +124637,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             /**
@@ -123953,7 +124648,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             namespaceSelector?: pulumi.Input<inputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDeploymentPodAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelector>;
@@ -124075,7 +124769,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             /**
@@ -124087,7 +124780,6 @@ export declare namespace gateway {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             namespaceSelector?: pulumi.Input<inputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDeploymentPodAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelector>;
@@ -124532,7 +125224,6 @@ export declare namespace gateway {
              * - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
              *
              * If this value is nil, the behavior is equivalent to the Honor policy.
-             * This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
              */
             nodeAffinityPolicy?: pulumi.Input<string>;
             /**
@@ -124543,7 +125234,6 @@ export declare namespace gateway {
              * - Ignore: node taints are ignored. All nodes are included.
              *
              * If this value is nil, the behavior is equivalent to the Ignore policy.
-             * This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
              */
             nodeTaintsPolicy?: pulumi.Input<string>;
             /**
@@ -125489,7 +126179,7 @@ export declare namespace gateway {
          * The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
          * The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
          * The volume will be mounted read-only (ro) and non-executable files (noexec).
-         * Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath).
+         * Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
          * The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDeploymentPodVolumesImage {
@@ -126343,7 +127033,9 @@ export declare namespace gateway {
         interface EnvoyProxySpecProviderKubernetesEnvoyHpaBehaviorScaleDown {
             /**
              * policies is a list of potential scaling polices which can be used during scaling.
-             * At least one policy must be specified, otherwise the HPAScalingRules will be discarded as invalid
+             * If not set, use the default values:
+             * - For scale up: allow doubling the number of pods, or an absolute change of 4 pods in a 15s window.
+             * - For scale down: allow all pods to be removed in a 15s window.
              */
             policies?: pulumi.Input<pulumi.Input<inputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyHpaBehaviorScaleDownPolicies>[]>;
             /**
@@ -126360,6 +127052,20 @@ export declare namespace gateway {
              * - For scale down: 300 (i.e. the stabilization window is 300 seconds long).
              */
             stabilizationWindowSeconds?: pulumi.Input<number>;
+            /**
+             * tolerance is the tolerance on the ratio between the current and desired
+             * metric value under which no updates are made to the desired number of
+             * replicas (e.g. 0.01 for 1%). Must be greater than or equal to zero. If not
+             * set, the default cluster-wide tolerance is applied (by default 10%).
+             *
+             * For example, if autoscaling is configured with a memory consumption target of 100Mi,
+             * and scale-down and scale-up tolerances of 5% and 1% respectively, scaling will be
+             * triggered when the actual consumption falls below 95Mi or exceeds 101Mi.
+             *
+             * This is an alpha field and requires enabling the HPAConfigurableTolerance
+             * feature gate.
+             */
+            tolerance?: pulumi.Input<number | string>;
         }
         /**
          * HPAScalingPolicy is a single policy which must hold true for a specified past interval.
@@ -126390,7 +127096,9 @@ export declare namespace gateway {
         interface EnvoyProxySpecProviderKubernetesEnvoyHpaBehaviorScaleUp {
             /**
              * policies is a list of potential scaling polices which can be used during scaling.
-             * At least one policy must be specified, otherwise the HPAScalingRules will be discarded as invalid
+             * If not set, use the default values:
+             * - For scale up: allow doubling the number of pods, or an absolute change of 4 pods in a 15s window.
+             * - For scale down: allow all pods to be removed in a 15s window.
              */
             policies?: pulumi.Input<pulumi.Input<inputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyHpaBehaviorScaleUpPolicies>[]>;
             /**
@@ -126407,6 +127115,20 @@ export declare namespace gateway {
              * - For scale down: 300 (i.e. the stabilization window is 300 seconds long).
              */
             stabilizationWindowSeconds?: pulumi.Input<number>;
+            /**
+             * tolerance is the tolerance on the ratio between the current and desired
+             * metric value under which no updates are made to the desired number of
+             * replicas (e.g. 0.01 for 1%). Must be greater than or equal to zero. If not
+             * set, the default cluster-wide tolerance is applied (by default 10%).
+             *
+             * For example, if autoscaling is configured with a memory consumption target of 100Mi,
+             * and scale-down and scale-up tolerances of 5% and 1% respectively, scaling will be
+             * triggered when the actual consumption falls below 95Mi or exceeds 101Mi.
+             *
+             * This is an alpha field and requires enabling the HPAConfigurableTolerance
+             * feature gate.
+             */
+            tolerance?: pulumi.Input<number | string>;
         }
         /**
          * HPAScalingPolicy is a single policy which must hold true for a specified past interval.
