@kilic.dev/pulumi-k8s-crds 4.0.0 → 4.0.2

package/dist/types/output.d.ts

@@ -54401,253 +54401,6 @@ export declare namespace cilium {
              */
             externalCIDRs: string[];
         }
-        interface CiliumClusterwideEnvoyConfig {
-            /**
-             * APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-             */
-            apiVersion: "cilium.io/v2";
-            /**
-             * Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-             */
-            kind: "CiliumClusterwideEnvoyConfig";
-            /**
-             * Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
-             */
-            metadata: pulumiKubernetes.types.output.meta.v1.ObjectMeta;
-            spec: outputs.cilium.v2.CiliumClusterwideEnvoyConfigSpec;
-        }
-        interface CiliumClusterwideEnvoyConfigSpec {
-            /**
-             * BackendServices specifies Kubernetes services whose backends
-             * are automatically synced to Envoy using EDS.  Traffic for these
-             * services is not forwarded to an Envoy listener. This allows an
-             * Envoy listener load balance traffic to these backends while
-             * normal Cilium service load balancing takes care of balancing
-             * traffic for these services at the same time.
-             */
-            backendServices: outputs.cilium.v2.CiliumClusterwideEnvoyConfigSpecBackendServices[];
-            nodeSelector: outputs.cilium.v2.CiliumClusterwideEnvoyConfigSpecNodeSelector;
-            /**
-             * Envoy xDS resources, a list of the following Envoy resource types:
-             * type.googleapis.com/envoy.config.listener.v3.Listener,
-             * type.googleapis.com/envoy.config.route.v3.RouteConfiguration,
-             * type.googleapis.com/envoy.config.cluster.v3.Cluster,
-             * type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment, and
-             * type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret.
-             */
-            resources: {
-                [key: string]: any;
-            }[];
-            /**
-             * Services specifies Kubernetes services for which traffic is
-             * forwarded to an Envoy listener for L7 load balancing. Backends
-             * of these services are automatically synced to Envoy usign EDS.
-             */
-            services: outputs.cilium.v2.CiliumClusterwideEnvoyConfigSpecServices[];
-        }
-        interface CiliumClusterwideEnvoyConfigSpecBackendServices {
-            /**
-             * Name is the name of a destination Kubernetes service that identifies traffic
-             * to be redirected.
-             */
-            name: string;
-            /**
-             * Namespace is the Kubernetes service namespace.
-             * In CiliumEnvoyConfig namespace defaults to the namespace of the CEC,
-             * In CiliumClusterwideEnvoyConfig namespace defaults to "default".
-             */
-            namespace: string;
-            /**
-             * Ports is a set of port numbers, which can be used for filtering in case of underlying
-             * is exposing multiple port numbers.
-             */
-            number: string[];
-        }
-        interface CiliumClusterwideEnvoyConfigSpecBackendServicesPatch {
-            /**
-             * Name is the name of a destination Kubernetes service that identifies traffic
-             * to be redirected.
-             */
-            name: string;
-            /**
-             * Namespace is the Kubernetes service namespace.
-             * In CiliumEnvoyConfig namespace defaults to the namespace of the CEC,
-             * In CiliumClusterwideEnvoyConfig namespace defaults to "default".
-             */
-            namespace: string;
-            /**
-             * Ports is a set of port numbers, which can be used for filtering in case of underlying
-             * is exposing multiple port numbers.
-             */
-            number: string[];
-        }
-        /**
-         * NodeSelector is a label selector that determines to which nodes
-         * this configuration applies.
-         * If nil, then this config applies to all nodes.
-         */
-        interface CiliumClusterwideEnvoyConfigSpecNodeSelector {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions: outputs.cilium.v2.CiliumClusterwideEnvoyConfigSpecNodeSelectorMatchExpressions[];
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels: {
-                [key: string]: string;
-            };
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumClusterwideEnvoyConfigSpecNodeSelectorMatchExpressions {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key: string;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator: string;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values: string[];
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumClusterwideEnvoyConfigSpecNodeSelectorMatchExpressionsPatch {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key: string;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator: string;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values: string[];
-        }
-        /**
-         * NodeSelector is a label selector that determines to which nodes
-         * this configuration applies.
-         * If nil, then this config applies to all nodes.
-         */
-        interface CiliumClusterwideEnvoyConfigSpecNodeSelectorPatch {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions: outputs.cilium.v2.CiliumClusterwideEnvoyConfigSpecNodeSelectorMatchExpressionsPatch[];
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels: {
-                [key: string]: string;
-            };
-        }
-        interface CiliumClusterwideEnvoyConfigSpecPatch {
-            /**
-             * BackendServices specifies Kubernetes services whose backends
-             * are automatically synced to Envoy using EDS.  Traffic for these
-             * services is not forwarded to an Envoy listener. This allows an
-             * Envoy listener load balance traffic to these backends while
-             * normal Cilium service load balancing takes care of balancing
-             * traffic for these services at the same time.
-             */
-            backendServices: outputs.cilium.v2.CiliumClusterwideEnvoyConfigSpecBackendServicesPatch[];
-            nodeSelector: outputs.cilium.v2.CiliumClusterwideEnvoyConfigSpecNodeSelectorPatch;
-            /**
-             * Envoy xDS resources, a list of the following Envoy resource types:
-             * type.googleapis.com/envoy.config.listener.v3.Listener,
-             * type.googleapis.com/envoy.config.route.v3.RouteConfiguration,
-             * type.googleapis.com/envoy.config.cluster.v3.Cluster,
-             * type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment, and
-             * type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret.
-             */
-            resources: {
-                [key: string]: any;
-            }[];
-            /**
-             * Services specifies Kubernetes services for which traffic is
-             * forwarded to an Envoy listener for L7 load balancing. Backends
-             * of these services are automatically synced to Envoy usign EDS.
-             */
-            services: outputs.cilium.v2.CiliumClusterwideEnvoyConfigSpecServicesPatch[];
-        }
-        interface CiliumClusterwideEnvoyConfigSpecServices {
-            /**
-             * Listener specifies the name of the Envoy listener the
-             * service traffic is redirected to. The listener must be
-             * specified in the Envoy 'resources' of the same
-             * CiliumEnvoyConfig.
-             *
-             * If omitted, the first listener specified in 'resources' is
-             * used.
-             */
-            listener: string;
-            /**
-             * Name is the name of a destination Kubernetes service that identifies traffic
-             * to be redirected.
-             */
-            name: string;
-            /**
-             * Namespace is the Kubernetes service namespace.
-             * In CiliumEnvoyConfig namespace this is overridden to the namespace of the CEC,
-             * In CiliumClusterwideEnvoyConfig namespace defaults to "default".
-             */
-            namespace: string;
-            /**
-             * Ports is a set of service's frontend ports that should be redirected to the Envoy
-             * listener. By default all frontend ports of the service are redirected.
-             */
-            ports: number[];
-        }
-        interface CiliumClusterwideEnvoyConfigSpecServicesPatch {
-            /**
-             * Listener specifies the name of the Envoy listener the
-             * service traffic is redirected to. The listener must be
-             * specified in the Envoy 'resources' of the same
-             * CiliumEnvoyConfig.
-             *
-             * If omitted, the first listener specified in 'resources' is
-             * used.
-             */
-            listener: string;
-            /**
-             * Name is the name of a destination Kubernetes service that identifies traffic
-             * to be redirected.
-             */
-            name: string;
-            /**
-             * Namespace is the Kubernetes service namespace.
-             * In CiliumEnvoyConfig namespace this is overridden to the namespace of the CEC,
-             * In CiliumClusterwideEnvoyConfig namespace defaults to "default".
-             */
-            namespace: string;
-            /**
-             * Ports is a set of service's frontend ports that should be redirected to the Envoy
-             * listener. By default all frontend ports of the service are redirected.
