From 79e299f8d5755d5be5e3e0dbce51ffdd17d01beb Mon Sep 17 00:00:00 2001
From: "renovate[bot]" <renovate[bot]@users.noreply.github.com>
Date: Wed, 17 Jan 2024 18:41:41 +0000
Subject: [PATCH] Generate libsonnet source from libgenerator PR
 https://github.com/tf-libsonnet/libgenerator/pull/237

Signed-off-by: tflibsonnet-ci <120686569+tflibsonnet-ci@users.noreply.github.com>
---
 .../azure_secret_backend_role.libsonnet       | 32 +++++++++++++++-
 ...tabase_secret_backend_connection.libsonnet | 30 +++++++++++++--
 .../database_secrets_mount.libsonnet          | 30 +++++++++++++--
 3.x/_gen/resources/gcp_auth_backend.libsonnet | 22 +++++++++--
 .../kubernetes_auth_backend_config.libsonnet  |  4 +-
 .../pki_secret_backend_role.libsonnet         | 18 ++++++++-
 docs/3.x/azure_secret_backend_role.md         | 38 +++++++++++++++++++
 .../3.x/database_secret_backend_connection.md | 12 ++++++
 docs/3.x/database_secrets_mount.md            | 12 ++++++
 docs/3.x/gcp_auth_backend.md                  | 19 ++++++++++
 docs/3.x/kubernetes_auth_backend_config.md    |  4 +-
 docs/3.x/pki_secret_backend_role.md           | 19 ++++++++++
 12 files changed, 222 insertions(+), 18 deletions(-)

diff --git a/3.x/_gen/resources/azure_secret_backend_role.libsonnet b/3.x/_gen/resources/azure_secret_backend_role.libsonnet
index 4c891b4..5a14fab 100644
--- a/3.x/_gen/resources/azure_secret_backend_role.libsonnet
+++ b/3.x/_gen/resources/azure_secret_backend_role.libsonnet
@@ -22,7 +22,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       scope: scope,
     }),
   },
-  '#new':: d.fn(help="\n`vault.azure_secret_backend_role.new` injects a new `vault_azure_secret_backend_role` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.azure_secret_backend_role.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.azure_secret_backend_role` using the reference:\n\n    $._ref.vault_azure_secret_backend_role.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_azure_secret_backend_role.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `application_object_id` (`string`): Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. When `null`, the `application_object_id` field will be omitted from the resulting object.\n  - `backend` (`string`): Unique name of the auth backend to configure. When `null`, the `backend` field will be omitted from the resulting object.\n  - `description` (`string`): Human-friendly description of the mount for the backend. When `null`, the `description` field will be omitted from the resulting object.\n  - `max_ttl` (`string`): Human-friendly description of the mount for the backend. When `null`, the `max_ttl` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `permanently_delete` (`bool`): Indicates whether the applications and service principals created by Vault will be permanently deleted when the corresponding leases expire. When `null`, the `permanently_delete` field will be omitted from the resulting object.\n  - `role` (`string`): Name of the role to create\n  - `ttl` (`string`): Human-friendly description of the mount for the backend. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `azure_groups` (`list[obj]`): Set the `azure_groups` field on the resulting resource block. When `null`, the `azure_groups` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.azure_secret_backend_role.azure_groups.new](#fn-azure_groupsnew) constructor.\n  - `azure_roles` (`list[obj]`): Set the `azure_roles` field on the resulting resource block. When `null`, the `azure_roles` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.azure_secret_backend_role.azure_roles.new](#fn-azure_rolesnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`vault.azure_secret_backend_role.new` injects a new `vault_azure_secret_backend_role` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.azure_secret_backend_role.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.azure_secret_backend_role` using the reference:\n\n    $._ref.vault_azure_secret_backend_role.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_azure_secret_backend_role.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `application_object_id` (`string`): Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. When `null`, the `application_object_id` field will be omitted from the resulting object.\n  - `backend` (`string`): Unique name of the auth backend to configure. When `null`, the `backend` field will be omitted from the resulting object.\n  - `description` (`string`): Human-friendly description of the mount for the backend. When `null`, the `description` field will be omitted from the resulting object.\n  - `max_ttl` (`string`): Human-friendly description of the mount for the backend. When `null`, the `max_ttl` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `permanently_delete` (`bool`): Indicates whether the applications and service principals created by Vault will be permanently deleted when the corresponding leases expire. When `null`, the `permanently_delete` field will be omitted from the resulting object.\n  - `role` (`string`): Name of the role to create\n  - `sign_in_audience` (`string`): Specifies the security principal types that are allowed to sign in to the application. Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount When `null`, the `sign_in_audience` field will be omitted from the resulting object.\n  - `tags` (`list`): Comma-separated strings of Azure tags to attach to an application. When `null`, the `tags` field will be omitted from the resulting object.\n  - `ttl` (`string`): Human-friendly description of the mount for the backend. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `azure_groups` (`list[obj]`): Set the `azure_groups` field on the resulting resource block. When `null`, the `azure_groups` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.azure_secret_backend_role.azure_groups.new](#fn-azure_groupsnew) constructor.\n  - `azure_roles` (`list[obj]`): Set the `azure_roles` field on the resulting resource block. When `null`, the `azure_roles` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.azure_secret_backend_role.azure_roles.new](#fn-azure_rolesnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     role,
@@ -34,6 +34,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     max_ttl=null,
     namespace=null,
     permanently_delete=null,
+    sign_in_audience=null,
+    tags=null,
     ttl=null,
     _meta={}
   ):: tf.withResource(
@@ -49,11 +51,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       namespace=namespace,
       permanently_delete=permanently_delete,
       role=role,
+      sign_in_audience=sign_in_audience,
+      tags=tags,
       ttl=ttl
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`vault.azure_secret_backend_role.newAttrs` constructs a new object with attributes and blocks configured for the `azure_secret_backend_role`\nTerraform resource.\n\nUnlike [vault.azure_secret_backend_role.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `application_object_id` (`string`): Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. When `null`, the `application_object_id` field will be omitted from the resulting object.\n  - `backend` (`string`): Unique name of the auth backend to configure. When `null`, the `backend` field will be omitted from the resulting object.\n  - `description` (`string`): Human-friendly description of the mount for the backend. When `null`, the `description` field will be omitted from the resulting object.\n  - `max_ttl` (`string`): Human-friendly description of the mount for the backend. When `null`, the `max_ttl` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `permanently_delete` (`bool`): Indicates whether the applications and service principals created by Vault will be permanently deleted when the corresponding leases expire. When `null`, the `permanently_delete` field will be omitted from the resulting object.\n  - `role` (`string`): Name of the role to create\n  - `ttl` (`string`): Human-friendly description of the mount for the backend. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `azure_groups` (`list[obj]`): Set the `azure_groups` field on the resulting object. When `null`, the `azure_groups` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.azure_secret_backend_role.azure_groups.new](#fn-azure_groupsnew) constructor.\n  - `azure_roles` (`list[obj]`): Set the `azure_roles` field on the resulting object. When `null`, the `azure_roles` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.azure_secret_backend_role.azure_roles.new](#fn-azure_rolesnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `azure_secret_backend_role` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`vault.azure_secret_backend_role.newAttrs` constructs a new object with attributes and blocks configured for the `azure_secret_backend_role`\nTerraform resource.\n\nUnlike [vault.azure_secret_backend_role.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `application_object_id` (`string`): Application Object ID for an existing service principal that will be used instead of creating dynamic service principals. When `null`, the `application_object_id` field will be omitted from the resulting object.\n  - `backend` (`string`): Unique name of the auth backend to configure. When `null`, the `backend` field will be omitted from the resulting object.\n  - `description` (`string`): Human-friendly description of the mount for the backend. When `null`, the `description` field will be omitted from the resulting object.\n  - `max_ttl` (`string`): Human-friendly description of the mount for the backend. When `null`, the `max_ttl` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `permanently_delete` (`bool`): Indicates whether the applications and service principals created by Vault will be permanently deleted when the corresponding leases expire. When `null`, the `permanently_delete` field will be omitted from the resulting object.\n  - `role` (`string`): Name of the role to create\n  - `sign_in_audience` (`string`): Specifies the security principal types that are allowed to sign in to the application. Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount When `null`, the `sign_in_audience` field will be omitted from the resulting object.\n  - `tags` (`list`): Comma-separated strings of Azure tags to attach to an application. When `null`, the `tags` field will be omitted from the resulting object.\n  - `ttl` (`string`): Human-friendly description of the mount for the backend. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `azure_groups` (`list[obj]`): Set the `azure_groups` field on the resulting object. When `null`, the `azure_groups` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.azure_secret_backend_role.azure_groups.new](#fn-azure_groupsnew) constructor.\n  - `azure_roles` (`list[obj]`): Set the `azure_roles` field on the resulting object. When `null`, the `azure_roles` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.azure_secret_backend_role.azure_roles.new](#fn-azure_rolesnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `azure_secret_backend_role` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     role,
     application_object_id=null,
@@ -64,6 +68,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     max_ttl=null,
     namespace=null,
     permanently_delete=null,
+    sign_in_audience=null,
+    tags=null,
     ttl=null
   ):: std.prune(a={
     application_object_id: application_object_id,
@@ -75,6 +81,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     namespace: namespace,
     permanently_delete: permanently_delete,
     role: role,
+    sign_in_audience: sign_in_audience,
+    tags: tags,
     ttl: ttl,
   }),
   '#withApplicationObjectId':: d.fn(help='`vault.string.withApplicationObjectId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the application_object_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `application_object_id` field.\n', args=[]),
@@ -187,6 +195,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withSignInAudience':: d.fn(help='`vault.string.withSignInAudience` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the sign_in_audience field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `sign_in_audience` field.\n', args=[]),
+  withSignInAudience(resourceLabel, value): {
+    resource+: {
+      vault_azure_secret_backend_role+: {
+        [resourceLabel]+: {
+          sign_in_audience: value,
+        },
+      },
+    },
+  },
+  '#withTags':: d.fn(help='`vault.list.withTags` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the tags field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `tags` field.\n', args=[]),
+  withTags(resourceLabel, value): {
+    resource+: {
+      vault_azure_secret_backend_role+: {
+        [resourceLabel]+: {
+          tags: value,
+        },
+      },
+    },
+  },
   '#withTtl':: d.fn(help='`vault.string.withTtl` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the ttl field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `ttl` field.\n', args=[]),
   withTtl(resourceLabel, value): {
     resource+: {
diff --git a/3.x/_gen/resources/database_secret_backend_connection.libsonnet b/3.x/_gen/resources/database_secret_backend_connection.libsonnet
index c085180..7b99c00 100644
--- a/3.x/_gen/resources/database_secret_backend_connection.libsonnet
+++ b/3.x/_gen/resources/database_secret_backend_connection.libsonnet
@@ -207,61 +207,85 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     }),
   },
   mysql_aurora:: {
