npm - @kilic.dev/pulumi-k8s-crds - Versions diffs - 4.0.3 → 4.0.5 - Mend

@kilic.dev/pulumi-k8s-crds 4.0.3 → 4.0.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (5) hide show

package/dist/package.json +1 -1
package/dist/types/input.d.ts +1026 -29
package/dist/types/output.d.ts +1026 -29
package/dist/utilities.js +1 -1
package/package.json +4 -13

package/dist/types/input.d.ts CHANGED Viewed

@@ -75339,7 +75339,10 @@ export declare namespace external_secrets {
          */
         interface ClusterSecretStoreSpecProviderConjurAuth {
             apikey?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthApikey | undefined>;
+            azure?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthAzure | undefined>;
             cert?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthCert | undefined>;
+            gcp?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthGcp | undefined>;
+            iam?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthIam | undefined>;
             jwt?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthJwt | undefined>;
         }
         /**
@@ -75444,6 +75447,98 @@ export declare namespace external_secrets {
              */
             namespace?: pulumi.Input<string | undefined>;
         }
+        /**
+         * Azure enables authentication to Conjur via the authn-azure authenticator.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthAzure {
+            /**
+             * Account is the Conjur organization account name.
+             */
+            account: pulumi.Input<string>;
+            /**
+             * ClientID is the Azure managed identity client ID. Required for user-assigned
+             * managed identities; omit for system-assigned identities.
+             */
+            clientId?: pulumi.Input<string | undefined>;
+            /**
+             * HostID is the Conjur host mapped to the Azure managed identity
+             * (e.g. "data/myapp/myhost").
+             */
+            hostId: pulumi.Input<string>;
+            serviceAccountRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthAzureServiceAccountRef | undefined>;
+            /**
+             * ServiceID is the Conjur authn-azure webservice identifier (e.g. "prod").
+             */
+            serviceID: pulumi.Input<string>;
+        }
+        /**
+         * Azure enables authentication to Conjur via the authn-azure authenticator.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthAzurePatch {
+            /**
+             * Account is the Conjur organization account name.
+             */
+            account?: pulumi.Input<string | undefined>;
+            /**
+             * ClientID is the Azure managed identity client ID. Required for user-assigned
+             * managed identities; omit for system-assigned identities.
+             */
+            clientId?: pulumi.Input<string | undefined>;
+            /**
+             * HostID is the Conjur host mapped to the Azure managed identity
+             * (e.g. "data/myapp/myhost").
+             */
+            hostId?: pulumi.Input<string | undefined>;
+            serviceAccountRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthAzureServiceAccountRefPatch | undefined>;
+            /**
+             * ServiceID is the Conjur authn-azure webservice identifier (e.g. "prod").
+             */
+            serviceID?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * ServiceAccountRef specifies the Kubernetes service account for which to request
+         * a token via the TokenRequest API. That token is used as the Azure JWT for Conjur
+         * authn-azure. If omitted, the token is fetched from the Azure IMDS endpoint instead.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthAzureServiceAccountRef {
+            /**
+             * Audience specifies the `aud` claim for the service account token
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
+             */
+            audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+            /**
+             * The name of the ServiceAccount resource being referred to.
+             */
+            name: pulumi.Input<string>;
+            /**
+             * Namespace of the resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * ServiceAccountRef specifies the Kubernetes service account for which to request
+         * a token via the TokenRequest API. That token is used as the Azure JWT for Conjur
+         * authn-azure. If omitted, the token is fetched from the Azure IMDS endpoint instead.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthAzureServiceAccountRefPatch {
+            /**
+             * Audience specifies the `aud` claim for the service account token
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
+             */
+            audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+            /**
+             * The name of the ServiceAccount resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * Namespace of the resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
         /**
          * Cert enables certificate-based authentication using a client certificate and key.
          */
@@ -75562,6 +75657,288 @@ export declare namespace external_secrets {
              */
             serviceID?: pulumi.Input<string | undefined>;
         }
+        /**
+         * GCP enables authentication to Conjur via the authn-gcp authenticator.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthGcp {
+            /**
+             * Account is the Conjur organization account name.
+             */
+            account: pulumi.Input<string>;
+            /**
+             * HostID is the Conjur host mapped to the GCP service account
+             * (e.g. "data/myapp/myhost").
+             */
+            hostId: pulumi.Input<string>;
+            secretRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthGcpSecretRef | undefined>;
+            /**
+             * ServiceID is the Conjur authn-gcp webservice identifier (e.g. "prod").
+             * Note: Conjur's authn-gcp authenticator does not include the service ID in the
+             * authentication URL; this field is reserved for future use.
+             */
+            serviceID?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * GCP enables authentication to Conjur via the authn-gcp authenticator.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthGcpPatch {
+            /**
+             * Account is the Conjur organization account name.
+             */
+            account?: pulumi.Input<string | undefined>;
+            /**
+             * HostID is the Conjur host mapped to the GCP service account
+             * (e.g. "data/myapp/myhost").
+             */
+            hostId?: pulumi.Input<string | undefined>;
+            secretRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthGcpSecretRefPatch | undefined>;
+            /**
+             * ServiceID is the Conjur authn-gcp webservice identifier (e.g. "prod").
+             * Note: Conjur's authn-gcp authenticator does not include the service ID in the
+             * authentication URL; this field is reserved for future use.
+             */
+            serviceID?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * SecretRef holds a reference to a Kubernetes Secret containing a pre-obtained
+         * GCP identity token. If omitted, the token is fetched from the GCP Metadata
+         * Service automatically (requires GKE Workload Identity or a GCE/GKE node).
