@kilic.dev/pulumi-k8s-crds 3.0.2 → 3.0.4

package/dist/types/output.d.ts

@@ -79816,8 +79816,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAkeylessAuthSecretRefKubernetesAuthServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -79839,8 +79839,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAkeylessAuthSecretRefKubernetesAuthServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -80006,8 +80006,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAkeylessAuthSecretRefServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -80029,8 +80029,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAkeylessAuthSecretRefServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -80190,8 +80190,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAwsAuthJwtServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -80210,8 +80210,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAwsAuthJwtServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -80796,8 +80796,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAzurekvServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -80817,8 +80817,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAzurekvServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -82249,8 +82249,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderConjurAuthJwtServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -82270,8 +82270,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderConjurAuthJwtServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -82527,8 +82527,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderCrdAuthServiceAccount {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -82547,8 +82547,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderCrdAuthServiceAccountPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -83034,8 +83034,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderDopplerAuthOidcConfigServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -83054,8 +83054,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderDopplerAuthOidcConfigServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -83669,8 +83669,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderGcpsmAuthWorkloadIdentityFederationServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -83690,8 +83690,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderGcpsmAuthWorkloadIdentityFederationServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -83731,8 +83731,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderGcpsmAuthWorkloadIdentityServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -83751,8 +83751,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderGcpsmAuthWorkloadIdentityServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -83788,7 +83788,7 @@ export declare namespace external_secrets {
             secretVersionSelectionPolicy: string;
         }
         /**
-         * Github configures this store to push GitHub Actions secrets using the GitHub API provider.
+         * Github configures this store to push GitHub Actions or Dependabot secrets using the GitHub API provider.
          * Note: This provider only supports write operations (PushSecret) and cannot fetch secrets from GitHub
          */
         interface ClusterSecretStoreSpecProviderGithub {
@@ -83820,6 +83820,11 @@ export declare namespace external_secrets {
              * repository will be used to fetch secrets from the Github repository within an organization
              */
             repository: string;
+            /**
+             * secretType specifies which GitHub secret service to use.
+             * Defaults to Actions for backwards compatibility.
+             */
+            secretType: string;
             /**
              * Upload URL for enterprise instances. Default to URL.
              */
@@ -83882,7 +83887,7 @@ export declare namespace external_secrets {
             namespace: string;
         }
         /**
-         * Github configures this store to push GitHub Actions secrets using the GitHub API provider.
+         * Github configures this store to push GitHub Actions or Dependabot secrets using the GitHub API provider.
          * Note: This provider only supports write operations (PushSecret) and cannot fetch secrets from GitHub
          */
         interface ClusterSecretStoreSpecProviderGithubPatch {
@@ -83914,6 +83919,11 @@ export declare namespace external_secrets {
              * repository will be used to fetch secrets from the Github repository within an organization
              */
             repository: string;
+            /**
+             * secretType specifies which GitHub secret service to use.
+             * Defaults to Actions for backwards compatibility.
+             */
+            secretType: string;
             /**
              * Upload URL for enterprise instances. Default to URL.
              */
@@ -85673,8 +85683,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderKubernetesAuthServiceAccount {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -85693,8 +85703,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderKubernetesAuthServiceAccountPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -85860,6 +85870,7 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderNebiusmysteryboxAuth {
             serviceAccountCredsSecretRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderNebiusmysteryboxAuthServiceAccountCredsSecretRef;
             tokenSecretRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderNebiusmysteryboxAuthTokenSecretRef;
+            workloadIdentity: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentity;
         }
         /**
          * Auth defines parameters to authenticate in MysteryBox
@@ -85867,6 +85878,7 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderNebiusmysteryboxAuthPatch {
             serviceAccountCredsSecretRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderNebiusmysteryboxAuthServiceAccountCredsSecretRefPatch;
             tokenSecretRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderNebiusmysteryboxAuthTokenSecretRefPatch;
+            workloadIdentity: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentityPatch;
         }
         /**
          * ServiceAccountCreds references a Kubernetes Secret key that contains a JSON
@@ -85968,6 +85980,72 @@ export declare namespace external_secrets {
              */
             namespace: string;
         }
+        /**
+         * WorkloadIdentity defines configuration for workload identity authentication to Nebius IAM.
