@kilic.dev/pulumi-k8s-crds 4.0.3 → 4.0.5

package/dist/types/output.d.ts

@@ -80477,7 +80477,10 @@ export declare namespace external_secrets {
          */
         interface ClusterSecretStoreSpecProviderConjurAuth {
             apikey: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthApikey;
+            azure: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthAzure;
             cert: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthCert;
+            gcp: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthGcp;
+            iam: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthIam;
             jwt: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthJwt;
         }
         /**
@@ -80582,6 +80585,98 @@ export declare namespace external_secrets {
              */
             namespace: string;
         }
+        /**
+         * Azure enables authentication to Conjur via the authn-azure authenticator.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthAzure {
+            /**
+             * Account is the Conjur organization account name.
+             */
+            account: string;
+            /**
+             * ClientID is the Azure managed identity client ID. Required for user-assigned
+             * managed identities; omit for system-assigned identities.
+             */
+            clientId: string;
+            /**
+             * HostID is the Conjur host mapped to the Azure managed identity
+             * (e.g. "data/myapp/myhost").
+             */
+            hostId: string;
+            serviceAccountRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthAzureServiceAccountRef;
+            /**
+             * ServiceID is the Conjur authn-azure webservice identifier (e.g. "prod").
+             */
+            serviceID: string;
+        }
+        /**
+         * Azure enables authentication to Conjur via the authn-azure authenticator.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthAzurePatch {
+            /**
+             * Account is the Conjur organization account name.
+             */
+            account: string;
+            /**
+             * ClientID is the Azure managed identity client ID. Required for user-assigned
+             * managed identities; omit for system-assigned identities.
+             */
+            clientId: string;
+            /**
+             * HostID is the Conjur host mapped to the Azure managed identity
+             * (e.g. "data/myapp/myhost").
+             */
+            hostId: string;
+            serviceAccountRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthAzureServiceAccountRefPatch;
+            /**
+             * ServiceID is the Conjur authn-azure webservice identifier (e.g. "prod").
+             */
+            serviceID: string;
+        }
+        /**
+         * ServiceAccountRef specifies the Kubernetes service account for which to request
+         * a token via the TokenRequest API. That token is used as the Azure JWT for Conjur
+         * authn-azure. If omitted, the token is fetched from the Azure IMDS endpoint instead.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthAzureServiceAccountRef {
+            /**
+             * Audience specifies the `aud` claim for the service account token
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
+             */
+            audiences: string[];
+            /**
+             * The name of the ServiceAccount resource being referred to.
+             */
+            name: string;
+            /**
+             * Namespace of the resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * ServiceAccountRef specifies the Kubernetes service account for which to request
+         * a token via the TokenRequest API. That token is used as the Azure JWT for Conjur
+         * authn-azure. If omitted, the token is fetched from the Azure IMDS endpoint instead.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthAzureServiceAccountRefPatch {
+            /**
+             * Audience specifies the `aud` claim for the service account token
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
+             */
+            audiences: string[];
+            /**
+             * The name of the ServiceAccount resource being referred to.
+             */
+            name: string;
+            /**
+             * Namespace of the resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
         /**
          * Cert enables certificate-based authentication using a client certificate and key.
          */
@@ -80700,6 +80795,288 @@ export declare namespace external_secrets {
              */
             serviceID: string;
         }
+        /**
+         * GCP enables authentication to Conjur via the authn-gcp authenticator.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthGcp {
+            /**
+             * Account is the Conjur organization account name.
+             */
+            account: string;
+            /**
+             * HostID is the Conjur host mapped to the GCP service account
+             * (e.g. "data/myapp/myhost").
+             */
+            hostId: string;
+            secretRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthGcpSecretRef;
+            /**
+             * ServiceID is the Conjur authn-gcp webservice identifier (e.g. "prod").
+             * Note: Conjur's authn-gcp authenticator does not include the service ID in the
+             * authentication URL; this field is reserved for future use.
+             */
+            serviceID: string;
+        }
+        /**
+         * GCP enables authentication to Conjur via the authn-gcp authenticator.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthGcpPatch {
+            /**
+             * Account is the Conjur organization account name.
+             */
+            account: string;
+            /**
+             * HostID is the Conjur host mapped to the GCP service account
+             * (e.g. "data/myapp/myhost").
+             */
+            hostId: string;
+            secretRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthGcpSecretRefPatch;
+            /**
+             * ServiceID is the Conjur authn-gcp webservice identifier (e.g. "prod").
+             * Note: Conjur's authn-gcp authenticator does not include the service ID in the
+             * authentication URL; this field is reserved for future use.
+             */
+            serviceID: string;
+        }
+        /**
+         * SecretRef holds a reference to a Kubernetes Secret containing a pre-obtained
+         * GCP identity token. If omitted, the token is fetched from the GCP Metadata
+         * Service automatically (requires GKE Workload Identity or a GCE/GKE node).
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthGcpSecretRef {
+            jwt: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthGcpSecretRefJwt;
+        }
+        /**
+         * JWT is a reference to the Kubernetes Secret key holding the GCP identity token.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthGcpSecretRefJwt {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * JWT is a reference to the Kubernetes Secret key holding the GCP identity token.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthGcpSecretRefJwtPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * SecretRef holds a reference to a Kubernetes Secret containing a pre-obtained
+         * GCP identity token. If omitted, the token is fetched from the GCP Metadata
+         * Service automatically (requires GKE Workload Identity or a GCE/GKE node).