@@ -127646,6 +128368,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses?: pulumi.Input<pulumi.Input<number>[]>;
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname?: pulumi.Input<string>;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -127701,6 +128428,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses?: pulumi.Input<pulumi.Input<number>[]>;
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname?: pulumi.Input<string>;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -128976,6 +129708,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses?: pulumi.Input<pulumi.Input<number>[]>;
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname?: pulumi.Input<string>;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -129031,6 +129768,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses?: pulumi.Input<pulumi.Input<number>[]>;
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname?: pulumi.Input<string>;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -130434,6 +131176,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses?: pulumi.Input<pulumi.Input<number>[]>;
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname?: pulumi.Input<string>;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -130489,6 +131236,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses?: pulumi.Input<pulumi.Input<number>[]>;
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname?: pulumi.Input<string>;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -131782,6 +132534,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses?: pulumi.Input<pulumi.Input<number>[]>;
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname?: pulumi.Input<string>;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -131837,6 +132594,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses?: pulumi.Input<pulumi.Input<number>[]>;
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname?: pulumi.Input<string>;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -134230,6 +134992,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses?: pulumi.Input<pulumi.Input<number>[]>;
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname?: pulumi.Input<string>;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -134285,6 +135052,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses?: pulumi.Input<pulumi.Input<number>[]>;
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname?: pulumi.Input<string>;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -135503,6 +136275,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses?: pulumi.Input<pulumi.Input<number>[]>;
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname?: pulumi.Input<string>;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -135558,6 +136335,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses?: pulumi.Input<pulumi.Input<number>[]>;
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname?: pulumi.Input<string>;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -137098,6 +137880,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses?: pulumi.Input<pulumi.Input<number>[]>;
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname?: pulumi.Input<string>;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -137153,6 +137940,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses?: pulumi.Input<pulumi.Input<number>[]>;
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname?: pulumi.Input<string>;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -137901,6 +138693,7 @@ export declare namespace gateway {
              * OAuth flow will fail.
              */
             defaultTokenTTL?: pulumi.Input<string>;
+            denyRedirect?: pulumi.Input<inputs.gateway.v1alpha1.SecurityPolicySpecOidcDenyRedirect>;
             /**
              * ForwardAccessToken indicates whether the Envoy should forward the access token
              * via the Authorization header Bearer scheme to the upstream.
@@ -137913,6 +138706,16 @@ export declare namespace gateway {
              * If not specified, uses a default logout path "/logout"
              */
             logoutPath?: pulumi.Input<string>;
+            /**
+             * Skips OIDC authentication when the request contains a header that will be extracted by the JWT filter. Unless
+             * explicitly stated otherwise in the extractFrom field, this will be the "Authorization: Bearer ..." header.
+             *
+             * The passThroughAuthHeader option is typically used for non-browser clients that may not be able to handle OIDC
+             * redirects and wish to directly supply a token instead.
+             *
+             * If not specified, defaults to false.
+             */
+            passThroughAuthHeader?: pulumi.Input<boolean>;
             provider?: pulumi.Input<inputs.gateway.v1alpha1.SecurityPolicySpecOidcProvider>;
             /**
              * The redirect URL to be used in the OIDC
@@ -138048,6 +138851,60 @@ export declare namespace gateway {
              */
             idToken?: pulumi.Input<string>;
         }
+        /**
+         * Any request that matches any of the provided matchers (with either tokens that are expired or missing tokens) will not be redirected to the OIDC Provider.
+         * This behavior can be useful for AJAX or machine requests.
+         */
+        interface SecurityPolicySpecOidcDenyRedirect {
+            /**
+             * Defines the headers to match against the request to deny redirect to the OIDC Provider.
+             */
+            headers?: pulumi.Input<pulumi.Input<inputs.gateway.v1alpha1.SecurityPolicySpecOidcDenyRedirectHeaders>[]>;
+        }
+        /**
+         * OIDCDenyRedirectHeader defines how a header is matched
+         */
+        interface SecurityPolicySpecOidcDenyRedirectHeaders {
+            /**
+             * Specifies the name of the header in the request.
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * Type specifies how to match against a string.
+             */
+            type?: pulumi.Input<string>;
+            /**
+             * Value specifies the string value that the match must have.
+             */
+            value?: pulumi.Input<string>;
+        }
+        /**
+         * OIDCDenyRedirectHeader defines how a header is matched
+         */
+        interface SecurityPolicySpecOidcDenyRedirectHeadersPatch {
+            /**
+             * Specifies the name of the header in the request.
+             */
+            name?: pulumi.Input<string>;
+            /**
+             * Type specifies how to match against a string.
+             */
+            type?: pulumi.Input<string>;
+            /**
+             * Value specifies the string value that the match must have.