-             */
-            ports: number[];
-        }
         /**
          * CiliumClusterwideNetworkPolicy is a Kubernetes third-party resource with an
          * modified version of CiliumNetworkPolicy which is cluster scoped rather than
@@ -64499,7 +64252,12 @@ export declare namespace cilium {
                 };
             };
         }
-        interface CiliumEgressGatewayPolicy {
+        /**
+         * CiliumLoadBalancerIPPool is a Kubernetes third-party resource which
+         * is used to defined pools of IPs which the operator can use to allocate
+         * and advertise IPs for Services of type LoadBalancer.
+         */
+        interface CiliumLoadBalancerIPPool {
             /**
              * APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
              */
@@ -64507,259 +64265,82 @@ export declare namespace cilium {
             /**
              * Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
              */
-            kind: "CiliumEgressGatewayPolicy";
+            kind: "CiliumLoadBalancerIPPool";
             /**
              * Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
              */
             metadata: pulumiKubernetes.types.output.meta.v1.ObjectMeta;
-            spec: outputs.cilium.v2.CiliumEgressGatewayPolicySpec;
-        }
-        interface CiliumEgressGatewayPolicySpec {
-            /**
-             * DestinationCIDRs is a list of destination CIDRs for destination IP addresses.
-             * If a destination IP matches any one CIDR, it will be selected.
-             */
-            destinationCIDRs: string[];
-            egressGateway: outputs.cilium.v2.CiliumEgressGatewayPolicySpecEgressGateway;
-            /**
-             * Optional list of gateway nodes responsible for SNATing traffic.
-             * If this field has any entries the contents of the egressGateway field will be ignored.
-             * In case multiple nodes are a match for the given set of labels in each entry,
-             * the first node in lexical ordering based on their name will be selected for each entry.
-             */
-            egressGateways: outputs.cilium.v2.CiliumEgressGatewayPolicySpecEgressGateways[];
-            /**
-             * ExcludedCIDRs is a list of destination CIDRs that will be excluded
-             * from the egress gateway redirection and SNAT logic.
-             * Should be a subset of destinationCIDRs otherwise it will not have any
-             * effect.
-             */
-            excludedCIDRs: string[];
-            /**
-             * Egress represents a list of rules by which egress traffic is
-             * filtered from the source pods.
-             */
-            selectors: outputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectors[];
-        }
-        /**
-         * EgressGateway is the gateway node responsible for SNATing traffic.
-         * In case multiple nodes are a match for the given set of labels, the first node
-         * in lexical ordering based on their name will be selected.
-         */
-        interface CiliumEgressGatewayPolicySpecEgressGateway {
-            /**
-             * EgressIP is the source IP address that the egress traffic is SNATed
-             * with.
-             *
-             * Example:
-             * When set to "192.168.1.100", matching egress traffic will be
-             * redirected to the node matching the NodeSelector field and SNATed
-             * with IP address 192.168.1.100.
-             *
-             * When set to "2001:db8::1", matching egress traffic will be
-             * redirected to the node matching the NodeSelector field and SNATed
-             * with IPv6 address 2001:db8::1.
-             *
-             * When none of the Interface or EgressIP fields is specified, the
-             * policy will use the first IPv4 assigned to the interface with the
-             * default route.
-             */
-            egressIP: string;
-            /**
-             * Interface is the network interface to which the egress IP address
-             * that the traffic is SNATed with is assigned.
-             *
-             * Example:
-             * When set to "eth1", matching egress traffic will be redirected to the
-             * node matching the NodeSelector field and SNATed with the first IPv4
-             * address assigned to the eth1 interface.
-             *
-             * When none of the Interface or EgressIP fields is specified, the
-             * policy will use the first IPv4 assigned to the interface with the
-             * default route.
-             */
-            interface: string;
-            nodeSelector: outputs.cilium.v2.CiliumEgressGatewayPolicySpecEgressGatewayNodeSelector;
-        }
-        /**
-         * This is a label selector which selects the node that should act as
-         * egress gateway for the given policy.
-         * In case multiple nodes are selected, only the first one in the
-         * lexical ordering over the node names will be used.
-         * This field follows standard label selector semantics.
-         */
-        interface CiliumEgressGatewayPolicySpecEgressGatewayNodeSelector {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions: outputs.cilium.v2.CiliumEgressGatewayPolicySpecEgressGatewayNodeSelectorMatchExpressions[];
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels: {
-                [key: string]: string;
-            };
+            spec: outputs.cilium.v2.CiliumLoadBalancerIPPoolSpec;
+            status: outputs.cilium.v2.CiliumLoadBalancerIPPoolStatus;
         }
         /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
+         * Spec is a human readable description for a BGP load balancer
+         * ip pool.
          */
-        interface CiliumEgressGatewayPolicySpecEgressGatewayNodeSelectorMatchExpressions {
+        interface CiliumLoadBalancerIPPoolSpec {
             /**
-             * key is the label key that the selector applies to.
+             * AllowFirstLastIPs, if set to `Yes` or undefined means that the first and last IPs of each CIDR will be allocatable.
+             * If `No`, these IPs will be reserved. This field is ignored for /{31,32} and /{127,128} CIDRs since
+             * reserving the first and last IPs would make the CIDRs unusable.
              */
-            key: string;
+            allowFirstLastIPs: string;
             /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
+             * Blocks is a list of CIDRs comprising this IP Pool
              */
-            operator: string;
+            blocks: outputs.cilium.v2.CiliumLoadBalancerIPPoolSpecBlocks[];
             /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
+             * Disabled, if set to true means that no new IPs will be allocated from this pool.
+             * Existing allocations will not be removed from services.
              */
-            values: string[];
+            disabled: boolean;
+            serviceSelector: outputs.cilium.v2.CiliumLoadBalancerIPPoolSpecServiceSelector;
         }
         /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
+         * CiliumLoadBalancerIPPoolIPBlock describes a single IP block.
          */
-        interface CiliumEgressGatewayPolicySpecEgressGatewayNodeSelectorMatchExpressionsPatch {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key: string;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator: string;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values: string[];
+        interface CiliumLoadBalancerIPPoolSpecBlocks {
+            cidr: string;
+            start: string;
+            stop: string;
         }
         /**
-         * This is a label selector which selects the node that should act as
-         * egress gateway for the given policy.
-         * In case multiple nodes are selected, only the first one in the
-         * lexical ordering over the node names will be used.
-         * This field follows standard label selector semantics.
+         * CiliumLoadBalancerIPPoolIPBlock describes a single IP block.
          */
-        interface CiliumEgressGatewayPolicySpecEgressGatewayNodeSelectorPatch {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions: outputs.cilium.v2.CiliumEgressGatewayPolicySpecEgressGatewayNodeSelectorMatchExpressionsPatch[];
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels: {
-                [key: string]: string;
-            };
+        interface CiliumLoadBalancerIPPoolSpecBlocksPatch {
+            cidr: string;
+            start: string;
+            stop: string;
         }
         /**
-         * EgressGateway is the gateway node responsible for SNATing traffic.
-         * In case multiple nodes are a match for the given set of labels, the first node
-         * in lexical ordering based on their name will be selected.
+         * Spec is a human readable description for a BGP load balancer
+         * ip pool.
          */
-        interface CiliumEgressGatewayPolicySpecEgressGatewayPatch {
-            /**
-             * EgressIP is the source IP address that the egress traffic is SNATed
-             * with.
-             *
-             * Example:
-             * When set to "192.168.1.100", matching egress traffic will be
-             * redirected to the node matching the NodeSelector field and SNATed
-             * with IP address 192.168.1.100.
-             *
-             * When set to "2001:db8::1", matching egress traffic will be
-             * redirected to the node matching the NodeSelector field and SNATed
-             * with IPv6 address 2001:db8::1.
-             *
-             * When none of the Interface or EgressIP fields is specified, the
-             * policy will use the first IPv4 assigned to the interface with the
-             * default route.