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthGcpSecretRefPatch {
+            jwt: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthGcpSecretRefJwtPatch;
+        }
+        /**
+         * IAM enables authentication to Conjur via the authn-iam authenticator.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthIam {
+            /**
+             * Account is the Conjur organization account name.
+             */
+            account: string;
+            /**
+             * HostID is the Conjur host mapped to the AWS IAM role
+             * (e.g. "data/myapp/123456789012/MyRole").
+             */
+            hostId: string;
+            /**
+             * Insecure allows authenticating to Conjur over plain HTTP. The AWS IAM authenticator
+             * sends a signed request as a bearer credential, so this should only be enabled when the
+             * connection is otherwise protected (e.g. a service mesh sidecar terminating TLS).
+             */
+            insecure: boolean;
+            secretRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthIamSecretRef;
+            /**
+             * ServiceID is the Conjur authn-iam webservice identifier (e.g. "prod").
+             */
+            serviceID: string;
+        }
+        /**
+         * IAM enables authentication to Conjur via the authn-iam authenticator.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthIamPatch {
+            /**
+             * Account is the Conjur organization account name.
+             */
+            account: string;
+            /**
+             * HostID is the Conjur host mapped to the AWS IAM role
+             * (e.g. "data/myapp/123456789012/MyRole").
+             */
+            hostId: string;
+            /**
+             * Insecure allows authenticating to Conjur over plain HTTP. The AWS IAM authenticator
+             * sends a signed request as a bearer credential, so this should only be enabled when the
+             * connection is otherwise protected (e.g. a service mesh sidecar terminating TLS).
+             */
+            insecure: boolean;
+            secretRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthIamSecretRefPatch;
+            /**
+             * ServiceID is the Conjur authn-iam webservice identifier (e.g. "prod").
+             */
+            serviceID: string;
+        }
+        /**
+         * SecretRef holds optional references to Kubernetes Secrets containing explicit
+         * AWS credentials. If omitted, the default AWS SDK credential chain is used
+         * (IRSA, instance metadata, environment variables, etc.).
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthIamSecretRef {
+            accessKeyIDSecretRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthIamSecretRefAccessKeyIDSecretRef;
+            secretAccessKeySecretRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthIamSecretRefSecretAccessKeySecretRef;
+            sessionTokenSecretRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthIamSecretRefSessionTokenSecretRef;
+        }
+        /**
+         * A reference to a Secret key containing the AWS Access Key ID.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthIamSecretRefAccessKeyIDSecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * A reference to a Secret key containing the AWS Access Key ID.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthIamSecretRefAccessKeyIDSecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * SecretRef holds optional references to Kubernetes Secrets containing explicit
+         * AWS credentials. If omitted, the default AWS SDK credential chain is used
+         * (IRSA, instance metadata, environment variables, etc.).
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthIamSecretRefPatch {
+            accessKeyIDSecretRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthIamSecretRefAccessKeyIDSecretRefPatch;
+            secretAccessKeySecretRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthIamSecretRefSecretAccessKeySecretRefPatch;
+            sessionTokenSecretRef: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthIamSecretRefSessionTokenSecretRefPatch;
+        }
+        /**
+         * A reference to a Secret key containing the AWS Secret Access Key.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthIamSecretRefSecretAccessKeySecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * A reference to a Secret key containing the AWS Secret Access Key.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthIamSecretRefSecretAccessKeySecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * A reference to a Secret key containing the AWS Session Token.
+         * Required only when using temporary credentials.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthIamSecretRefSessionTokenSecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * A reference to a Secret key containing the AWS Session Token.
+         * Required only when using temporary credentials.
+         */
+        interface ClusterSecretStoreSpecProviderConjurAuthIamSecretRefSessionTokenSecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
         /**
          * Jwt enables JWT authentication using Kubernetes service account tokens.
          */
@@ -80827,7 +81204,10 @@ export declare namespace external_secrets {
          */
         interface ClusterSecretStoreSpecProviderConjurAuthPatch {
             apikey: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthApikeyPatch;
+            azure: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthAzurePatch;
             cert: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthCertPatch;
+            gcp: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthGcpPatch;
+            iam: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthIamPatch;
             jwt: outputs.external_secrets.v1.ClusterSecretStoreSpecProviderConjurAuthJwtPatch;
         }
         /**
@@ -93408,7 +93788,10 @@ export declare namespace external_secrets {
          */
         interface SecretStoreSpecProviderConjurAuth {
             apikey: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthApikey;
+            azure: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthAzure;
             cert: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthCert;
+            gcp: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthGcp;
+            iam: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthIam;
             jwt: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthJwt;
         }
         /**
@@ -93513,6 +93896,98 @@ export declare namespace external_secrets {
              */
             namespace: string;
         }
+        /**
+         * Azure enables authentication to Conjur via the authn-azure authenticator.
+         */
+        interface SecretStoreSpecProviderConjurAuthAzure {
+            /**
+             * Account is the Conjur organization account name.
+             */
+            account: string;
+            /**
+             * ClientID is the Azure managed identity client ID. Required for user-assigned
+             * managed identities; omit for system-assigned identities.