+             */
+            value?: pulumi.Input<string>;
+        }
+        /**
+         * Any request that matches any of the provided matchers (with either tokens that are expired or missing tokens) will not be redirected to the OIDC Provider.
+         * This behavior can be useful for AJAX or machine requests.
+         */
+        interface SecurityPolicySpecOidcDenyRedirectPatch {
+            /**
+             * Defines the headers to match against the request to deny redirect to the OIDC Provider.
+             */
+            headers?: pulumi.Input<pulumi.Input<inputs.gateway.v1alpha1.SecurityPolicySpecOidcDenyRedirectHeadersPatch>[]>;
+        }
         /**
          * OIDC defines the configuration for the OpenID Connect (OIDC) authentication.
          */
@@ -138086,6 +138943,7 @@ export declare namespace gateway {
              * OAuth flow will fail.
              */
             defaultTokenTTL?: pulumi.Input<string>;
+            denyRedirect?: pulumi.Input<inputs.gateway.v1alpha1.SecurityPolicySpecOidcDenyRedirectPatch>;
             /**
              * ForwardAccessToken indicates whether the Envoy should forward the access token
              * via the Authorization header Bearer scheme to the upstream.
@@ -138098,6 +138956,16 @@ export declare namespace gateway {
              * If not specified, uses a default logout path "/logout"
              */
             logoutPath?: pulumi.Input<string>;
+            /**
+             * Skips OIDC authentication when the request contains a header that will be extracted by the JWT filter. Unless
+             * explicitly stated otherwise in the extractFrom field, this will be the "Authorization: Bearer ..." header.
+             *
+             * The passThroughAuthHeader option is typically used for non-browser clients that may not be able to handle OIDC
+             * redirects and wish to directly supply a token instead.
+             *
+             * If not specified, defaults to false.
+             */
+            passThroughAuthHeader?: pulumi.Input<boolean>;
             provider?: pulumi.Input<inputs.gateway.v1alpha1.SecurityPolicySpecOidcProviderPatch>;
             /**
              * The redirect URL to be used in the OIDC
@@ -138635,6 +139503,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses?: pulumi.Input<pulumi.Input<number>[]>;
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname?: pulumi.Input<string>;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -138690,6 +139563,11 @@ export declare namespace gateway {
              * Defaults to 200 only
              */
             expectedStatuses?: pulumi.Input<pulumi.Input<number>[]>;
+            /**
+             * Hostname defines the HTTP host that will be requested during health checking.
+             * Default: HTTPRoute or GRPCRoute hostname.
+             */
+            hostname?: pulumi.Input<string>;
             /**
              * Method defines the HTTP method used for health checking.
              * Defaults to GET
@@ -216242,7 +217120,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             /**
@@ -216254,7 +217131,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             namespaceSelector?: pulumi.Input<inputs.postgresql.v1.ClusterSpecAffinityAdditionalPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelector>;
@@ -216454,7 +217330,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             /**
@@ -216466,7 +217341,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             namespaceSelector?: pulumi.Input<inputs.postgresql.v1.ClusterSpecAffinityAdditionalPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelectorPatch>;
@@ -216505,7 +217379,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             /**
@@ -216517,7 +217390,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             namespaceSelector?: pulumi.Input<inputs.postgresql.v1.ClusterSpecAffinityAdditionalPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelector>;
@@ -216722,7 +217594,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             /**
@@ -216734,7 +217605,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             namespaceSelector?: pulumi.Input<inputs.postgresql.v1.ClusterSpecAffinityAdditionalPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelectorPatch>;
@@ -216846,7 +217716,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             /**
@@ -216858,7 +217727,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             namespaceSelector?: pulumi.Input<inputs.postgresql.v1.ClusterSpecAffinityAdditionalPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelector>;
@@ -217058,7 +217926,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             /**
@@ -217070,7 +217937,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             namespaceSelector?: pulumi.Input<inputs.postgresql.v1.ClusterSpecAffinityAdditionalPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelectorPatch>;
@@ -217109,7 +217975,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             /**
@@ -217121,7 +217986,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             namespaceSelector?: pulumi.Input<inputs.postgresql.v1.ClusterSpecAffinityAdditionalPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelector>;
@@ -217326,7 +218190,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             /**
@@ -217338,7 +218201,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             namespaceSelector?: pulumi.Input<inputs.postgresql.v1.ClusterSpecAffinityAdditionalPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelectorPatch>;
@@ -219754,12 +220616,12 @@ export declare namespace postgresql {
             valueFrom?: pulumi.Input<inputs.postgresql.v1.ClusterSpecEnvValueFrom>;
         }
         /**
-         * EnvFromSource represents the source of a set of ConfigMaps
+         * EnvFromSource represents the source of a set of ConfigMaps or Secrets
          */
         interface ClusterSpecEnvFrom {
