@kilic.dev/pulumi-k8s-crds 3.0.2 → 3.0.4

package/dist/types/input.d.ts

@@ -74671,8 +74671,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAkeylessAuthSecretRefKubernetesAuthServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -74694,8 +74694,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAkeylessAuthSecretRefKubernetesAuthServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -74861,8 +74861,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAkeylessAuthSecretRefServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -74884,8 +74884,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAkeylessAuthSecretRefServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -75045,8 +75045,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAwsAuthJwtServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -75065,8 +75065,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAwsAuthJwtServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -75651,8 +75651,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAzurekvServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -75672,8 +75672,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAzurekvServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -77104,8 +77104,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderConjurAuthJwtServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -77125,8 +77125,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderConjurAuthJwtServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -77382,8 +77382,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderCrdAuthServiceAccount {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -77402,8 +77402,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderCrdAuthServiceAccountPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -77889,8 +77889,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderDopplerAuthOidcConfigServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -77909,8 +77909,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderDopplerAuthOidcConfigServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -78524,8 +78524,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderGcpsmAuthWorkloadIdentityFederationServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -78545,8 +78545,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderGcpsmAuthWorkloadIdentityFederationServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -78586,8 +78586,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderGcpsmAuthWorkloadIdentityServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -78606,8 +78606,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderGcpsmAuthWorkloadIdentityServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -78643,7 +78643,7 @@ export declare namespace external_secrets {
             secretVersionSelectionPolicy?: pulumi.Input<string | undefined>;
         }
         /**
-         * Github configures this store to push GitHub Actions secrets using the GitHub API provider.
+         * Github configures this store to push GitHub Actions or Dependabot secrets using the GitHub API provider.
          * Note: This provider only supports write operations (PushSecret) and cannot fetch secrets from GitHub
          */
         interface ClusterSecretStoreSpecProviderGithub {
@@ -78675,6 +78675,11 @@ export declare namespace external_secrets {
              * repository will be used to fetch secrets from the Github repository within an organization
              */
             repository?: pulumi.Input<string | undefined>;
+            /**
+             * secretType specifies which GitHub secret service to use.
+             * Defaults to Actions for backwards compatibility.
+             */
+            secretType?: pulumi.Input<string | undefined>;
             /**
              * Upload URL for enterprise instances. Default to URL.
              */
@@ -78737,7 +78742,7 @@ export declare namespace external_secrets {
             namespace?: pulumi.Input<string | undefined>;
         }
         /**
-         * Github configures this store to push GitHub Actions secrets using the GitHub API provider.
+         * Github configures this store to push GitHub Actions or Dependabot secrets using the GitHub API provider.
          * Note: This provider only supports write operations (PushSecret) and cannot fetch secrets from GitHub
          */
         interface ClusterSecretStoreSpecProviderGithubPatch {
@@ -78769,6 +78774,11 @@ export declare namespace external_secrets {
              * repository will be used to fetch secrets from the Github repository within an organization
              */
             repository?: pulumi.Input<string | undefined>;
+            /**
+             * secretType specifies which GitHub secret service to use.
+             * Defaults to Actions for backwards compatibility.
+             */
+            secretType?: pulumi.Input<string | undefined>;
             /**
              * Upload URL for enterprise instances. Default to URL.
              */
@@ -80528,8 +80538,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderKubernetesAuthServiceAccount {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -80548,8 +80558,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderKubernetesAuthServiceAccountPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -80715,6 +80725,7 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderNebiusmysteryboxAuth {
             serviceAccountCredsSecretRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderNebiusmysteryboxAuthServiceAccountCredsSecretRef | undefined>;
             tokenSecretRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderNebiusmysteryboxAuthTokenSecretRef | undefined>;
+            workloadIdentity?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentity | undefined>;
         }
         /**
          * Auth defines parameters to authenticate in MysteryBox
@@ -80722,6 +80733,7 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderNebiusmysteryboxAuthPatch {
             serviceAccountCredsSecretRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderNebiusmysteryboxAuthServiceAccountCredsSecretRefPatch | undefined>;
             tokenSecretRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderNebiusmysteryboxAuthTokenSecretRefPatch | undefined>;
+            workloadIdentity?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentityPatch | undefined>;
         }
         /**
          * ServiceAccountCreds references a Kubernetes Secret key that contains a JSON
@@ -80823,6 +80835,72 @@ export declare namespace external_secrets {
              */
             namespace?: pulumi.Input<string | undefined>;
         }
+        /**
+         * WorkloadIdentity defines configuration for workload identity authentication to Nebius IAM.