+             */
+            clientId: string;
+            /**
+             * HostID is the Conjur host mapped to the Azure managed identity
+             * (e.g. "data/myapp/myhost").
+             */
+            hostId: string;
+            serviceAccountRef: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthAzureServiceAccountRef;
+            /**
+             * ServiceID is the Conjur authn-azure webservice identifier (e.g. "prod").
+             */
+            serviceID: string;
+        }
+        /**
+         * Azure enables authentication to Conjur via the authn-azure authenticator.
+         */
+        interface SecretStoreSpecProviderConjurAuthAzurePatch {
+            /**
+             * Account is the Conjur organization account name.
+             */
+            account: string;
+            /**
+             * ClientID is the Azure managed identity client ID. Required for user-assigned
+             * managed identities; omit for system-assigned identities.
+             */
+            clientId: string;
+            /**
+             * HostID is the Conjur host mapped to the Azure managed identity
+             * (e.g. "data/myapp/myhost").
+             */
+            hostId: string;
+            serviceAccountRef: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthAzureServiceAccountRefPatch;
+            /**
+             * ServiceID is the Conjur authn-azure webservice identifier (e.g. "prod").
+             */
+            serviceID: string;
+        }
+        /**
+         * ServiceAccountRef specifies the Kubernetes service account for which to request
+         * a token via the TokenRequest API. That token is used as the Azure JWT for Conjur
+         * authn-azure. If omitted, the token is fetched from the Azure IMDS endpoint instead.
+         */
+        interface SecretStoreSpecProviderConjurAuthAzureServiceAccountRef {
+            /**
+             * Audience specifies the `aud` claim for the service account token
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
+             */
+            audiences: string[];
+            /**
+             * The name of the ServiceAccount resource being referred to.
+             */
+            name: string;
+            /**
+             * Namespace of the resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * ServiceAccountRef specifies the Kubernetes service account for which to request
+         * a token via the TokenRequest API. That token is used as the Azure JWT for Conjur
+         * authn-azure. If omitted, the token is fetched from the Azure IMDS endpoint instead.
+         */
+        interface SecretStoreSpecProviderConjurAuthAzureServiceAccountRefPatch {
+            /**
+             * Audience specifies the `aud` claim for the service account token
+             * Some providers automatically extend the audience field based on well-known annotations for workload
+             * identity (e.g. IRSA or GCP Workload Identity)
+             */
+            audiences: string[];
+            /**
+             * The name of the ServiceAccount resource being referred to.
+             */
+            name: string;
+            /**
+             * Namespace of the resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
         /**
          * Cert enables certificate-based authentication using a client certificate and key.
          */
@@ -93631,6 +94106,288 @@ export declare namespace external_secrets {
              */
             serviceID: string;
         }
+        /**
+         * GCP enables authentication to Conjur via the authn-gcp authenticator.
+         */
+        interface SecretStoreSpecProviderConjurAuthGcp {
+            /**
+             * Account is the Conjur organization account name.
+             */
+            account: string;
+            /**
+             * HostID is the Conjur host mapped to the GCP service account
+             * (e.g. "data/myapp/myhost").
+             */
+            hostId: string;
+            secretRef: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthGcpSecretRef;
+            /**
+             * ServiceID is the Conjur authn-gcp webservice identifier (e.g. "prod").
+             * Note: Conjur's authn-gcp authenticator does not include the service ID in the
+             * authentication URL; this field is reserved for future use.
+             */
+            serviceID: string;
+        }
+        /**
+         * GCP enables authentication to Conjur via the authn-gcp authenticator.
+         */
+        interface SecretStoreSpecProviderConjurAuthGcpPatch {
+            /**
+             * Account is the Conjur organization account name.
+             */
+            account: string;
+            /**
+             * HostID is the Conjur host mapped to the GCP service account
+             * (e.g. "data/myapp/myhost").
+             */
+            hostId: string;
+            secretRef: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthGcpSecretRefPatch;
+            /**
+             * ServiceID is the Conjur authn-gcp webservice identifier (e.g. "prod").
+             * Note: Conjur's authn-gcp authenticator does not include the service ID in the
+             * authentication URL; this field is reserved for future use.
+             */
+            serviceID: string;
+        }
+        /**
+         * SecretRef holds a reference to a Kubernetes Secret containing a pre-obtained
+         * GCP identity token. If omitted, the token is fetched from the GCP Metadata
+         * Service automatically (requires GKE Workload Identity or a GCE/GKE node).
+         */
+        interface SecretStoreSpecProviderConjurAuthGcpSecretRef {
+            jwt: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthGcpSecretRefJwt;
+        }
+        /**
+         * JWT is a reference to the Kubernetes Secret key holding the GCP identity token.
+         */
+        interface SecretStoreSpecProviderConjurAuthGcpSecretRefJwt {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * JWT is a reference to the Kubernetes Secret key holding the GCP identity token.
+         */
+        interface SecretStoreSpecProviderConjurAuthGcpSecretRefJwtPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * SecretRef holds a reference to a Kubernetes Secret containing a pre-obtained
+         * GCP identity token. If omitted, the token is fetched from the GCP Metadata
+         * Service automatically (requires GKE Workload Identity or a GCE/GKE node).
+         */
+        interface SecretStoreSpecProviderConjurAuthGcpSecretRefPatch {
+            jwt: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthGcpSecretRefJwtPatch;
+        }
+        /**
+         * IAM enables authentication to Conjur via the authn-iam authenticator.