-             */
-            egressIP: string;
+        interface CiliumLoadBalancerIPPoolSpecPatch {
             /**
-             * Interface is the network interface to which the egress IP address
-             * that the traffic is SNATed with is assigned.
-             *
-             * Example:
-             * When set to "eth1", matching egress traffic will be redirected to the
-             * node matching the NodeSelector field and SNATed with the first IPv4
-             * address assigned to the eth1 interface.
-             *
-             * When none of the Interface or EgressIP fields is specified, the
-             * policy will use the first IPv4 assigned to the interface with the
-             * default route.
+             * AllowFirstLastIPs, if set to `Yes` or undefined means that the first and last IPs of each CIDR will be allocatable.
+             * If `No`, these IPs will be reserved. This field is ignored for /{31,32} and /{127,128} CIDRs since
+             * reserving the first and last IPs would make the CIDRs unusable.
              */
-            interface: string;
-            nodeSelector: outputs.cilium.v2.CiliumEgressGatewayPolicySpecEgressGatewayNodeSelectorPatch;
-        }
-        /**
-         * EgressGateway identifies the node that should act as egress gateway for a
-         * given egress Gateway policy. In addition to that it also specifies the
-         * configuration of said node (which egress IP or network interface should be
-         * used to SNAT traffic).
-         */
-        interface CiliumEgressGatewayPolicySpecEgressGateways {
+            allowFirstLastIPs: string;
             /**
-             * EgressIP is the source IP address that the egress traffic is SNATed
-             * with.
-             *
-             * Example:
-             * When set to "192.168.1.100", matching egress traffic will be
-             * redirected to the node matching the NodeSelector field and SNATed
-             * with IP address 192.168.1.100.
-             *
-             * When set to "2001:db8::1", matching egress traffic will be
-             * redirected to the node matching the NodeSelector field and SNATed
-             * with IPv6 address 2001:db8::1.
-             *
-             * When none of the Interface or EgressIP fields is specified, the
-             * policy will use the first IPv4 assigned to the interface with the
-             * default route.
+             * Blocks is a list of CIDRs comprising this IP Pool
              */
-            egressIP: string;
+            blocks: outputs.cilium.v2.CiliumLoadBalancerIPPoolSpecBlocksPatch[];
             /**
-             * Interface is the network interface to which the egress IP address
-             * that the traffic is SNATed with is assigned.
-             *
-             * Example:
-             * When set to "eth1", matching egress traffic will be redirected to the
-             * node matching the NodeSelector field and SNATed with the first IPv4
-             * address assigned to the eth1 interface.
-             *
-             * When none of the Interface or EgressIP fields is specified, the
-             * policy will use the first IPv4 assigned to the interface with the
-             * default route.
+             * Disabled, if set to true means that no new IPs will be allocated from this pool.
+             * Existing allocations will not be removed from services.
              */
-            interface: string;
-            nodeSelector: outputs.cilium.v2.CiliumEgressGatewayPolicySpecEgressGatewaysNodeSelector;
+            disabled: boolean;
+            serviceSelector: outputs.cilium.v2.CiliumLoadBalancerIPPoolSpecServiceSelectorPatch;
         }
         /**
-         * This is a label selector which selects the node that should act as
-         * egress gateway for the given policy.
-         * In case multiple nodes are selected, only the first one in the
-         * lexical ordering over the node names will be used.
-         * This field follows standard label selector semantics.
+         * ServiceSelector selects a set of services which are eligible to receive IPs from this
          */
-        interface CiliumEgressGatewayPolicySpecEgressGatewaysNodeSelector {
+        interface CiliumLoadBalancerIPPoolSpecServiceSelector {
             /**
              * matchExpressions is a list of label selector requirements. The requirements are ANDed.
              */
-            matchExpressions: outputs.cilium.v2.CiliumEgressGatewayPolicySpecEgressGatewaysNodeSelectorMatchExpressions[];
+            matchExpressions: outputs.cilium.v2.CiliumLoadBalancerIPPoolSpecServiceSelectorMatchExpressions[];
             /**
              * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
              * map is equivalent to an element of matchExpressions, whose key field is "key", the
@@ -64773,735 +64354,7 @@ export declare namespace cilium {
          * A label selector requirement is a selector that contains values, a key, and an operator that
          * relates the key and values.
          */
-        interface CiliumEgressGatewayPolicySpecEgressGatewaysNodeSelectorMatchExpressions {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key: string;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator: string;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values: string[];
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumEgressGatewayPolicySpecEgressGatewaysNodeSelectorMatchExpressionsPatch {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key: string;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator: string;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values: string[];
-        }
-        /**
-         * This is a label selector which selects the node that should act as
-         * egress gateway for the given policy.
-         * In case multiple nodes are selected, only the first one in the
-         * lexical ordering over the node names will be used.
-         * This field follows standard label selector semantics.
-         */
-        interface CiliumEgressGatewayPolicySpecEgressGatewaysNodeSelectorPatch {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions: outputs.cilium.v2.CiliumEgressGatewayPolicySpecEgressGatewaysNodeSelectorMatchExpressionsPatch[];
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels: {
-                [key: string]: string;
-            };
-        }
-        /**
-         * EgressGateway identifies the node that should act as egress gateway for a
-         * given egress Gateway policy. In addition to that it also specifies the
-         * configuration of said node (which egress IP or network interface should be
-         * used to SNAT traffic).
-         */
-        interface CiliumEgressGatewayPolicySpecEgressGatewaysPatch {
-            /**
-             * EgressIP is the source IP address that the egress traffic is SNATed
-             * with.
-             *
-             * Example:
-             * When set to "192.168.1.100", matching egress traffic will be
-             * redirected to the node matching the NodeSelector field and SNATed
-             * with IP address 192.168.1.100.
-             *
-             * When set to "2001:db8::1", matching egress traffic will be
-             * redirected to the node matching the NodeSelector field and SNATed
-             * with IPv6 address 2001:db8::1.
-             *
-             * When none of the Interface or EgressIP fields is specified, the
-             * policy will use the first IPv4 assigned to the interface with the
-             * default route.
-             */
-            egressIP: string;
-            /**
-             * Interface is the network interface to which the egress IP address
-             * that the traffic is SNATed with is assigned.
-             *
-             * Example:
-             * When set to "eth1", matching egress traffic will be redirected to the
-             * node matching the NodeSelector field and SNATed with the first IPv4
-             * address assigned to the eth1 interface.
-             *
-             * When none of the Interface or EgressIP fields is specified, the
-             * policy will use the first IPv4 assigned to the interface with the
-             * default route.
-             */
-            interface: string;
-            nodeSelector: outputs.cilium.v2.CiliumEgressGatewayPolicySpecEgressGatewaysNodeSelectorPatch;
-        }
-        interface CiliumEgressGatewayPolicySpecPatch {
-            /**
-             * DestinationCIDRs is a list of destination CIDRs for destination IP addresses.
-             * If a destination IP matches any one CIDR, it will be selected.
-             */
-            destinationCIDRs: string[];
-            egressGateway: outputs.cilium.v2.CiliumEgressGatewayPolicySpecEgressGatewayPatch;
-            /**
-             * Optional list of gateway nodes responsible for SNATing traffic.
-             * If this field has any entries the contents of the egressGateway field will be ignored.
-             * In case multiple nodes are a match for the given set of labels in each entry,
-             * the first node in lexical ordering based on their name will be selected for each entry.
-             */
-            egressGateways: outputs.cilium.v2.CiliumEgressGatewayPolicySpecEgressGatewaysPatch[];
-            /**
-             * ExcludedCIDRs is a list of destination CIDRs that will be excluded
-             * from the egress gateway redirection and SNAT logic.
-             * Should be a subset of destinationCIDRs otherwise it will not have any
-             * effect.
-             */
-            excludedCIDRs: string[];
-            /**
-             * Egress represents a list of rules by which egress traffic is
-             * filtered from the source pods.