+         */
+        interface ClusterSecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentity {
+            /**
+             * IAMServiceAccountID is the Nebius IAM service account identifier that the
+             * federated Kubernetes service account should impersonate during token exchange.
+             */
+            iamServiceAccountID?: pulumi.Input<string | undefined>;
+            serviceAccountRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentityServiceAccountRef | undefined>;
+        }
+        /**
+         * WorkloadIdentity defines configuration for workload identity authentication to Nebius IAM.
+         */
+        interface ClusterSecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentityPatch {
+            /**
+             * IAMServiceAccountID is the Nebius IAM service account identifier that the
+             * federated Kubernetes service account should impersonate during token exchange.
+             */
+            iamServiceAccountID?: pulumi.Input<string | undefined>;
+            serviceAccountRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentityServiceAccountRefPatch | undefined>;
+        }
+        /**
+         * ServiceAccountRef references a Kubernetes ServiceAccount used to request a
+         * temporary JWT via the TokenRequest API. The JWT is then exchanged for a
+         * Nebius IAM token using workload federation.
+         */
+        interface ClusterSecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentityServiceAccountRef {
+            /**
+             * Audience specifies the `aud` claim for the service account token
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
+             */
+            audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+            /**
+             * The name of the ServiceAccount resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * Namespace of the resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * ServiceAccountRef references a Kubernetes ServiceAccount used to request a
+         * temporary JWT via the TokenRequest API. The JWT is then exchanged for a
+         * Nebius IAM token using workload federation.
+         */
+        interface ClusterSecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentityServiceAccountRefPatch {
+            /**
+             * Audience specifies the `aud` claim for the service account token
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
+             */
+            audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+            /**
+             * The name of the ServiceAccount resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * Namespace of the resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
         /**
          * The provider for the CA bundle to use to validate NebiusMysterybox server certificate.
          */
@@ -81406,6 +81484,7 @@ export declare namespace external_secrets {
          */
         interface ClusterSecretStoreSpecProviderOpenBaoAuth {
             appRole?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderOpenBaoAuthAppRole | undefined>;
+            kubernetes?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderOpenBaoAuthKubernetes | undefined>;
             /**
              * Name of the [OpenBao Namespace] to authenticate to. This can be different
              * than the namespace your secret is in. Namespaces is a set of features
@@ -81547,11 +81626,140 @@ export declare namespace external_secrets {
              */
             namespace?: pulumi.Input<string | undefined>;
         }
+        /**
+         * Kubernetes authenticates with OpenBao by passing a ServiceAccount
+         * token to the [Kubernetes auth mechanism].
+         *
+         * [Kubernetes auth mechanism]: https://openbao.org/docs/auth/kubernetes/
+         */
+        interface ClusterSecretStoreSpecProviderOpenBaoAuthKubernetes {
+            /**
+             * Path where the Kubernetes authentication backend is mounted in OpenBao, e.g:
+             * "kubernetes"
+             */
+            path?: pulumi.Input<string | undefined>;
+            /**
+             * A required field containing the OpenBao Role to assume. A Role binds a
+             * Kubernetes ServiceAccount with a set of OpenBao policies.
+             */
+            role?: pulumi.Input<string | undefined>;
+            secretRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderOpenBaoAuthKubernetesSecretRef | undefined>;
+            serviceAccountRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderOpenBaoAuthKubernetesServiceAccountRef | undefined>;
+        }
+        /**
+         * Kubernetes authenticates with OpenBao by passing a ServiceAccount
+         * token to the [Kubernetes auth mechanism].
+         *
+         * [Kubernetes auth mechanism]: https://openbao.org/docs/auth/kubernetes/
+         */
+        interface ClusterSecretStoreSpecProviderOpenBaoAuthKubernetesPatch {
+            /**
+             * Path where the Kubernetes authentication backend is mounted in OpenBao, e.g:
+             * "kubernetes"
+             */
+            path?: pulumi.Input<string | undefined>;
+            /**
+             * A required field containing the OpenBao Role to assume. A Role binds a
+             * Kubernetes ServiceAccount with a set of OpenBao policies.