+         */
+        interface SecretStoreSpecProviderConjurAuthIam {
+            /**
+             * Account is the Conjur organization account name.
+             */
+            account: string;
+            /**
+             * HostID is the Conjur host mapped to the AWS IAM role
+             * (e.g. "data/myapp/123456789012/MyRole").
+             */
+            hostId: string;
+            /**
+             * Insecure allows authenticating to Conjur over plain HTTP. The AWS IAM authenticator
+             * sends a signed request as a bearer credential, so this should only be enabled when the
+             * connection is otherwise protected (e.g. a service mesh sidecar terminating TLS).
+             */
+            insecure: boolean;
+            secretRef: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthIamSecretRef;
+            /**
+             * ServiceID is the Conjur authn-iam webservice identifier (e.g. "prod").
+             */
+            serviceID: string;
+        }
+        /**
+         * IAM enables authentication to Conjur via the authn-iam authenticator.
+         */
+        interface SecretStoreSpecProviderConjurAuthIamPatch {
+            /**
+             * Account is the Conjur organization account name.
+             */
+            account: string;
+            /**
+             * HostID is the Conjur host mapped to the AWS IAM role
+             * (e.g. "data/myapp/123456789012/MyRole").
+             */
+            hostId: string;
+            /**
+             * Insecure allows authenticating to Conjur over plain HTTP. The AWS IAM authenticator
+             * sends a signed request as a bearer credential, so this should only be enabled when the
+             * connection is otherwise protected (e.g. a service mesh sidecar terminating TLS).
+             */
+            insecure: boolean;
+            secretRef: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthIamSecretRefPatch;
+            /**
+             * ServiceID is the Conjur authn-iam webservice identifier (e.g. "prod").
+             */
+            serviceID: string;
+        }
+        /**
+         * SecretRef holds optional references to Kubernetes Secrets containing explicit
+         * AWS credentials. If omitted, the default AWS SDK credential chain is used
+         * (IRSA, instance metadata, environment variables, etc.).
+         */
+        interface SecretStoreSpecProviderConjurAuthIamSecretRef {
+            accessKeyIDSecretRef: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthIamSecretRefAccessKeyIDSecretRef;
+            secretAccessKeySecretRef: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthIamSecretRefSecretAccessKeySecretRef;
+            sessionTokenSecretRef: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthIamSecretRefSessionTokenSecretRef;
+        }
+        /**
+         * A reference to a Secret key containing the AWS Access Key ID.
+         */
+        interface SecretStoreSpecProviderConjurAuthIamSecretRefAccessKeyIDSecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * A reference to a Secret key containing the AWS Access Key ID.
+         */
+        interface SecretStoreSpecProviderConjurAuthIamSecretRefAccessKeyIDSecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * SecretRef holds optional references to Kubernetes Secrets containing explicit
+         * AWS credentials. If omitted, the default AWS SDK credential chain is used
+         * (IRSA, instance metadata, environment variables, etc.).
+         */
+        interface SecretStoreSpecProviderConjurAuthIamSecretRefPatch {
+            accessKeyIDSecretRef: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthIamSecretRefAccessKeyIDSecretRefPatch;
+            secretAccessKeySecretRef: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthIamSecretRefSecretAccessKeySecretRefPatch;
+            sessionTokenSecretRef: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthIamSecretRefSessionTokenSecretRefPatch;
+        }
+        /**
+         * A reference to a Secret key containing the AWS Secret Access Key.
+         */
+        interface SecretStoreSpecProviderConjurAuthIamSecretRefSecretAccessKeySecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * A reference to a Secret key containing the AWS Secret Access Key.
+         */
+        interface SecretStoreSpecProviderConjurAuthIamSecretRefSecretAccessKeySecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * A reference to a Secret key containing the AWS Session Token.
+         * Required only when using temporary credentials.
+         */
+        interface SecretStoreSpecProviderConjurAuthIamSecretRefSessionTokenSecretRef {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
+        /**
+         * A reference to a Secret key containing the AWS Session Token.
+         * Required only when using temporary credentials.
+         */
+        interface SecretStoreSpecProviderConjurAuthIamSecretRefSessionTokenSecretRefPatch {
+            /**
+             * A key in the referenced Secret.
+             * Some instances of this field may be defaulted, in others it may be required.
+             */
+            key: string;
+            /**
+             * The name of the Secret resource being referred to.
+             */
+            name: string;
+            /**
+             * The namespace of the Secret resource being referred to.
+             * Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
+             */
+            namespace: string;
+        }
         /**
          * Jwt enables JWT authentication using Kubernetes service account tokens.
          */
@@ -93758,7 +94515,10 @@ export declare namespace external_secrets {
          */
         interface SecretStoreSpecProviderConjurAuthPatch {
             apikey: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthApikeyPatch;
+            azure: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthAzurePatch;
             cert: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthCertPatch;
+            gcp: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthGcpPatch;
+            iam: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthIamPatch;
             jwt: outputs.external_secrets.v1.SecretStoreSpecProviderConjurAuthJwtPatch;
         }
         /**
@@ -137001,7 +137761,8 @@ export declare namespace gateway {
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDaemonSetContainerEnvValueFromConfigMapKeyRef {
             /**
-             * The key to select.