+         */
+        interface ClusterSecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentity {
+            /**
+             * IAMServiceAccountID is the Nebius IAM service account identifier that the
+             * federated Kubernetes service account should impersonate during token exchange.
+             */
+            iamServiceAccountID: string;
+            serviceAccountRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentityServiceAccountRef;
+        }
+        /**
+         * WorkloadIdentity defines configuration for workload identity authentication to Nebius IAM.
+         */
+        interface ClusterSecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentityPatch {
+            /**
+             * IAMServiceAccountID is the Nebius IAM service account identifier that the
+             * federated Kubernetes service account should impersonate during token exchange.
+             */
+            iamServiceAccountID: string;
+            serviceAccountRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentityServiceAccountRefPatch;
+        }
+        /**
+         * ServiceAccountRef references a Kubernetes ServiceAccount used to request a
+         * temporary JWT via the TokenRequest API. The JWT is then exchanged for a
+         * Nebius IAM token using workload federation.
+         */
+        interface ClusterSecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentityServiceAccountRef {
+            /**
+             * Audience specifies the `aud` claim for the service account token
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
+             */
+            audiences: string[];
+            /**
+             * The name of the ServiceAccount resource being referred to.
+             */
+            name: string;
+            /**
+             * Namespace of the resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * ServiceAccountRef references a Kubernetes ServiceAccount used to request a
+         * temporary JWT via the TokenRequest API. The JWT is then exchanged for a
+         * Nebius IAM token using workload federation.
+         */
+        interface ClusterSecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentityServiceAccountRefPatch {
+            /**
+             * Audience specifies the `aud` claim for the service account token
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
+             */
+            audiences: string[];
+            /**
+             * The name of the ServiceAccount resource being referred to.
+             */
+            name: string;
+            /**
+             * Namespace of the resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
         /**
          * The provider for the CA bundle to use to validate NebiusMysterybox server certificate.
          */
@@ -86551,6 +86629,7 @@ export declare namespace external_secrets {
          */
         interface ClusterSecretStoreSpecProviderOpenBaoAuth {
             appRole: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderOpenBaoAuthAppRole;
+            kubernetes: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderOpenBaoAuthKubernetes;
             /**
              * Name of the [OpenBao Namespace] to authenticate to. This can be different
              * than the namespace your secret is in. Namespaces is a set of features
@@ -86692,11 +86771,140 @@ export declare namespace external_secrets {
              */
             namespace: string;
         }
+        /**
+         * Kubernetes authenticates with OpenBao by passing a ServiceAccount
+         * token to the [Kubernetes auth mechanism].
+         *
+         * [Kubernetes auth mechanism]: https://openbao.org/docs/auth/kubernetes/
+         */
+        interface ClusterSecretStoreSpecProviderOpenBaoAuthKubernetes {
+            /**
+             * Path where the Kubernetes authentication backend is mounted in OpenBao, e.g:
+             * "kubernetes"
+             */
+            path: string;
+            /**
+             * A required field containing the OpenBao Role to assume. A Role binds a
+             * Kubernetes ServiceAccount with a set of OpenBao policies.
+             */
+            role: string;
+            secretRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderOpenBaoAuthKubernetesSecretRef;
+            serviceAccountRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderOpenBaoAuthKubernetesServiceAccountRef;
+        }
+        /**
+         * Kubernetes authenticates with OpenBao by passing a ServiceAccount
+         * token to the [Kubernetes auth mechanism].
+         *
+         * [Kubernetes auth mechanism]: https://openbao.org/docs/auth/kubernetes/
+         */
+        interface ClusterSecretStoreSpecProviderOpenBaoAuthKubernetesPatch {
+            /**
+             * Path where the Kubernetes authentication backend is mounted in OpenBao, e.g:
+             * "kubernetes"
+             */
+            path: string;
+            /**
+             * A required field containing the OpenBao Role to assume. A Role binds a
+             * Kubernetes ServiceAccount with a set of OpenBao policies.
+             */
+            role: string;
+            secretRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderOpenBaoAuthKubernetesSecretRefPatch;
+            serviceAccountRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderOpenBaoAuthKubernetesServiceAccountRefPatch;
+        }
+        /**
+         * Optional secret field containing a Kubernetes ServiceAccount JWT used
+         * for authenticating with OpenBao. If a name is specified without a key,
+         * `token` is the default.