+             */
+            role?: pulumi.Input<string | undefined>;
+            secretRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderOpenBaoAuthKubernetesSecretRefPatch | undefined>;
+            serviceAccountRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderOpenBaoAuthKubernetesServiceAccountRefPatch | undefined>;
+        }
+        /**
+         * Optional secret field containing a Kubernetes ServiceAccount JWT used
+         * for authenticating with OpenBao. If a name is specified without a key,
+         * `token` is the default.
+         */
+        interface ClusterSecretStoreSpecProviderOpenBaoAuthKubernetesSecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * Optional secret field containing a Kubernetes ServiceAccount JWT used
+         * for authenticating with OpenBao. If a name is specified without a key,
+         * `token` is the default.
+         */
+        interface ClusterSecretStoreSpecProviderOpenBaoAuthKubernetesSecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * Optional service account field containing the name of a Kubernetes ServiceAccount.
+         * If the service account is specified, a token will be requested from the Kubernetes
+         * TokenRequest API for authenticating with OpenBao.
+         * Any configured audiences will be passed to the TokenRequest as-is.
+         */
+        interface ClusterSecretStoreSpecProviderOpenBaoAuthKubernetesServiceAccountRef {
+            /**
+             * Audience specifies the `aud` claim for the service account token
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
+             */
+            audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+            /**
+             * The name of the ServiceAccount resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * Namespace of the resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * Optional service account field containing the name of a Kubernetes ServiceAccount.
+         * If the service account is specified, a token will be requested from the Kubernetes
+         * TokenRequest API for authenticating with OpenBao.
+         * Any configured audiences will be passed to the TokenRequest as-is.
+         */
+        interface ClusterSecretStoreSpecProviderOpenBaoAuthKubernetesServiceAccountRefPatch {
+            /**
+             * Audience specifies the `aud` claim for the service account token
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
+             */
+            audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+            /**
+             * The name of the ServiceAccount resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * Namespace of the resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
         /**
          * Auth configures how secret-manager authenticates with the OpenBao server.
          */
         interface ClusterSecretStoreSpecProviderOpenBaoAuthPatch {
             appRole?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderOpenBaoAuthAppRolePatch | undefined>;
+            kubernetes?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderOpenBaoAuthKubernetesPatch | undefined>;
             /**
              * Name of the [OpenBao Namespace] to authenticate to. This can be different
              * than the namespace your secret is in. Namespaces is a set of features
@@ -81959,8 +82167,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderOracleServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -81980,8 +82188,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderOracleServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -82811,8 +83019,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderPulumiAuthOidcConfigServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -82831,8 +83039,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderPulumiAuthOidcConfigServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -83046,6 +83254,11 @@ export declare namespace external_secrets {
              */
             caBundle?: pulumi.Input<string | undefined>;
             caProvider?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderSecretserverCaProvider | undefined>;
+            /**
+             * DisableSiteIDValidation permits a missing site ID for new secrets.
+             * The provider sends 0 if no site ID is set.
+             */
+            disableSiteIDValidation?: pulumi.Input<boolean | undefined>;
             /**
              * Domain is the secret server domain.
              */
@@ -83056,6 +83269,12 @@ export declare namespace external_secrets {
              * URL to your secret server installation
              */
             serverURL?: pulumi.Input<string | undefined>;
+            /**
+             * SiteID is the ID of the Secret Server site for new secrets.
+             * PushSecret metadata can override this value for one secret.
+             * The provider uses 1 if this field is not set.
+             */
+            siteId?: pulumi.Input<number | undefined>;
             token?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderSecretserverToken | undefined>;
             username?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderSecretserverUsername | undefined>;
         }
@@ -83175,6 +83394,11 @@ export declare namespace external_secrets {
              */
             caBundle?: pulumi.Input<string | undefined>;
             caProvider?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderSecretserverCaProviderPatch | undefined>;
+            /**
+             * DisableSiteIDValidation permits a missing site ID for new secrets.
+             * The provider sends 0 if no site ID is set.
+             */
+            disableSiteIDValidation?: pulumi.Input<boolean | undefined>;
             /**
              * Domain is the secret server domain.
              */
@@ -83185,6 +83409,12 @@ export declare namespace external_secrets {
              * URL to your secret server installation
              */
             serverURL?: pulumi.Input<string | undefined>;
+            /**
+             * SiteID is the ID of the Secret Server site for new secrets.