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthGcpSecretRef {
+            jwt: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthGcpSecretRefJwt>;
+        }
+        /**
+         * JWT is a reference to the Kubernetes Secret key holding the GCP identity token.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthGcpSecretRefJwt {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * JWT is a reference to the Kubernetes Secret key holding the GCP identity token.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthGcpSecretRefJwtPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * SecretRef holds a reference to a Kubernetes Secret containing a pre-obtained
+         * GCP identity token. If omitted, the token is fetched from the GCP Metadata
+         * Service automatically (requires GKE Workload Identity or a GCE/GKE node).
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthGcpSecretRefPatch {
+            jwt?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthGcpSecretRefJwtPatch | undefined>;
+        }
+        /**
+         * IAM enables authentication to Conjur via the authn-iam authenticator.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthIam {
+            /**
+             * Account is the Conjur organization account name.
+             */
+            account: pulumi.Input<string>;
+            /**
+             * HostID is the Conjur host mapped to the AWS IAM role
+             * (e.g. "data/myapp/123456789012/MyRole").
+             */
+            hostId: pulumi.Input<string>;
+            /**
+             * Insecure allows authenticating to Conjur over plain HTTP. The AWS IAM authenticator
+             * sends a signed request as a bearer credential, so this should only be enabled when the
+             * connection is otherwise protected (e.g. a service mesh sidecar terminating TLS).
+             */
+            insecure?: pulumi.Input<boolean | undefined>;
+            secretRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthIamSecretRef | undefined>;
+            /**
+             * ServiceID is the Conjur authn-iam webservice identifier (e.g. "prod").
+             */
+            serviceID: pulumi.Input<string>;
+        }
+        /**
+         * IAM enables authentication to Conjur via the authn-iam authenticator.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthIamPatch {
+            /**
+             * Account is the Conjur organization account name.
+             */
+            account?: pulumi.Input<string | undefined>;
+            /**
+             * HostID is the Conjur host mapped to the AWS IAM role
+             * (e.g. "data/myapp/123456789012/MyRole").
+             */
+            hostId?: pulumi.Input<string | undefined>;
+            /**
+             * Insecure allows authenticating to Conjur over plain HTTP. The AWS IAM authenticator
+             * sends a signed request as a bearer credential, so this should only be enabled when the
+             * connection is otherwise protected (e.g. a service mesh sidecar terminating TLS).
+             */
+            insecure?: pulumi.Input<boolean | undefined>;
+            secretRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthIamSecretRefPatch | undefined>;
+            /**
+             * ServiceID is the Conjur authn-iam webservice identifier (e.g. "prod").
+             */
+            serviceID?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * SecretRef holds optional references to Kubernetes Secrets containing explicit
+         * AWS credentials. If omitted, the default AWS SDK credential chain is used
+         * (IRSA, instance metadata, environment variables, etc.).
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthIamSecretRef {
+            accessKeyIDSecretRef: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthIamSecretRefAccessKeyIDSecretRef>;
+            secretAccessKeySecretRef: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthIamSecretRefSecretAccessKeySecretRef>;
+            sessionTokenSecretRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthIamSecretRefSessionTokenSecretRef | undefined>;
+        }
+        /**
+         * A reference to a Secret key containing the AWS Access Key ID.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthIamSecretRefAccessKeyIDSecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * A reference to a Secret key containing the AWS Access Key ID.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthIamSecretRefAccessKeyIDSecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * SecretRef holds optional references to Kubernetes Secrets containing explicit
+         * AWS credentials. If omitted, the default AWS SDK credential chain is used
+         * (IRSA, instance metadata, environment variables, etc.).
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthIamSecretRefPatch {
+            accessKeyIDSecretRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthIamSecretRefAccessKeyIDSecretRefPatch | undefined>;
+            secretAccessKeySecretRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthIamSecretRefSecretAccessKeySecretRefPatch | undefined>;
+            sessionTokenSecretRef?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthIamSecretRefSessionTokenSecretRefPatch | undefined>;
+        }
+        /**
+         * A reference to a Secret key containing the AWS Secret Access Key.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthIamSecretRefSecretAccessKeySecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * A reference to a Secret key containing the AWS Secret Access Key.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthIamSecretRefSecretAccessKeySecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * A reference to a Secret key containing the AWS Session Token.
+         * Required only when using temporary credentials.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthIamSecretRefSessionTokenSecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * A reference to a Secret key containing the AWS Session Token.
+         * Required only when using temporary credentials.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthIamSecretRefSessionTokenSecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
         /**
          * Jwt enables JWT authentication using Kubernetes service account tokens.
          */
@@ -75689,7 +76066,10 @@ export declare namespace external_secrets {
          */
         interface ClusterSecretStoreSpecProviderConjurAuthPatch {
             apikey?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthApikeyPatch | undefined>;
+            azure?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthAzurePatch | undefined>;
             cert?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthCertPatch | undefined>;
+            gcp?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthGcpPatch | undefined>;
+            iam?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthIamPatch | undefined>;
             jwt?: pulumi.Input<inputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthJwtPatch | undefined>;
         }
         /**
@@ -88205,7 +88585,10 @@ export declare namespace external_secrets {
          */
         interface SecretStoreSpecProviderConjurAuth {
             apikey?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthApikey | undefined>;
+            azure?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthAzure | undefined>;
             cert?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthCert | undefined>;
+            gcp?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthGcp | undefined>;
+            iam?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthIam | undefined>;
             jwt?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthJwt | undefined>;
         }
         /**
@@ -88310,6 +88693,98 @@ export declare namespace external_secrets {
              */
             namespace?: pulumi.Input<string | undefined>;
         }
+        /**
+         * Azure enables authentication to Conjur via the authn-azure authenticator.