             configMapRef?: pulumi.Input<inputs.postgresql.v1.ClusterSpecEnvFromConfigMapRef>;
             /**
-             * An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
+             * Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
              */
             prefix?: pulumi.Input<string>;
             secretRef?: pulumi.Input<inputs.postgresql.v1.ClusterSpecEnvFromSecretRef>;
@@ -219799,12 +220661,12 @@ export declare namespace postgresql {
             optional?: pulumi.Input<boolean>;
         }
         /**
-         * EnvFromSource represents the source of a set of ConfigMaps
+         * EnvFromSource represents the source of a set of ConfigMaps or Secrets
          */
         interface ClusterSpecEnvFromPatch {
             configMapRef?: pulumi.Input<inputs.postgresql.v1.ClusterSpecEnvFromConfigMapRefPatch>;
             /**
-             * An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
+             * Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
              */
             prefix?: pulumi.Input<string>;
             secretRef?: pulumi.Input<inputs.postgresql.v1.ClusterSpecEnvFromSecretRefPatch>;
@@ -222062,13 +222924,12 @@ export declare namespace postgresql {
             sessionAffinity?: pulumi.Input<string>;
             sessionAffinityConfig?: pulumi.Input<inputs.postgresql.v1.ClusterSpecManagedServicesAdditionalServiceTemplateSpecSessionAffinityConfig>;
             /**
-             * TrafficDistribution offers a way to express preferences for how traffic is
-             * distributed to Service endpoints. Implementations can use this field as a
-             * hint, but are not required to guarantee strict adherence. If the field is
-             * not set, the implementation will apply its default routing strategy. If set
-             * to "PreferClose", implementations should prioritize endpoints that are
-             * topologically close (e.g., same zone).
-             * This is a beta field and requires enabling ServiceTrafficDistribution feature.
+             * TrafficDistribution offers a way to express preferences for how traffic
+             * is distributed to Service endpoints. Implementations can use this field
+             * as a hint, but are not required to guarantee strict adherence. If the
+             * field is not set, the implementation will apply its default routing
+             * strategy. If set to "PreferClose", implementations should prioritize
+             * endpoints that are in the same zone.
              */
             trafficDistribution?: pulumi.Input<string>;
             /**
@@ -222300,13 +223161,12 @@ export declare namespace postgresql {
             sessionAffinity?: pulumi.Input<string>;
             sessionAffinityConfig?: pulumi.Input<inputs.postgresql.v1.ClusterSpecManagedServicesAdditionalServiceTemplateSpecSessionAffinityConfigPatch>;
             /**
-             * TrafficDistribution offers a way to express preferences for how traffic is
-             * distributed to Service endpoints. Implementations can use this field as a
-             * hint, but are not required to guarantee strict adherence. If the field is
-             * not set, the implementation will apply its default routing strategy. If set
-             * to "PreferClose", implementations should prioritize endpoints that are
-             * topologically close (e.g., same zone).
-             * This is a beta field and requires enabling ServiceTrafficDistribution feature.
+             * TrafficDistribution offers a way to express preferences for how traffic
+             * is distributed to Service endpoints. Implementations can use this field
+             * as a hint, but are not required to guarantee strict adherence. If the
+             * field is not set, the implementation will apply its default routing
+             * strategy. If set to "PreferClose", implementations should prioritize
+             * endpoints that are in the same zone.
              */
             trafficDistribution?: pulumi.Input<string>;
             /**
@@ -225736,7 +226596,6 @@ export declare namespace postgresql {
              * - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
              *
              * If this value is nil, the behavior is equivalent to the Honor policy.
-             * This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
              */
             nodeAffinityPolicy?: pulumi.Input<string>;
             /**
@@ -225747,7 +226606,6 @@ export declare namespace postgresql {
              * - Ignore: node taints are ignored. All nodes are included.
              *
              * If this value is nil, the behavior is equivalent to the Ignore policy.
-             * This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
              */
             nodeTaintsPolicy?: pulumi.Input<string>;
             /**
@@ -225934,7 +226792,6 @@ export declare namespace postgresql {
              * - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
              *
              * If this value is nil, the behavior is equivalent to the Honor policy.
-             * This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
              */
             nodeAffinityPolicy?: pulumi.Input<string>;
             /**
@@ -225945,7 +226802,6 @@ export declare namespace postgresql {
              * - Ignore: node taints are ignored. All nodes are included.
              *
              * If this value is nil, the behavior is equivalent to the Ignore policy.
-             * This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
              */
             nodeTaintsPolicy?: pulumi.Input<string>;
             /**
@@ -226511,16 +227367,12 @@ export declare namespace postgresql {
              * ID of the latest generated node (used to avoid node name clashing)
              */
             latestGeneratedNode?: pulumi.Input<number>;
-            /**
-             * MajorVersionUpgradeFromImage contains the image that was
-             * running before the major version upgrade started.