+             * PushSecret metadata can override this value for one secret.
+             * The provider uses 1 if this field is not set.
+             */
+            siteId?: pulumi.Input<number | undefined>;
             token?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderSecretserverTokenPatch | undefined>;
             username?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderSecretserverUsernamePatch | undefined>;
         }
@@ -83824,8 +84054,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthGcpServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -83844,8 +84074,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthGcpServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -83906,8 +84136,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthGcpWorkloadIdentityServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -83926,8 +84156,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthGcpWorkloadIdentityServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -83990,8 +84220,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthIamJwtServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -84010,8 +84240,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthIamJwtServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -84262,8 +84492,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthJwtKubernetesServiceAccountTokenServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -84282,8 +84512,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthJwtKubernetesServiceAccountTokenServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -84443,8 +84673,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthKubernetesServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -84466,8 +84696,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthKubernetesServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -87183,8 +87413,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAkeylessAuthSecretRefKubernetesAuthServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -87206,8 +87436,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAkeylessAuthSecretRefKubernetesAuthServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -87373,8 +87603,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAkeylessAuthSecretRefServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -87396,8 +87626,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAkeylessAuthSecretRefServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -87557,8 +87787,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAwsAuthJwtServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -87577,8 +87807,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAwsAuthJwtServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -88163,8 +88393,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAzurekvServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -88184,8 +88414,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAzurekvServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -89616,8 +89846,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderConjurAuthJwtServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -89637,8 +89867,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderConjurAuthJwtServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -89894,8 +90124,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderCrdAuthServiceAccount {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -89914,8 +90144,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderCrdAuthServiceAccountPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -90401,8 +90631,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderDopplerAuthOidcConfigServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -90421,8 +90651,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderDopplerAuthOidcConfigServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -91036,8 +91266,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderGcpsmAuthWorkloadIdentityFederationServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -91057,8 +91287,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderGcpsmAuthWorkloadIdentityFederationServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -91098,8 +91328,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderGcpsmAuthWorkloadIdentityServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -91118,8 +91348,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderGcpsmAuthWorkloadIdentityServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -91155,7 +91385,7 @@ export declare namespace external_secrets {
             secretVersionSelectionPolicy?: pulumi.Input<string | undefined>;
         }
         /**
-         * Github configures this store to push GitHub Actions secrets using the GitHub API provider.
+         * Github configures this store to push GitHub Actions or Dependabot secrets using the GitHub API provider.
          * Note: This provider only supports write operations (PushSecret) and cannot fetch secrets from GitHub
          */
         interface SecretStoreSpecProviderGithub {
@@ -91187,6 +91417,11 @@ export declare namespace external_secrets {
              * repository will be used to fetch secrets from the Github repository within an organization
              */
             repository?: pulumi.Input<string | undefined>;
+            /**
+             * secretType specifies which GitHub secret service to use.
+             * Defaults to Actions for backwards compatibility.
+             */
+            secretType?: pulumi.Input<string | undefined>;
             /**
              * Upload URL for enterprise instances. Default to URL.
              */
@@ -91249,7 +91484,7 @@ export declare namespace external_secrets {
             namespace?: pulumi.Input<string | undefined>;
         }
         /**
-         * Github configures this store to push GitHub Actions secrets using the GitHub API provider.
+         * Github configures this store to push GitHub Actions or Dependabot secrets using the GitHub API provider.
          * Note: This provider only supports write operations (PushSecret) and cannot fetch secrets from GitHub
          */
         interface SecretStoreSpecProviderGithubPatch {
@@ -91281,6 +91516,11 @@ export declare namespace external_secrets {
              * repository will be used to fetch secrets from the Github repository within an organization
              */
             repository?: pulumi.Input<string | undefined>;
+            /**
+             * secretType specifies which GitHub secret service to use.
+             * Defaults to Actions for backwards compatibility.
+             */
+            secretType?: pulumi.Input<string | undefined>;
             /**
              * Upload URL for enterprise instances. Default to URL.