-    '#new':: d.fn(help='\n`vault.database_secret_backend_connection.mysql_aurora.new` constructs a new object with attributes and blocks configured for the `mysql_aurora`\nTerraform sub block.\n\n\n\n**Args**:\n  - `connection_url` (`string`): Connection string to use to connect to the database. When `null`, the `connection_url` field will be omitted from the resulting object.\n  - `max_connection_lifetime` (`number`): Maximum number of seconds a connection may be reused. When `null`, the `max_connection_lifetime` field will be omitted from the resulting object.\n  - `max_idle_connections` (`number`): Maximum number of idle connections to the database. When `null`, the `max_idle_connections` field will be omitted from the resulting object.\n  - `max_open_connections` (`number`): Maximum number of open connections to the database. When `null`, the `max_open_connections` field will be omitted from the resulting object.\n  - `password` (`string`): The root credential password used in the connection URL When `null`, the `password` field will be omitted from the resulting object.\n  - `username` (`string`): The root credential username used in the connection URL When `null`, the `username` field will be omitted from the resulting object.\n  - `username_template` (`string`): Username generation template. When `null`, the `username_template` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `mysql_aurora` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`vault.database_secret_backend_connection.mysql_aurora.new` constructs a new object with attributes and blocks configured for the `mysql_aurora`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auth_type` (`string`): Specify alternative authorization type. (Only &#39;gcp_iam&#39; is valid currently) When `null`, the `auth_type` field will be omitted from the resulting object.\n  - `connection_url` (`string`): Connection string to use to connect to the database. When `null`, the `connection_url` field will be omitted from the resulting object.\n  - `max_connection_lifetime` (`number`): Maximum number of seconds a connection may be reused. When `null`, the `max_connection_lifetime` field will be omitted from the resulting object.\n  - `max_idle_connections` (`number`): Maximum number of idle connections to the database. When `null`, the `max_idle_connections` field will be omitted from the resulting object.\n  - `max_open_connections` (`number`): Maximum number of open connections to the database. When `null`, the `max_open_connections` field will be omitted from the resulting object.\n  - `password` (`string`): The root credential password used in the connection URL When `null`, the `password` field will be omitted from the resulting object.\n  - `service_account_json` (`string`): A JSON encoded credential for use with IAM authorization When `null`, the `service_account_json` field will be omitted from the resulting object.\n  - `tls_ca` (`string`): x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded. When `null`, the `tls_ca` field will be omitted from the resulting object.\n  - `tls_certificate_key` (`string`): x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined. When `null`, the `tls_certificate_key` field will be omitted from the resulting object.\n  - `username` (`string`): The root credential username used in the connection URL When `null`, the `username` field will be omitted from the resulting object.\n  - `username_template` (`string`): Username generation template. When `null`, the `username_template` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `mysql_aurora` sub block.\n', args=[]),
     new(
+      auth_type=null,
       connection_url=null,
       max_connection_lifetime=null,
       max_idle_connections=null,
       max_open_connections=null,
       password=null,
+      service_account_json=null,
+      tls_ca=null,
+      tls_certificate_key=null,
       username=null,
       username_template=null
     ):: std.prune(a={
+      auth_type: auth_type,
       connection_url: connection_url,
       max_connection_lifetime: max_connection_lifetime,
       max_idle_connections: max_idle_connections,
       max_open_connections: max_open_connections,
       password: password,
+      service_account_json: service_account_json,
+      tls_ca: tls_ca,
+      tls_certificate_key: tls_certificate_key,
       username: username,
       username_template: username_template,
     }),
   },
   mysql_legacy:: {
-    '#new':: d.fn(help='\n`vault.database_secret_backend_connection.mysql_legacy.new` constructs a new object with attributes and blocks configured for the `mysql_legacy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `connection_url` (`string`): Connection string to use to connect to the database. When `null`, the `connection_url` field will be omitted from the resulting object.\n  - `max_connection_lifetime` (`number`): Maximum number of seconds a connection may be reused. When `null`, the `max_connection_lifetime` field will be omitted from the resulting object.\n  - `max_idle_connections` (`number`): Maximum number of idle connections to the database. When `null`, the `max_idle_connections` field will be omitted from the resulting object.\n  - `max_open_connections` (`number`): Maximum number of open connections to the database. When `null`, the `max_open_connections` field will be omitted from the resulting object.\n  - `password` (`string`): The root credential password used in the connection URL When `null`, the `password` field will be omitted from the resulting object.\n  - `username` (`string`): The root credential username used in the connection URL When `null`, the `username` field will be omitted from the resulting object.\n  - `username_template` (`string`): Username generation template. When `null`, the `username_template` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `mysql_legacy` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`vault.database_secret_backend_connection.mysql_legacy.new` constructs a new object with attributes and blocks configured for the `mysql_legacy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auth_type` (`string`): Specify alternative authorization type. (Only &#39;gcp_iam&#39; is valid currently) When `null`, the `auth_type` field will be omitted from the resulting object.\n  - `connection_url` (`string`): Connection string to use to connect to the database. When `null`, the `connection_url` field will be omitted from the resulting object.\n  - `max_connection_lifetime` (`number`): Maximum number of seconds a connection may be reused. When `null`, the `max_connection_lifetime` field will be omitted from the resulting object.\n  - `max_idle_connections` (`number`): Maximum number of idle connections to the database. When `null`, the `max_idle_connections` field will be omitted from the resulting object.\n  - `max_open_connections` (`number`): Maximum number of open connections to the database. When `null`, the `max_open_connections` field will be omitted from the resulting object.\n  - `password` (`string`): The root credential password used in the connection URL When `null`, the `password` field will be omitted from the resulting object.\n  - `service_account_json` (`string`): A JSON encoded credential for use with IAM authorization When `null`, the `service_account_json` field will be omitted from the resulting object.\n  - `tls_ca` (`string`): x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded. When `null`, the `tls_ca` field will be omitted from the resulting object.\n  - `tls_certificate_key` (`string`): x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined. When `null`, the `tls_certificate_key` field will be omitted from the resulting object.\n  - `username` (`string`): The root credential username used in the connection URL When `null`, the `username` field will be omitted from the resulting object.\n  - `username_template` (`string`): Username generation template. When `null`, the `username_template` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `mysql_legacy` sub block.\n', args=[]),
     new(
+      auth_type=null,
       connection_url=null,
       max_connection_lifetime=null,
       max_idle_connections=null,
       max_open_connections=null,
       password=null,
+      service_account_json=null,
+      tls_ca=null,
+      tls_certificate_key=null,
       username=null,
       username_template=null
     ):: std.prune(a={
+      auth_type: auth_type,
       connection_url: connection_url,
       max_connection_lifetime: max_connection_lifetime,
       max_idle_connections: max_idle_connections,
       max_open_connections: max_open_connections,
       password: password,
+      service_account_json: service_account_json,
+      tls_ca: tls_ca,
+      tls_certificate_key: tls_certificate_key,
       username: username,
       username_template: username_template,
     }),
   },
   mysql_rds:: {
-    '#new':: d.fn(help='\n`vault.database_secret_backend_connection.mysql_rds.new` constructs a new object with attributes and blocks configured for the `mysql_rds`\nTerraform sub block.\n\n\n\n**Args**:\n  - `connection_url` (`string`): Connection string to use to connect to the database. When `null`, the `connection_url` field will be omitted from the resulting object.\n  - `max_connection_lifetime` (`number`): Maximum number of seconds a connection may be reused. When `null`, the `max_connection_lifetime` field will be omitted from the resulting object.\n  - `max_idle_connections` (`number`): Maximum number of idle connections to the database. When `null`, the `max_idle_connections` field will be omitted from the resulting object.\n  - `max_open_connections` (`number`): Maximum number of open connections to the database. When `null`, the `max_open_connections` field will be omitted from the resulting object.\n  - `password` (`string`): The root credential password used in the connection URL When `null`, the `password` field will be omitted from the resulting object.\n  - `username` (`string`): The root credential username used in the connection URL When `null`, the `username` field will be omitted from the resulting object.\n  - `username_template` (`string`): Username generation template. When `null`, the `username_template` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `mysql_rds` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`vault.database_secret_backend_connection.mysql_rds.new` constructs a new object with attributes and blocks configured for the `mysql_rds`\nTerraform sub block.\n\n\n\n**Args**:\n  - `auth_type` (`string`): Specify alternative authorization type. (Only &#39;gcp_iam&#39; is valid currently) When `null`, the `auth_type` field will be omitted from the resulting object.\n  - `connection_url` (`string`): Connection string to use to connect to the database. When `null`, the `connection_url` field will be omitted from the resulting object.\n  - `max_connection_lifetime` (`number`): Maximum number of seconds a connection may be reused. When `null`, the `max_connection_lifetime` field will be omitted from the resulting object.\n  - `max_idle_connections` (`number`): Maximum number of idle connections to the database. When `null`, the `max_idle_connections` field will be omitted from the resulting object.\n  - `max_open_connections` (`number`): Maximum number of open connections to the database. When `null`, the `max_open_connections` field will be omitted from the resulting object.\n  - `password` (`string`): The root credential password used in the connection URL When `null`, the `password` field will be omitted from the resulting object.\n  - `service_account_json` (`string`): A JSON encoded credential for use with IAM authorization When `null`, the `service_account_json` field will be omitted from the resulting object.\n  - `tls_ca` (`string`): x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded. When `null`, the `tls_ca` field will be omitted from the resulting object.\n  - `tls_certificate_key` (`string`): x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined. When `null`, the `tls_certificate_key` field will be omitted from the resulting object.\n  - `username` (`string`): The root credential username used in the connection URL When `null`, the `username` field will be omitted from the resulting object.\n  - `username_template` (`string`): Username generation template. When `null`, the `username_template` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `mysql_rds` sub block.\n', args=[]),
     new(
+      auth_type=null,
       connection_url=null,
       max_connection_lifetime=null,
       max_idle_connections=null,
       max_open_connections=null,
       password=null,
+      service_account_json=null,
+      tls_ca=null,
+      tls_certificate_key=null,
       username=null,
       username_template=null
     ):: std.prune(a={
+      auth_type: auth_type,
       connection_url: connection_url,
       max_connection_lifetime: max_connection_lifetime,
       max_idle_connections: max_idle_connections,
       max_open_connections: max_open_connections,
       password: password,
+      service_account_json: service_account_json,
+      tls_ca: tls_ca,
+      tls_certificate_key: tls_certificate_key,
       username: username,
       username_template: username_template,
     }),
diff --git a/3.x/_gen/resources/database_secrets_mount.libsonnet b/3.x/_gen/resources/database_secrets_mount.libsonnet
index 9cf4ed0..bdc1911 100644
--- a/3.x/_gen/resources/database_secrets_mount.libsonnet
+++ b/3.x/_gen/resources/database_secrets_mount.libsonnet
@@ -315,10 +315,11 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     }),
   },
   mysql_aurora:: {