-             */
-            majorVersionUpgradeFromImage?: pulumi.Input<string>;
             managedRolesStatus?: pulumi.Input<inputs.postgresql.v1.ClusterStatusManagedRolesStatus>;
             /**
              * OnlineUpdateEnabled shows if the online upgrade is enabled inside the cluster
              */
             onlineUpdateEnabled?: pulumi.Input<boolean>;
+            pgDataImageInfo?: pulumi.Input<inputs.postgresql.v1.ClusterStatusPgDataImageInfo>;
             /**
              * Current phase of the cluster
              */
@@ -226723,6 +227575,19 @@ export declare namespace postgresql {
                 }>;
             }>;
         }
+        /**
+         * PGDataImageInfo contains the details of the latest image that has run on the current data directory.
+         */
+        interface ClusterStatusPgDataImageInfo {
+            /**
+             * Image is the image name
+             */
+            image?: pulumi.Input<string>;
+            /**
+             * MajorVersion is the major version of the image
+             */
+            majorVersion?: pulumi.Input<number>;
+        }
         /**
          * PluginStatus is the status of a loaded plugin
          */
@@ -227743,13 +228608,12 @@ export declare namespace postgresql {
             sessionAffinity?: pulumi.Input<string>;
             sessionAffinityConfig?: pulumi.Input<inputs.postgresql.v1.PoolerSpecServiceTemplateSpecSessionAffinityConfig>;
             /**
-             * TrafficDistribution offers a way to express preferences for how traffic is
-             * distributed to Service endpoints. Implementations can use this field as a
-             * hint, but are not required to guarantee strict adherence. If the field is
-             * not set, the implementation will apply its default routing strategy. If set
-             * to "PreferClose", implementations should prioritize endpoints that are
-             * topologically close (e.g., same zone).
-             * This is a beta field and requires enabling ServiceTrafficDistribution feature.
+             * TrafficDistribution offers a way to express preferences for how traffic
+             * is distributed to Service endpoints. Implementations can use this field
+             * as a hint, but are not required to guarantee strict adherence. If the
+             * field is not set, the implementation will apply its default routing
+             * strategy. If set to "PreferClose", implementations should prioritize
+             * endpoints that are in the same zone.
              */
             trafficDistribution?: pulumi.Input<string>;
             /**
@@ -227981,13 +228845,12 @@ export declare namespace postgresql {
             sessionAffinity?: pulumi.Input<string>;
             sessionAffinityConfig?: pulumi.Input<inputs.postgresql.v1.PoolerSpecServiceTemplateSpecSessionAffinityConfigPatch>;
             /**
-             * TrafficDistribution offers a way to express preferences for how traffic is
-             * distributed to Service endpoints. Implementations can use this field as a
-             * hint, but are not required to guarantee strict adherence. If the field is
-             * not set, the implementation will apply its default routing strategy. If set
-             * to "PreferClose", implementations should prioritize endpoints that are
-             * topologically close (e.g., same zone).
-             * This is a beta field and requires enabling ServiceTrafficDistribution feature.
+             * TrafficDistribution offers a way to express preferences for how traffic
+             * is distributed to Service endpoints. Implementations can use this field
+             * as a hint, but are not required to guarantee strict adherence. If the
+             * field is not set, the implementation will apply its default routing
+             * strategy. If set to "PreferClose", implementations should prioritize
+             * endpoints that are in the same zone.
              */
             trafficDistribution?: pulumi.Input<string>;
             /**
@@ -228339,7 +229202,7 @@ export declare namespace postgresql {
              * Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes.
              * The resourceRequirements of an init container are taken into account during scheduling
              * by finding the highest request/limit for each resource type, and then using the max of
-             * of that value or the sum of the normal containers. Limits are applied to init containers
+             * that value or the sum of the normal containers. Limits are applied to init containers
              * in a similar fashion.
              * Init containers cannot currently be added or removed.
              * Cannot be updated.
@@ -228935,7 +229798,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             /**
@@ -228947,7 +229809,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             namespaceSelector?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelector>;
@@ -229147,7 +230008,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             /**
@@ -229159,7 +230019,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             namespaceSelector?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecAffinityPodAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelectorPatch>;
@@ -229198,7 +230057,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             /**
@@ -229210,7 +230068,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             namespaceSelector?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelector>;
@@ -229415,7 +230272,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             /**
@@ -229427,7 +230283,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             namespaceSelector?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecAffinityPodAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelectorPatch>;
@@ -229537,7 +230392,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             /**
@@ -229549,7 +230403,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             namespaceSelector?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelector>;
@@ -229749,7 +230602,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             /**
@@ -229761,7 +230613,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             namespaceSelector?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecAffinityPodAntiAffinityPreferredDuringSchedulingIgnoredDuringExecutionPodAffinityTermNamespaceSelectorPatch>;
@@ -229800,7 +230651,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             /**
@@ -229812,7 +230662,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             namespaceSelector?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelector>;
@@ -230017,7 +230866,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both matchLabelKeys and labelSelector.