-             */
-            selectors: outputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsPatch[];
-        }
-        interface CiliumEgressGatewayPolicySpecSelectors {
-            namespaceSelector: outputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsNamespaceSelector;
-            nodeSelector: outputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsNodeSelector;
-            podSelector: outputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsPodSelector;
-        }
-        /**
-         * Selects Namespaces using cluster-scoped labels. This field follows standard label
-         * selector semantics; if present but empty, it selects all namespaces.
-         */
-        interface CiliumEgressGatewayPolicySpecSelectorsNamespaceSelector {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions: outputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsNamespaceSelectorMatchExpressions[];
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels: {
-                [key: string]: string;
-            };
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumEgressGatewayPolicySpecSelectorsNamespaceSelectorMatchExpressions {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key: string;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator: string;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values: string[];
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumEgressGatewayPolicySpecSelectorsNamespaceSelectorMatchExpressionsPatch {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key: string;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator: string;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values: string[];
-        }
-        /**
-         * Selects Namespaces using cluster-scoped labels. This field follows standard label
-         * selector semantics; if present but empty, it selects all namespaces.
-         */
-        interface CiliumEgressGatewayPolicySpecSelectorsNamespaceSelectorPatch {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions: outputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsNamespaceSelectorMatchExpressionsPatch[];
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels: {
-                [key: string]: string;
-            };
-        }
-        /**
-         * This is a label selector which selects Pods by Node. This field follows standard label
-         * selector semantics; if present but empty, it selects all nodes.
-         */
-        interface CiliumEgressGatewayPolicySpecSelectorsNodeSelector {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions: outputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsNodeSelectorMatchExpressions[];
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels: {
-                [key: string]: string;
-            };
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumEgressGatewayPolicySpecSelectorsNodeSelectorMatchExpressions {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key: string;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator: string;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values: string[];
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumEgressGatewayPolicySpecSelectorsNodeSelectorMatchExpressionsPatch {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key: string;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator: string;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values: string[];
-        }
-        /**
-         * This is a label selector which selects Pods by Node. This field follows standard label
-         * selector semantics; if present but empty, it selects all nodes.
-         */
-        interface CiliumEgressGatewayPolicySpecSelectorsNodeSelectorPatch {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions: outputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsNodeSelectorMatchExpressionsPatch[];
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels: {
-                [key: string]: string;
-            };
-        }
-        interface CiliumEgressGatewayPolicySpecSelectorsPatch {
-            namespaceSelector: outputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsNamespaceSelectorPatch;
-            nodeSelector: outputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsNodeSelectorPatch;
-            podSelector: outputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsPodSelectorPatch;
-        }
-        /**
-         * This is a label selector which selects Pods. This field follows standard label
-         * selector semantics; if present but empty, it selects all pods.
-         */
-        interface CiliumEgressGatewayPolicySpecSelectorsPodSelector {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions: outputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsPodSelectorMatchExpressions[];
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels: {
-                [key: string]: string;
-            };
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumEgressGatewayPolicySpecSelectorsPodSelectorMatchExpressions {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key: string;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator: string;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values: string[];
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumEgressGatewayPolicySpecSelectorsPodSelectorMatchExpressionsPatch {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key: string;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator: string;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values: string[];
-        }
-        /**
-         * This is a label selector which selects Pods. This field follows standard label
-         * selector semantics; if present but empty, it selects all pods.
-         */
-        interface CiliumEgressGatewayPolicySpecSelectorsPodSelectorPatch {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions: outputs.cilium.v2.CiliumEgressGatewayPolicySpecSelectorsPodSelectorMatchExpressionsPatch[];
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels: {
-                [key: string]: string;
-            };
-        }
-        interface CiliumEnvoyConfig {
-            /**
-             * APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-             */
-            apiVersion: "cilium.io/v2";
-            /**
-             * Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-             */
-            kind: "CiliumEnvoyConfig";
-            /**
-             * Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
-             */
-            metadata: pulumiKubernetes.types.output.meta.v1.ObjectMeta;
-            spec: outputs.cilium.v2.CiliumEnvoyConfigSpec;
-        }
-        interface CiliumEnvoyConfigSpec {
-            /**
-             * BackendServices specifies Kubernetes services whose backends
-             * are automatically synced to Envoy using EDS.  Traffic for these
-             * services is not forwarded to an Envoy listener. This allows an
-             * Envoy listener load balance traffic to these backends while
-             * normal Cilium service load balancing takes care of balancing
-             * traffic for these services at the same time.
-             */
-            backendServices: outputs.cilium.v2.CiliumEnvoyConfigSpecBackendServices[];
-            nodeSelector: outputs.cilium.v2.CiliumEnvoyConfigSpecNodeSelector;
-            /**
-             * Envoy xDS resources, a list of the following Envoy resource types:
-             * type.googleapis.com/envoy.config.listener.v3.Listener,
-             * type.googleapis.com/envoy.config.route.v3.RouteConfiguration,
-             * type.googleapis.com/envoy.config.cluster.v3.Cluster,
-             * type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment, and
-             * type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret.
-             */
-            resources: {
-                [key: string]: any;
-            }[];
-            /**
-             * Services specifies Kubernetes services for which traffic is
-             * forwarded to an Envoy listener for L7 load balancing. Backends
-             * of these services are automatically synced to Envoy usign EDS.
-             */
-            services: outputs.cilium.v2.CiliumEnvoyConfigSpecServices[];
-        }
-        interface CiliumEnvoyConfigSpecBackendServices {
-            /**
-             * Name is the name of a destination Kubernetes service that identifies traffic
-             * to be redirected.
-             */
-            name: string;
-            /**
-             * Namespace is the Kubernetes service namespace.
-             * In CiliumEnvoyConfig namespace defaults to the namespace of the CEC,
-             * In CiliumClusterwideEnvoyConfig namespace defaults to "default".
-             */
-            namespace: string;
-            /**
-             * Ports is a set of port numbers, which can be used for filtering in case of underlying
-             * is exposing multiple port numbers.
-             */
-            number: string[];
-        }
-        interface CiliumEnvoyConfigSpecBackendServicesPatch {
-            /**
-             * Name is the name of a destination Kubernetes service that identifies traffic
-             * to be redirected.
-             */
-            name: string;
-            /**
-             * Namespace is the Kubernetes service namespace.
-             * In CiliumEnvoyConfig namespace defaults to the namespace of the CEC,
-             * In CiliumClusterwideEnvoyConfig namespace defaults to "default".
-             */
-            namespace: string;
-            /**
-             * Ports is a set of port numbers, which can be used for filtering in case of underlying
-             * is exposing multiple port numbers.
-             */
-            number: string[];
-        }
-        /**
-         * NodeSelector is a label selector that determines to which nodes
-         * this configuration applies.
-         * If nil, then this config applies to all nodes.
-         */
-        interface CiliumEnvoyConfigSpecNodeSelector {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions: outputs.cilium.v2.CiliumEnvoyConfigSpecNodeSelectorMatchExpressions[];
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels: {
-                [key: string]: string;
-            };
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumEnvoyConfigSpecNodeSelectorMatchExpressions {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key: string;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator: string;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values: string[];
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumEnvoyConfigSpecNodeSelectorMatchExpressionsPatch {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key: string;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator: string;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values: string[];
-        }
-        /**
-         * NodeSelector is a label selector that determines to which nodes
-         * this configuration applies.
-         * If nil, then this config applies to all nodes.
-         */
-        interface CiliumEnvoyConfigSpecNodeSelectorPatch {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions: outputs.cilium.v2.CiliumEnvoyConfigSpecNodeSelectorMatchExpressionsPatch[];
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels: {
-                [key: string]: string;
-            };
-        }
-        interface CiliumEnvoyConfigSpecPatch {
-            /**
-             * BackendServices specifies Kubernetes services whose backends
-             * are automatically synced to Envoy using EDS.  Traffic for these
-             * services is not forwarded to an Envoy listener. This allows an
-             * Envoy listener load balance traffic to these backends while
-             * normal Cilium service load balancing takes care of balancing
-             * traffic for these services at the same time.