-    '#new':: d.fn(help='\n`vault.database_secrets_mount.mysql_aurora.new` constructs a new object with attributes and blocks configured for the `mysql_aurora`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allowed_roles` (`list`): A list of roles that are allowed to use this connection. When `null`, the `allowed_roles` field will be omitted from the resulting object.\n  - `connection_url` (`string`): Connection string to use to connect to the database. When `null`, the `connection_url` field will be omitted from the resulting object.\n  - `data` (`obj`): A map of sensitive data to pass to the endpoint. Useful for templated connection strings. When `null`, the `data` field will be omitted from the resulting object.\n  - `max_connection_lifetime` (`number`): Maximum number of seconds a connection may be reused. When `null`, the `max_connection_lifetime` field will be omitted from the resulting object.\n  - `max_idle_connections` (`number`): Maximum number of idle connections to the database. When `null`, the `max_idle_connections` field will be omitted from the resulting object.\n  - `max_open_connections` (`number`): Maximum number of open connections to the database. When `null`, the `max_open_connections` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the database connection.\n  - `password` (`string`): The root credential password used in the connection URL When `null`, the `password` field will be omitted from the resulting object.\n  - `plugin_name` (`string`): Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types. When `null`, the `plugin_name` field will be omitted from the resulting object.\n  - `root_rotation_statements` (`list`): A list of database statements to be executed to rotate the root user&#39;s credentials. When `null`, the `root_rotation_statements` field will be omitted from the resulting object.\n  - `username` (`string`): The root credential username used in the connection URL When `null`, the `username` field will be omitted from the resulting object.\n  - `username_template` (`string`): Username generation template. When `null`, the `username_template` field will be omitted from the resulting object.\n  - `verify_connection` (`bool`): Specifies if the connection is verified during initial configuration. When `null`, the `verify_connection` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `mysql_aurora` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`vault.database_secrets_mount.mysql_aurora.new` constructs a new object with attributes and blocks configured for the `mysql_aurora`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allowed_roles` (`list`): A list of roles that are allowed to use this connection. When `null`, the `allowed_roles` field will be omitted from the resulting object.\n  - `auth_type` (`string`): Specify alternative authorization type. (Only &#39;gcp_iam&#39; is valid currently) When `null`, the `auth_type` field will be omitted from the resulting object.\n  - `connection_url` (`string`): Connection string to use to connect to the database. When `null`, the `connection_url` field will be omitted from the resulting object.\n  - `data` (`obj`): A map of sensitive data to pass to the endpoint. Useful for templated connection strings. When `null`, the `data` field will be omitted from the resulting object.\n  - `max_connection_lifetime` (`number`): Maximum number of seconds a connection may be reused. When `null`, the `max_connection_lifetime` field will be omitted from the resulting object.\n  - `max_idle_connections` (`number`): Maximum number of idle connections to the database. When `null`, the `max_idle_connections` field will be omitted from the resulting object.\n  - `max_open_connections` (`number`): Maximum number of open connections to the database. When `null`, the `max_open_connections` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the database connection.\n  - `password` (`string`): The root credential password used in the connection URL When `null`, the `password` field will be omitted from the resulting object.\n  - `plugin_name` (`string`): Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types. When `null`, the `plugin_name` field will be omitted from the resulting object.\n  - `root_rotation_statements` (`list`): A list of database statements to be executed to rotate the root user&#39;s credentials. When `null`, the `root_rotation_statements` field will be omitted from the resulting object.\n  - `service_account_json` (`string`): A JSON encoded credential for use with IAM authorization When `null`, the `service_account_json` field will be omitted from the resulting object.\n  - `tls_ca` (`string`): x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded. When `null`, the `tls_ca` field will be omitted from the resulting object.\n  - `tls_certificate_key` (`string`): x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined. When `null`, the `tls_certificate_key` field will be omitted from the resulting object.\n  - `username` (`string`): The root credential username used in the connection URL When `null`, the `username` field will be omitted from the resulting object.\n  - `username_template` (`string`): Username generation template. When `null`, the `username_template` field will be omitted from the resulting object.\n  - `verify_connection` (`bool`): Specifies if the connection is verified during initial configuration. When `null`, the `verify_connection` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `mysql_aurora` sub block.\n', args=[]),
     new(
       name,
       allowed_roles=null,
+      auth_type=null,
       connection_url=null,
       data=null,
       max_connection_lifetime=null,
@@ -327,11 +328,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       password=null,
       plugin_name=null,
       root_rotation_statements=null,
+      service_account_json=null,
+      tls_ca=null,
+      tls_certificate_key=null,
       username=null,
       username_template=null,
       verify_connection=null
     ):: std.prune(a={
       allowed_roles: allowed_roles,
+      auth_type: auth_type,
       connection_url: connection_url,
       data: data,
       max_connection_lifetime: max_connection_lifetime,
@@ -341,16 +346,20 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       password: password,
       plugin_name: plugin_name,
       root_rotation_statements: root_rotation_statements,
+      service_account_json: service_account_json,
+      tls_ca: tls_ca,
+      tls_certificate_key: tls_certificate_key,
       username: username,
       username_template: username_template,
       verify_connection: verify_connection,
     }),
   },
   mysql_legacy:: {
-    '#new':: d.fn(help='\n`vault.database_secrets_mount.mysql_legacy.new` constructs a new object with attributes and blocks configured for the `mysql_legacy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allowed_roles` (`list`): A list of roles that are allowed to use this connection. When `null`, the `allowed_roles` field will be omitted from the resulting object.\n  - `connection_url` (`string`): Connection string to use to connect to the database. When `null`, the `connection_url` field will be omitted from the resulting object.\n  - `data` (`obj`): A map of sensitive data to pass to the endpoint. Useful for templated connection strings. When `null`, the `data` field will be omitted from the resulting object.\n  - `max_connection_lifetime` (`number`): Maximum number of seconds a connection may be reused. When `null`, the `max_connection_lifetime` field will be omitted from the resulting object.\n  - `max_idle_connections` (`number`): Maximum number of idle connections to the database. When `null`, the `max_idle_connections` field will be omitted from the resulting object.\n  - `max_open_connections` (`number`): Maximum number of open connections to the database. When `null`, the `max_open_connections` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the database connection.\n  - `password` (`string`): The root credential password used in the connection URL When `null`, the `password` field will be omitted from the resulting object.\n  - `plugin_name` (`string`): Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types. When `null`, the `plugin_name` field will be omitted from the resulting object.\n  - `root_rotation_statements` (`list`): A list of database statements to be executed to rotate the root user&#39;s credentials. When `null`, the `root_rotation_statements` field will be omitted from the resulting object.\n  - `username` (`string`): The root credential username used in the connection URL When `null`, the `username` field will be omitted from the resulting object.\n  - `username_template` (`string`): Username generation template. When `null`, the `username_template` field will be omitted from the resulting object.\n  - `verify_connection` (`bool`): Specifies if the connection is verified during initial configuration. When `null`, the `verify_connection` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `mysql_legacy` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`vault.database_secrets_mount.mysql_legacy.new` constructs a new object with attributes and blocks configured for the `mysql_legacy`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allowed_roles` (`list`): A list of roles that are allowed to use this connection. When `null`, the `allowed_roles` field will be omitted from the resulting object.\n  - `auth_type` (`string`): Specify alternative authorization type. (Only &#39;gcp_iam&#39; is valid currently) When `null`, the `auth_type` field will be omitted from the resulting object.\n  - `connection_url` (`string`): Connection string to use to connect to the database. When `null`, the `connection_url` field will be omitted from the resulting object.\n  - `data` (`obj`): A map of sensitive data to pass to the endpoint. Useful for templated connection strings. When `null`, the `data` field will be omitted from the resulting object.\n  - `max_connection_lifetime` (`number`): Maximum number of seconds a connection may be reused. When `null`, the `max_connection_lifetime` field will be omitted from the resulting object.\n  - `max_idle_connections` (`number`): Maximum number of idle connections to the database. When `null`, the `max_idle_connections` field will be omitted from the resulting object.\n  - `max_open_connections` (`number`): Maximum number of open connections to the database. When `null`, the `max_open_connections` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the database connection.\n  - `password` (`string`): The root credential password used in the connection URL When `null`, the `password` field will be omitted from the resulting object.\n  - `plugin_name` (`string`): Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types. When `null`, the `plugin_name` field will be omitted from the resulting object.\n  - `root_rotation_statements` (`list`): A list of database statements to be executed to rotate the root user&#39;s credentials. When `null`, the `root_rotation_statements` field will be omitted from the resulting object.\n  - `service_account_json` (`string`): A JSON encoded credential for use with IAM authorization When `null`, the `service_account_json` field will be omitted from the resulting object.\n  - `tls_ca` (`string`): x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded. When `null`, the `tls_ca` field will be omitted from the resulting object.\n  - `tls_certificate_key` (`string`): x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined. When `null`, the `tls_certificate_key` field will be omitted from the resulting object.\n  - `username` (`string`): The root credential username used in the connection URL When `null`, the `username` field will be omitted from the resulting object.\n  - `username_template` (`string`): Username generation template. When `null`, the `username_template` field will be omitted from the resulting object.\n  - `verify_connection` (`bool`): Specifies if the connection is verified during initial configuration. When `null`, the `verify_connection` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `mysql_legacy` sub block.\n', args=[]),
     new(
       name,
       allowed_roles=null,
+      auth_type=null,
       connection_url=null,
       data=null,
       max_connection_lifetime=null,
@@ -359,11 +368,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       password=null,
       plugin_name=null,
       root_rotation_statements=null,
+      service_account_json=null,
+      tls_ca=null,
+      tls_certificate_key=null,
       username=null,
       username_template=null,
       verify_connection=null
     ):: std.prune(a={
       allowed_roles: allowed_roles,
+      auth_type: auth_type,
       connection_url: connection_url,
       data: data,
       max_connection_lifetime: max_connection_lifetime,
@@ -373,16 +386,20 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       password: password,
       plugin_name: plugin_name,
       root_rotation_statements: root_rotation_statements,
+      service_account_json: service_account_json,
+      tls_ca: tls_ca,
+      tls_certificate_key: tls_certificate_key,
       username: username,
       username_template: username_template,
       verify_connection: verify_connection,
     }),
   },
   mysql_rds:: {
-    '#new':: d.fn(help='\n`vault.database_secrets_mount.mysql_rds.new` constructs a new object with attributes and blocks configured for the `mysql_rds`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allowed_roles` (`list`): A list of roles that are allowed to use this connection. When `null`, the `allowed_roles` field will be omitted from the resulting object.\n  - `connection_url` (`string`): Connection string to use to connect to the database. When `null`, the `connection_url` field will be omitted from the resulting object.\n  - `data` (`obj`): A map of sensitive data to pass to the endpoint. Useful for templated connection strings. When `null`, the `data` field will be omitted from the resulting object.\n  - `max_connection_lifetime` (`number`): Maximum number of seconds a connection may be reused. When `null`, the `max_connection_lifetime` field will be omitted from the resulting object.\n  - `max_idle_connections` (`number`): Maximum number of idle connections to the database. When `null`, the `max_idle_connections` field will be omitted from the resulting object.\n  - `max_open_connections` (`number`): Maximum number of open connections to the database. When `null`, the `max_open_connections` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the database connection.\n  - `password` (`string`): The root credential password used in the connection URL When `null`, the `password` field will be omitted from the resulting object.\n  - `plugin_name` (`string`): Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types. When `null`, the `plugin_name` field will be omitted from the resulting object.\n  - `root_rotation_statements` (`list`): A list of database statements to be executed to rotate the root user&#39;s credentials. When `null`, the `root_rotation_statements` field will be omitted from the resulting object.\n  - `username` (`string`): The root credential username used in the connection URL When `null`, the `username` field will be omitted from the resulting object.\n  - `username_template` (`string`): Username generation template. When `null`, the `username_template` field will be omitted from the resulting object.\n  - `verify_connection` (`bool`): Specifies if the connection is verified during initial configuration. When `null`, the `verify_connection` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `mysql_rds` sub block.\n', args=[]),