              * Also, matchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             matchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             /**
@@ -230029,7 +230877,6 @@ export declare namespace postgresql {
              * pod labels will be ignored. The default value is empty.
              * The same key is forbidden to exist in both mismatchLabelKeys and labelSelector.
              * Also, mismatchLabelKeys cannot be set when labelSelector isn't set.
-             * This is a beta field and requires enabling MatchLabelKeysInPodAffinity feature gate (enabled by default).
              */
             mismatchLabelKeys?: pulumi.Input<pulumi.Input<string>[]>;
             namespaceSelector?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecAffinityPodAntiAffinityRequiredDuringSchedulingIgnoredDuringExecutionNamespaceSelectorPatch>;
@@ -230229,12 +231076,12 @@ export declare namespace postgresql {
             valueFrom?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecContainersEnvValueFrom>;
         }
         /**
-         * EnvFromSource represents the source of a set of ConfigMaps
+         * EnvFromSource represents the source of a set of ConfigMaps or Secrets
          */
         interface PoolerSpecTemplateSpecContainersEnvFrom {
             configMapRef?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecContainersEnvFromConfigMapRef>;
             /**
-             * An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
+             * Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
              */
             prefix?: pulumi.Input<string>;
             secretRef?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecContainersEnvFromSecretRef>;
@@ -230274,12 +231121,12 @@ export declare namespace postgresql {
             optional?: pulumi.Input<boolean>;
         }
         /**
-         * EnvFromSource represents the source of a set of ConfigMaps
+         * EnvFromSource represents the source of a set of ConfigMaps or Secrets
          */
         interface PoolerSpecTemplateSpecContainersEnvFromPatch {
             configMapRef?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecContainersEnvFromConfigMapRefPatch>;
             /**
-             * An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
+             * Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
              */
             prefix?: pulumi.Input<string>;
             secretRef?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecContainersEnvFromSecretRefPatch>;
@@ -230513,6 +231360,12 @@ export declare namespace postgresql {
         interface PoolerSpecTemplateSpecContainersLifecycle {
             postStart?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecContainersLifecyclePostStart>;
             preStop?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecContainersLifecyclePreStop>;
+            /**
+             * StopSignal defines which signal will be sent to a container when it is being stopped.
+             * If not specified, the default is defined by the container runtime in use.
+             * StopSignal can only be set for Pods with a non-empty .spec.os.name
+             */
+            stopSignal?: pulumi.Input<string>;
         }
         /**
          * Actions that the management system should take in response to container lifecycle events.
@@ -230521,6 +231374,12 @@ export declare namespace postgresql {
         interface PoolerSpecTemplateSpecContainersLifecyclePatch {
             postStart?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecContainersLifecyclePostStartPatch>;
             preStop?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecContainersLifecyclePreStopPatch>;
+            /**
+             * StopSignal defines which signal will be sent to a container when it is being stopped.
+             * If not specified, the default is defined by the container runtime in use.
+             * StopSignal can only be set for Pods with a non-empty .spec.os.name
+             */
+            stopSignal?: pulumi.Input<string>;
         }
         /**
          * PostStart is called immediately after a container is created. If the handler fails,
@@ -232865,12 +233724,12 @@ export declare namespace postgresql {
             valueFrom?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecEphemeralContainersEnvValueFrom>;
         }
         /**
-         * EnvFromSource represents the source of a set of ConfigMaps
+         * EnvFromSource represents the source of a set of ConfigMaps or Secrets
          */
         interface PoolerSpecTemplateSpecEphemeralContainersEnvFrom {
             configMapRef?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecEphemeralContainersEnvFromConfigMapRef>;
             /**
-             * An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
+             * Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
              */
             prefix?: pulumi.Input<string>;
             secretRef?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecEphemeralContainersEnvFromSecretRef>;
@@ -232910,12 +233769,12 @@ export declare namespace postgresql {
             optional?: pulumi.Input<boolean>;
         }
         /**
-         * EnvFromSource represents the source of a set of ConfigMaps
+         * EnvFromSource represents the source of a set of ConfigMaps or Secrets
          */
         interface PoolerSpecTemplateSpecEphemeralContainersEnvFromPatch {
             configMapRef?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecEphemeralContainersEnvFromConfigMapRefPatch>;
             /**
-             * An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
+             * Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
              */
             prefix?: pulumi.Input<string>;
             secretRef?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecEphemeralContainersEnvFromSecretRefPatch>;
@@ -233148,6 +234007,12 @@ export declare namespace postgresql {
         interface PoolerSpecTemplateSpecEphemeralContainersLifecycle {
             postStart?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecEphemeralContainersLifecyclePostStart>;
             preStop?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecEphemeralContainersLifecyclePreStop>;
+            /**
+             * StopSignal defines which signal will be sent to a container when it is being stopped.