+         */
+        interface ClusterSecretStoreSpecProviderOpenBaoAuthKubernetesSecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * Optional secret field containing a Kubernetes ServiceAccount JWT used
+         * for authenticating with OpenBao. If a name is specified without a key,
+         * `token` is the default.
+         */
+        interface ClusterSecretStoreSpecProviderOpenBaoAuthKubernetesSecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * Optional service account field containing the name of a Kubernetes ServiceAccount.
+         * If the service account is specified, a token will be requested from the Kubernetes
+         * TokenRequest API for authenticating with OpenBao.
+         * Any configured audiences will be passed to the TokenRequest as-is.
+         */
+        interface ClusterSecretStoreSpecProviderOpenBaoAuthKubernetesServiceAccountRef {
+            /**
+             * Audience specifies the `aud` claim for the service account token
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
+             */
+            audiences: string[];
+            /**
+             * The name of the ServiceAccount resource being referred to.
+             */
+            name: string;
+            /**
+             * Namespace of the resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * Optional service account field containing the name of a Kubernetes ServiceAccount.
+         * If the service account is specified, a token will be requested from the Kubernetes
+         * TokenRequest API for authenticating with OpenBao.
+         * Any configured audiences will be passed to the TokenRequest as-is.
+         */
+        interface ClusterSecretStoreSpecProviderOpenBaoAuthKubernetesServiceAccountRefPatch {
+            /**
+             * Audience specifies the `aud` claim for the service account token
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
+             */
+            audiences: string[];
+            /**
+             * The name of the ServiceAccount resource being referred to.
+             */
+            name: string;
+            /**
+             * Namespace of the resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
         /**
          * Auth configures how secret-manager authenticates with the OpenBao server.
          */
         interface ClusterSecretStoreSpecProviderOpenBaoAuthPatch {
             appRole: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderOpenBaoAuthAppRolePatch;
+            kubernetes: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderOpenBaoAuthKubernetesPatch;
             /**
              * Name of the [OpenBao Namespace] to authenticate to. This can be different
              * than the namespace your secret is in. Namespaces is a set of features
@@ -87104,8 +87312,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderOracleServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -87125,8 +87333,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderOracleServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -87956,8 +88164,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderPulumiAuthOidcConfigServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -87976,8 +88184,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderPulumiAuthOidcConfigServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -88191,6 +88399,11 @@ export declare namespace external_secrets {
              */
             caBundle: string;
             caProvider: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderSecretserverCaProvider;
+            /**
+             * DisableSiteIDValidation permits a missing site ID for new secrets.
+             * The provider sends 0 if no site ID is set.
+             */
+            disableSiteIDValidation: boolean;
             /**
              * Domain is the secret server domain.
              */
@@ -88201,6 +88414,12 @@ export declare namespace external_secrets {
              * URL to your secret server installation
              */
             serverURL: string;
+            /**
+             * SiteID is the ID of the Secret Server site for new secrets.
+             * PushSecret metadata can override this value for one secret.
+             * The provider uses 1 if this field is not set.
+             */
+            siteId: number;
             token: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderSecretserverToken;
             username: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderSecretserverUsername;
         }
@@ -88320,6 +88539,11 @@ export declare namespace external_secrets {
              */
             caBundle: string;
             caProvider: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderSecretserverCaProviderPatch;
+            /**
+             * DisableSiteIDValidation permits a missing site ID for new secrets.
+             * The provider sends 0 if no site ID is set.
+             */
+            disableSiteIDValidation: boolean;
             /**
              * Domain is the secret server domain.
              */
@@ -88330,6 +88554,12 @@ export declare namespace external_secrets {
              * URL to your secret server installation
              */
             serverURL: string;
+            /**
+             * SiteID is the ID of the Secret Server site for new secrets.
+             * PushSecret metadata can override this value for one secret.
+             * The provider uses 1 if this field is not set.