+    '#new':: d.fn(help='\n`vault.database_secrets_mount.mysql_rds.new` constructs a new object with attributes and blocks configured for the `mysql_rds`\nTerraform sub block.\n\n\n\n**Args**:\n  - `allowed_roles` (`list`): A list of roles that are allowed to use this connection. When `null`, the `allowed_roles` field will be omitted from the resulting object.\n  - `auth_type` (`string`): Specify alternative authorization type. (Only &#39;gcp_iam&#39; is valid currently) When `null`, the `auth_type` field will be omitted from the resulting object.\n  - `connection_url` (`string`): Connection string to use to connect to the database. When `null`, the `connection_url` field will be omitted from the resulting object.\n  - `data` (`obj`): A map of sensitive data to pass to the endpoint. Useful for templated connection strings. When `null`, the `data` field will be omitted from the resulting object.\n  - `max_connection_lifetime` (`number`): Maximum number of seconds a connection may be reused. When `null`, the `max_connection_lifetime` field will be omitted from the resulting object.\n  - `max_idle_connections` (`number`): Maximum number of idle connections to the database. When `null`, the `max_idle_connections` field will be omitted from the resulting object.\n  - `max_open_connections` (`number`): Maximum number of open connections to the database. When `null`, the `max_open_connections` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the database connection.\n  - `password` (`string`): The root credential password used in the connection URL When `null`, the `password` field will be omitted from the resulting object.\n  - `plugin_name` (`string`): Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types. When `null`, the `plugin_name` field will be omitted from the resulting object.\n  - `root_rotation_statements` (`list`): A list of database statements to be executed to rotate the root user&#39;s credentials. When `null`, the `root_rotation_statements` field will be omitted from the resulting object.\n  - `service_account_json` (`string`): A JSON encoded credential for use with IAM authorization When `null`, the `service_account_json` field will be omitted from the resulting object.\n  - `tls_ca` (`string`): x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded. When `null`, the `tls_ca` field will be omitted from the resulting object.\n  - `tls_certificate_key` (`string`): x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined. When `null`, the `tls_certificate_key` field will be omitted from the resulting object.\n  - `username` (`string`): The root credential username used in the connection URL When `null`, the `username` field will be omitted from the resulting object.\n  - `username_template` (`string`): Username generation template. When `null`, the `username_template` field will be omitted from the resulting object.\n  - `verify_connection` (`bool`): Specifies if the connection is verified during initial configuration. When `null`, the `verify_connection` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that represents the `mysql_rds` sub block.\n', args=[]),
     new(
       name,
       allowed_roles=null,
+      auth_type=null,
       connection_url=null,
       data=null,
       max_connection_lifetime=null,
@@ -391,11 +408,15 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       password=null,
       plugin_name=null,
       root_rotation_statements=null,
+      service_account_json=null,
+      tls_ca=null,
+      tls_certificate_key=null,
       username=null,
       username_template=null,
       verify_connection=null
     ):: std.prune(a={
       allowed_roles: allowed_roles,
+      auth_type: auth_type,
       connection_url: connection_url,
       data: data,
       max_connection_lifetime: max_connection_lifetime,
@@ -405,6 +426,9 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       password: password,
       plugin_name: plugin_name,
       root_rotation_statements: root_rotation_statements,
+      service_account_json: service_account_json,
+      tls_ca: tls_ca,
+      tls_certificate_key: tls_certificate_key,
       username: username,
       username_template: username_template,
       verify_connection: verify_connection,
diff --git a/3.x/_gen/resources/gcp_auth_backend.libsonnet b/3.x/_gen/resources/gcp_auth_backend.libsonnet
index f17668e..b50f3e2 100644
--- a/3.x/_gen/resources/gcp_auth_backend.libsonnet
+++ b/3.x/_gen/resources/gcp_auth_backend.libsonnet
@@ -16,7 +16,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       iam: iam,
     }),
   },
-  '#new':: d.fn(help="\n`vault.gcp_auth_backend.new` injects a new `vault_gcp_auth_backend` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.gcp_auth_backend.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.gcp_auth_backend` using the reference:\n\n    $._ref.vault_gcp_auth_backend.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_gcp_auth_backend.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `client_email` (`string`): Set the `client_email` field on the resulting resource block. When `null`, the `client_email` field will be omitted from the resulting object.\n  - `client_id` (`string`): Set the `client_id` field on the resulting resource block. When `null`, the `client_id` field will be omitted from the resulting object.\n  - `credentials` (`string`): Set the `credentials` field on the resulting resource block. When `null`, the `credentials` field will be omitted from the resulting object.\n  - `description` (`string`): Set the `description` field on the resulting resource block. When `null`, the `description` field will be omitted from the resulting object.\n  - `disable_remount` (`bool`): If set, opts out of mount migration on path updates. When `null`, the `disable_remount` field will be omitted from the resulting object.\n  - `local_` (`bool`): Specifies if the auth method is local only When `null`, the `local_` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `path` (`string`): Set the `path` field on the resulting resource block. When `null`, the `path` field will be omitted from the resulting object.\n  - `private_key_id` (`string`): Set the `private_key_id` field on the resulting resource block. When `null`, the `private_key_id` field will be omitted from the resulting object.\n  - `project_id` (`string`): Set the `project_id` field on the resulting resource block. When `null`, the `project_id` field will be omitted from the resulting object.\n  - `custom_endpoint` (`list[obj]`): Specifies overrides to service endpoints used when making API requests to GCP. When `null`, the `custom_endpoint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.gcp_auth_backend.custom_endpoint.new](#fn-custom_endpointnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`vault.gcp_auth_backend.new` injects a new `vault_gcp_auth_backend` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.gcp_auth_backend.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.gcp_auth_backend` using the reference:\n\n    $._ref.vault_gcp_auth_backend.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_gcp_auth_backend.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `client_email` (`string`): Set the `client_email` field on the resulting resource block. When `null`, the `client_email` field will be omitted from the resulting object.\n  - `client_id` (`string`): Set the `client_id` field on the resulting resource block. When `null`, the `client_id` field will be omitted from the resulting object.\n  - `credentials` (`string`): Set the `credentials` field on the resulting resource block. When `null`, the `credentials` field will be omitted from the resulting object.\n  - `description` (`string`): Set the `description` field on the resulting resource block. When `null`, the `description` field will be omitted from the resulting object.\n  - `disable_remount` (`bool`): If set, opts out of mount migration on path updates. When `null`, the `disable_remount` field will be omitted from the resulting object.\n  - `local_` (`bool`): Specifies if the auth method is local only When `null`, the `local_` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `path` (`string`): Set the `path` field on the resulting resource block. When `null`, the `path` field will be omitted from the resulting object.\n  - `private_key_id` (`string`): Set the `private_key_id` field on the resulting resource block. When `null`, the `private_key_id` field will be omitted from the resulting object.\n  - `project_id` (`string`): Set the `project_id` field on the resulting resource block. When `null`, the `project_id` field will be omitted from the resulting object.\n  - `tune` (`list`): Set the `tune` field on the resulting resource block. When `null`, the `tune` field will be omitted from the resulting object.\n  - `custom_endpoint` (`list[obj]`): Specifies overrides to service endpoints used when making API requests to GCP. When `null`, the `custom_endpoint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.gcp_auth_backend.custom_endpoint.new](#fn-custom_endpointnew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     client_email=null,
@@ -30,6 +30,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     path=null,
     private_key_id=null,
     project_id=null,
+    tune=null,
     _meta={}
   ):: tf.withResource(
     type='vault_gcp_auth_backend',
@@ -45,11 +46,12 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       namespace=namespace,
       path=path,
       private_key_id=private_key_id,
-      project_id=project_id
+      project_id=project_id,
+      tune=tune
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`vault.gcp_auth_backend.newAttrs` constructs a new object with attributes and blocks configured for the `gcp_auth_backend`\nTerraform resource.\n\nUnlike [vault.gcp_auth_backend.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `client_email` (`string`): Set the `client_email` field on the resulting object. When `null`, the `client_email` field will be omitted from the resulting object.\n  - `client_id` (`string`): Set the `client_id` field on the resulting object. When `null`, the `client_id` field will be omitted from the resulting object.\n  - `credentials` (`string`): Set the `credentials` field on the resulting object. When `null`, the `credentials` field will be omitted from the resulting object.\n  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.\n  - `disable_remount` (`bool`): If set, opts out of mount migration on path updates. When `null`, the `disable_remount` field will be omitted from the resulting object.\n  - `local_` (`bool`): Specifies if the auth method is local only When `null`, the `local_` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `path` (`string`): Set the `path` field on the resulting object. When `null`, the `path` field will be omitted from the resulting object.\n  - `private_key_id` (`string`): Set the `private_key_id` field on the resulting object. When `null`, the `private_key_id` field will be omitted from the resulting object.\n  - `project_id` (`string`): Set the `project_id` field on the resulting object. When `null`, the `project_id` field will be omitted from the resulting object.\n  - `custom_endpoint` (`list[obj]`): Specifies overrides to service endpoints used when making API requests to GCP. When `null`, the `custom_endpoint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.gcp_auth_backend.custom_endpoint.new](#fn-custom_endpointnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gcp_auth_backend` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`vault.gcp_auth_backend.newAttrs` constructs a new object with attributes and blocks configured for the `gcp_auth_backend`\nTerraform resource.\n\nUnlike [vault.gcp_auth_backend.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `client_email` (`string`): Set the `client_email` field on the resulting object. When `null`, the `client_email` field will be omitted from the resulting object.\n  - `client_id` (`string`): Set the `client_id` field on the resulting object. When `null`, the `client_id` field will be omitted from the resulting object.\n  - `credentials` (`string`): Set the `credentials` field on the resulting object. When `null`, the `credentials` field will be omitted from the resulting object.\n  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.\n  - `disable_remount` (`bool`): If set, opts out of mount migration on path updates. When `null`, the `disable_remount` field will be omitted from the resulting object.\n  - `local_` (`bool`): Specifies if the auth method is local only When `null`, the `local_` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `path` (`string`): Set the `path` field on the resulting object. When `null`, the `path` field will be omitted from the resulting object.\n  - `private_key_id` (`string`): Set the `private_key_id` field on the resulting object. When `null`, the `private_key_id` field will be omitted from the resulting object.\n  - `project_id` (`string`): Set the `project_id` field on the resulting object. When `null`, the `project_id` field will be omitted from the resulting object.\n  - `tune` (`list`): Set the `tune` field on the resulting object. When `null`, the `tune` field will be omitted from the resulting object.\n  - `custom_endpoint` (`list[obj]`): Specifies overrides to service endpoints used when making API requests to GCP. When `null`, the `custom_endpoint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.gcp_auth_backend.custom_endpoint.new](#fn-custom_endpointnew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `gcp_auth_backend` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     client_email=null,
     client_id=null,
@@ -61,7 +63,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     namespace=null,
     path=null,
     private_key_id=null,
-    project_id=null
+    project_id=null,
+    tune=null
   ):: std.prune(a={
     client_email: client_email,
     client_id: client_id,
@@ -74,6 +77,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     path: path,
     private_key_id: private_key_id,
     project_id: project_id,
+    tune: tune,
   }),
   '#withClientEmail':: d.fn(help='`vault.string.withClientEmail` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the client_email field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `client_email` field.\n', args=[]),
   withClientEmail(resourceLabel, value): {
@@ -195,4 +199,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withTune':: d.fn(help='`vault.list.withTune` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the tune field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `tune` field.\n', args=[]),
+  withTune(resourceLabel, value): {
+    resource+: {
+      vault_gcp_auth_backend+: {
+        [resourceLabel]+: {
+          tune: value,
+        },
+      },
+    },
+  },
 }
diff --git a/3.x/_gen/resources/kubernetes_auth_backend_config.libsonnet b/3.x/_gen/resources/kubernetes_auth_backend_config.libsonnet
index 8ae1fee..536c3fa 100644
--- a/3.x/_gen/resources/kubernetes_auth_backend_config.libsonnet