+             * The key to select from the ConfigMap's Data field.
+             * Keys in the BinaryData field are not currently propagated to container env vars.
              */
             key: string;
             /**
@@ -137340,8 +138101,16 @@ export declare namespace gateway {
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDaemonSetContainerVolumeMounts {
             /**
-             * Path within the container at which the volume should be mounted.  Must
-             * not contain ':'.
+             * bindMountOptions is the list of additional bind mount options to apply when
+             * mounting this volume into the container. Allowed values are noexec,
+             * nodev, and nosuid. These are Linux mount options and have no effect on
+             * Windows nodes.
+             * This field is not supported with image volumes.
+             * This is an alpha field and requires enabling the VolumeBindMountOptions feature gate.
+             */
+            bindMountOptions: string[];
+            /**
+             * Path within the container at which the volume should be mounted.
              */
             mountPath: string;
             /**
@@ -138316,11 +139085,8 @@ export declare namespace gateway {
              * Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes
              * whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their
              * CSIDriver instance. Other volumes are always re-labelled recursively.
-             * "MountOption" value is allowed only when SELinuxMount feature gate is enabled.
              *
-             * If not specified and SELinuxMount feature gate is enabled, "MountOption" is used.
-             * If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes
-             * and "Recursive" for all other volumes.
+             * If not specified, "MountOption" is used.
              *
              * This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.
              *
@@ -138892,6 +139658,12 @@ export declare namespace gateway {
              * mode, like fsGroup, and the result can be other mode bits set.
              */
             defaultMode: number;
+            /**
+             * defaultUser is Optional: The owner UID of the created files by default.
+             * The defaultUser field is only used as a fallback when the item-level user field is unset.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            defaultUser: number;
             /**
              * items if unspecified, each key-value pair in the Data field of the referenced
              * ConfigMap will be projected into the volume as a file whose name is the
@@ -138939,6 +139711,12 @@ export declare namespace gateway {
              * May not start with the string '..'.
              */
             path: string;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user: number;
         }
         /**
          * csi (Container Storage Interface) represents ephemeral storage that is handled by certain external CSI drivers.
@@ -139001,6 +139779,12 @@ export declare namespace gateway {
              * mode, like fsGroup, and the result can be other mode bits set.
              */
             defaultMode: number;
+            /**
+             * defaultUser is Optional: The owner UID of the created files by default.
+             * The defaultUser field is only used as a fallback when the item-level user field is unset.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            defaultUser: number;
             /**
              * Items is a list of downward API volume file
              */
@@ -139025,6 +139809,12 @@ export declare namespace gateway {
              */
             path: string;
             resourceFieldRef: outputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDaemonSetPodVolumesDownwardAPIItemsResourceFieldRef;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user: number;
         }
         /**
          * Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.
@@ -139069,6 +139859,17 @@ export declare namespace gateway {
              * More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
              */
             medium: string;
+            /**
+             * mode specifies the permission bits for the emptyDir directory, in numeric
+             * notation (e.g., 0755, 01777). Must be a value between 0000 and 01777.
+             * If not specified, defaults to 0777.
+             * This might be in conflict with other options that affect the file
+             * mode, like fsGroup. If fsGroup is specified, the fsGroup permissions
+             * will override the mode specified here.
+             * This field has no effect on Windows.
+             * This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled.
+             */
+            mode: number;
             /**
              * sizeLimit is the total amount of local storage required for this EmptyDir volume.
              * The size limit is also applicable for memory medium.
@@ -139192,8 +139993,8 @@ export declare namespace gateway {
          * * An existing PVC (PersistentVolumeClaim)
          *   If the provisioner or an external controller can support the specified data source,
          *   it will create a new volume based on the contents of the specified data source.
-         *   When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
-         *   and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
+         *   dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be
+         *   copied to dataSource when dataSourceRef.namespace is not specified.
          *   If the namespace is specified, then dataSourceRef will not be copied to dataSource.
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDaemonSetPodVolumesEphemeralVolumeClaimTemplateSpecDataSource {
@@ -139234,7 +140035,6 @@ export declare namespace gateway {
          *   specified.
          * * While dataSource only allows local objects, dataSourceRef allows objects
          *   in any namespaces.
-         *   (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
          *   (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDaemonSetPodVolumesEphemeralVolumeClaimTemplateSpecDataSourceRef {
@@ -139708,6 +140508,12 @@ export declare namespace gateway {
              * mode, like fsGroup, and the result can be other mode bits set.
              */
             defaultMode: number;
+            /**
+             * defaultUser is Optional: The owner UID of the created files by default.
+             * The defaultUser field is only used as a fallback when the item-level user field is unset.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            defaultUser: number;
             /**
              * sources is the list of volume projections. Each entry in this list
              * handles one source.
@@ -139766,6 +140572,12 @@ export declare namespace gateway {
              * ClusterTrustBundles will be unified and deduplicated.
              */
             signerName: string;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user: number;
         }
         /**
          * Select all ClusterTrustBundles that match this label selector.  Only has
@@ -139860,6 +140672,12 @@ export declare namespace gateway {
              * May not start with the string '..'.