+             */
+            siteId: number;
             token: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderSecretserverTokenPatch;
             username: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderSecretserverUsernamePatch;
         }
@@ -88969,8 +89199,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthGcpServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -88989,8 +89219,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthGcpServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -89051,8 +89281,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthGcpWorkloadIdentityServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -89071,8 +89301,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthGcpWorkloadIdentityServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -89135,8 +89365,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthIamJwtServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -89155,8 +89385,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthIamJwtServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -89407,8 +89637,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthJwtKubernetesServiceAccountTokenServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -89427,8 +89657,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthJwtKubernetesServiceAccountTokenServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -89588,8 +89818,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthKubernetesServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -89611,8 +89841,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthKubernetesServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -92393,8 +92623,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAkeylessAuthSecretRefKubernetesAuthServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -92416,8 +92646,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAkeylessAuthSecretRefKubernetesAuthServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -92583,8 +92813,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAkeylessAuthSecretRefServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -92606,8 +92836,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAkeylessAuthSecretRefServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -92767,8 +92997,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAwsAuthJwtServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -92787,8 +93017,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAwsAuthJwtServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -93373,8 +93603,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAzurekvServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -93394,8 +93624,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAzurekvServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -94826,8 +95056,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderConjurAuthJwtServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -94847,8 +95077,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderConjurAuthJwtServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -95104,8 +95334,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderCrdAuthServiceAccount {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -95124,8 +95354,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderCrdAuthServiceAccountPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -95611,8 +95841,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderDopplerAuthOidcConfigServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -95631,8 +95861,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderDopplerAuthOidcConfigServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -96246,8 +96476,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderGcpsmAuthWorkloadIdentityFederationServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -96267,8 +96497,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderGcpsmAuthWorkloadIdentityFederationServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -96308,8 +96538,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderGcpsmAuthWorkloadIdentityServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -96328,8 +96558,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderGcpsmAuthWorkloadIdentityServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -96365,7 +96595,7 @@ export declare namespace external_secrets {
             secretVersionSelectionPolicy: string;
         }
         /**
-         * Github configures this store to push GitHub Actions secrets using the GitHub API provider.
+         * Github configures this store to push GitHub Actions or Dependabot secrets using the GitHub API provider.
          * Note: This provider only supports write operations (PushSecret) and cannot fetch secrets from GitHub
          */
         interface SecretStoreSpecProviderGithub {
@@ -96397,6 +96627,11 @@ export declare namespace external_secrets {
              * repository will be used to fetch secrets from the Github repository within an organization
              */
             repository: string;
+            /**
+             * secretType specifies which GitHub secret service to use.
+             * Defaults to Actions for backwards compatibility.
+             */
+            secretType: string;
             /**
              * Upload URL for enterprise instances. Default to URL.
              */
@@ -96459,7 +96694,7 @@ export declare namespace external_secrets {
             namespace: string;
         }
         /**
-         * Github configures this store to push GitHub Actions secrets using the GitHub API provider.
+         * Github configures this store to push GitHub Actions or Dependabot secrets using the GitHub API provider.
          * Note: This provider only supports write operations (PushSecret) and cannot fetch secrets from GitHub
          */
         interface SecretStoreSpecProviderGithubPatch {
@@ -96491,6 +96726,11 @@ export declare namespace external_secrets {
              * repository will be used to fetch secrets from the Github repository within an organization
              */
             repository: string;
+            /**
+             * secretType specifies which GitHub secret service to use.
+             * Defaults to Actions for backwards compatibility.
+             */
+            secretType: string;
             /**
              * Upload URL for enterprise instances. Default to URL.
              */
@@ -98250,8 +98490,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderKubernetesAuthServiceAccount {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -98270,8 +98510,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderKubernetesAuthServiceAccountPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -98437,6 +98677,7 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderNebiusmysteryboxAuth {
             serviceAccountCredsSecretRef: outputs.external_secrets.v1.SecretStoreSpecProviderNebiusmysteryboxAuthServiceAccountCredsSecretRef;
             tokenSecretRef: outputs.external_secrets.v1.SecretStoreSpecProviderNebiusmysteryboxAuthTokenSecretRef;
+            workloadIdentity: outputs.external_secrets.v1.SecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentity;
         }
         /**
          * Auth defines parameters to authenticate in MysteryBox
@@ -98444,6 +98685,7 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderNebiusmysteryboxAuthPatch {
             serviceAccountCredsSecretRef: outputs.external_secrets.v1.SecretStoreSpecProviderNebiusmysteryboxAuthServiceAccountCredsSecretRefPatch;
             tokenSecretRef: outputs.external_secrets.v1.SecretStoreSpecProviderNebiusmysteryboxAuthTokenSecretRefPatch;
+            workloadIdentity: outputs.external_secrets.v1.SecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentityPatch;
         }
         /**
          * ServiceAccountCreds references a Kubernetes Secret key that contains a JSON
@@ -98545,6 +98787,72 @@ export declare namespace external_secrets {
              */
             namespace: string;
         }
+        /**
+         * WorkloadIdentity defines configuration for workload identity authentication to Nebius IAM.