+++ b/3.x/_gen/resources/kubernetes_auth_backend_config.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='kubernetes_auth_backend_config', url='', help='`kubernetes_auth_backend_config` represents the `vault_kubernetes_auth_backend_config` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`vault.kubernetes_auth_backend_config.new` injects a new `vault_kubernetes_auth_backend_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.kubernetes_auth_backend_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.kubernetes_auth_backend_config` using the reference:\n\n    $._ref.vault_kubernetes_auth_backend_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_kubernetes_auth_backend_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `backend` (`string`): Unique name of the kubernetes backend to configure. When `null`, the `backend` field will be omitted from the resulting object.\n  - `disable_iss_validation` (`bool`): Optional disable JWT issuer validation. Allows to skip ISS validation. When `null`, the `disable_iss_validation` field will be omitted from the resulting object.\n  - `disable_local_ca_jwt` (`bool`): Optional disable defaulting to the local CA cert and service account JWT when running in a Kubernetes pod. When `null`, the `disable_local_ca_jwt` field will be omitted from the resulting object.\n  - `issuer` (`string`): Optional JWT issuer. If no issuer is specified, kubernetes.io/serviceaccount will be used as the default issuer. When `null`, the `issuer` field will be omitted from the resulting object.\n  - `kubernetes_ca_cert` (`string`): PEM encoded CA cert for use by the TLS client used to talk with the Kubernetes API. When `null`, the `kubernetes_ca_cert` field will be omitted from the resulting object.\n  - `kubernetes_host` (`string`): Host must be a host string, a host:port pair, or a URL to the base of the Kubernetes API server.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `pem_keys` (`list`): Optional list of PEM-formatted public keys or certificates used to verify the signatures of Kubernetes service account JWTs. If a certificate is given, its public key will be extracted. Not every installation of Kubernetes exposes these keys. When `null`, the `pem_keys` field will be omitted from the resulting object.\n  - `token_reviewer_jwt` (`string`): A service account JWT used to access the TokenReview API to validate other JWTs during login. If not set the JWT used for login will be used to access the API. When `null`, the `token_reviewer_jwt` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`vault.kubernetes_auth_backend_config.new` injects a new `vault_kubernetes_auth_backend_config` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.kubernetes_auth_backend_config.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.kubernetes_auth_backend_config` using the reference:\n\n    $._ref.vault_kubernetes_auth_backend_config.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_kubernetes_auth_backend_config.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `backend` (`string`): Unique name of the kubernetes backend to configure. When `null`, the `backend` field will be omitted from the resulting object.\n  - `disable_iss_validation` (`bool`): Optional disable JWT issuer validation. Allows to skip ISS validation. When `null`, the `disable_iss_validation` field will be omitted from the resulting object.\n  - `disable_local_ca_jwt` (`bool`): Optional disable defaulting to the local CA cert and service account JWT when running in a Kubernetes pod. When `null`, the `disable_local_ca_jwt` field will be omitted from the resulting object.\n  - `issuer` (`string`): Optional JWT issuer. If no issuer is specified, kubernetes.io/serviceaccount will be used as the default issuer. When `null`, the `issuer` field will be omitted from the resulting object.\n  - `kubernetes_ca_cert` (`string`): PEM encoded CA cert for use by the TLS client used to talk with the Kubernetes API. When `null`, the `kubernetes_ca_cert` field will be omitted from the resulting object.\n  - `kubernetes_host` (`string`): Host must be a host string, a host:port pair, or a URL to the base of the Kubernetes API server.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `pem_keys` (`list`): Optional list of PEM-formatted public keys or certificates used to verify the signatures of Kubernetes service account JWTs. If a certificate is given, its public key will be extracted. Not every installation of Kubernetes exposes these keys. When `null`, the `pem_keys` field will be omitted from the resulting object.\n  - `token_reviewer_jwt` (`string`): A service account JWT (or other token) used as a bearer token to access the TokenReview API to validate other JWTs during login. If not set the JWT used for login will be used to access the API. When `null`, the `token_reviewer_jwt` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     kubernetes_host,
@@ -31,7 +31,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`vault.kubernetes_auth_backend_config.newAttrs` constructs a new object with attributes and blocks configured for the `kubernetes_auth_backend_config`\nTerraform resource.\n\nUnlike [vault.kubernetes_auth_backend_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `backend` (`string`): Unique name of the kubernetes backend to configure. When `null`, the `backend` field will be omitted from the resulting object.\n  - `disable_iss_validation` (`bool`): Optional disable JWT issuer validation. Allows to skip ISS validation. When `null`, the `disable_iss_validation` field will be omitted from the resulting object.\n  - `disable_local_ca_jwt` (`bool`): Optional disable defaulting to the local CA cert and service account JWT when running in a Kubernetes pod. When `null`, the `disable_local_ca_jwt` field will be omitted from the resulting object.\n  - `issuer` (`string`): Optional JWT issuer. If no issuer is specified, kubernetes.io/serviceaccount will be used as the default issuer. When `null`, the `issuer` field will be omitted from the resulting object.\n  - `kubernetes_ca_cert` (`string`): PEM encoded CA cert for use by the TLS client used to talk with the Kubernetes API. When `null`, the `kubernetes_ca_cert` field will be omitted from the resulting object.\n  - `kubernetes_host` (`string`): Host must be a host string, a host:port pair, or a URL to the base of the Kubernetes API server.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `pem_keys` (`list`): Optional list of PEM-formatted public keys or certificates used to verify the signatures of Kubernetes service account JWTs. If a certificate is given, its public key will be extracted. Not every installation of Kubernetes exposes these keys. When `null`, the `pem_keys` field will be omitted from the resulting object.\n  - `token_reviewer_jwt` (`string`): A service account JWT used to access the TokenReview API to validate other JWTs during login. If not set the JWT used for login will be used to access the API. When `null`, the `token_reviewer_jwt` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `kubernetes_auth_backend_config` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`vault.kubernetes_auth_backend_config.newAttrs` constructs a new object with attributes and blocks configured for the `kubernetes_auth_backend_config`\nTerraform resource.\n\nUnlike [vault.kubernetes_auth_backend_config.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `backend` (`string`): Unique name of the kubernetes backend to configure. When `null`, the `backend` field will be omitted from the resulting object.\n  - `disable_iss_validation` (`bool`): Optional disable JWT issuer validation. Allows to skip ISS validation. When `null`, the `disable_iss_validation` field will be omitted from the resulting object.\n  - `disable_local_ca_jwt` (`bool`): Optional disable defaulting to the local CA cert and service account JWT when running in a Kubernetes pod. When `null`, the `disable_local_ca_jwt` field will be omitted from the resulting object.\n  - `issuer` (`string`): Optional JWT issuer. If no issuer is specified, kubernetes.io/serviceaccount will be used as the default issuer. When `null`, the `issuer` field will be omitted from the resulting object.\n  - `kubernetes_ca_cert` (`string`): PEM encoded CA cert for use by the TLS client used to talk with the Kubernetes API. When `null`, the `kubernetes_ca_cert` field will be omitted from the resulting object.\n  - `kubernetes_host` (`string`): Host must be a host string, a host:port pair, or a URL to the base of the Kubernetes API server.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `pem_keys` (`list`): Optional list of PEM-formatted public keys or certificates used to verify the signatures of Kubernetes service account JWTs. If a certificate is given, its public key will be extracted. Not every installation of Kubernetes exposes these keys. When `null`, the `pem_keys` field will be omitted from the resulting object.\n  - `token_reviewer_jwt` (`string`): A service account JWT (or other token) used as a bearer token to access the TokenReview API to validate other JWTs during login. If not set the JWT used for login will be used to access the API. When `null`, the `token_reviewer_jwt` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `kubernetes_auth_backend_config` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     kubernetes_host,
     backend=null,
diff --git a/3.x/_gen/resources/pki_secret_backend_role.libsonnet b/3.x/_gen/resources/pki_secret_backend_role.libsonnet
index 0fdcd19..0235fbb 100644
--- a/3.x/_gen/resources/pki_secret_backend_role.libsonnet
+++ b/3.x/_gen/resources/pki_secret_backend_role.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='pki_secret_backend_role', url='', help='`pki_secret_backend_role` represents the `vault_pki_secret_backend_role` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`vault.pki_secret_backend_role.new` injects a new `vault_pki_secret_backend_role` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.pki_secret_backend_role.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.pki_secret_backend_role` using the reference:\n\n    $._ref.vault_pki_secret_backend_role.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_pki_secret_backend_role.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `allow_any_name` (`bool`): Flag to allow any name When `null`, the `allow_any_name` field will be omitted from the resulting object.\n  - `allow_bare_domains` (`bool`): Flag to allow certificates matching the actual domain. When `null`, the `allow_bare_domains` field will be omitted from the resulting object.\n  - `allow_glob_domains` (`bool`): Flag to allow names containing glob patterns. When `null`, the `allow_glob_domains` field will be omitted from the resulting object.\n  - `allow_ip_sans` (`bool`): Flag to allow IP SANs When `null`, the `allow_ip_sans` field will be omitted from the resulting object.\n  - `allow_localhost` (`bool`): Flag to allow certificates for localhost. When `null`, the `allow_localhost` field will be omitted from the resulting object.\n  - `allow_subdomains` (`bool`): Flag to allow certificates matching subdomains. When `null`, the `allow_subdomains` field will be omitted from the resulting object.\n  - `allow_wildcard_certificates` (`bool`): Flag to allow wildcard certificates When `null`, the `allow_wildcard_certificates` field will be omitted from the resulting object.\n  - `allowed_domains` (`list`): The domains of the role. When `null`, the `allowed_domains` field will be omitted from the resulting object.\n  - `allowed_domains_template` (`bool`): Flag to indicate that `allowed_domains` specifies a template expression (e.g. {{identity.entity.aliases.\u0026lt;mount accessor\u0026gt;.name}}) When `null`, the `allowed_domains_template` field will be omitted from the resulting object.\n  - `allowed_other_sans` (`list`): Defines allowed custom SANs When `null`, the `allowed_other_sans` field will be omitted from the resulting object.\n  - `allowed_serial_numbers` (`list`): Defines allowed Subject serial numbers. When `null`, the `allowed_serial_numbers` field will be omitted from the resulting object.\n  - `allowed_uri_sans` (`list`): Defines allowed URI SANs When `null`, the `allowed_uri_sans` field will be omitted from the resulting object.\n  - `allowed_uri_sans_template` (`bool`): Flag to indicate that `allowed_uri_sans` specifies a template expression (e.g. {{identity.entity.aliases.\u0026lt;mount accessor\u0026gt;.name}}) When `null`, the `allowed_uri_sans_template` field will be omitted from the resulting object.\n  - `allowed_user_ids` (`list`): The allowed User ID\u0026#39;s. When `null`, the `allowed_user_ids` field will be omitted from the resulting object.\n  - `backend` (`string`): The path of the PKI secret backend the resource belongs to.\n  - `basic_constraints_valid_for_non_ca` (`bool`): Flag to mark basic constraints valid when issuing non-CA certificates. When `null`, the `basic_constraints_valid_for_non_ca` field will be omitted from the resulting object.\n  - `client_flag` (`bool`): Flag to specify certificates for client use. When `null`, the `client_flag` field will be omitted from the resulting object.\n  - `code_signing_flag` (`bool`): Flag to specify certificates for code signing use. When `null`, the `code_signing_flag` field will be omitted from the resulting object.\n  - `country` (`list`): The country of generated certificates. When `null`, the `country` field will be omitted from the resulting object.\n  - `email_protection_flag` (`bool`): Flag to specify certificates for email protection use. When `null`, the `email_protection_flag` field will be omitted from the resulting object.\n  - `enforce_hostnames` (`bool`): Flag to allow only valid host names When `null`, the `enforce_hostnames` field will be omitted from the resulting object.\n  - `ext_key_usage` (`list`): Specify the allowed extended key usage constraint on issued certificates. When `null`, the `ext_key_usage` field will be omitted from the resulting object.\n  - `generate_lease` (`bool`): Flag to generate leases with certificates. When `null`, the `generate_lease` field will be omitted from the resulting object.\n  - `issuer_ref` (`string`): Specifies the default issuer of this request. When `null`, the `issuer_ref` field will be omitted from the resulting object.\n  - `key_bits` (`number`): The number of bits of generated keys. When `null`, the `key_bits` field will be omitted from the resulting object.\n  - `key_type` (`string`): The generated key type. When `null`, the `key_type` field will be omitted from the resulting object.\n  - `key_usage` (`list`): Specify the allowed key usage constraint on issued certificates. When `null`, the `key_usage` field will be omitted from the resulting object.\n  - `locality` (`list`): The locality of generated certificates. When `null`, the `locality` field will be omitted from the resulting object.\n  - `max_ttl` (`string`): The maximum TTL. When `null`, the `max_ttl` field will be omitted from the resulting object.\n  - `name` (`string`): Unique name for the role.