+         */
+        interface SecretStoreSpecProviderConjurAuthAzure {
+            /**
+             * Account is the Conjur organization account name.
+             */
+            account: pulumi.Input<string>;
+            /**
+             * ClientID is the Azure managed identity client ID. Required for user-assigned
+             * managed identities; omit for system-assigned identities.
+             */
+            clientId?: pulumi.Input<string | undefined>;
+            /**
+             * HostID is the Conjur host mapped to the Azure managed identity
+             * (e.g. "data/myapp/myhost").
+             */
+            hostId: pulumi.Input<string>;
+            serviceAccountRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthAzureServiceAccountRef | undefined>;
+            /**
+             * ServiceID is the Conjur authn-azure webservice identifier (e.g. "prod").
+             */
+            serviceID: pulumi.Input<string>;
+        }
+        /**
+         * Azure enables authentication to Conjur via the authn-azure authenticator.
+         */
+        interface SecretStoreSpecProviderConjurAuthAzurePatch {
+            /**
+             * Account is the Conjur organization account name.
+             */
+            account?: pulumi.Input<string | undefined>;
+            /**
+             * ClientID is the Azure managed identity client ID. Required for user-assigned
+             * managed identities; omit for system-assigned identities.
+             */
+            clientId?: pulumi.Input<string | undefined>;
+            /**
+             * HostID is the Conjur host mapped to the Azure managed identity
+             * (e.g. "data/myapp/myhost").
+             */
+            hostId?: pulumi.Input<string | undefined>;
+            serviceAccountRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthAzureServiceAccountRefPatch | undefined>;
+            /**
+             * ServiceID is the Conjur authn-azure webservice identifier (e.g. "prod").
+             */
+            serviceID?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * ServiceAccountRef specifies the Kubernetes service account for which to request
+         * a token via the TokenRequest API. That token is used as the Azure JWT for Conjur
+         * authn-azure. If omitted, the token is fetched from the Azure IMDS endpoint instead.
+         */
+        interface SecretStoreSpecProviderConjurAuthAzureServiceAccountRef {
+            /**
+             * Audience specifies the `aud` claim for the service account token
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
+             */
+            audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+            /**
+             * The name of the ServiceAccount resource being referred to.
+             */
+            name: pulumi.Input<string>;
+            /**
+             * Namespace of the resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * ServiceAccountRef specifies the Kubernetes service account for which to request
+         * a token via the TokenRequest API. That token is used as the Azure JWT for Conjur
+         * authn-azure. If omitted, the token is fetched from the Azure IMDS endpoint instead.
+         */
+        interface SecretStoreSpecProviderConjurAuthAzureServiceAccountRefPatch {
+            /**
+             * Audience specifies the `aud` claim for the service account token
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
+             */
+            audiences?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+            /**
+             * The name of the ServiceAccount resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * Namespace of the resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
         /**
          * Cert enables certificate-based authentication using a client certificate and key.
          */
@@ -88428,6 +88903,288 @@ export declare namespace external_secrets {
              */
             serviceID?: pulumi.Input<string | undefined>;
         }
+        /**
+         * GCP enables authentication to Conjur via the authn-gcp authenticator.
+         */
+        interface SecretStoreSpecProviderConjurAuthGcp {
+            /**
+             * Account is the Conjur organization account name.
+             */
+            account: pulumi.Input<string>;
+            /**
+             * HostID is the Conjur host mapped to the GCP service account
+             * (e.g. "data/myapp/myhost").
+             */
+            hostId: pulumi.Input<string>;
+            secretRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthGcpSecretRef | undefined>;
+            /**
+             * ServiceID is the Conjur authn-gcp webservice identifier (e.g. "prod").
+             * Note: Conjur's authn-gcp authenticator does not include the service ID in the
+             * authentication URL; this field is reserved for future use.
+             */
+            serviceID?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * GCP enables authentication to Conjur via the authn-gcp authenticator.
+         */
+        interface SecretStoreSpecProviderConjurAuthGcpPatch {
+            /**
+             * Account is the Conjur organization account name.
+             */
+            account?: pulumi.Input<string | undefined>;
+            /**
+             * HostID is the Conjur host mapped to the GCP service account
+             * (e.g. "data/myapp/myhost").
+             */
+            hostId?: pulumi.Input<string | undefined>;
+            secretRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthGcpSecretRefPatch | undefined>;
+            /**
+             * ServiceID is the Conjur authn-gcp webservice identifier (e.g. "prod").
+             * Note: Conjur's authn-gcp authenticator does not include the service ID in the
+             * authentication URL; this field is reserved for future use.
+             */
+            serviceID?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * SecretRef holds a reference to a Kubernetes Secret containing a pre-obtained
+         * GCP identity token. If omitted, the token is fetched from the GCP Metadata
+         * Service automatically (requires GKE Workload Identity or a GCE/GKE node).
+         */
+        interface SecretStoreSpecProviderConjurAuthGcpSecretRef {
+            jwt: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthGcpSecretRefJwt>;
+        }
+        /**
+         * JWT is a reference to the Kubernetes Secret key holding the GCP identity token.
+         */
+        interface SecretStoreSpecProviderConjurAuthGcpSecretRefJwt {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * JWT is a reference to the Kubernetes Secret key holding the GCP identity token.
+         */
+        interface SecretStoreSpecProviderConjurAuthGcpSecretRefJwtPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * SecretRef holds a reference to a Kubernetes Secret containing a pre-obtained
+         * GCP identity token. If omitted, the token is fetched from the GCP Metadata
+         * Service automatically (requires GKE Workload Identity or a GCE/GKE node).