+             * If not specified, the default is defined by the container runtime in use.
+             * StopSignal can only be set for Pods with a non-empty .spec.os.name
+             */
+            stopSignal?: pulumi.Input<string>;
         }
         /**
          * Lifecycle is not allowed for ephemeral containers.
@@ -233155,6 +234020,12 @@ export declare namespace postgresql {
         interface PoolerSpecTemplateSpecEphemeralContainersLifecyclePatch {
             postStart?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecEphemeralContainersLifecyclePostStartPatch>;
             preStop?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecEphemeralContainersLifecyclePreStopPatch>;
+            /**
+             * StopSignal defines which signal will be sent to a container when it is being stopped.
+             * If not specified, the default is defined by the container runtime in use.
+             * StopSignal can only be set for Pods with a non-empty .spec.os.name
+             */
+            stopSignal?: pulumi.Input<string>;
         }
         /**
          * PostStart is called immediately after a container is created. If the handler fails,
@@ -235447,12 +236318,12 @@ export declare namespace postgresql {
             valueFrom?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecInitContainersEnvValueFrom>;
         }
         /**
-         * EnvFromSource represents the source of a set of ConfigMaps
+         * EnvFromSource represents the source of a set of ConfigMaps or Secrets
          */
         interface PoolerSpecTemplateSpecInitContainersEnvFrom {
             configMapRef?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecInitContainersEnvFromConfigMapRef>;
             /**
-             * An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
+             * Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
              */
             prefix?: pulumi.Input<string>;
             secretRef?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecInitContainersEnvFromSecretRef>;
@@ -235492,12 +236363,12 @@ export declare namespace postgresql {
             optional?: pulumi.Input<boolean>;
         }
         /**
-         * EnvFromSource represents the source of a set of ConfigMaps
+         * EnvFromSource represents the source of a set of ConfigMaps or Secrets
          */
         interface PoolerSpecTemplateSpecInitContainersEnvFromPatch {
             configMapRef?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecInitContainersEnvFromConfigMapRefPatch>;
             /**
-             * An optional identifier to prepend to each key in the ConfigMap. Must be a C_IDENTIFIER.
+             * Optional text to prepend to the name of each environment variable. Must be a C_IDENTIFIER.
              */
             prefix?: pulumi.Input<string>;
             secretRef?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecInitContainersEnvFromSecretRefPatch>;
@@ -235731,6 +236602,12 @@ export declare namespace postgresql {
         interface PoolerSpecTemplateSpecInitContainersLifecycle {
             postStart?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecInitContainersLifecyclePostStart>;
             preStop?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecInitContainersLifecyclePreStop>;
+            /**
+             * StopSignal defines which signal will be sent to a container when it is being stopped.
+             * If not specified, the default is defined by the container runtime in use.
+             * StopSignal can only be set for Pods with a non-empty .spec.os.name
+             */
+            stopSignal?: pulumi.Input<string>;
         }
         /**
          * Actions that the management system should take in response to container lifecycle events.
@@ -235739,6 +236616,12 @@ export declare namespace postgresql {
         interface PoolerSpecTemplateSpecInitContainersLifecyclePatch {
             postStart?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecInitContainersLifecyclePostStartPatch>;
             preStop?: pulumi.Input<inputs.postgresql.v1.PoolerSpecTemplateSpecInitContainersLifecyclePreStopPatch>;
+            /**
+             * StopSignal defines which signal will be sent to a container when it is being stopped.
+             * If not specified, the default is defined by the container runtime in use.
+             * StopSignal can only be set for Pods with a non-empty .spec.os.name
+             */
+            stopSignal?: pulumi.Input<string>;
         }
         /**
          * PostStart is called immediately after a container is created. If the handler fails,
@@ -238010,7 +238893,7 @@ export declare namespace postgresql {
              * Init containers may not have Lifecycle actions, Readiness probes, Liveness probes, or Startup probes.
              * The resourceRequirements of an init container are taken into account during scheduling
              * by finding the highest request/limit for each resource type, and then using the max of
-             * of that value or the sum of the normal containers. Limits are applied to init containers
+             * that value or the sum of the normal containers. Limits are applied to init containers
              * in a similar fashion.