-             */
-            backendServices: outputs.cilium.v2.CiliumEnvoyConfigSpecBackendServicesPatch[];
-            nodeSelector: outputs.cilium.v2.CiliumEnvoyConfigSpecNodeSelectorPatch;
-            /**
-             * Envoy xDS resources, a list of the following Envoy resource types:
-             * type.googleapis.com/envoy.config.listener.v3.Listener,
-             * type.googleapis.com/envoy.config.route.v3.RouteConfiguration,
-             * type.googleapis.com/envoy.config.cluster.v3.Cluster,
-             * type.googleapis.com/envoy.config.endpoint.v3.ClusterLoadAssignment, and
-             * type.googleapis.com/envoy.extensions.transport_sockets.tls.v3.Secret.
-             */
-            resources: {
-                [key: string]: any;
-            }[];
-            /**
-             * Services specifies Kubernetes services for which traffic is
-             * forwarded to an Envoy listener for L7 load balancing. Backends
-             * of these services are automatically synced to Envoy usign EDS.
-             */
-            services: outputs.cilium.v2.CiliumEnvoyConfigSpecServicesPatch[];
-        }
-        interface CiliumEnvoyConfigSpecServices {
-            /**
-             * Listener specifies the name of the Envoy listener the
-             * service traffic is redirected to. The listener must be
-             * specified in the Envoy 'resources' of the same
-             * CiliumEnvoyConfig.
-             *
-             * If omitted, the first listener specified in 'resources' is
-             * used.
-             */
-            listener: string;
-            /**
-             * Name is the name of a destination Kubernetes service that identifies traffic
-             * to be redirected.
-             */
-            name: string;
-            /**
-             * Namespace is the Kubernetes service namespace.
-             * In CiliumEnvoyConfig namespace this is overridden to the namespace of the CEC,
-             * In CiliumClusterwideEnvoyConfig namespace defaults to "default".
-             */
-            namespace: string;
-            /**
-             * Ports is a set of service's frontend ports that should be redirected to the Envoy
-             * listener. By default all frontend ports of the service are redirected.
-             */
-            ports: number[];
-        }
-        interface CiliumEnvoyConfigSpecServicesPatch {
-            /**
-             * Listener specifies the name of the Envoy listener the
-             * service traffic is redirected to. The listener must be
-             * specified in the Envoy 'resources' of the same
-             * CiliumEnvoyConfig.
-             *
-             * If omitted, the first listener specified in 'resources' is
-             * used.
-             */
-            listener: string;
-            /**
-             * Name is the name of a destination Kubernetes service that identifies traffic
-             * to be redirected.
-             */
-            name: string;
-            /**
-             * Namespace is the Kubernetes service namespace.
-             * In CiliumEnvoyConfig namespace this is overridden to the namespace of the CEC,
-             * In CiliumClusterwideEnvoyConfig namespace defaults to "default".
-             */
-            namespace: string;
-            /**
-             * Ports is a set of service's frontend ports that should be redirected to the Envoy
-             * listener. By default all frontend ports of the service are redirected.
-             */
-            ports: number[];
-        }
-        /**
-         * CiliumLoadBalancerIPPool is a Kubernetes third-party resource which
-         * is used to defined pools of IPs which the operator can use to allocate
-         * and advertise IPs for Services of type LoadBalancer.
-         */
-        interface CiliumLoadBalancerIPPool {
-            /**
-             * APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-             */
-            apiVersion: "cilium.io/v2";
-            /**
-             * Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-             */
-            kind: "CiliumLoadBalancerIPPool";
-            /**
-             * Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
-             */
-            metadata: pulumiKubernetes.types.output.meta.v1.ObjectMeta;
-            spec: outputs.cilium.v2.CiliumLoadBalancerIPPoolSpec;
-            status: outputs.cilium.v2.CiliumLoadBalancerIPPoolStatus;
-        }
-        /**
-         * Spec is a human readable description for a BGP load balancer
-         * ip pool.
-         */
-        interface CiliumLoadBalancerIPPoolSpec {
-            /**
-             * AllowFirstLastIPs, if set to `Yes` or undefined means that the first and last IPs of each CIDR will be allocatable.
-             * If `No`, these IPs will be reserved. This field is ignored for /{31,32} and /{127,128} CIDRs since
-             * reserving the first and last IPs would make the CIDRs unusable.
-             */
-            allowFirstLastIPs: string;
-            /**
-             * Blocks is a list of CIDRs comprising this IP Pool
-             */
-            blocks: outputs.cilium.v2.CiliumLoadBalancerIPPoolSpecBlocks[];
-            /**
-             * Disabled, if set to true means that no new IPs will be allocated from this pool.
-             * Existing allocations will not be removed from services.
-             */
-            disabled: boolean;
-            serviceSelector: outputs.cilium.v2.CiliumLoadBalancerIPPoolSpecServiceSelector;
-        }
-        /**
-         * CiliumLoadBalancerIPPoolIPBlock describes a single IP block.
-         */
-        interface CiliumLoadBalancerIPPoolSpecBlocks {
-            cidr: string;
-            start: string;
-            stop: string;
-        }
-        /**
-         * CiliumLoadBalancerIPPoolIPBlock describes a single IP block.
-         */
-        interface CiliumLoadBalancerIPPoolSpecBlocksPatch {
-            cidr: string;
-            start: string;
-            stop: string;
-        }
-        /**
-         * Spec is a human readable description for a BGP load balancer
-         * ip pool.
-         */
-        interface CiliumLoadBalancerIPPoolSpecPatch {
-            /**
-             * AllowFirstLastIPs, if set to `Yes` or undefined means that the first and last IPs of each CIDR will be allocatable.
-             * If `No`, these IPs will be reserved. This field is ignored for /{31,32} and /{127,128} CIDRs since
-             * reserving the first and last IPs would make the CIDRs unusable.
-             */
-            allowFirstLastIPs: string;
-            /**
-             * Blocks is a list of CIDRs comprising this IP Pool
-             */
-            blocks: outputs.cilium.v2.CiliumLoadBalancerIPPoolSpecBlocksPatch[];
-            /**
-             * Disabled, if set to true means that no new IPs will be allocated from this pool.
-             * Existing allocations will not be removed from services.
-             */
-            disabled: boolean;
-            serviceSelector: outputs.cilium.v2.CiliumLoadBalancerIPPoolSpecServiceSelectorPatch;
-        }
-        /**
-         * ServiceSelector selects a set of services which are eligible to receive IPs from this
-         */
-        interface CiliumLoadBalancerIPPoolSpecServiceSelector {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions: outputs.cilium.v2.CiliumLoadBalancerIPPoolSpecServiceSelectorMatchExpressions[];
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels: {
-                [key: string]: string;
-            };
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumLoadBalancerIPPoolSpecServiceSelectorMatchExpressions {
+        interface CiliumLoadBalancerIPPoolSpecServiceSelectorMatchExpressions {
             /**
              * key is the label key that the selector applies to.
              */
@@ -65609,494 +64462,54 @@ export declare namespace cilium {
             type: string;
         }
         /**
-         * Condition contains details for one aspect of the current state of this API Resource.
-         */
-        interface CiliumLoadBalancerIPPoolStatusConditionsPatch {
-            /**
-             * lastTransitionTime is the last time the condition transitioned from one status to another.
-             * This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
-             */
-            lastTransitionTime: string;
-            /**
-             * message is a human readable message indicating details about the transition.
-             * This may be an empty string.
-             */
-            message: string;
-            /**
-             * observedGeneration represents the .metadata.generation that the condition was set based upon.
-             * For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
-             * with respect to the current state of the instance.
-             */
-            observedGeneration: number;
-            /**
-             * reason contains a programmatic identifier indicating the reason for the condition's last transition.