+         */
+        interface SecretStoreSpecProviderConjurAuthGcpSecretRefPatch {
+            jwt?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthGcpSecretRefJwtPatch | undefined>;
+        }
+        /**
+         * IAM enables authentication to Conjur via the authn-iam authenticator.
+         */
+        interface SecretStoreSpecProviderConjurAuthIam {
+            /**
+             * Account is the Conjur organization account name.
+             */
+            account: pulumi.Input<string>;
+            /**
+             * HostID is the Conjur host mapped to the AWS IAM role
+             * (e.g. "data/myapp/123456789012/MyRole").
+             */
+            hostId: pulumi.Input<string>;
+            /**
+             * Insecure allows authenticating to Conjur over plain HTTP. The AWS IAM authenticator
+             * sends a signed request as a bearer credential, so this should only be enabled when the
+             * connection is otherwise protected (e.g. a service mesh sidecar terminating TLS).
+             */
+            insecure?: pulumi.Input<boolean | undefined>;
+            secretRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthIamSecretRef | undefined>;
+            /**
+             * ServiceID is the Conjur authn-iam webservice identifier (e.g. "prod").
+             */
+            serviceID: pulumi.Input<string>;
+        }
+        /**
+         * IAM enables authentication to Conjur via the authn-iam authenticator.
+         */
+        interface SecretStoreSpecProviderConjurAuthIamPatch {
+            /**
+             * Account is the Conjur organization account name.
+             */
+            account?: pulumi.Input<string | undefined>;
+            /**
+             * HostID is the Conjur host mapped to the AWS IAM role
+             * (e.g. "data/myapp/123456789012/MyRole").
+             */
+            hostId?: pulumi.Input<string | undefined>;
+            /**
+             * Insecure allows authenticating to Conjur over plain HTTP. The AWS IAM authenticator
+             * sends a signed request as a bearer credential, so this should only be enabled when the
+             * connection is otherwise protected (e.g. a service mesh sidecar terminating TLS).
+             */
+            insecure?: pulumi.Input<boolean | undefined>;
+            secretRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthIamSecretRefPatch | undefined>;
+            /**
+             * ServiceID is the Conjur authn-iam webservice identifier (e.g. "prod").
+             */
+            serviceID?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * SecretRef holds optional references to Kubernetes Secrets containing explicit
+         * AWS credentials. If omitted, the default AWS SDK credential chain is used
+         * (IRSA, instance metadata, environment variables, etc.).
+         */
+        interface SecretStoreSpecProviderConjurAuthIamSecretRef {
+            accessKeyIDSecretRef: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthIamSecretRefAccessKeyIDSecretRef>;
+            secretAccessKeySecretRef: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthIamSecretRefSecretAccessKeySecretRef>;
+            sessionTokenSecretRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthIamSecretRefSessionTokenSecretRef | undefined>;
+        }
+        /**
+         * A reference to a Secret key containing the AWS Access Key ID.
+         */
+        interface SecretStoreSpecProviderConjurAuthIamSecretRefAccessKeyIDSecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * A reference to a Secret key containing the AWS Access Key ID.
+         */
+        interface SecretStoreSpecProviderConjurAuthIamSecretRefAccessKeyIDSecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * SecretRef holds optional references to Kubernetes Secrets containing explicit
+         * AWS credentials. If omitted, the default AWS SDK credential chain is used
+         * (IRSA, instance metadata, environment variables, etc.).
+         */
+        interface SecretStoreSpecProviderConjurAuthIamSecretRefPatch {
+            accessKeyIDSecretRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthIamSecretRefAccessKeyIDSecretRefPatch | undefined>;
+            secretAccessKeySecretRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthIamSecretRefSecretAccessKeySecretRefPatch | undefined>;
+            sessionTokenSecretRef?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthIamSecretRefSessionTokenSecretRefPatch | undefined>;
+        }
+        /**
+         * A reference to a Secret key containing the AWS Secret Access Key.
+         */
+        interface SecretStoreSpecProviderConjurAuthIamSecretRefSecretAccessKeySecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * A reference to a Secret key containing the AWS Secret Access Key.
+         */
+        interface SecretStoreSpecProviderConjurAuthIamSecretRefSecretAccessKeySecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * A reference to a Secret key containing the AWS Session Token.
+         * Required only when using temporary credentials.
+         */
+        interface SecretStoreSpecProviderConjurAuthIamSecretRefSessionTokenSecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
+        /**
+         * A reference to a Secret key containing the AWS Session Token.
+         * Required only when using temporary credentials.
+         */
+        interface SecretStoreSpecProviderConjurAuthIamSecretRefSessionTokenSecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key?: pulumi.Input<string | undefined>;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name?: pulumi.Input<string | undefined>;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace?: pulumi.Input<string | undefined>;
+        }
         /**
          * Jwt enables JWT authentication using Kubernetes service account tokens.
          */
@@ -88555,7 +89312,10 @@ export declare namespace external_secrets {
          */
         interface SecretStoreSpecProviderConjurAuthPatch {
             apikey?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthApikeyPatch | undefined>;
+            azure?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthAzurePatch | undefined>;
             cert?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthCertPatch | undefined>;
+            gcp?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthGcpPatch | undefined>;
+            iam?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthIamPatch | undefined>;
             jwt?: pulumi.Input<inputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthJwtPatch | undefined>;
         }
         /**
@@ -128814,7 +129574,8 @@ export declare namespace gateway {
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDaemonSetContainerEnvValueFromConfigMapKeyRef {
             /**
-             * The key to select.