              */
             path: string;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user: number;
         }
         /**
          * downwardAPI information about the downwardAPI data to project
@@ -139889,6 +140707,12 @@ export declare namespace gateway {
              */
             path: string;
             resourceFieldRef: outputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDaemonSetPodVolumesProjectedSourcesDownwardAPIItemsResourceFieldRef;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user: number;
         }
         /**
          * Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.
@@ -140021,6 +140845,12 @@ export declare namespace gateway {
              * Kubelet's generated CSRs will be addressed to this signer.
              */
             signerName: string;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user: number;
             /**
              * userAnnotations allow pod authors to pass additional information to
              * the signer implementation.  Kubernetes does not restrict or validate this
@@ -140091,6 +140921,12 @@ export declare namespace gateway {
              * May not start with the string '..'.
              */
             path: string;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user: number;
         }
         /**
          * serviceAccountToken is information about the serviceAccountToken data to project
@@ -140117,6 +140953,12 @@ export declare namespace gateway {
              * token into.
              */
             path: string;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user: number;
         }
         /**
          * quobyte represents a Quobyte mount on the host that shares a pod's lifetime.
@@ -140296,6 +141138,12 @@ export declare namespace gateway {
              * mode, like fsGroup, and the result can be other mode bits set.
              */
             defaultMode: number;
+            /**
+             * defaultUser is Optional: The owner UID of the created files by default.
+             * The defaultUser field is only used as a fallback when the item-level user field is unset.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            defaultUser: number;
             /**
              * items If unspecified, each key-value pair in the Data field of the referenced
              * Secret will be projected into the volume as a file whose name is the
@@ -140340,6 +141188,12 @@ export declare namespace gateway {
              * May not start with the string '..'.
              */
             path: string;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user: number;
         }
         /**
          * storageOS represents a StorageOS volume attached and mounted on Kubernetes nodes.
@@ -140555,7 +141409,8 @@ export declare namespace gateway {
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDeploymentContainerEnvValueFromConfigMapKeyRef {
             /**
-             * The key to select.
+             * The key to select from the ConfigMap's Data field.
+             * Keys in the BinaryData field are not currently propagated to container env vars.
              */
             key: string;
             /**
@@ -140894,8 +141749,16 @@ export declare namespace gateway {
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDeploymentContainerVolumeMounts {
             /**
-             * Path within the container at which the volume should be mounted.  Must
-             * not contain ':'.
+             * bindMountOptions is the list of additional bind mount options to apply when
+             * mounting this volume into the container. Allowed values are noexec,
+             * nodev, and nosuid. These are Linux mount options and have no effect on
+             * Windows nodes.
+             * This field is not supported with image volumes.
+             * This is an alpha field and requires enabling the VolumeBindMountOptions feature gate.
+             */
+            bindMountOptions: string[];
+            /**
+             * Path within the container at which the volume should be mounted.
              */
             mountPath: string;
             /**
@@ -141204,7 +142067,8 @@ export declare namespace gateway {
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDeploymentInitContainersEnvValueFromConfigMapKeyRef {
             /**
-             * The key to select.
+             * The key to select from the ConfigMap's Data field.
+             * Keys in the BinaryData field are not currently propagated to container env vars.
              */
             key: string;
             /**
@@ -141366,6 +142230,11 @@ export declare namespace gateway {
              * Name must be an IANA_SVC_NAME.
              */
             port: number | string;
+            /**
+             * Protocol selects the wire protocol for the probe connection.
+             * Nil defaults to HTTP/1.1.
+             */
+            protocol: string;
             /**
              * Scheme to use for connecting to the host.
              * Defaults to HTTP.
@@ -141465,6 +142334,11 @@ export declare namespace gateway {
              * Name must be an IANA_SVC_NAME.
              */
             port: number | string;
+            /**
+             * Protocol selects the wire protocol for the probe connection.
+             * Nil defaults to HTTP/1.1.
+             */
+            protocol: string;
             /**
              * Scheme to use for connecting to the host.
              * Defaults to HTTP.
@@ -141579,6 +142453,13 @@ export declare namespace gateway {
          * GRPC specifies a GRPC HealthCheckRequest.
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDeploymentInitContainersLivenessProbeGrpc {
+            /**
+             * mode specifies the connection mode for the gRPC health probe.
+             * Set to "TLS" to use TLS without certificate verification.
+             * Set to "Plaintext" to use a plaintext (insecure) connection explicitly.
+             * If not specified, the probe uses a plaintext (insecure) connection.
+             */
+            mode: string;
             /**
              * Port number of the gRPC service. Number must be in the range 1 to 65535.
              */
@@ -141614,6 +142495,11 @@ export declare namespace gateway {
              * Name must be an IANA_SVC_NAME.
              */
             port: number | string;
+            /**
+             * Protocol selects the wire protocol for the probe connection.
+             * Nil defaults to HTTP/1.1.
+             */
+            protocol: string;
             /**
              * Scheme to use for connecting to the host.
              * Defaults to HTTP.
@@ -141749,6 +142635,13 @@ export declare namespace gateway {
          * GRPC specifies a GRPC HealthCheckRequest.
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDeploymentInitContainersReadinessProbeGrpc {
+            /**
+             * mode specifies the connection mode for the gRPC health probe.
+             * Set to "TLS" to use TLS without certificate verification.
+             * Set to "Plaintext" to use a plaintext (insecure) connection explicitly.
+             * If not specified, the probe uses a plaintext (insecure) connection.