+         */
+        interface SecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentity {
+            /**
+             * IAMServiceAccountID is the Nebius IAM service account identifier that the
+             * federated Kubernetes service account should impersonate during token exchange.
+             */
+            iamServiceAccountID: string;
+            serviceAccountRef: outputs.external_secrets.v1.SecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentityServiceAccountRef;
+        }
+        /**
+         * WorkloadIdentity defines configuration for workload identity authentication to Nebius IAM.
+         */
+        interface SecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentityPatch {
+            /**
+             * IAMServiceAccountID is the Nebius IAM service account identifier that the
+             * federated Kubernetes service account should impersonate during token exchange.
+             */
+            iamServiceAccountID: string;
+            serviceAccountRef: outputs.external_secrets.v1.SecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentityServiceAccountRefPatch;
+        }
+        /**
+         * ServiceAccountRef references a Kubernetes ServiceAccount used to request a
+         * temporary JWT via the TokenRequest API. The JWT is then exchanged for a
+         * Nebius IAM token using workload federation.
+         */
+        interface SecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentityServiceAccountRef {
+            /**
+             * Audience specifies the `aud` claim for the service account token
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
+             */
+            audiences: string[];
+            /**
+             * The name of the ServiceAccount resource being referred to.
+             */
+            name: string;
+            /**
+             * Namespace of the resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * ServiceAccountRef references a Kubernetes ServiceAccount used to request a
+         * temporary JWT via the TokenRequest API. The JWT is then exchanged for a
+         * Nebius IAM token using workload federation.
+         */
+        interface SecretStoreSpecProviderNebiusmysteryboxAuthWorkloadIdentityServiceAccountRefPatch {
+            /**
+             * Audience specifies the `aud` claim for the service account token
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
+             */
+            audiences: string[];
+            /**
+             * The name of the ServiceAccount resource being referred to.
+             */
+            name: string;
+            /**
+             * Namespace of the resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
         /**
          * The provider for the CA bundle to use to validate NebiusMysterybox server certificate.
          */
@@ -99128,6 +99436,7 @@ export declare namespace external_secrets {
          */
         interface SecretStoreSpecProviderOpenBaoAuth {
             appRole: outputs.external_secrets.v1.SecretStoreSpecProviderOpenBaoAuthAppRole;
+            kubernetes: outputs.external_secrets.v1.SecretStoreSpecProviderOpenBaoAuthKubernetes;
             /**
              * Name of the [OpenBao Namespace] to authenticate to. This can be different
              * than the namespace your secret is in. Namespaces is a set of features
@@ -99269,11 +99578,140 @@ export declare namespace external_secrets {
              */
             namespace: string;
         }
+        /**
+         * Kubernetes authenticates with OpenBao by passing a ServiceAccount
+         * token to the [Kubernetes auth mechanism].
+         *
+         * [Kubernetes auth mechanism]: https://openbao.org/docs/auth/kubernetes/
+         */
+        interface SecretStoreSpecProviderOpenBaoAuthKubernetes {
+            /**
+             * Path where the Kubernetes authentication backend is mounted in OpenBao, e.g:
+             * "kubernetes"
+             */
+            path: string;
+            /**
+             * A required field containing the OpenBao Role to assume. A Role binds a
+             * Kubernetes ServiceAccount with a set of OpenBao policies.
+             */
+            role: string;
+            secretRef: outputs.external_secrets.v1.SecretStoreSpecProviderOpenBaoAuthKubernetesSecretRef;
+            serviceAccountRef: outputs.external_secrets.v1.SecretStoreSpecProviderOpenBaoAuthKubernetesServiceAccountRef;
+        }
+        /**
+         * Kubernetes authenticates with OpenBao by passing a ServiceAccount
+         * token to the [Kubernetes auth mechanism].