+             * The key to select from the ConfigMap's Data field.
+             * Keys in the BinaryData field are not currently propagated to container env vars.
              */
             key: pulumi.Input<string>;
             /**
@@ -129153,8 +129914,16 @@ export declare namespace gateway {
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDaemonSetContainerVolumeMounts {
             /**
-             * Path within the container at which the volume should be mounted.  Must
-             * not contain ':'.
+             * bindMountOptions is the list of additional bind mount options to apply when
+             * mounting this volume into the container. Allowed values are noexec,
+             * nodev, and nosuid. These are Linux mount options and have no effect on
+             * Windows nodes.
+             * This field is not supported with image volumes.
+             * This is an alpha field and requires enabling the VolumeBindMountOptions feature gate.
+             */
+            bindMountOptions?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+            /**
+             * Path within the container at which the volume should be mounted.
              */
             mountPath: pulumi.Input<string>;
             /**
@@ -130129,11 +130898,8 @@ export declare namespace gateway {
              * Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes
              * whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their
              * CSIDriver instance. Other volumes are always re-labelled recursively.
-             * "MountOption" value is allowed only when SELinuxMount feature gate is enabled.
              *
-             * If not specified and SELinuxMount feature gate is enabled, "MountOption" is used.
-             * If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes
-             * and "Recursive" for all other volumes.
+             * If not specified, "MountOption" is used.
              *
              * This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.
              *
@@ -130705,6 +131471,12 @@ export declare namespace gateway {
              * mode, like fsGroup, and the result can be other mode bits set.
              */
             defaultMode?: pulumi.Input<number | undefined>;
+            /**
+             * defaultUser is Optional: The owner UID of the created files by default.
+             * The defaultUser field is only used as a fallback when the item-level user field is unset.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            defaultUser?: pulumi.Input<number | undefined>;
             /**
              * items if unspecified, each key-value pair in the Data field of the referenced
              * ConfigMap will be projected into the volume as a file whose name is the
@@ -130752,6 +131524,12 @@ export declare namespace gateway {
              * May not start with the string '..'.
              */
             path: pulumi.Input<string>;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user?: pulumi.Input<number | undefined>;
         }
         /**
          * csi (Container Storage Interface) represents ephemeral storage that is handled by certain external CSI drivers.
@@ -130814,6 +131592,12 @@ export declare namespace gateway {
              * mode, like fsGroup, and the result can be other mode bits set.
              */
             defaultMode?: pulumi.Input<number | undefined>;
+            /**
+             * defaultUser is Optional: The owner UID of the created files by default.
+             * The defaultUser field is only used as a fallback when the item-level user field is unset.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            defaultUser?: pulumi.Input<number | undefined>;
             /**
              * Items is a list of downward API volume file
              */
@@ -130838,6 +131622,12 @@ export declare namespace gateway {
              */
             path: pulumi.Input<string>;
             resourceFieldRef?: pulumi.Input<inputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDaemonSetPodVolumesDownwardAPIItemsResourceFieldRef | undefined>;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user?: pulumi.Input<number | undefined>;
         }
         /**
          * Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.
@@ -130882,6 +131672,17 @@ export declare namespace gateway {
              * More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
              */
             medium?: pulumi.Input<string | undefined>;
+            /**
+             * mode specifies the permission bits for the emptyDir directory, in numeric
+             * notation (e.g., 0755, 01777). Must be a value between 0000 and 01777.
+             * If not specified, defaults to 0777.
+             * This might be in conflict with other options that affect the file
+             * mode, like fsGroup. If fsGroup is specified, the fsGroup permissions
+             * will override the mode specified here.
+             * This field has no effect on Windows.
+             * This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled.
+             */
+            mode?: pulumi.Input<number | undefined>;
             /**
              * sizeLimit is the total amount of local storage required for this EmptyDir volume.
              * The size limit is also applicable for memory medium.
@@ -131005,8 +131806,8 @@ export declare namespace gateway {
          * * An existing PVC (PersistentVolumeClaim)
          *   If the provisioner or an external controller can support the specified data source,
          *   it will create a new volume based on the contents of the specified data source.
-         *   When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
-         *   and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
+         *   dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be
+         *   copied to dataSource when dataSourceRef.namespace is not specified.
          *   If the namespace is specified, then dataSourceRef will not be copied to dataSource.
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDaemonSetPodVolumesEphemeralVolumeClaimTemplateSpecDataSource {
@@ -131047,7 +131848,6 @@ export declare namespace gateway {
          *   specified.
          * * While dataSource only allows local objects, dataSourceRef allows objects
          *   in any namespaces.
-         *   (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
          *   (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDaemonSetPodVolumesEphemeralVolumeClaimTemplateSpecDataSourceRef {
@@ -131521,6 +132321,12 @@ export declare namespace gateway {
              * mode, like fsGroup, and the result can be other mode bits set.
              */
             defaultMode?: pulumi.Input<number | undefined>;
+            /**
+             * defaultUser is Optional: The owner UID of the created files by default.
+             * The defaultUser field is only used as a fallback when the item-level user field is unset.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            defaultUser?: pulumi.Input<number | undefined>;
             /**
              * sources is the list of volume projections. Each entry in this list
              * handles one source.
@@ -131579,6 +132385,12 @@ export declare namespace gateway {
              * ClusterTrustBundles will be unified and deduplicated.
              */
             signerName?: pulumi.Input<string | undefined>;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user?: pulumi.Input<number | undefined>;
         }
         /**
          * Select all ClusterTrustBundles that match this label selector.  Only has
@@ -131673,6 +132485,12 @@ export declare namespace gateway {
              * May not start with the string '..'.