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `no_store` (`bool`): Flag to not store certificates in the storage backend. When `null`, the `no_store` field will be omitted from the resulting object.\n  - `not_before_duration` (`string`): Specifies the duration by which to backdate the NotBefore property. When `null`, the `not_before_duration` field will be omitted from the resulting object.\n  - `organization` (`list`): The organization of generated certificates. When `null`, the `organization` field will be omitted from the resulting object.\n  - `ou` (`list`): The organization unit of generated certificates. When `null`, the `ou` field will be omitted from the resulting object.\n  - `policy_identifiers` (`list`): Specify the list of allowed policies OIDs. When `null`, the `policy_identifiers` field will be omitted from the resulting object.\n  - `postal_code` (`list`): The postal code of generated certificates. When `null`, the `postal_code` field will be omitted from the resulting object.\n  - `province` (`list`): The province of generated certificates. When `null`, the `province` field will be omitted from the resulting object.\n  - `require_cn` (`bool`): Flag to force CN usage. When `null`, the `require_cn` field will be omitted from the resulting object.\n  - `server_flag` (`bool`): Flag to specify certificates for server use. When `null`, the `server_flag` field will be omitted from the resulting object.\n  - `street_address` (`list`): The street address of generated certificates. When `null`, the `street_address` field will be omitted from the resulting object.\n  - `ttl` (`string`): The TTL. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `use_csr_common_name` (`bool`): Flag to use the CN in the CSR. When `null`, the `use_csr_common_name` field will be omitted from the resulting object.\n  - `use_csr_sans` (`bool`): Flag to use the SANs in the CSR. When `null`, the `use_csr_sans` field will be omitted from the resulting object.\n  - `policy_identifier` (`list[obj]`): Policy identifier block; can only be used with Vault 1.11\u0026#43; When `null`, the `policy_identifier` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.pki_secret_backend_role.policy_identifier.new](#fn-policy_identifiernew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`vault.pki_secret_backend_role.new` injects a new `vault_pki_secret_backend_role` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.pki_secret_backend_role.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.pki_secret_backend_role` using the reference:\n\n    $._ref.vault_pki_secret_backend_role.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_pki_secret_backend_role.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `allow_any_name` (`bool`): Flag to allow any name When `null`, the `allow_any_name` field will be omitted from the resulting object.\n  - `allow_bare_domains` (`bool`): Flag to allow certificates matching the actual domain. When `null`, the `allow_bare_domains` field will be omitted from the resulting object.\n  - `allow_glob_domains` (`bool`): Flag to allow names containing glob patterns. When `null`, the `allow_glob_domains` field will be omitted from the resulting object.\n  - `allow_ip_sans` (`bool`): Flag to allow IP SANs When `null`, the `allow_ip_sans` field will be omitted from the resulting object.\n  - `allow_localhost` (`bool`): Flag to allow certificates for localhost. When `null`, the `allow_localhost` field will be omitted from the resulting object.\n  - `allow_subdomains` (`bool`): Flag to allow certificates matching subdomains. When `null`, the `allow_subdomains` field will be omitted from the resulting object.\n  - `allow_wildcard_certificates` (`bool`): Flag to allow wildcard certificates When `null`, the `allow_wildcard_certificates` field will be omitted from the resulting object.\n  - `allowed_domains` (`list`): The domains of the role. When `null`, the `allowed_domains` field will be omitted from the resulting object.\n  - `allowed_domains_template` (`bool`): Flag to indicate that `allowed_domains` specifies a template expression (e.g. {{identity.entity.aliases.\u0026lt;mount accessor\u0026gt;.name}}) When `null`, the `allowed_domains_template` field will be omitted from the resulting object.\n  - `allowed_other_sans` (`list`): Defines allowed custom SANs When `null`, the `allowed_other_sans` field will be omitted from the resulting object.\n  - `allowed_serial_numbers` (`list`): Defines allowed Subject serial numbers. When `null`, the `allowed_serial_numbers` field will be omitted from the resulting object.\n  - `allowed_uri_sans` (`list`): Defines allowed URI SANs When `null`, the `allowed_uri_sans` field will be omitted from the resulting object.\n  - `allowed_uri_sans_template` (`bool`): Flag to indicate that `allowed_uri_sans` specifies a template expression (e.g. {{identity.entity.aliases.\u0026lt;mount accessor\u0026gt;.name}}) When `null`, the `allowed_uri_sans_template` field will be omitted from the resulting object.\n  - `allowed_user_ids` (`list`): The allowed User ID\u0026#39;s. When `null`, the `allowed_user_ids` field will be omitted from the resulting object.\n  - `backend` (`string`): The path of the PKI secret backend the resource belongs to.\n  - `basic_constraints_valid_for_non_ca` (`bool`): Flag to mark basic constraints valid when issuing non-CA certificates. When `null`, the `basic_constraints_valid_for_non_ca` field will be omitted from the resulting object.\n  - `client_flag` (`bool`): Flag to specify certificates for client use. When `null`, the `client_flag` field will be omitted from the resulting object.\n  - `code_signing_flag` (`bool`): Flag to specify certificates for code signing use. When `null`, the `code_signing_flag` field will be omitted from the resulting object.\n  - `country` (`list`): The country of generated certificates. When `null`, the `country` field will be omitted from the resulting object.\n  - `email_protection_flag` (`bool`): Flag to specify certificates for email protection use. When `null`, the `email_protection_flag` field will be omitted from the resulting object.\n  - `enforce_hostnames` (`bool`): Flag to allow only valid host names When `null`, the `enforce_hostnames` field will be omitted from the resulting object.\n  - `ext_key_usage` (`list`): Specify the allowed extended key usage constraint on issued certificates. When `null`, the `ext_key_usage` field will be omitted from the resulting object.\n  - `ext_key_usage_oids` (`list`): A list of extended key usage OIDs. When `null`, the `ext_key_usage_oids` field will be omitted from the resulting object.\n  - `generate_lease` (`bool`): Flag to generate leases with certificates. When `null`, the `generate_lease` field will be omitted from the resulting object.\n  - `issuer_ref` (`string`): Specifies the default issuer of this request. When `null`, the `issuer_ref` field will be omitted from the resulting object.\n  - `key_bits` (`number`): The number of bits of generated keys. When `null`, the `key_bits` field will be omitted from the resulting object.\n  - `key_type` (`string`): The generated key type. When `null`, the `key_type` field will be omitted from the resulting object.\n  - `key_usage` (`list`): Specify the allowed key usage constraint on issued certificates. When `null`, the `key_usage` field will be omitted from the resulting object.\n  - `locality` (`list`): The locality of generated certificates. When `null`, the `locality` field will be omitted from the resulting object.\n  - `max_ttl` (`string`): The maximum TTL. When `null`, the `max_ttl` field will be omitted from the resulting object.\n  - `name` (`string`): Unique name for the role.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `no_store` (`bool`): Flag to not store certificates in the storage backend. When `null`, the `no_store` field will be omitted from the resulting object.\n  - `not_before_duration` (`string`): Specifies the duration by which to backdate the NotBefore property. When `null`, the `not_before_duration` field will be omitted from the resulting object.\n  - `organization` (`list`): The organization of generated certificates. When `null`, the `organization` field will be omitted from the resulting object.\n  - `ou` (`list`): The organization unit of generated certificates. When `null`, the `ou` field will be omitted from the resulting object.\n  - `policy_identifiers` (`list`): Specify the list of allowed policies OIDs. When `null`, the `policy_identifiers` field will be omitted from the resulting object.\n  - `postal_code` (`list`): The postal code of generated certificates. When `null`, the `postal_code` field will be omitted from the resulting object.\n  - `province` (`list`): The province of generated certificates. When `null`, the `province` field will be omitted from the resulting object.\n  - `require_cn` (`bool`): Flag to force CN usage. When `null`, the `require_cn` field will be omitted from the resulting object.\n  - `server_flag` (`bool`): Flag to specify certificates for server use. When `null`, the `server_flag` field will be omitted from the resulting object.\n  - `street_address` (`list`): The street address of generated certificates. When `null`, the `street_address` field will be omitted from the resulting object.\n  - `ttl` (`string`): The TTL. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `use_csr_common_name` (`bool`): Flag to use the CN in the CSR. When `null`, the `use_csr_common_name` field will be omitted from the resulting object.\n  - `use_csr_sans` (`bool`): Flag to use the SANs in the CSR. When `null`, the `use_csr_sans` field will be omitted from the resulting object.\n  - `policy_identifier` (`list[obj]`): Policy identifier block; can only be used with Vault 1.11\u0026#43; When `null`, the `policy_identifier` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.pki_secret_backend_role.policy_identifier.new](#fn-policy_identifiernew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     backend,
@@ -28,6 +28,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     email_protection_flag=null,
     enforce_hostnames=null,
     ext_key_usage=null,
+    ext_key_usage_oids=null,
     generate_lease=null,
     issuer_ref=null,
     key_bits=null,
@@ -77,6 +78,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       email_protection_flag=email_protection_flag,
       enforce_hostnames=enforce_hostnames,
       ext_key_usage=ext_key_usage,
+      ext_key_usage_oids=ext_key_usage_oids,
       generate_lease=generate_lease,
       issuer_ref=issuer_ref,
       key_bits=key_bits,
@@ -103,7 +105,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`vault.pki_secret_backend_role.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_role`\nTerraform resource.\n\nUnlike [vault.pki_secret_backend_role.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `allow_any_name` (`bool`): Flag to allow any name When `null`, the `allow_any_name` field will be omitted from the resulting object.\n  - `allow_bare_domains` (`bool`): Flag to allow certificates matching the actual domain. When `null`, the `allow_bare_domains` field will be omitted from the resulting object.\n  - `allow_glob_domains` (`bool`): Flag to allow names containing glob patterns. When `null`, the `allow_glob_domains` field will be omitted from the resulting object.\n  - `allow_ip_sans` (`bool`): Flag to allow IP SANs When `null`, the `allow_ip_sans` field will be omitted from the resulting object.\n  - `allow_localhost` (`bool`): Flag to allow certificates for localhost. When `null`, the `allow_localhost` field will be omitted from the resulting object.\n  - `allow_subdomains` (`bool`): Flag to allow certificates matching subdomains. When `null`, the `allow_subdomains` field will be omitted from the resulting object.\n  - `allow_wildcard_certificates` (`bool`): Flag to allow wildcard certificates When `null`, the `allow_wildcard_certificates` field will be omitted from the resulting object.\n  - `allowed_domains` (`list`): The domains of the role. When `null`, the `allowed_domains` field will be omitted from the resulting object.\n  - `allowed_domains_template` (`bool`): Flag to indicate that `allowed_domains` specifies a template expression (e.g. {{identity.entity.aliases.&lt;mount accessor&gt;.name}}) When `null`, the `allowed_domains_template` field will be omitted from the resulting object.\n  - `allowed_other_sans` (`list`): Defines allowed custom SANs When `null`, the `allowed_other_sans` field will be omitted from the resulting object.\n  - `allowed_serial_numbers` (`list`): Defines allowed Subject serial numbers. When `null`, the `allowed_serial_numbers` field will be omitted from the resulting object.\n  - `allowed_uri_sans` (`list`): Defines allowed URI SANs When `null`, the `allowed_uri_sans` field will be omitted from the resulting object.\n  - `allowed_uri_sans_template` (`bool`): Flag to indicate that `allowed_uri_sans` specifies a template expression (e.g. {{identity.entity.aliases.&lt;mount accessor&gt;.name}}) When `null`, the `allowed_uri_sans_template` field will be omitted from the resulting object.\n  - `allowed_user_ids` (`list`): The allowed User ID&#39;s. When `null`, the `allowed_user_ids` field will be omitted from the resulting object.\n  - `backend` (`string`): The path of the PKI secret backend the resource belongs to.\n  - `basic_constraints_valid_for_non_ca` (`bool`): Flag to mark basic constraints valid when issuing non-CA certificates. When `null`, the `basic_constraints_valid_for_non_ca` field will be omitted from the resulting object.\n  - `client_flag` (`bool`): Flag to specify certificates for client use. When `null`, the `client_flag` field will be omitted from the resulting object.\n  - `code_signing_flag` (`bool`): Flag to specify certificates for code signing use. When `null`, the `code_signing_flag` field will be omitted from the resulting object.\n  - `country` (`list`): The country of generated certificates. When `null`, the `country` field will be omitted from the resulting object.\n  - `email_protection_flag` (`bool`): Flag to specify certificates for email protection use. When `null`, the `email_protection_flag` field will be omitted from the resulting object.\n  - `enforce_hostnames` (`bool`): Flag to allow only valid host names When `null`, the `enforce_hostnames` field will be omitted from the resulting object.\n  - `ext_key_usage` (`list`): Specify the allowed extended key usage constraint on issued certificates. When `null`, the `ext_key_usage` field will be omitted from the resulting object.\n  - `generate_lease` (`bool`): Flag to generate leases with certificates. When `null`, the `generate_lease` field will be omitted from the resulting object.