              * Init containers cannot currently be added or removed.
              * Cannot be updated.
@@ -238997,7 +239880,6 @@ export declare namespace postgresql {
              * - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
              *
              * If this value is nil, the behavior is equivalent to the Honor policy.
-             * This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
              */
             nodeAffinityPolicy?: pulumi.Input<string>;
             /**
@@ -239008,7 +239890,6 @@ export declare namespace postgresql {
              * - Ignore: node taints are ignored. All nodes are included.
              *
              * If this value is nil, the behavior is equivalent to the Ignore policy.
-             * This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
              */
             nodeTaintsPolicy?: pulumi.Input<string>;
             /**
@@ -239195,7 +240076,6 @@ export declare namespace postgresql {
              * - Ignore: nodeAffinity/nodeSelector are ignored. All nodes are included in the calculations.
              *
              * If this value is nil, the behavior is equivalent to the Honor policy.
-             * This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
              */
             nodeAffinityPolicy?: pulumi.Input<string>;
             /**
@@ -239206,7 +240086,6 @@ export declare namespace postgresql {
              * - Ignore: node taints are ignored. All nodes are included.
              *
              * If this value is nil, the behavior is equivalent to the Ignore policy.
-             * This is a beta-level feature default enabled by the NodeInclusionPolicyInPodTopologySpread feature flag.
              */
             nodeTaintsPolicy?: pulumi.Input<string>;
             /**
@@ -240924,7 +241803,7 @@ export declare namespace postgresql {
          * The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
          * The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
          * The volume will be mounted read-only (ro) and non-executable files (noexec).
-         * Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath).
+         * Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
          * The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
          */
         interface PoolerSpecTemplateSpecVolumesImage {
@@ -240959,7 +241838,7 @@ export declare namespace postgresql {
          * The types of objects that may be mounted by this volume are defined by the container runtime implementation on a host machine and at minimum must include all valid types supported by the container image field.
          * The OCI object gets mounted in a single directory (spec.containers[*].volumeMounts.mountPath) by merging the manifest layers in the same way as for container images.
          * The volume will be mounted read-only (ro) and non-executable files (noexec).
-         * Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath).
+         * Sub path mounts for containers are not supported (spec.containers[*].volumeMounts.subpath) before 1.33.
          * The field spec.securityContext.fsGroupChangePolicy has no effect on this volume type.
          */
         interface PoolerSpecTemplateSpecVolumesImagePatch {
@@ -243189,6 +244068,10 @@ export declare namespace velero {
              */
             ttl?: pulumi.Input<string>;
             uploaderConfig?: pulumi.Input<inputs.velero.v1.BackupSpecUploaderConfig>;
+            /**
+             * VolumeGroupSnapshotLabelKey specifies the label key to group PVCs under a VGS.
+             */
+            volumeGroupSnapshotLabelKey?: pulumi.Input<string>;
             /**
              * VolumeSnapshotLocations is a list containing names of VolumeSnapshotLocations associated with this backup.
              */
@@ -243783,6 +244666,10 @@ export declare namespace velero {
              */
             ttl?: pulumi.Input<string>;
             uploaderConfig?: pulumi.Input<inputs.velero.v1.BackupSpecUploaderConfigPatch>;
+            /**
+             * VolumeGroupSnapshotLabelKey specifies the label key to group PVCs under a VGS.
+             */
+            volumeGroupSnapshotLabelKey?: pulumi.Input<string>;
             /**
              * VolumeSnapshotLocations is a list containing names of VolumeSnapshotLocations associated with this backup.
              */
@@ -245731,6 +246618,10 @@ export declare namespace velero {
              */
             ttl?: pulumi.Input<string>;
             uploaderConfig?: pulumi.Input<inputs.velero.v1.ScheduleSpecTemplateUploaderConfig>;
+            /**
+             * VolumeGroupSnapshotLabelKey specifies the label key to group PVCs under a VGS.
+             */
+            volumeGroupSnapshotLabelKey?: pulumi.Input<string>;
             /**
              * VolumeSnapshotLocations is a list containing names of VolumeSnapshotLocations associated with this backup.
              */
@@ -246326,6 +247217,10 @@ export declare namespace velero {
              */
             ttl?: pulumi.Input<string>;
             uploaderConfig?: pulumi.Input<inputs.velero.v1.ScheduleSpecTemplateUploaderConfigPatch>;
+            /**
+             * VolumeGroupSnapshotLabelKey specifies the label key to group PVCs under a VGS.
+             */
+            volumeGroupSnapshotLabelKey?: pulumi.Input<string>;
             /**
              * VolumeSnapshotLocations is a list containing names of VolumeSnapshotLocations associated with this backup.
              */