-             * Producers of specific condition types may define expected values and meanings for this field,
-             * and whether the values are considered a guaranteed API.
-             * The value should be a CamelCase string.
-             * This field may not be empty.
-             */
-            reason: string;
-            /**
-             * status of the condition, one of True, False, Unknown.
-             */
-            status: string;
-            /**
-             * type of condition in CamelCase or in foo.example.com/CamelCase.
-             */
-            type: string;
-        }
-        /**
-         * Status is the status of the IP Pool.
-         *
-         * It might be possible for users to define overlapping IP Pools, we can't validate or enforce non-overlapping pools
-         * during object creation. The Cilium operator will do this validation and update the status to reflect the ability
-         * to allocate IPs from this pool.
-         */
-        interface CiliumLoadBalancerIPPoolStatusPatch {
-            /**
-             * Current service state
-             */
-            conditions: outputs.cilium.v2.CiliumLoadBalancerIPPoolStatusConditionsPatch[];
-        }
-        /**
-         * CiliumLocalRedirectPolicy is a Kubernetes Custom Resource that contains a
-         * specification to redirect traffic locally within a node.
-         */
-        interface CiliumLocalRedirectPolicy {
-            /**
-             * APIVersion defines the versioned schema of this representation of an object. Servers should convert recognized schemas to the latest internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
-             */
-            apiVersion: "cilium.io/v2";
-            /**
-             * Kind is a string value representing the REST resource this object represents. Servers may infer this from the endpoint the client submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
-             */
-            kind: "CiliumLocalRedirectPolicy";
-            /**
-             * Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata
-             */
-            metadata: pulumiKubernetes.types.output.meta.v1.ObjectMeta;
-            spec: outputs.cilium.v2.CiliumLocalRedirectPolicySpec;
-            status: outputs.cilium.v2.CiliumLocalRedirectPolicyStatus;
-        }
-        /**
-         * Spec is the desired behavior of the local redirect policy.
-         */
-        interface CiliumLocalRedirectPolicySpec {
-            /**
-             * Description can be used by the creator of the policy to describe the
-             * purpose of this policy.
-             */
-            description: string;
-            redirectBackend: outputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectBackend;
-            redirectFrontend: outputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectFrontend;
-            /**
-             * SkipRedirectFromBackend indicates whether traffic matching RedirectFrontend
-             * from RedirectBackend should skip redirection, and hence the traffic will
-             * be forwarded as-is.
-             *
-             * The default is false which means traffic matching RedirectFrontend will
-             * get redirected from all pods, including the RedirectBackend(s).
-             *
-             * Example: If RedirectFrontend is configured to "169.254.169.254:80" as the traffic
-             * that needs to be redirected to backends selected by RedirectBackend, if
-             * SkipRedirectFromBackend is set to true, traffic going to "169.254.169.254:80"
-             * from such backends will not be redirected back to the backends. Instead,
-             * the matched traffic from the backends will be forwarded to the original
-             * destination "169.254.169.254:80".
-             */
-            skipRedirectFromBackend: boolean;
-        }
-        /**
-         * Spec is the desired behavior of the local redirect policy.
-         */
-        interface CiliumLocalRedirectPolicySpecPatch {
-            /**
-             * Description can be used by the creator of the policy to describe the
-             * purpose of this policy.
-             */
-            description: string;
-            redirectBackend: outputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectBackendPatch;
-            redirectFrontend: outputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectFrontendPatch;
-            /**
-             * SkipRedirectFromBackend indicates whether traffic matching RedirectFrontend
-             * from RedirectBackend should skip redirection, and hence the traffic will
-             * be forwarded as-is.
-             *
-             * The default is false which means traffic matching RedirectFrontend will
-             * get redirected from all pods, including the RedirectBackend(s).
-             *
-             * Example: If RedirectFrontend is configured to "169.254.169.254:80" as the traffic
-             * that needs to be redirected to backends selected by RedirectBackend, if
-             * SkipRedirectFromBackend is set to true, traffic going to "169.254.169.254:80"
-             * from such backends will not be redirected back to the backends. Instead,
-             * the matched traffic from the backends will be forwarded to the original
-             * destination "169.254.169.254:80".
-             */
-            skipRedirectFromBackend: boolean;
-        }
-        /**
-         * RedirectBackend specifies backend configuration to redirect traffic to.
-         * It can not be empty.
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectBackend {
-            localEndpointSelector: outputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectBackendLocalEndpointSelector;
-            /**
-             * ToPorts is a list of L4 ports with protocol of node local pod(s) where traffic
-             * is redirected to.
-             * When multiple ports are specified, the ports must be named.
-             */
-            toPorts: outputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectBackendToPorts[];
-        }
-        /**
-         * LocalEndpointSelector selects node local pod(s) where traffic is redirected to.
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectBackendLocalEndpointSelector {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions: outputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectBackendLocalEndpointSelectorMatchExpressions[];
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels: {
-                [key: string]: string;
-            };
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectBackendLocalEndpointSelectorMatchExpressions {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key: string;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator: string;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values: string[];
-        }
-        /**
-         * A label selector requirement is a selector that contains values, a key, and an operator that
-         * relates the key and values.
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectBackendLocalEndpointSelectorMatchExpressionsPatch {
-            /**
-             * key is the label key that the selector applies to.
-             */
-            key: string;
-            /**
-             * operator represents a key's relationship to a set of values.
-             * Valid operators are In, NotIn, Exists and DoesNotExist.
-             */
-            operator: string;
-            /**
-             * values is an array of string values. If the operator is In or NotIn,
-             * the values array must be non-empty. If the operator is Exists or DoesNotExist,
-             * the values array must be empty. This array is replaced during a strategic
-             * merge patch.
-             */
-            values: string[];
-        }
-        /**
-         * LocalEndpointSelector selects node local pod(s) where traffic is redirected to.
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectBackendLocalEndpointSelectorPatch {
-            /**
-             * matchExpressions is a list of label selector requirements. The requirements are ANDed.
-             */
-            matchExpressions: outputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectBackendLocalEndpointSelectorMatchExpressionsPatch[];
-            /**
-             * matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
-             * map is equivalent to an element of matchExpressions, whose key field is "key", the
-             * operator is "In", and the values array contains only "value". The requirements are ANDed.
-             */
-            matchLabels: {
-                [key: string]: string;
-            };
-        }
-        /**
-         * RedirectBackend specifies backend configuration to redirect traffic to.
-         * It can not be empty.
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectBackendPatch {
-            localEndpointSelector: outputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectBackendLocalEndpointSelectorPatch;
-            /**
-             * ToPorts is a list of L4 ports with protocol of node local pod(s) where traffic
-             * is redirected to.
-             * When multiple ports are specified, the ports must be named.
-             */
-            toPorts: outputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectBackendToPortsPatch[];
-        }
-        /**
-         * PortInfo specifies L4 port number and name along with the transport protocol
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectBackendToPorts {
-            /**
-             * Name is a port name, which must contain at least one [a-z],
-             * and may also contain [0-9] and '-' anywhere except adjacent to another
-             * '-' or in the beginning or the end.
-             */
-            name: string;
-            /**
-             * Port is an L4 port number. The string will be strictly parsed as a single uint16.
-             */
-            port: string;
-            /**
-             * Protocol is the L4 protocol.
-             * Accepted values: "TCP", "UDP"
-             */
-            protocol: string;
-        }
-        /**
-         * PortInfo specifies L4 port number and name along with the transport protocol
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectBackendToPortsPatch {
-            /**
-             * Name is a port name, which must contain at least one [a-z],
-             * and may also contain [0-9] and '-' anywhere except adjacent to another
-             * '-' or in the beginning or the end.
-             */
-            name: string;
-            /**
-             * Port is an L4 port number. The string will be strictly parsed as a single uint16.
-             */
-            port: string;
-            /**
-             * Protocol is the L4 protocol.