              */
@@ -93040,8 +93280,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderKubernetesAuthServiceAccount {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -93060,8 +93300,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderKubernetesAuthServiceAccountPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -93227,6 +93467,7 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderNebiusmysteryboxAuth {
             serviceAccountCredsSecretRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderNebiusmysteryboxAuthServiceAccountCredsSecretRef | undefined>;
             tokenSecretRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderNebiusmysteryboxAuthTokenSecretRef | undefined>;
+            workloadIdentity?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentity | undefined>;
         }
         /**
          * Auth defines parameters to authenticate in MysteryBox
@@ -93234,6 +93475,7 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderNebiusmysteryboxAuthPatch {
             serviceAccountCredsSecretRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderNebiusmysteryboxAuthServiceAccountCredsSecretRefPatch | undefined>;
             tokenSecretRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderNebiusmysteryboxAuthTokenSecretRefPatch | undefined>;
+            workloadIdentity?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentityPatch | undefined>;
         }
         /**
          * ServiceAccountCreds references a Kubernetes Secret key that contains a JSON
@@ -93335,6 +93577,72 @@ export declare namespace external_secrets {
              */
             namespace?: pulumi.Input<string | undefined>;
         }
+        /**
+         * WorkloadIdentity defines configuration for workload identity authentication to Nebius IAM.
+         */
+        interface SecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentity {
+            /**
+             * IAMServiceAccountID is the Nebius IAM service account identifier that the
+             * federated Kubernetes service account should impersonate during token exchange.
+             */
+            iamServiceAccountID?: pulumi.Input<string | undefined>;
+            serviceAccountRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentityServiceAccountRef | undefined>;
+        }
+        /**
+         * WorkloadIdentity defines configuration for workload identity authentication to Nebius IAM.
+         */
+        interface SecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentityPatch {
+            /**
+             * IAMServiceAccountID is the Nebius IAM service account identifier that the
+             * federated Kubernetes service account should impersonate during token exchange.
+             */
+            iamServiceAccountID?: pulumi.Input<string | undefined>;
+            serviceAccountRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentityServiceAccountRefPatch | undefined>;
+        }
+        /**
+         * ServiceAccountRef references a Kubernetes ServiceAccount used to request a
+         * temporary JWT via the TokenRequest API. The JWT is then exchanged for a
+         * Nebius IAM token using workload federation.
+         */
+        interface SecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentityServiceAccountRef {
+            /**
+             * Audience specifies the `aud` claim for the service account token
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
+             */
+            audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+            /**
+             * The name of the ServiceAccount resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * Namespace of the resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * ServiceAccountRef references a Kubernetes ServiceAccount used to request a
+         * temporary JWT via the TokenRequest API. The JWT is then exchanged for a
+         * Nebius IAM token using workload federation.
+         */
+        interface SecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentityServiceAccountRefPatch {
+            /**
+             * Audience specifies the `aud` claim for the service account token
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
+             */
+            audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+            /**
+             * The name of the ServiceAccount resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * Namespace of the resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
         /**
          * The provider for the CA bundle to use to validate NebiusMysterybox server certificate.
          */
@@ -93918,6 +94226,7 @@ export declare namespace external_secrets {
          */
         interface SecretStoreSpecProviderOpenBaoAuth {
             appRole?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderOpenBaoAuthAppRole | undefined>;
+            kubernetes?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderOpenBaoAuthKubernetes | undefined>;
             /**
              * Name of the [OpenBao Namespace] to authenticate to. This can be different
              * than the namespace your secret is in. Namespaces is a set of features
@@ -94059,11 +94368,140 @@ export declare namespace external_secrets {
              */
             namespace?: pulumi.Input<string | undefined>;
         }
+        /**
+         * Kubernetes authenticates with OpenBao by passing a ServiceAccount
+         * token to the [Kubernetes auth mechanism].
+         *
+         * [Kubernetes auth mechanism]: https://openbao.org/docs/auth/kubernetes/
+         */
+        interface SecretStoreSpecProviderOpenBaoAuthKubernetes {
+            /**
+             * Path where the Kubernetes authentication backend is mounted in OpenBao, e.g:
+             * "kubernetes"
+             */
+            path?: pulumi.Input<string | undefined>;
+            /**
+             * A required field containing the OpenBao Role to assume. A Role binds a
+             * Kubernetes ServiceAccount with a set of OpenBao policies.
+             */
+            role?: pulumi.Input<string | undefined>;
+            secretRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderOpenBaoAuthKubernetesSecretRef | undefined>;
+            serviceAccountRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderOpenBaoAuthKubernetesServiceAccountRef | undefined>;
+        }
+        /**
+         * Kubernetes authenticates with OpenBao by passing a ServiceAccount
+         * token to the [Kubernetes auth mechanism].