\n  - `issuer_ref` (`string`): Specifies the default issuer of this request. When `null`, the `issuer_ref` field will be omitted from the resulting object.\n  - `key_bits` (`number`): The number of bits of generated keys. When `null`, the `key_bits` field will be omitted from the resulting object.\n  - `key_type` (`string`): The generated key type. When `null`, the `key_type` field will be omitted from the resulting object.\n  - `key_usage` (`list`): Specify the allowed key usage constraint on issued certificates. When `null`, the `key_usage` field will be omitted from the resulting object.\n  - `locality` (`list`): The locality of generated certificates. When `null`, the `locality` field will be omitted from the resulting object.\n  - `max_ttl` (`string`): The maximum TTL. When `null`, the `max_ttl` field will be omitted from the resulting object.\n  - `name` (`string`): Unique name for the role.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `no_store` (`bool`): Flag to not store certificates in the storage backend. When `null`, the `no_store` field will be omitted from the resulting object.\n  - `not_before_duration` (`string`): Specifies the duration by which to backdate the NotBefore property. When `null`, the `not_before_duration` field will be omitted from the resulting object.\n  - `organization` (`list`): The organization of generated certificates. When `null`, the `organization` field will be omitted from the resulting object.\n  - `ou` (`list`): The organization unit of generated certificates. When `null`, the `ou` field will be omitted from the resulting object.\n  - `policy_identifiers` (`list`): Specify the list of allowed policies OIDs. When `null`, the `policy_identifiers` field will be omitted from the resulting object.\n  - `postal_code` (`list`): The postal code of generated certificates. When `null`, the `postal_code` field will be omitted from the resulting object.\n  - `province` (`list`): The province of generated certificates. When `null`, the `province` field will be omitted from the resulting object.\n  - `require_cn` (`bool`): Flag to force CN usage. When `null`, the `require_cn` field will be omitted from the resulting object.\n  - `server_flag` (`bool`): Flag to specify certificates for server use. When `null`, the `server_flag` field will be omitted from the resulting object.\n  - `street_address` (`list`): The street address of generated certificates. When `null`, the `street_address` field will be omitted from the resulting object.\n  - `ttl` (`string`): The TTL. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `use_csr_common_name` (`bool`): Flag to use the CN in the CSR. When `null`, the `use_csr_common_name` field will be omitted from the resulting object.\n  - `use_csr_sans` (`bool`): Flag to use the SANs in the CSR. When `null`, the `use_csr_sans` field will be omitted from the resulting object.\n  - `policy_identifier` (`list[obj]`): Policy identifier block; can only be used with Vault 1.11&#43; When `null`, the `policy_identifier` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.pki_secret_backend_role.policy_identifier.new](#fn-policy_identifiernew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pki_secret_backend_role` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`vault.pki_secret_backend_role.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_role`\nTerraform resource.\n\nUnlike [vault.pki_secret_backend_role.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `allow_any_name` (`bool`): Flag to allow any name When `null`, the `allow_any_name` field will be omitted from the resulting object.\n  - `allow_bare_domains` (`bool`): Flag to allow certificates matching the actual domain. When `null`, the `allow_bare_domains` field will be omitted from the resulting object.\n  - `allow_glob_domains` (`bool`): Flag to allow names containing glob patterns. When `null`, the `allow_glob_domains` field will be omitted from the resulting object.\n  - `allow_ip_sans` (`bool`): Flag to allow IP SANs When `null`, the `allow_ip_sans` field will be omitted from the resulting object.\n  - `allow_localhost` (`bool`): Flag to allow certificates for localhost. When `null`, the `allow_localhost` field will be omitted from the resulting object.\n  - `allow_subdomains` (`bool`): Flag to allow certificates matching subdomains. When `null`, the `allow_subdomains` field will be omitted from the resulting object.\n  - `allow_wildcard_certificates` (`bool`): Flag to allow wildcard certificates When `null`, the `allow_wildcard_certificates` field will be omitted from the resulting object.\n  - `allowed_domains` (`list`): The domains of the role. When `null`, the `allowed_domains` field will be omitted from the resulting object.\n  - `allowed_domains_template` (`bool`): Flag to indicate that `allowed_domains` specifies a template expression (e.g. {{identity.entity.aliases.&lt;mount accessor&gt;.name}}) When `null`, the `allowed_domains_template` field will be omitted from the resulting object.\n  - `allowed_other_sans` (`list`): Defines allowed custom SANs When `null`, the `allowed_other_sans` field will be omitted from the resulting object.\n  - `allowed_serial_numbers` (`list`): Defines allowed Subject serial numbers. When `null`, the `allowed_serial_numbers` field will be omitted from the resulting object.\n  - `allowed_uri_sans` (`list`): Defines allowed URI SANs When `null`, the `allowed_uri_sans` field will be omitted from the resulting object.\n  - `allowed_uri_sans_template` (`bool`): Flag to indicate that `allowed_uri_sans` specifies a template expression (e.g. {{identity.entity.aliases.&lt;mount accessor&gt;.name}}) When `null`, the `allowed_uri_sans_template` field will be omitted from the resulting object.\n  - `allowed_user_ids` (`list`): The allowed User ID&#39;s. When `null`, the `allowed_user_ids` field will be omitted from the resulting object.\n  - `backend` (`string`): The path of the PKI secret backend the resource belongs to.\n  - `basic_constraints_valid_for_non_ca` (`bool`): Flag to mark basic constraints valid when issuing non-CA certificates. When `null`, the `basic_constraints_valid_for_non_ca` field will be omitted from the resulting object.\n  - `client_flag` (`bool`): Flag to specify certificates for client use. When `null`, the `client_flag` field will be omitted from the resulting object.\n  - `code_signing_flag` (`bool`): Flag to specify certificates for code signing use. When `null`, the `code_signing_flag` field will be omitted from the resulting object.\n  - `country` (`list`): The country of generated certificates. When `null`, the `country` field will be omitted from the resulting object.\n  - `email_protection_flag` (`bool`): Flag to specify certificates for email protection use. When `null`, the `email_protection_flag` field will be omitted from the resulting object.\n  - `enforce_hostnames` (`bool`): Flag to allow only valid host names When `null`, the `enforce_hostnames` field will be omitted from the resulting object.\n  - `ext_key_usage` (`list`): Specify the allowed extended key usage constraint on issued certificates. When `null`, the `ext_key_usage` field will be omitted from the resulting object.\n  - `ext_key_usage_oids` (`list`): A list of extended key usage OIDs. When `null`, the `ext_key_usage_oids` field will be omitted from the resulting object.\n  - `generate_lease` (`bool`): Flag to generate leases with certificates. When `null`, the `generate_lease` field will be omitted from the resulting object.\n  - `issuer_ref` (`string`): Specifies the default issuer of this request. When `null`, the `issuer_ref` field will be omitted from the resulting object.\n  - `key_bits` (`number`): The number of bits of generated keys. When `null`, the `key_bits` field will be omitted from the resulting object.\n  - `key_type` (`string`): The generated key type. When `null`, the `key_type` field will be omitted from the resulting object.\n  - `key_usage` (`list`): Specify the allowed key usage constraint on issued certificates. When `null`, the `key_usage` field will be omitted from the resulting object.\n  - `locality` (`list`): The locality of generated certificates. When `null`, the `locality` field will be omitted from the resulting object.\n  - `max_ttl` (`string`): The maximum TTL. When `null`, the `max_ttl` field will be omitted from the resulting object.\n  - `name` (`string`): Unique name for the role.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `no_store` (`bool`): Flag to not store certificates in the storage backend. When `null`, the `no_store` field will be omitted from the resulting object.\n  - `not_before_duration` (`string`): Specifies the duration by which to backdate the NotBefore property. When `null`, the `not_before_duration` field will be omitted from the resulting object.\n  - `organization` (`list`): The organization of generated certificates. When `null`, the `organization` field will be omitted from the resulting object.\n  - `ou` (`list`): The organization unit of generated certificates. When `null`, the `ou` field will be omitted from the resulting object.\n  - `policy_identifiers` (`list`): Specify the list of allowed policies OIDs. When `null`, the `policy_identifiers` field will be omitted from the resulting object.\n  - `postal_code` (`list`): The postal code of generated certificates. When `null`, the `postal_code` field will be omitted from the resulting object.\n  - `province` (`list`): The province of generated certificates. When `null`, the `province` field will be omitted from the resulting object.\n  - `require_cn` (`bool`): Flag to force CN usage. When `null`, the `require_cn` field will be omitted from the resulting object.\n  - `server_flag` (`bool`): Flag to specify certificates for server use. When `null`, the `server_flag` field will be omitted from the resulting object.\n  - `street_address` (`list`): The street address of generated certificates. When `null`, the `street_address` field will be omitted from the resulting object.\n  - `ttl` (`string`): The TTL. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `use_csr_common_name` (`bool`): Flag to use the CN in the CSR. When `null`, the `use_csr_common_name` field will be omitted from the resulting object.\n  - `use_csr_sans` (`bool`): Flag to use the SANs in the CSR. When `null`, the `use_csr_sans` field will be omitted from the resulting object.\n  - `policy_identifier` (`list[obj]`): Policy identifier block; can only be used with Vault 1.11&#43; When `null`, the `policy_identifier` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.pki_secret_backend_role.policy_identifier.new](#fn-policy_identifiernew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pki_secret_backend_role` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     backend,
     name,
@@ -128,6 +130,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     email_protection_flag=null,
     enforce_hostnames=null,
     ext_key_usage=null,
+    ext_key_usage_oids=null,
     generate_lease=null,
     issuer_ref=null,
     key_bits=null,
@@ -173,6 +176,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     email_protection_flag: email_protection_flag,
     enforce_hostnames: enforce_hostnames,
     ext_key_usage: ext_key_usage,
+    ext_key_usage_oids: ext_key_usage_oids,
     generate_lease: generate_lease,
     issuer_ref: issuer_ref,
     key_bits: key_bits,
@@ -429,6 +433,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withExtKeyUsageOids':: d.fn(help='`vault.list.withExtKeyUsageOids` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the ext_key_usage_oids field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `ext_key_usage_oids` field.\n', args=[]),
+  withExtKeyUsageOids(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_role+: {
+        [resourceLabel]+: {
+          ext_key_usage_oids: value,
+        },
+      },
+    },
+  },
   '#withGenerateLease':: d.fn(help='`vault.bool.withGenerateLease` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the generate_lease field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `generate_lease` field.\n', args=[]),
   withGenerateLease(resourceLabel, value): {
     resource+: {
diff --git a/docs/3.x/azure_secret_backend_role.md b/docs/3.x/azure_secret_backend_role.md
index ce3c062..14c92e4 100644
--- a/docs/3.x/azure_secret_backend_role.md
+++ b/docs/3.x/azure_secret_backend_role.md
@@ -26,6 +26,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withNamespace()`](#fn-withnamespace)
 * [`fn withPermanentlyDelete()`](#fn-withpermanentlydelete)
 * [`fn withRole()`](#fn-withrole)
+* [`fn withSignInAudience()`](#fn-withsigninaudience)
+* [`fn withTags()`](#fn-withtags)
 * [`fn withTtl()`](#fn-withttl)
 * [`obj azure_groups`](#obj-azure_groups)
   * [`fn new()`](#fn-azure_groupsnew)
@@ -68,6 +70,8 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
   - `permanently_delete` (`bool`): Indicates whether the applications and service principals created by Vault will be permanently deleted when the corresponding leases expire. When `null`, the `permanently_delete` field will be omitted from the resulting object.
   - `role` (`string`): Name of the role to create
+  - `sign_in_audience` (`string`): Specifies the security principal types that are allowed to sign in to the application. Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount When `null`, the `sign_in_audience` field will be omitted from the resulting object.
+  - `tags` (`list`): Comma-separated strings of Azure tags to attach to an application. When `null`, the `tags` field will be omitted from the resulting object.
   - `ttl` (`string`): Human-friendly description of the mount for the backend. When `null`, the `ttl` field will be omitted from the resulting object.
   - `azure_groups` (`list[obj]`): Set the `azure_groups` field on the resulting resource block. When `null`, the `azure_groups` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.azure_secret_backend_role.azure_groups.new](#fn-azure_groupsnew) constructor.
   - `azure_roles` (`list[obj]`): Set the `azure_roles` field on the resulting resource block. When `null`, the `azure_roles` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.azure_secret_backend_role.azure_roles.new](#fn-azure_rolesnew) constructor.
@@ -101,6 +105,8 @@ injecting into a complete block.
   - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
   - `permanently_delete` (`bool`): Indicates whether the applications and service principals created by Vault will be permanently deleted when the corresponding leases expire. When `null`, the `permanently_delete` field will be omitted from the resulting object.