+             */
+            mode: string;
             /**
              * Port number of the gRPC service. Number must be in the range 1 to 65535.
              */
@@ -141784,6 +142677,11 @@ export declare namespace gateway {
              * Name must be an IANA_SVC_NAME.
              */
             port: number | string;
+            /**
+             * Protocol selects the wire protocol for the probe connection.
+             * Nil defaults to HTTP/1.1.
+             */
+            protocol: string;
             /**
              * Scheme to use for connecting to the host.
              * Defaults to HTTP.
@@ -142171,6 +143069,13 @@ export declare namespace gateway {
          * GRPC specifies a GRPC HealthCheckRequest.
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDeploymentInitContainersStartupProbeGrpc {
+            /**
+             * mode specifies the connection mode for the gRPC health probe.
+             * Set to "TLS" to use TLS without certificate verification.
+             * Set to "Plaintext" to use a plaintext (insecure) connection explicitly.
+             * If not specified, the probe uses a plaintext (insecure) connection.
+             */
+            mode: string;
             /**
              * Port number of the gRPC service. Number must be in the range 1 to 65535.
              */
@@ -142206,6 +143111,11 @@ export declare namespace gateway {
              * Name must be an IANA_SVC_NAME.
              */
             port: number | string;
+            /**
+             * Protocol selects the wire protocol for the probe connection.
+             * Nil defaults to HTTP/1.1.
+             */
+            protocol: string;
             /**
              * Scheme to use for connecting to the host.
              * Defaults to HTTP.
@@ -142259,8 +143169,16 @@ export declare namespace gateway {
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDeploymentInitContainersVolumeMounts {
             /**
-             * Path within the container at which the volume should be mounted.  Must
-             * not contain ':'.
+             * bindMountOptions is the list of additional bind mount options to apply when
+             * mounting this volume into the container. Allowed values are noexec,
+             * nodev, and nosuid. These are Linux mount options and have no effect on
+             * Windows nodes.
+             * This field is not supported with image volumes.
+             * This is an alpha field and requires enabling the VolumeBindMountOptions feature gate.
+             */
+            bindMountOptions: string[];
+            /**
+             * Path within the container at which the volume should be mounted.
              */
             mountPath: string;
             /**
@@ -143235,11 +144153,8 @@ export declare namespace gateway {
              * Eligible volumes are in-tree FibreChannel and iSCSI volumes, and all CSI volumes
              * whose CSI driver announces SELinux support by setting spec.seLinuxMount: true in their
              * CSIDriver instance. Other volumes are always re-labelled recursively.
-             * "MountOption" value is allowed only when SELinuxMount feature gate is enabled.
              *
-             * If not specified and SELinuxMount feature gate is enabled, "MountOption" is used.
-             * If not specified and SELinuxMount feature gate is disabled, "MountOption" is used for ReadWriteOncePod volumes
-             * and "Recursive" for all other volumes.
+             * If not specified, "MountOption" is used.
              *
              * This field affects only Pods that have SELinux label set, either in PodSecurityContext or in SecurityContext of all containers.
              *
@@ -143811,6 +144726,12 @@ export declare namespace gateway {
              * mode, like fsGroup, and the result can be other mode bits set.
              */
             defaultMode: number;
+            /**
+             * defaultUser is Optional: The owner UID of the created files by default.
+             * The defaultUser field is only used as a fallback when the item-level user field is unset.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            defaultUser: number;
             /**
              * items if unspecified, each key-value pair in the Data field of the referenced
              * ConfigMap will be projected into the volume as a file whose name is the
@@ -143858,6 +144779,12 @@ export declare namespace gateway {
              * May not start with the string '..'.
              */
             path: string;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user: number;
         }
         /**
          * csi (Container Storage Interface) represents ephemeral storage that is handled by certain external CSI drivers.
@@ -143920,6 +144847,12 @@ export declare namespace gateway {
              * mode, like fsGroup, and the result can be other mode bits set.
              */
             defaultMode: number;
+            /**
+             * defaultUser is Optional: The owner UID of the created files by default.
+             * The defaultUser field is only used as a fallback when the item-level user field is unset.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            defaultUser: number;
             /**
              * Items is a list of downward API volume file
              */
@@ -143944,6 +144877,12 @@ export declare namespace gateway {
              */
             path: string;
             resourceFieldRef: outputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDeploymentPodVolumesDownwardAPIItemsResourceFieldRef;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user: number;
         }
         /**
          * Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.
@@ -143988,6 +144927,17 @@ export declare namespace gateway {
              * More info: https://kubernetes.io/docs/concepts/storage/volumes#emptydir
              */
             medium: string;
+            /**
+             * mode specifies the permission bits for the emptyDir directory, in numeric
+             * notation (e.g., 0755, 01777). Must be a value between 0000 and 01777.
+             * If not specified, defaults to 0777.
+             * This might be in conflict with other options that affect the file
+             * mode, like fsGroup. If fsGroup is specified, the fsGroup permissions
+             * will override the mode specified here.
+             * This field has no effect on Windows.
+             * This field is alpha and requires EmptyDirVolumeMode featuregate to be enabled.
+             */
+            mode: number;
             /**
              * sizeLimit is the total amount of local storage required for this EmptyDir volume.
              * The size limit is also applicable for memory medium.