+         *
+         * [Kubernetes auth mechanism]: https://openbao.org/docs/auth/kubernetes/
+         */
+        interface SecretStoreSpecProviderOpenBaoAuthKubernetesPatch {
+            /**
+             * Path where the Kubernetes authentication backend is mounted in OpenBao, e.g:
+             * "kubernetes"
+             */
+            path?: pulumi.Input<string | undefined>;
+            /**
+             * A required field containing the OpenBao Role to assume. A Role binds a
+             * Kubernetes ServiceAccount with a set of OpenBao policies.
+             */
+            role?: pulumi.Input<string | undefined>;
+            secretRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderOpenBaoAuthKubernetesSecretRefPatch | undefined>;
+            serviceAccountRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderOpenBaoAuthKubernetesServiceAccountRefPatch | undefined>;
+        }
+        /**
+         * Optional secret field containing a Kubernetes ServiceAccount JWT used
+         * for authenticating with OpenBao. If a name is specified without a key,
+         * `token` is the default.
+         */
+        interface SecretStoreSpecProviderOpenBaoAuthKubernetesSecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * Optional secret field containing a Kubernetes ServiceAccount JWT used
+         * for authenticating with OpenBao. If a name is specified without a key,
+         * `token` is the default.
+         */
+        interface SecretStoreSpecProviderOpenBaoAuthKubernetesSecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * Optional service account field containing the name of a Kubernetes ServiceAccount.
+         * If the service account is specified, a token will be requested from the Kubernetes
+         * TokenRequest API for authenticating with OpenBao.
+         * Any configured audiences will be passed to the TokenRequest as-is.
+         */
+        interface SecretStoreSpecProviderOpenBaoAuthKubernetesServiceAccountRef {
+            /**
+             * Audience specifies the `aud` claim for the service account token
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
+             */
+            audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+            /**
+             * The name of the ServiceAccount resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * Namespace of the resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * Optional service account field containing the name of a Kubernetes ServiceAccount.
+         * If the service account is specified, a token will be requested from the Kubernetes
+         * TokenRequest API for authenticating with OpenBao.
+         * Any configured audiences will be passed to the TokenRequest as-is.
+         */
+        interface SecretStoreSpecProviderOpenBaoAuthKubernetesServiceAccountRefPatch {
+            /**
+             * Audience specifies the `aud` claim for the service account token
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
+             */
+            audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+            /**
+             * The name of the ServiceAccount resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * Namespace of the resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
         /**
          * Auth configures how secret-manager authenticates with the OpenBao server.
          */
         interface SecretStoreSpecProviderOpenBaoAuthPatch {
             appRole?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderOpenBaoAuthAppRolePatch | undefined>;
+            kubernetes?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderOpenBaoAuthKubernetesPatch | undefined>;
             /**
              * Name of the [OpenBao Namespace] to authenticate to. This can be different
              * than the namespace your secret is in. Namespaces is a set of features
@@ -94471,8 +94909,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderOracleServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -94492,8 +94930,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderOracleServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -95323,8 +95761,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderPulumiAuthOidcConfigServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -95343,8 +95781,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderPulumiAuthOidcConfigServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -95558,6 +95996,11 @@ export declare namespace external_secrets {
              */
             caBundle?: pulumi.Input<string | undefined>;
             caProvider?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderSecretserverCaProvider | undefined>;
+            /**
+             * DisableSiteIDValidation permits a missing site ID for new secrets.
+             * The provider sends 0 if no site ID is set.
+             */
+            disableSiteIDValidation?: pulumi.Input<boolean | undefined>;
             /**
              * Domain is the secret server domain.
              */
@@ -95568,6 +96011,12 @@ export declare namespace external_secrets {
              * URL to your secret server installation
              */
             serverURL?: pulumi.Input<string | undefined>;
+            /**
+             * SiteID is the ID of the Secret Server site for new secrets.
+             * PushSecret metadata can override this value for one secret.
+             * The provider uses 1 if this field is not set.
+             */
+            siteId?: pulumi.Input<number | undefined>;
             token?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderSecretserverToken | undefined>;
             username?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderSecretserverUsername | undefined>;
         }
@@ -95687,6 +96136,11 @@ export declare namespace external_secrets {
              */
             caBundle?: pulumi.Input<string | undefined>;
             caProvider?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderSecretserverCaProviderPatch | undefined>;
+            /**
+             * DisableSiteIDValidation permits a missing site ID for new secrets.