+         *
+         * [Kubernetes auth mechanism]: https://openbao.org/docs/auth/kubernetes/
+         */
+        interface SecretStoreSpecProviderOpenBaoAuthKubernetesPatch {
+            /**
+             * Path where the Kubernetes authentication backend is mounted in OpenBao, e.g:
+             * "kubernetes"
+             */
+            path: string;
+            /**
+             * A required field containing the OpenBao Role to assume. A Role binds a
+             * Kubernetes ServiceAccount with a set of OpenBao policies.
+             */
+            role: string;
+            secretRef: outputs.external_secrets.v1.SecretStoreSpecProviderOpenBaoAuthKubernetesSecretRefPatch;
+            serviceAccountRef: outputs.external_secrets.v1.SecretStoreSpecProviderOpenBaoAuthKubernetesServiceAccountRefPatch;
+        }
+        /**
+         * Optional secret field containing a Kubernetes ServiceAccount JWT used
+         * for authenticating with OpenBao. If a name is specified without a key,
+         * `token` is the default.
+         */
+        interface SecretStoreSpecProviderOpenBaoAuthKubernetesSecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * Optional secret field containing a Kubernetes ServiceAccount JWT used
+         * for authenticating with OpenBao. If a name is specified without a key,
+         * `token` is the default.
+         */
+        interface SecretStoreSpecProviderOpenBaoAuthKubernetesSecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * Optional service account field containing the name of a Kubernetes ServiceAccount.
+         * If the service account is specified, a token will be requested from the Kubernetes
+         * TokenRequest API for authenticating with OpenBao.
+         * Any configured audiences will be passed to the TokenRequest as-is.
+         */
+        interface SecretStoreSpecProviderOpenBaoAuthKubernetesServiceAccountRef {
+            /**
+             * Audience specifies the `aud` claim for the service account token
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
+             */
+            audiences: string[];
+            /**
+             * The name of the ServiceAccount resource being referred to.
+             */
+            name: string;
+            /**
+             * Namespace of the resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * Optional service account field containing the name of a Kubernetes ServiceAccount.
+         * If the service account is specified, a token will be requested from the Kubernetes
+         * TokenRequest API for authenticating with OpenBao.
+         * Any configured audiences will be passed to the TokenRequest as-is.
+         */
+        interface SecretStoreSpecProviderOpenBaoAuthKubernetesServiceAccountRefPatch {
+            /**
+             * Audience specifies the `aud` claim for the service account token
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
+             */
+            audiences: string[];
+            /**
+             * The name of the ServiceAccount resource being referred to.
+             */
+            name: string;
+            /**
+             * Namespace of the resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
         /**
          * Auth configures how secret-manager authenticates with the OpenBao server.
          */
         interface SecretStoreSpecProviderOpenBaoAuthPatch {
             appRole: outputs.external_secrets.v1.SecretStoreSpecProviderOpenBaoAuthAppRolePatch;
+            kubernetes: outputs.external_secrets.v1.SecretStoreSpecProviderOpenBaoAuthKubernetesPatch;
             /**
              * Name of the [OpenBao Namespace] to authenticate to. This can be different
              * than the namespace your secret is in. Namespaces is a set of features
@@ -99681,8 +100119,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderOracleServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -99702,8 +100140,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderOracleServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -100533,8 +100971,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderPulumiAuthOidcConfigServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -100553,8 +100991,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderPulumiAuthOidcConfigServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -100768,6 +101206,11 @@ export declare namespace external_secrets {
              */
             caBundle: string;
             caProvider: outputs.external_secrets.v1.SecretStoreSpecProviderSecretserverCaProvider;
+            /**
+             * DisableSiteIDValidation permits a missing site ID for new secrets.
+             * The provider sends 0 if no site ID is set.
+             */
+            disableSiteIDValidation: boolean;
             /**
              * Domain is the secret server domain.
              */
@@ -100778,6 +101221,12 @@ export declare namespace external_secrets {
              * URL to your secret server installation
              */
             serverURL: string;
+            /**
+             * SiteID is the ID of the Secret Server site for new secrets.
+             * PushSecret metadata can override this value for one secret.
+             * The provider uses 1 if this field is not set.
+             */
+            siteId: number;
             token: outputs.external_secrets.v1.SecretStoreSpecProviderSecretserverToken;
             username: outputs.external_secrets.v1.SecretStoreSpecProviderSecretserverUsername;
         }
@@ -100897,6 +101346,11 @@ export declare namespace external_secrets {
              */
             caBundle: string;
             caProvider: outputs.external_secrets.v1.SecretStoreSpecProviderSecretserverCaProviderPatch;
+            /**
+             * DisableSiteIDValidation permits a missing site ID for new secrets.