              */
             path: pulumi.Input<string>;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user?: pulumi.Input<number | undefined>;
         }
         /**
          * downwardAPI information about the downwardAPI data to project
@@ -131702,6 +132520,12 @@ export declare namespace gateway {
              */
             path: pulumi.Input<string>;
             resourceFieldRef?: pulumi.Input<inputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDaemonSetPodVolumesProjectedSourcesDownwardAPIItemsResourceFieldRef | undefined>;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user?: pulumi.Input<number | undefined>;
         }
         /**
          * Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.
@@ -131834,6 +132658,12 @@ export declare namespace gateway {
              * Kubelet's generated CSRs will be addressed to this signer.
              */
             signerName: pulumi.Input<string>;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user?: pulumi.Input<number | undefined>;
             /**
              * userAnnotations allow pod authors to pass additional information to
              * the signer implementation.  Kubernetes does not restrict or validate this
@@ -131904,6 +132734,12 @@ export declare namespace gateway {
              * May not start with the string '..'.
              */
             path: pulumi.Input<string>;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user?: pulumi.Input<number | undefined>;
         }
         /**
          * serviceAccountToken is information about the serviceAccountToken data to project
@@ -131930,6 +132766,12 @@ export declare namespace gateway {
              * token into.
              */
             path: pulumi.Input<string>;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user?: pulumi.Input<number | undefined>;
         }
         /**
          * quobyte represents a Quobyte mount on the host that shares a pod's lifetime.
@@ -132109,6 +132951,12 @@ export declare namespace gateway {
              * mode, like fsGroup, and the result can be other mode bits set.
              */
             defaultMode?: pulumi.Input<number | undefined>;
+            /**
+             * defaultUser is Optional: The owner UID of the created files by default.
+             * The defaultUser field is only used as a fallback when the item-level user field is unset.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            defaultUser?: pulumi.Input<number | undefined>;
             /**
              * items If unspecified, each key-value pair in the Data field of the referenced
              * Secret will be projected into the volume as a file whose name is the
@@ -132153,6 +133001,12 @@ export declare namespace gateway {
              * May not start with the string '..'.
              */
             path: pulumi.Input<string>;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user?: pulumi.Input<number | undefined>;
         }
         /**
          * storageOS represents a StorageOS volume attached and mounted on Kubernetes nodes.
@@ -132368,7 +133222,8 @@ export declare namespace gateway {
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDeploymentContainerEnvValueFromConfigMapKeyRef {
             /**
-             * The key to select.
+             * The key to select from the ConfigMap's Data field.
+             * Keys in the BinaryData field are not currently propagated to container env vars.
              */
             key: pulumi.Input<string>;
             /**
@@ -132707,8 +133562,16 @@ export declare namespace gateway {
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDeploymentContainerVolumeMounts {
             /**
-             * Path within the container at which the volume should be mounted.  Must
-             * not contain ':'.
+             * bindMountOptions is the list of additional bind mount options to apply when
+             * mounting this volume into the container. Allowed values are noexec,
+             * nodev, and nosuid. These are Linux mount options and have no effect on
+             * Windows nodes.
+             * This field is not supported with image volumes.
+             * This is an alpha field and requires enabling the VolumeBindMountOptions feature gate.
+             */
+            bindMountOptions?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+            /**
+             * Path within the container at which the volume should be mounted.
              */
             mountPath: pulumi.Input<string>;
             /**
@@ -133017,7 +133880,8 @@ export declare namespace gateway {
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDeploymentInitContainersEnvValueFromConfigMapKeyRef {
             /**
-             * The key to select.
+             * The key to select from the ConfigMap's Data field.
+             * Keys in the BinaryData field are not currently propagated to container env vars.
              */
             key: pulumi.Input<string>;
             /**
@@ -133179,6 +134043,11 @@ export declare namespace gateway {
              * Name must be an IANA_SVC_NAME.
              */
             port: pulumi.Input<number | string>;
+            /**
+             * Protocol selects the wire protocol for the probe connection.
+             * Nil defaults to HTTP/1.1.
+             */
+            protocol?: pulumi.Input<string | undefined>;
             /**
              * Scheme to use for connecting to the host.
              * Defaults to HTTP.
@@ -133278,6 +134147,11 @@ export declare namespace gateway {
              * Name must be an IANA_SVC_NAME.
              */
             port: pulumi.Input<number | string>;
+            /**
+             * Protocol selects the wire protocol for the probe connection.
+             * Nil defaults to HTTP/1.1.
+             */
+            protocol?: pulumi.Input<string | undefined>;
             /**
              * Scheme to use for connecting to the host.
              * Defaults to HTTP.
@@ -133392,6 +134266,13 @@ export declare namespace gateway {
          * GRPC specifies a GRPC HealthCheckRequest.
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDeploymentInitContainersLivenessProbeGrpc {
+            /**
+             * mode specifies the connection mode for the gRPC health probe.
+             * Set to "TLS" to use TLS without certificate verification.
+             * Set to "Plaintext" to use a plaintext (insecure) connection explicitly.
+             * If not specified, the probe uses a plaintext (insecure) connection.
+             */
+            mode?: pulumi.Input<string | undefined>;
             /**
              * Port number of the gRPC service. Number must be in the range 1 to 65535.
              */
@@ -133427,6 +134308,11 @@ export declare namespace gateway {
              * Name must be an IANA_SVC_NAME.
              */
             port: pulumi.Input<number | string>;
+            /**
+             * Protocol selects the wire protocol for the probe connection.