@@ -144111,8 +145061,8 @@ export declare namespace gateway {
          * * An existing PVC (PersistentVolumeClaim)
          *   If the provisioner or an external controller can support the specified data source,
          *   it will create a new volume based on the contents of the specified data source.
-         *   When the AnyVolumeDataSource feature gate is enabled, dataSource contents will be copied to dataSourceRef,
-         *   and dataSourceRef contents will be copied to dataSource when dataSourceRef.namespace is not specified.
+         *   dataSource contents will be copied to dataSourceRef, and dataSourceRef contents will be
+         *   copied to dataSource when dataSourceRef.namespace is not specified.
          *   If the namespace is specified, then dataSourceRef will not be copied to dataSource.
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDeploymentPodVolumesEphemeralVolumeClaimTemplateSpecDataSource {
@@ -144153,7 +145103,6 @@ export declare namespace gateway {
          *   specified.
          * * While dataSource only allows local objects, dataSourceRef allows objects
          *   in any namespaces.
-         *   (Beta) Using this field requires the AnyVolumeDataSource feature gate to be enabled.
          *   (Alpha) Using the namespace field of dataSourceRef requires the CrossNamespaceVolumeDataSource feature gate to be enabled.
          */
         interface EnvoyProxySpecProviderKubernetesEnvoyDeploymentPodVolumesEphemeralVolumeClaimTemplateSpecDataSourceRef {
@@ -144627,6 +145576,12 @@ export declare namespace gateway {
              * mode, like fsGroup, and the result can be other mode bits set.
              */
             defaultMode: number;
+            /**
+             * defaultUser is Optional: The owner UID of the created files by default.
+             * The defaultUser field is only used as a fallback when the item-level user field is unset.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            defaultUser: number;
             /**
              * sources is the list of volume projections. Each entry in this list
              * handles one source.
@@ -144685,6 +145640,12 @@ export declare namespace gateway {
              * ClusterTrustBundles will be unified and deduplicated.
              */
             signerName: string;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user: number;
         }
         /**
          * Select all ClusterTrustBundles that match this label selector.  Only has
@@ -144779,6 +145740,12 @@ export declare namespace gateway {
              * May not start with the string '..'.
              */
             path: string;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user: number;
         }
         /**
          * downwardAPI information about the downwardAPI data to project
@@ -144808,6 +145775,12 @@ export declare namespace gateway {
              */
             path: string;
             resourceFieldRef: outputs.gateway.v1alpha1.EnvoyProxySpecProviderKubernetesEnvoyDeploymentPodVolumesProjectedSourcesDownwardAPIItemsResourceFieldRef;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user: number;
         }
         /**
          * Required: Selects a field of the pod: only annotations, labels, name, namespace and uid are supported.
@@ -144940,6 +145913,12 @@ export declare namespace gateway {
              * Kubelet's generated CSRs will be addressed to this signer.
              */
             signerName: string;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user: number;
             /**
              * userAnnotations allow pod authors to pass additional information to
              * the signer implementation.  Kubernetes does not restrict or validate this
@@ -145010,6 +145989,12 @@ export declare namespace gateway {
              * May not start with the string '..'.
              */
             path: string;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user: number;
         }
         /**
          * serviceAccountToken is information about the serviceAccountToken data to project
@@ -145036,6 +146021,12 @@ export declare namespace gateway {
              * token into.
              */
             path: string;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user: number;
         }
         /**
          * quobyte represents a Quobyte mount on the host that shares a pod's lifetime.
@@ -145215,6 +146206,12 @@ export declare namespace gateway {
              * mode, like fsGroup, and the result can be other mode bits set.
              */
             defaultMode: number;
+            /**
+             * defaultUser is Optional: The owner UID of the created files by default.
+             * The defaultUser field is only used as a fallback when the item-level user field is unset.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            defaultUser: number;
             /**
              * items If unspecified, each key-value pair in the Data field of the referenced
              * Secret will be projected into the volume as a file whose name is the
@@ -145259,6 +146256,12 @@ export declare namespace gateway {
              * May not start with the string '..'.
              */
             path: string;
+            /**
+             * user is Optional: The owner UID of the created file.
+             * If specified, the item-level user field takes precedence over defaultUser.
+             * (Alpha) This field requires the AtomicWriteVolumeUserFields feature gate to be enabled.
+             */
+            user: number;
         }
         /**
          * storageOS represents a StorageOS volume attached and mounted on Kubernetes nodes.
@@ -145453,9 +146456,6 @@ export declare namespace gateway {
              * For example, if autoscaling is configured with a memory consumption target of 100Mi,
              * and scale-down and scale-up tolerances of 5% and 1% respectively, scaling will be
              * triggered when the actual consumption falls below 95Mi or exceeds 101Mi.
-             *
-             * This is an beta field and requires the HPAConfigurableTolerance feature
-             * gate to be enabled.
              */
             tolerance: number | string;
         }
@@ -145516,9 +146516,6 @@ export declare namespace gateway {
              * For example, if autoscaling is configured with a memory consumption target of 100Mi,
              * and scale-down and scale-up tolerances of 5% and 1% respectively, scaling will be
              * triggered when the actual consumption falls below 95Mi or exceeds 101Mi.
-             *
-             * This is an beta field and requires the HPAConfigurableTolerance feature
-             * gate to be enabled.
              */
             tolerance: number | string;
         }