+             * The provider sends 0 if no site ID is set.
+             */
+            disableSiteIDValidation?: pulumi.Input<boolean | undefined>;
             /**
              * Domain is the secret server domain.
              */
@@ -95697,6 +96151,12 @@ export declare namespace external_secrets {
              * URL to your secret server installation
              */
             serverURL?: pulumi.Input<string | undefined>;
+            /**
+             * SiteID is the ID of the Secret Server site for new secrets.
+             * PushSecret metadata can override this value for one secret.
+             * The provider uses 1 if this field is not set.
+             */
+            siteId?: pulumi.Input<number | undefined>;
             token?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderSecretserverTokenPatch | undefined>;
             username?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderSecretserverUsernamePatch | undefined>;
         }
@@ -96336,8 +96796,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthGcpServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -96356,8 +96816,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthGcpServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -96418,8 +96878,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthGcpWorkloadIdentityServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -96438,8 +96898,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthGcpWorkloadIdentityServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -96502,8 +96962,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthIamJwtServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -96522,8 +96982,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthIamJwtServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -96774,8 +97234,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthJwtKubernetesServiceAccountTokenServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -96794,8 +97254,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthJwtKubernetesServiceAccountTokenServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -96955,8 +97415,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthKubernetesServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -96978,8 +97438,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthKubernetesServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -101674,8 +102134,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAkeylessAuthSecretRefKubernetesAuthServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -101697,8 +102157,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAkeylessAuthSecretRefKubernetesAuthServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -102123,8 +102583,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAwsAuthJwtServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -102143,8 +102603,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAwsAuthJwtServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -102640,8 +103100,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAzurekvServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -102661,8 +103121,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAzurekvServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -103624,8 +104084,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderConjurAuthJwtServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -103645,8 +104105,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderConjurAuthJwtServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -104305,8 +104765,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderGcpsmAuthWorkloadIdentityServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -104325,8 +104785,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderGcpsmAuthWorkloadIdentityServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -105153,8 +105613,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderKubernetesAuthServiceAccount {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -105173,8 +105633,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderKubernetesAuthServiceAccountPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -105734,8 +106194,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderOracleServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -105755,8 +106215,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderOracleServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -106921,8 +107381,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthIamJwtServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -106941,8 +107401,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthIamJwtServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -107193,8 +107653,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthJwtKubernetesServiceAccountTokenServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -107213,8 +107673,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthJwtKubernetesServiceAccountTokenServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -107374,8 +107834,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthKubernetesServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -107397,8 +107857,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthKubernetesServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -109615,8 +110075,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAkeylessAuthSecretRefKubernetesAuthServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -109638,8 +110098,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAkeylessAuthSecretRefKubernetesAuthServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -110064,8 +110524,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAwsAuthJwtServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -110084,8 +110544,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAwsAuthJwtServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -110581,8 +111041,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAzurekvServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -110602,8 +111062,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAzurekvServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -111565,8 +112025,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderConjurAuthJwtServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -111586,8 +112046,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderConjurAuthJwtServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -112246,8 +112706,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderGcpsmAuthWorkloadIdentityServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -112266,8 +112726,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderGcpsmAuthWorkloadIdentityServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -113094,8 +113554,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderKubernetesAuthServiceAccount {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -113114,8 +113574,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderKubernetesAuthServiceAccountPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -113675,8 +114135,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderOracleServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -113696,8 +114156,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderOracleServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -114862,8 +115322,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthIamJwtServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -114882,8 +115342,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthIamJwtServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -115134,8 +115594,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthJwtKubernetesServiceAccountTokenServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -115154,8 +115614,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthJwtKubernetesServiceAccountTokenServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -115315,8 +115775,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthKubernetesServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -115338,8 +115798,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthKubernetesServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
             /**
@@ -124413,7 +124873,7 @@ export declare namespace gateway {
              * Accepted Condition for the Route to `status: False`, with a
              * Reason of `UnsupportedValue`.
              *
-             * Support: Core
+             * Support: statusCode 301 and 302 are Core; all others are Extended.