-             * Accepted values: "TCP", "UDP"
-             */
-            protocol: string;
-        }
-        /**
-         * RedirectFrontend specifies frontend configuration to redirect traffic from.
-         * It can not be empty.
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectFrontend {
-            addressMatcher: outputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectFrontendAddressMatcher;
-            serviceMatcher: outputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectFrontendServiceMatcher;
-        }
-        /**
-         * AddressMatcher is a tuple {IP, port, protocol} that matches traffic to be
-         * redirected.
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectFrontendAddressMatcher {
-            /**
-             * IP is a destination ip address for traffic to be redirected.
-             *
-             * Example:
-             * When it is set to "169.254.169.254", traffic destined to
-             * "169.254.169.254" is redirected.
-             */
-            ip: string;
-            /**
-             * ToPorts is a list of destination L4 ports with protocol for traffic
-             * to be redirected.
-             * When multiple ports are specified, the ports must be named.
-             *
-             * Example:
-             * When set to Port: "53" and Protocol: UDP, traffic destined to port '53'
-             * with UDP protocol is redirected.
-             */
-            toPorts: outputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectFrontendAddressMatcherToPorts[];
-        }
-        /**
-         * AddressMatcher is a tuple {IP, port, protocol} that matches traffic to be
-         * redirected.
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectFrontendAddressMatcherPatch {
-            /**
-             * IP is a destination ip address for traffic to be redirected.
-             *
-             * Example:
-             * When it is set to "169.254.169.254", traffic destined to
-             * "169.254.169.254" is redirected.
-             */
-            ip: string;
-            /**
-             * ToPorts is a list of destination L4 ports with protocol for traffic
-             * to be redirected.
-             * When multiple ports are specified, the ports must be named.
-             *
-             * Example:
-             * When set to Port: "53" and Protocol: UDP, traffic destined to port '53'
-             * with UDP protocol is redirected.
-             */
-            toPorts: outputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectFrontendAddressMatcherToPortsPatch[];
-        }
-        /**
-         * PortInfo specifies L4 port number and name along with the transport protocol
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectFrontendAddressMatcherToPorts {
-            /**
-             * Name is a port name, which must contain at least one [a-z],
-             * and may also contain [0-9] and '-' anywhere except adjacent to another
-             * '-' or in the beginning or the end.
-             */
-            name: string;
-            /**
-             * Port is an L4 port number. The string will be strictly parsed as a single uint16.
-             */
-            port: string;
-            /**
-             * Protocol is the L4 protocol.
-             * Accepted values: "TCP", "UDP"
-             */
-            protocol: string;
-        }
-        /**
-         * PortInfo specifies L4 port number and name along with the transport protocol
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectFrontendAddressMatcherToPortsPatch {
-            /**
-             * Name is a port name, which must contain at least one [a-z],
-             * and may also contain [0-9] and '-' anywhere except adjacent to another
-             * '-' or in the beginning or the end.
-             */
-            name: string;
-            /**
-             * Port is an L4 port number. The string will be strictly parsed as a single uint16.
-             */
-            port: string;
-            /**
-             * Protocol is the L4 protocol.
-             * Accepted values: "TCP", "UDP"
-             */
-            protocol: string;
-        }
-        /**
-         * RedirectFrontend specifies frontend configuration to redirect traffic from.
-         * It can not be empty.
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectFrontendPatch {
-            addressMatcher: outputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectFrontendAddressMatcherPatch;
-            serviceMatcher: outputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectFrontendServiceMatcherPatch;
-        }
-        /**
-         * ServiceMatcher specifies Kubernetes service and port that matches
-         * traffic to be redirected.
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectFrontendServiceMatcher {
-            /**
-             * Namespace is the Kubernetes service namespace.
-             * The service namespace must match the namespace of the parent Local
-             * Redirect Policy.  For Cluster-wide Local Redirect Policy, this
-             * can be any namespace.
-             */
-            namespace: string;
-            /**
-             * Name is the name of a destination Kubernetes service that identifies traffic
-             * to be redirected.
-             * The service type needs to be ClusterIP.
-             *
-             * Example:
-             * When this field is populated with 'serviceName:myService', all the traffic
-             * destined to the cluster IP of this service at the (specified)
-             * service port(s) will be redirected.
-             */
-            serviceName: string;
-            /**
-             * ToPorts is a list of destination service L4 ports with protocol for
-             * traffic to be redirected. If not specified, traffic for all the service
-             * ports will be redirected.
-             * When multiple ports are specified, the ports must be named.
-             */
-            toPorts: outputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectFrontendServiceMatcherToPorts[];
-        }
-        /**
-         * ServiceMatcher specifies Kubernetes service and port that matches
-         * traffic to be redirected.
+         * Condition contains details for one aspect of the current state of this API Resource.
          */
-        interface CiliumLocalRedirectPolicySpecRedirectFrontendServiceMatcherPatch {
+        interface CiliumLoadBalancerIPPoolStatusConditionsPatch {
             /**
-             * Namespace is the Kubernetes service namespace.
-             * The service namespace must match the namespace of the parent Local
-             * Redirect Policy.  For Cluster-wide Local Redirect Policy, this
-             * can be any namespace.
+             * lastTransitionTime is the last time the condition transitioned from one status to another.
+             * This should be when the underlying condition changed.  If that is not known, then using the time when the API field changed is acceptable.
              */
-            namespace: string;
+            lastTransitionTime: string;
             /**
-             * Name is the name of a destination Kubernetes service that identifies traffic
-             * to be redirected.
-             * The service type needs to be ClusterIP.
-             *
-             * Example:
-             * When this field is populated with 'serviceName:myService', all the traffic
-             * destined to the cluster IP of this service at the (specified)
-             * service port(s) will be redirected.
+             * message is a human readable message indicating details about the transition.
+             * This may be an empty string.
              */
-            serviceName: string;
+            message: string;
             /**
-             * ToPorts is a list of destination service L4 ports with protocol for
-             * traffic to be redirected. If not specified, traffic for all the service
-             * ports will be redirected.
-             * When multiple ports are specified, the ports must be named.
+             * observedGeneration represents the .metadata.generation that the condition was set based upon.
+             * For instance, if .metadata.generation is currently 12, but the .status.conditions[x].observedGeneration is 9, the condition is out of date
+             * with respect to the current state of the instance.
              */
-            toPorts: outputs.cilium.v2.CiliumLocalRedirectPolicySpecRedirectFrontendServiceMatcherToPortsPatch[];
-        }
-        /**
-         * PortInfo specifies L4 port number and name along with the transport protocol
-         */
-        interface CiliumLocalRedirectPolicySpecRedirectFrontendServiceMatcherToPorts {
+            observedGeneration: number;
             /**
-             * Name is a port name, which must contain at least one [a-z],
-             * and may also contain [0-9] and '-' anywhere except adjacent to another
-             * '-' or in the beginning or the end.
+             * reason contains a programmatic identifier indicating the reason for the condition's last transition.
+             * Producers of specific condition types may define expected values and meanings for this field,
+             * and whether the values are considered a guaranteed API.
+             * The value should be a CamelCase string.
+             * This field may not be empty.
              */
-            name: string;
+            reason: string;
             /**
-             * Port is an L4 port number. The string will be strictly parsed as a single uint16.
+             * status of the condition, one of True, False, Unknown.
              */
-            port: string;
+            status: string;
             /**
-             * Protocol is the L4 protocol.
-             * Accepted values: "TCP", "UDP"
+             * type of condition in CamelCase or in foo.example.com/CamelCase.
              */
-            protocol: string;
+            type: string;
         }
         /**
-         * PortInfo specifies L4 port number and name along with the transport protocol
+         * Status is the status of the IP Pool.
+         *
+         * It might be possible for users to define overlapping IP Pools, we can't validate or enforce non-overlapping pools
+         * during object creation. The Cilium operator will do this validation and update the status to reflect the ability
+         * to allocate IPs from this pool.