+             * The provider sends 0 if no site ID is set.
+             */
+            disableSiteIDValidation: boolean;
             /**
              * Domain is the secret server domain.
              */
@@ -100907,6 +101361,12 @@ export declare namespace external_secrets {
              * URL to your secret server installation
              */
             serverURL: string;
+            /**
+             * SiteID is the ID of the Secret Server site for new secrets.
+             * PushSecret metadata can override this value for one secret.
+             * The provider uses 1 if this field is not set.
+             */
+            siteId: number;
             token: outputs.external_secrets.v1.SecretStoreSpecProviderSecretserverTokenPatch;
             username: outputs.external_secrets.v1.SecretStoreSpecProviderSecretserverUsernamePatch;
         }
@@ -101546,8 +102006,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthGcpServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -101566,8 +102026,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthGcpServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -101628,8 +102088,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthGcpWorkloadIdentityServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -101648,8 +102108,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthGcpWorkloadIdentityServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -101712,8 +102172,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthIamJwtServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -101732,8 +102192,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthIamJwtServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -101984,8 +102444,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthJwtKubernetesServiceAccountTokenServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -102004,8 +102464,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthJwtKubernetesServiceAccountTokenServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -102165,8 +102625,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthKubernetesServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -102188,8 +102648,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthKubernetesServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -107029,8 +107489,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAkeylessAuthSecretRefKubernetesAuthServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -107052,8 +107512,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAkeylessAuthSecretRefKubernetesAuthServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -107478,8 +107938,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAwsAuthJwtServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -107498,8 +107958,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAwsAuthJwtServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -107995,8 +108455,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAzurekvServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -108016,8 +108476,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderAzurekvServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -108979,8 +109439,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderConjurAuthJwtServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -109000,8 +109460,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderConjurAuthJwtServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -109660,8 +110120,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderGcpsmAuthWorkloadIdentityServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -109680,8 +110140,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderGcpsmAuthWorkloadIdentityServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -110508,8 +110968,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderKubernetesAuthServiceAccount {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -110528,8 +110988,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderKubernetesAuthServiceAccountPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -111089,8 +111549,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderOracleServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -111110,8 +111570,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderOracleServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -112276,8 +112736,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthIamJwtServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -112296,8 +112756,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthIamJwtServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -112548,8 +113008,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthJwtKubernetesServiceAccountTokenServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -112568,8 +113028,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthJwtKubernetesServiceAccountTokenServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -112729,8 +113189,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthKubernetesServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -112752,8 +113212,8 @@ export declare namespace external_secrets {
         interface ClusterSecretStoreSpecProviderVaultAuthKubernetesServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -115035,8 +115495,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAkeylessAuthSecretRefKubernetesAuthServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -115058,8 +115518,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAkeylessAuthSecretRefKubernetesAuthServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -115484,8 +115944,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAwsAuthJwtServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -115504,8 +115964,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAwsAuthJwtServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -116001,8 +116461,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAzurekvServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -116022,8 +116482,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderAzurekvServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -116985,8 +117445,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderConjurAuthJwtServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -117006,8 +117466,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderConjurAuthJwtServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -117666,8 +118126,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderGcpsmAuthWorkloadIdentityServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -117686,8 +118146,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderGcpsmAuthWorkloadIdentityServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -118514,8 +118974,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderKubernetesAuthServiceAccount {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -118534,8 +118994,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderKubernetesAuthServiceAccountPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -119095,8 +119555,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderOracleServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -119116,8 +119576,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderOracleServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -120282,8 +120742,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthIamJwtServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -120302,8 +120762,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthIamJwtServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -120554,8 +121014,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthJwtKubernetesServiceAccountTokenServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -120574,8 +121034,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthJwtKubernetesServiceAccountTokenServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -120735,8 +121195,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthKubernetesServiceAccountRef {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -120758,8 +121218,8 @@ export declare namespace external_secrets {
         interface SecretStoreSpecProviderVaultAuthKubernetesServiceAccountRefPatch {
             /**
              * Audience specifies the `aud` claim for the service account token
-             * If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
-             * then this audiences will be appended to the list
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
              */
             audiences: string[];
             /**
@@ -130579,7 +131039,7 @@ export declare namespace gateway {
              * Accepted Condition for the Route to `status: False`, with a
              * Reason of `UnsupportedValue`.