+             * Nil defaults to HTTP/1.1.
+             */
+            protocol?: pulumi.Input<string | undefined>;
             /**
              * Scheme to use for connecting to the host.
              * Defaults to HTTP.
@@ -133562,6 +134448,13 @@ export declare namespace gateway {
          * GRPC specifies a GRPC HealthCheckRequest.
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDeploymentInitContainersReadinessProbeGrpc {
+            /**
+             * mode specifies the connection mode for the gRPC health probe.
+             * Set to "TLS" to use TLS without certificate verification.
+             * Set to "Plaintext" to use a plaintext (insecure) connection explicitly.
+             * If not specified, the probe uses a plaintext (insecure) connection.
+             */
+            mode?: pulumi.Input<string | undefined>;
             /**
              * Port number of the gRPC service. Number must be in the range 1 to 65535.
              */
@@ -133597,6 +134490,11 @@ export declare namespace gateway {
              * Name must be an IANA_SVC_NAME.
              */
             port: pulumi.Input<number | string>;
+            /**
+             * Protocol selects the wire protocol for the probe connection.
+             * Nil defaults to HTTP/1.1.
+             */
+            protocol?: pulumi.Input<string | undefined>;
             /**
              * Scheme to use for connecting to the host.
              * Defaults to HTTP.
@@ -133984,6 +134882,13 @@ export declare namespace gateway {
          * GRPC specifies a GRPC HealthCheckRequest.
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDeploymentInitContainersStartupProbeGrpc {
+            /**
+             * mode specifies the connection mode for the gRPC health probe.
+             * Set to "TLS" to use TLS without certificate verification.
+             * Set to "Plaintext" to use a plaintext (insecure) connection explicitly.
+             * If not specified, the probe uses a plaintext (insecure) connection.
+             */
+            mode?: pulumi.Input<string | undefined>;
             /**
              * Port number of the gRPC service. Number must be in the range 1 to 65535.
              */
@@ -134019,6 +134924,11 @@ export declare namespace gateway {
              * Name must be an IANA_SVC_NAME.
              */
             port: pulumi.Input<number | string>;
+            /**
+             * Protocol selects the wire protocol for the probe connection.
+             * Nil defaults to HTTP/1.1.
+             */
+            protocol?: pulumi.Input<string | undefined>;
             /**
              * Scheme to use for connecting to the host.
              * Defaults to HTTP.
@@ -134072,8 +134982,16 @@ export declare namespace gateway {
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDeploymentInitContainersVolumeMounts {
             /**
-             * Path within the container at which the volume should be mounted.  Must
-             * not contain ':'.
+             * bindMountOptions is the list of additional bind mount options to apply when
+             * mounting this volume into the container. Allowed values are noexec,
+             * nodev, and nosuid. These are Linux mount options and have no effect on
+             * Windows nodes.
+             * This field is not supported with image volumes.
+             * This is an alpha field and requires enabling the VolumeBindMountOptions feature gate.
+             */
+            bindMountOptions?: pulumi.Input<pulumi.Input<string>[] | undefined>;
+            /**
+             * Path within the container at which the volume should be mounted.
              */
             mountPath: pulumi.Input<string>;
             /**
@@ -135048,11 +135966,8 @@ export declare namespace gateway {
              * Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes
              * whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their
              * CSIDriver instance. Other volumes are always re-labelled recursively.
-             * "MountOption" value is allowed only when SELinuxMount feature gate is enabled.
              *
-             * If not specified and SELinuxMount feature gate is enabled, "MountOption" is used.
-             * If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes
-             * and "Recursive" for all other volumes.
+             * If not specified, "MountOption" is used.
              *
              * This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.
              *
@@ -135624,6 +136539,12 @@ export declare namespace gateway {
              * mode, like fsGroup, and the result can be other mode bits set.
              */
             defaultMode?: pulumi.Input<number | undefined>;
+            /**
+             * defaultUser is Optional: The owner UID of the created files by default.
+             * The defaultUser field is only used as a fallback when the item-level user field is unset.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            defaultUser?: pulumi.Input<number | undefined>;
             /**
              * items if unspecified, each key-value pair in the Data field of the referenced
              * ConfigMap will be projected into the volume as a file whose name is the
@@ -135671,6 +136592,12 @@ export declare namespace gateway {
              * May not start with the string '..'.
              */
             path: pulumi.Input<string>;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user?: pulumi.Input<number | undefined>;
         }
         /**
          * csi (Container Storage Interface) represents ephemeral storage that is handled by certain external CSI drivers.
@@ -135733,6 +136660,12 @@ export declare namespace gateway {
              * mode, like fsGroup, and the result can be other mode bits set.
              */
             defaultMode?: pulumi.Input<number | undefined>;
+            /**
+             * defaultUser is Optional: The owner UID of the created files by default.
+             * The defaultUser field is only used as a fallback when the item-level user field is unset.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            defaultUser?: pulumi.Input<number | undefined>;
             /**
              * Items is a list of downward API volume file
              */
@@ -135757,6 +136690,12 @@ export declare namespace gateway {
              */
             path: pulumi.Input<string>;
             resourceFieldRef?: pulumi.Input<inputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDeploymentPodVolumesDownwardAPIItemsResourceFieldRef | undefined>;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user?: pulumi.Input<number | undefined>;
         }
         /**
          * Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.
@@ -135801,6 +136740,17 @@ export declare namespace gateway {
              * More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
              */
             medium?: pulumi.Input<string | undefined>;
+            /**
+             * mode specifies the permission bits for the emptyDir directory, in numeric
+             * notation (e.g., 0755, 01777). Must be a value between 0000 and 01777.