          */
-        interface CiliumLocalRedirectPolicySpecRedirectFrontendServiceMatcherToPortsPatch {
-            /**
-             * Name is a port name, which must contain at least one [a-z],
-             * and may also contain [0-9] and '-' anywhere except adjacent to another
-             * '-' or in the beginning or the end.
-             */
-            name: string;
-            /**
-             * Port is an L4 port number. The string will be strictly parsed as a single uint16.
-             */
-            port: string;
+        interface CiliumLoadBalancerIPPoolStatusPatch {
             /**
-             * Protocol is the L4 protocol.
-             * Accepted values: "TCP", "UDP"
+             * Current service state
              */
-            protocol: string;
-        }
-        /**
-         * Status is the most recent status of the local redirect policy.
-         * It is a read-only field.
-         */
-        interface CiliumLocalRedirectPolicyStatus {
-            ok: boolean;
-        }
-        /**
-         * Status is the most recent status of the local redirect policy.
-         * It is a read-only field.
-         */
-        interface CiliumLocalRedirectPolicyStatusPatch {
-            ok: boolean;
+            conditions: outputs.cilium.v2.CiliumLoadBalancerIPPoolStatusConditionsPatch[];
         }
         /**
          * CiliumNetworkPolicy is a Kubernetes third-party resource with an extended
@@ -80846,9 +79259,124 @@ export declare namespace external_secrets {
          * BarbicanAuth contains the authentication information for Barbican.
          */
         interface ClusterSecretStoreSpecProviderBarbicanAuth {
+            applicationCredentialID: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialID;
+            applicationCredentialSecret: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialSecret;
+            /**
+             * AuthType selects how Barbican authenticates.
+             * - "password": use username and password.
+             * - "applicationCredential": use application credential ID and secret.
+             *   Defaults to "password".
+             */
+            authType: string;
             password: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthPassword;
             username: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthUsername;
         }
+        /**
+         * ID of the application credential used for authentication.
+         */
+        interface ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialID {
+            secretRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialIDSecretRef;
+            value: string;
+        }
+        /**
+         * ID of the application credential used for authentication.
+         */
+        interface ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialIDPatch {
+            secretRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialIDSecretRefPatch;
+            value: string;
+        }
+        /**
+         * SecretKeySelector is a reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialIDSecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * SecretKeySelector is a reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialIDSecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * BarbicanProviderAppCredSecretRef defines a reference to an Application Credential Secret.
+         */
+        interface ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialSecret {
+            secretRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialSecretSecretRef;
+        }
+        /**
+         * BarbicanProviderAppCredSecretRef defines a reference to an Application Credential Secret.
+         */
+        interface ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialSecretPatch {
+            secretRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialSecretSecretRefPatch;
+        }
+        /**
+         * SecretKeySelector is a reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialSecretSecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * SecretKeySelector is a reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialSecretSecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
         /**
          * BarbicanProviderPasswordRef defines a reference to a secret containing password for the Barbican provider.
          */
@@ -80905,18 +79433,27 @@ export declare namespace external_secrets {
          * BarbicanAuth contains the authentication information for Barbican.
          */
         interface ClusterSecretStoreSpecProviderBarbicanAuthPatch {
+            applicationCredentialID: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialIDPatch;
+            applicationCredentialSecret: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthApplicationCredentialSecretPatch;
+            /**
+             * AuthType selects how Barbican authenticates.
+             * - "password": use username and password.
+             * - "applicationCredential": use application credential ID and secret.
+             *   Defaults to "password".
+             */
+            authType: string;
             password: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthPasswordPatch;
             username: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthUsernamePatch;
         }
         /**
-         * BarbicanProviderUsernameRef defines a reference to a secret containing username for the Barbican provider.
+         * Username / Password authentication fields.
          */
         interface ClusterSecretStoreSpecProviderBarbicanAuthUsername {
             secretRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthUsernameSecretRef;
             value: string;
         }
         /**
-         * BarbicanProviderUsernameRef defines a reference to a secret containing username for the Barbican provider.
+         * Username / Password authentication fields.
          */
         interface ClusterSecretStoreSpecProviderBarbicanAuthUsernamePatch {
             secretRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderBarbicanAuthUsernameSecretRefPatch;
@@ -93653,9 +92190,124 @@ export declare namespace external_secrets {
          * BarbicanAuth contains the authentication information for Barbican.
          */
         interface SecretStoreSpecProviderBarbicanAuth {
+            applicationCredentialID: outputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthApplicationCredentialID;
+            applicationCredentialSecret: outputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthApplicationCredentialSecret;
+            /**
+             * AuthType selects how Barbican authenticates.
+             * - "password": use username and password.
+             * - "applicationCredential": use application credential ID and secret.
+             *   Defaults to "password".
+             */
+            authType: string;
             password: outputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthPassword;
             username: outputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthUsername;
         }
+        /**
+         * ID of the application credential used for authentication.
+         */
+        interface SecretStoreSpecProviderBarbicanAuthApplicationCredentialID {
+            secretRef: outputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthApplicationCredentialIDSecretRef;
+            value: string;
+        }
+        /**
+         * ID of the application credential used for authentication.
+         */
+        interface SecretStoreSpecProviderBarbicanAuthApplicationCredentialIDPatch {
+            secretRef: outputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthApplicationCredentialIDSecretRefPatch;
+            value: string;
+        }
+        /**
+         * SecretKeySelector is a reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface SecretStoreSpecProviderBarbicanAuthApplicationCredentialIDSecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * SecretKeySelector is a reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface SecretStoreSpecProviderBarbicanAuthApplicationCredentialIDSecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * BarbicanProviderAppCredSecretRef defines a reference to an Application Credential Secret.
+         */
+        interface SecretStoreSpecProviderBarbicanAuthApplicationCredentialSecret {
+            secretRef: outputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthApplicationCredentialSecretSecretRef;
+        }
+        /**
+         * BarbicanProviderAppCredSecretRef defines a reference to an Application Credential Secret.
+         */
+        interface SecretStoreSpecProviderBarbicanAuthApplicationCredentialSecretPatch {
+            secretRef: outputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthApplicationCredentialSecretSecretRefPatch;
+        }
+        /**
+         * SecretKeySelector is a reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface SecretStoreSpecProviderBarbicanAuthApplicationCredentialSecretSecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * SecretKeySelector is a reference to a specific 'key' within a Secret resource.
+         * In some instances, `key` is a required field.
+         */
+        interface SecretStoreSpecProviderBarbicanAuthApplicationCredentialSecretSecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
         /**
          * BarbicanProviderPasswordRef defines a reference to a secret containing password for the Barbican provider.
          */
@@ -93712,18 +92364,27 @@ export declare namespace external_secrets {
          * BarbicanAuth contains the authentication information for Barbican.
          */
         interface SecretStoreSpecProviderBarbicanAuthPatch {
+            applicationCredentialID: outputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthApplicationCredentialIDPatch;
+            applicationCredentialSecret: outputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthApplicationCredentialSecretPatch;
+            /**
+             * AuthType selects how Barbican authenticates.
+             * - "password": use username and password.
+             * - "applicationCredential": use application credential ID and secret.
+             *   Defaults to "password".
+             */
+            authType: string;
             password: outputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthPasswordPatch;
             username: outputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthUsernamePatch;
         }
         /**
-         * BarbicanProviderUsernameRef defines a reference to a secret containing username for the Barbican provider.
+         * Username / Password authentication fields.
          */
         interface SecretStoreSpecProviderBarbicanAuthUsername {
             secretRef: outputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthUsernameSecretRef;
             value: string;
         }
         /**
-         * BarbicanProviderUsernameRef defines a reference to a secret containing username for the Barbican provider.
+         * Username / Password authentication fields.
          */
         interface SecretStoreSpecProviderBarbicanAuthUsernamePatch {
             secretRef: outputs.external_secrets.v1.SecretStoreSpecProviderBarbicanAuthUsernameSecretRefPatch;