              *
-             * Support: Core
+             * Support: statusCode 301 and 302 are Core; all others are Extended.
              */
             statusCode: number;
         }
@@ -130651,7 +131111,7 @@ export declare namespace gateway {
              * Accepted Condition for the Route to `status: False`, with a
              * Reason of `UnsupportedValue`.
              *
-             * Support: Core
+             * Support: statusCode 301 and 302 are Core; all others are Extended.
              */
             statusCode: number;
         }
@@ -132251,7 +132711,7 @@ export declare namespace gateway {
              * Accepted Condition for the Route to `status: False`, with a
              * Reason of `UnsupportedValue`.
              *
-             * Support: Core
+             * Support: statusCode 301 and 302 are Core; all others are Extended.
              */
             statusCode: number;
         }
@@ -132323,7 +132783,7 @@ export declare namespace gateway {
              * Accepted Condition for the Route to `status: False`, with a
              * Reason of `UnsupportedValue`.
              *
-             * Support: Core
+             * Support: statusCode 301 and 302 are Core; all others are Extended.
              */
             statusCode: number;
         }
@@ -151170,6 +151630,7 @@ export declare namespace gateway {
         }
         /**
          * TLS configuration when connecting to the Wasm code source.
+         * If unset, system trust store is used for HTTPS url.
          */
         interface EnvoyExtensionPolicySpecWasmCodeHttpTls {
             caCertificateRef: outputs.gateway.v1alpha1.EnvoyExtensionPolicySpecWasmCodeHttpTlsCaCertificateRef;
@@ -151246,6 +151707,7 @@ export declare namespace gateway {
         }
         /**
          * TLS configuration when connecting to the Wasm code source.
+         * If unset, system trust store is used for HTTPS url.
          */
         interface EnvoyExtensionPolicySpecWasmCodeHttpTlsPatch {
             caCertificateRef: outputs.gateway.v1alpha1.EnvoyExtensionPolicySpecWasmCodeHttpTlsCaCertificateRefPatch;
@@ -151358,6 +151820,7 @@ export declare namespace gateway {
         }
         /**
          * TLS configuration when connecting to the Wasm code source.
+         * If unset, system trust store is used.
          */
         interface EnvoyExtensionPolicySpecWasmCodeImageTls {
             caCertificateRef: outputs.gateway.v1alpha1.EnvoyExtensionPolicySpecWasmCodeImageTlsCaCertificateRef;
@@ -151434,6 +151897,7 @@ export declare namespace gateway {
         }
         /**
          * TLS configuration when connecting to the Wasm code source.
+         * If unset, system trust store is used.
          */
         interface EnvoyExtensionPolicySpecWasmCodeImageTlsPatch {
             caCertificateRef: outputs.gateway.v1alpha1.EnvoyExtensionPolicySpecWasmCodeImageTlsCaCertificateRefPatch;
@@ -196046,7 +196510,7 @@ export declare namespace gateway {
              * Accepted Condition for the Route to `status: False`, with a
              * Reason of `UnsupportedValue`.
              *
-             * Support: Core
+             * Support: statusCode 301 and 302 are Core; all others are Extended.
              */
             statusCode: number;
         }
@@ -196118,7 +196582,7 @@ export declare namespace gateway {
              * Accepted Condition for the Route to `status: False`, with a
              * Reason of `UnsupportedValue`.
              *
-             * Support: Core
+             * Support: statusCode 301 and 302 are Core; all others are Extended.
              */
             statusCode: number;
         }
@@ -197718,7 +198182,7 @@ export declare namespace gateway {
              * Accepted Condition for the Route to `status: False`, with a
              * Reason of `UnsupportedValue`.
              *
-             * Support: Core
+             * Support: statusCode 301 and 302 are Core; all others are Extended.
              */
             statusCode: number;
         }
@@ -197790,7 +198254,7 @@ export declare namespace gateway {
              * Accepted Condition for the Route to `status: False`, with a
              * Reason of `UnsupportedValue`.
              *
-             * Support: Core
+             * Support: statusCode 301 and 302 are Core; all others are Extended.
              */
             statusCode: number;
         }