+             * If not specified, defaults to 0777.
+             * This might be in conflict with other options that affect the file
+             * mode, like fsGroup. If fsGroup is specified, the fsGroup permissions
+             * will override the mode specified here.
+             * This field has no effect on Windows.
+             * This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled.
+             */
+            mode?: pulumi.Input<number | undefined>;
             /**
              * sizeLimit is the total amount of local storage required for this EmptyDir volume.
              * The size limit is also applicable for memory medium.
@@ -135924,8 +136874,8 @@ export declare namespace gateway {
          * * An existing PVC (PersistentVolumeClaim)
          *   If the provisioner or an external controller can support the specified data source,
          *   it will create a new volume based on the contents of the specified data source.
-         *   When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
-         *   and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
+         *   dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be
+         *   copied to dataSource when dataSourceRef.namespace is not specified.
          *   If the namespace is specified, then dataSourceRef will not be copied to dataSource.
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDeploymentPodVolumesEphemeralVolumeClaimTemplateSpecDataSource {
@@ -135966,7 +136916,6 @@ export declare namespace gateway {
          *   specified.
          * * While dataSource only allows local objects, dataSourceRef allows objects
          *   in any namespaces.
-         *   (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
          *   (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDeploymentPodVolumesEphemeralVolumeClaimTemplateSpecDataSourceRef {
@@ -136440,6 +137389,12 @@ export declare namespace gateway {
              * mode, like fsGroup, and the result can be other mode bits set.
              */
             defaultMode?: pulumi.Input<number | undefined>;
+            /**
+             * defaultUser is Optional: The owner UID of the created files by default.
+             * The defaultUser field is only used as a fallback when the item-level user field is unset.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            defaultUser?: pulumi.Input<number | undefined>;
             /**
              * sources is the list of volume projections. Each entry in this list
              * handles one source.
@@ -136498,6 +137453,12 @@ export declare namespace gateway {
              * ClusterTrustBundles will be unified and deduplicated.
              */
             signerName?: pulumi.Input<string | undefined>;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user?: pulumi.Input<number | undefined>;
         }
         /**
          * Select all ClusterTrustBundles that match this label selector.  Only has
@@ -136592,6 +137553,12 @@ export declare namespace gateway {
              * May not start with the string '..'.
              */
             path: pulumi.Input<string>;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user?: pulumi.Input<number | undefined>;
         }
         /**
          * downwardAPI information about the downwardAPI data to project
@@ -136621,6 +137588,12 @@ export declare namespace gateway {
              */
             path: pulumi.Input<string>;
             resourceFieldRef?: pulumi.Input<inputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDeploymentPodVolumesProjectedSourcesDownwardAPIItemsResourceFieldRef | undefined>;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user?: pulumi.Input<number | undefined>;
         }
         /**
          * Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.
@@ -136753,6 +137726,12 @@ export declare namespace gateway {
              * Kubelet's generated CSRs will be addressed to this signer.
              */
             signerName: pulumi.Input<string>;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user?: pulumi.Input<number | undefined>;
             /**
              * userAnnotations allow pod authors to pass additional information to
              * the signer implementation.  Kubernetes does not restrict or validate this
@@ -136823,6 +137802,12 @@ export declare namespace gateway {
              * May not start with the string '..'.
              */
             path: pulumi.Input<string>;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user?: pulumi.Input<number | undefined>;
         }
         /**
          * serviceAccountToken is information about the serviceAccountToken data to project
@@ -136849,6 +137834,12 @@ export declare namespace gateway {
              * token into.
              */
             path: pulumi.Input<string>;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user?: pulumi.Input<number | undefined>;
         }
         /**
          * quobyte represents a Quobyte mount on the host that shares a pod's lifetime.
@@ -137028,6 +138019,12 @@ export declare namespace gateway {
              * mode, like fsGroup, and the result can be other mode bits set.
              */
             defaultMode?: pulumi.Input<number | undefined>;
+            /**
+             * defaultUser is Optional: The owner UID of the created files by default.
+             * The defaultUser field is only used as a fallback when the item-level user field is unset.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            defaultUser?: pulumi.Input<number | undefined>;
             /**
              * items If unspecified, each key-value pair in the Data field of the referenced
              * Secret will be projected into the volume as a file whose name is the
@@ -137072,6 +138069,12 @@ export declare namespace gateway {
              * May not start with the string '..'.
              */
             path: pulumi.Input<string>;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user?: pulumi.Input<number | undefined>;
         }
         /**
          * storageOS represents a StorageOS volume attached and mounted on Kubernetes nodes.
@@ -137266,9 +138269,6 @@ export declare namespace gateway {
              * For example, if autoscaling is configured with a memory consumption target of 100Mi,
              * and scale-down and scale-up tolerances of 5% and 1% respectively, scaling will be
              * triggered when the actual consumption falls below 95Mi or exceeds 101Mi.
-             *
-             * This is an beta field and requires the HPAConfigurableTolerance feature
-             * gate to be enabled.
              */
             tolerance?: pulumi.Input<number | string | undefined>;
         }
@@ -137329,9 +138329,6 @@ export declare namespace gateway {
              * For example, if autoscaling is configured with a memory consumption target of 100Mi,
              * and scale-down and scale-up tolerances of 5% and 1% respectively, scaling will be
              * triggered when the actual consumption falls below 95Mi or exceeds 101Mi.
-             *
-             * This is an beta field and requires the HPAConfigurableTolerance feature
-             * gate to be enabled.
              */
             tolerance?: pulumi.Input<number | string | undefined>;
         }