              */
             statusCode?: pulumi.Input<number | undefined>;
         }
@@ -124485,7 +124945,7 @@ export declare namespace gateway {
              * Accepted Condition for the Route to `status: False`, with a
              * Reason of `UnsupportedValue`.
              *
-             * Support: Core
+             * Support: statusCode 301 and 302 are Core; all others are Extended.
              */
             statusCode?: pulumi.Input<number | undefined>;
         }
@@ -126085,7 +126545,7 @@ export declare namespace gateway {
              * Accepted Condition for the Route to `status: False`, with a
              * Reason of `UnsupportedValue`.
              *
-             * Support: Core
+             * Support: statusCode 301 and 302 are Core; all others are Extended.
              */
             statusCode?: pulumi.Input<number | undefined>;
         }
@@ -126157,7 +126617,7 @@ export declare namespace gateway {
              * Accepted Condition for the Route to `status: False`, with a
              * Reason of `UnsupportedValue`.
              *
-             * Support: Core
+             * Support: statusCode 301 and 302 are Core; all others are Extended.
              */
             statusCode?: pulumi.Input<number | undefined>;
         }
@@ -143382,6 +143842,7 @@ export declare namespace gateway {
         }
         /**
          * TLS configuration when connecting to the Wasm code source.
+         * If unset, system trust store is used for HTTPS url.
          */
         interface EnvoyExtensionPolicySpecWasmCodeHttpTls {
             caCertificateRef?: pulumi.Input<inputs.gateway.v1alpha1.EnvoyExtensionPolicySpecWasmCodeHttpTlsCaCertificateRef | undefined>;
@@ -143458,6 +143919,7 @@ export declare namespace gateway {
         }
         /**
          * TLS configuration when connecting to the Wasm code source.
+         * If unset, system trust store is used for HTTPS url.
          */
         interface EnvoyExtensionPolicySpecWasmCodeHttpTlsPatch {
             caCertificateRef?: pulumi.Input<inputs.gateway.v1alpha1.EnvoyExtensionPolicySpecWasmCodeHttpTlsCaCertificateRefPatch | undefined>;
@@ -143570,6 +144032,7 @@ export declare namespace gateway {
         }
         /**
          * TLS configuration when connecting to the Wasm code source.
+         * If unset, system trust store is used.
          */
         interface EnvoyExtensionPolicySpecWasmCodeImageTls {
             caCertificateRef?: pulumi.Input<inputs.gateway.v1alpha1.EnvoyExtensionPolicySpecWasmCodeImageTlsCaCertificateRef | undefined>;
@@ -143646,6 +144109,7 @@ export declare namespace gateway {
         }
         /**
          * TLS configuration when connecting to the Wasm code source.
+         * If unset, system trust store is used.
          */
         interface EnvoyExtensionPolicySpecWasmCodeImageTlsPatch {
             caCertificateRef?: pulumi.Input<inputs.gateway.v1alpha1.EnvoyExtensionPolicySpecWasmCodeImageTlsCaCertificateRefPatch | undefined>;
@@ -185865,7 +186329,7 @@ export declare namespace gateway {
              * Accepted Condition for the Route to `status: False`, with a
              * Reason of `UnsupportedValue`.
              *
-             * Support: Core
+             * Support: statusCode 301 and 302 are Core; all others are Extended.
              */
             statusCode?: pulumi.Input<number | undefined>;
         }
@@ -185937,7 +186401,7 @@ export declare namespace gateway {
              * Accepted Condition for the Route to `status: False`, with a
              * Reason of `UnsupportedValue`.
              *
-             * Support: Core
+             * Support: statusCode 301 and 302 are Core; all others are Extended.
              */
             statusCode?: pulumi.Input<number | undefined>;
         }
@@ -187537,7 +188001,7 @@ export declare namespace gateway {
              * Accepted Condition for the Route to `status: False`, with a
              * Reason of `UnsupportedValue`.
              *
-             * Support: Core
+             * Support: statusCode 301 and 302 are Core; all others are Extended.
              */
             statusCode?: pulumi.Input<number | undefined>;
         }
@@ -187609,7 +188073,7 @@ export declare namespace gateway {
              * Accepted Condition for the Route to `status: False`, with a
              * Reason of `UnsupportedValue`.
              *
-             * Support: Core
+             * Support: statusCode 301 and 302 are Core; all others are Extended.
              */
             statusCode?: pulumi.Input<number | undefined>;
         }