   - `role` (`string`): Name of the role to create
+  - `sign_in_audience` (`string`): Specifies the security principal types that are allowed to sign in to the application. Valid values are: AzureADMyOrg, AzureADMultipleOrgs, AzureADandPersonalMicrosoftAccount, PersonalMicrosoftAccount When `null`, the `sign_in_audience` field will be omitted from the resulting object.
+  - `tags` (`list`): Comma-separated strings of Azure tags to attach to an application. When `null`, the `tags` field will be omitted from the resulting object.
   - `ttl` (`string`): Human-friendly description of the mount for the backend. When `null`, the `ttl` field will be omitted from the resulting object.
   - `azure_groups` (`list[obj]`): Set the `azure_groups` field on the resulting object. When `null`, the `azure_groups` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.azure_secret_backend_role.azure_groups.new](#fn-azure_groupsnew) constructor.
   - `azure_roles` (`list[obj]`): Set the `azure_roles` field on the resulting object. When `null`, the `azure_roles` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.azure_secret_backend_role.azure_roles.new](#fn-azure_rolesnew) constructor.
@@ -295,6 +301,38 @@ Terraform resource block to set or update the role field.
   - `value` (`string`): The value to set for the `role` field.
 
 
+### fn withSignInAudience
+
+```ts
+withSignInAudience()
+```
+
+`vault.string.withSignInAudience` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the sign_in_audience field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `sign_in_audience` field.
+
+
+### fn withTags
+
+```ts
+withTags()
+```
+
+`vault.list.withTags` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the tags field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `tags` field.
+
+
 ### fn withTtl
 
 ```ts
diff --git a/docs/3.x/database_secret_backend_connection.md b/docs/3.x/database_secret_backend_connection.md
index 6db766a..fb46302 100644
--- a/docs/3.x/database_secret_backend_connection.md
+++ b/docs/3.x/database_secret_backend_connection.md
@@ -1289,11 +1289,15 @@ Terraform sub block.
 
 
 **Args**:
+  - `auth_type` (`string`): Specify alternative authorization type. (Only &#39;gcp_iam&#39; is valid currently) When `null`, the `auth_type` field will be omitted from the resulting object.
   - `connection_url` (`string`): Connection string to use to connect to the database. When `null`, the `connection_url` field will be omitted from the resulting object.
   - `max_connection_lifetime` (`number`): Maximum number of seconds a connection may be reused. When `null`, the `max_connection_lifetime` field will be omitted from the resulting object.
   - `max_idle_connections` (`number`): Maximum number of idle connections to the database. When `null`, the `max_idle_connections` field will be omitted from the resulting object.
   - `max_open_connections` (`number`): Maximum number of open connections to the database. When `null`, the `max_open_connections` field will be omitted from the resulting object.
   - `password` (`string`): The root credential password used in the connection URL When `null`, the `password` field will be omitted from the resulting object.
+  - `service_account_json` (`string`): A JSON encoded credential for use with IAM authorization When `null`, the `service_account_json` field will be omitted from the resulting object.
+  - `tls_ca` (`string`): x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded. When `null`, the `tls_ca` field will be omitted from the resulting object.
+  - `tls_certificate_key` (`string`): x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined. When `null`, the `tls_certificate_key` field will be omitted from the resulting object.
   - `username` (`string`): The root credential username used in the connection URL When `null`, the `username` field will be omitted from the resulting object.
   - `username_template` (`string`): Username generation template. When `null`, the `username_template` field will be omitted from the resulting object.
 
@@ -1318,11 +1322,15 @@ Terraform sub block.
 
 
 **Args**:
+  - `auth_type` (`string`): Specify alternative authorization type. (Only &#39;gcp_iam&#39; is valid currently) When `null`, the `auth_type` field will be omitted from the resulting object.
   - `connection_url` (`string`): Connection string to use to connect to the database. When `null`, the `connection_url` field will be omitted from the resulting object.
   - `max_connection_lifetime` (`number`): Maximum number of seconds a connection may be reused. When `null`, the `max_connection_lifetime` field will be omitted from the resulting object.
   - `max_idle_connections` (`number`): Maximum number of idle connections to the database. When `null`, the `max_idle_connections` field will be omitted from the resulting object.
   - `max_open_connections` (`number`): Maximum number of open connections to the database. When `null`, the `max_open_connections` field will be omitted from the resulting object.
   - `password` (`string`): The root credential password used in the connection URL When `null`, the `password` field will be omitted from the resulting object.
+  - `service_account_json` (`string`): A JSON encoded credential for use with IAM authorization When `null`, the `service_account_json` field will be omitted from the resulting object.
+  - `tls_ca` (`string`): x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded. When `null`, the `tls_ca` field will be omitted from the resulting object.
+  - `tls_certificate_key` (`string`): x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined. When `null`, the `tls_certificate_key` field will be omitted from the resulting object.
   - `username` (`string`): The root credential username used in the connection URL When `null`, the `username` field will be omitted from the resulting object.
   - `username_template` (`string`): Username generation template. When `null`, the `username_template` field will be omitted from the resulting object.
 
@@ -1347,11 +1355,15 @@ Terraform sub block.
 
 
 **Args**:
+  - `auth_type` (`string`): Specify alternative authorization type. (Only &#39;gcp_iam&#39; is valid currently) When `null`, the `auth_type` field will be omitted from the resulting object.
   - `connection_url` (`string`): Connection string to use to connect to the database. When `null`, the `connection_url` field will be omitted from the resulting object.
   - `max_connection_lifetime` (`number`): Maximum number of seconds a connection may be reused. When `null`, the `max_connection_lifetime` field will be omitted from the resulting object.
   - `max_idle_connections` (`number`): Maximum number of idle connections to the database. When `null`, the `max_idle_connections` field will be omitted from the resulting object.
   - `max_open_connections` (`number`): Maximum number of open connections to the database. When `null`, the `max_open_connections` field will be omitted from the resulting object.
   - `password` (`string`): The root credential password used in the connection URL When `null`, the `password` field will be omitted from the resulting object.
+  - `service_account_json` (`string`): A JSON encoded credential for use with IAM authorization When `null`, the `service_account_json` field will be omitted from the resulting object.
+  - `tls_ca` (`string`): x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded. When `null`, the `tls_ca` field will be omitted from the resulting object.
+  - `tls_certificate_key` (`string`): x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined. When `null`, the `tls_certificate_key` field will be omitted from the resulting object.
   - `username` (`string`): The root credential username used in the connection URL When `null`, the `username` field will be omitted from the resulting object.
   - `username_template` (`string`): Username generation template. When `null`, the `username_template` field will be omitted from the resulting object.
 
diff --git a/docs/3.x/database_secrets_mount.md b/docs/3.x/database_secrets_mount.md
index 7fcc20c..c63bd2c 100644
--- a/docs/3.x/database_secrets_mount.md
+++ b/docs/3.x/database_secrets_mount.md
@@ -1420,6 +1420,7 @@ Terraform sub block.
 
 **Args**:
   - `allowed_roles` (`list`): A list of roles that are allowed to use this connection. When `null`, the `allowed_roles` field will be omitted from the resulting object.
+  - `auth_type` (`string`): Specify alternative authorization type. (Only &#39;gcp_iam&#39; is valid currently) When `null`, the `auth_type` field will be omitted from the resulting object.
   - `connection_url` (`string`): Connection string to use to connect to the database. When `null`, the `connection_url` field will be omitted from the resulting object.
   - `data` (`obj`): A map of sensitive data to pass to the endpoint. Useful for templated connection strings. When `null`, the `data` field will be omitted from the resulting object.
   - `max_connection_lifetime` (`number`): Maximum number of seconds a connection may be reused. When `null`, the `max_connection_lifetime` field will be omitted from the resulting object.
@@ -1429,6 +1430,9 @@ Terraform sub block.
   - `password` (`string`): The root credential password used in the connection URL When `null`, the `password` field will be omitted from the resulting object.
   - `plugin_name` (`string`): Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types. When `null`, the `plugin_name` field will be omitted from the resulting object.
   - `root_rotation_statements` (`list`): A list of database statements to be executed to rotate the root user&#39;s credentials. When `null`, the `root_rotation_statements` field will be omitted from the resulting object.
+  - `service_account_json` (`string`): A JSON encoded credential for use with IAM authorization When `null`, the `service_account_json` field will be omitted from the resulting object.
+  - `tls_ca` (`string`): x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded. When `null`, the `tls_ca` field will be omitted from the resulting object.
+  - `tls_certificate_key` (`string`): x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined. When `null`, the `tls_certificate_key` field will be omitted from the resulting object.
   - `username` (`string`): The root credential username used in the connection URL When `null`, the `username` field will be omitted from the resulting object.
   - `username_template` (`string`): Username generation template. When `null`, the `username_template` field will be omitted from the resulting object.
   - `verify_connection` (`bool`): Specifies if the connection is verified during initial configuration. When `null`, the `verify_connection` field will be omitted from the resulting object.
@@ -1455,6 +1459,7 @@ Terraform sub block.
 
 **Args**:
   - `allowed_roles` (`list`): A list of roles that are allowed to use this connection. When `null`, the `allowed_roles` field will be omitted from the resulting object.
+  - `auth_type` (`string`): Specify alternative authorization type. (Only &#39;gcp_iam&#39; is valid currently) When `null`, the `auth_type` field will be omitted from the resulting object.
   - `connection_url` (`string`): Connection string to use to connect to the database. When `null`, the `connection_url` field will be omitted from the resulting object.
   - `data` (`obj`): A map of sensitive data to pass to the endpoint. Useful for templated connection strings. When `null`, the `data` field will be omitted from the resulting object.
   - `max_connection_lifetime` (`number`): Maximum number of seconds a connection may be reused. When `null`, the `max_connection_lifetime` field will be omitted from the resulting object.
@@ -1464,6 +1469,9 @@ Terraform sub block.
   - `password` (`string`): The root credential password used in the connection URL When `null`, the `password` field will be omitted from the resulting object.
   - `plugin_name` (`string`): Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types. When `null`, the `plugin_name` field will be omitted from the resulting object.
   - `root_rotation_statements` (`list`): A list of database statements to be executed to rotate the root user&#39;s credentials. When `null`, the `root_rotation_statements` field will be omitted from the resulting object.
+  - `service_account_json` (`string`): A JSON encoded credential for use with IAM authorization When `null`, the `service_account_json` field will be omitted from the resulting object.
+  - `tls_ca` (`string`): x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded. When `null`, the `tls_ca` field will be omitted from the resulting object.
+  - `tls_certificate_key` (`string`): x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined. When `null`, the `tls_certificate_key` field will be omitted from the resulting object.
   - `username` (`string`): The root credential username used in the connection URL When `null`, the `username` field will be omitted from the resulting object.
   - `username_template` (`string`): Username generation template. When `null`, the `username_template` field will be omitted from the resulting object.
   - `verify_connection` (`bool`): Specifies if the connection is verified during initial configuration. When `null`, the `verify_connection` field will be omitted from the resulting object.
@@ -1490,6 +1498,7 @@ Terraform sub block.
 
 **Args**:
   - `allowed_roles` (`list`): A list of roles that are allowed to use this connection. When `null`, the `allowed_roles` field will be omitted from the resulting object.
+  - `auth_type` (`string`): Specify alternative authorization type. (Only &#39;gcp_iam&#39; is valid currently) When `null`, the `auth_type` field will be omitted from the resulting object.
   - `connection_url` (`string`): Connection string to use to connect to the database. When `null`, the `connection_url` field will be omitted from the resulting object.
   - `data` (`obj`): A map of sensitive data to pass to the endpoint. Useful for templated connection strings. When `null`, the `data` field will be omitted from the resulting object.
   - `max_connection_lifetime` (`number`): Maximum number of seconds a connection may be reused. When `null`, the `max_connection_lifetime` field will be omitted from the resulting object.
@@ -1499,6 +1508,9 @@ Terraform sub block.
   - `password` (`string`): The root credential password used in the connection URL When `null`, the `password` field will be omitted from the resulting object.
   - `plugin_name` (`string`): Specifies the name of the plugin to use for this connection. Must be prefixed with the name of one of the supported database engine types. When `null`, the `plugin_name` field will be omitted from the resulting object.
   - `root_rotation_statements` (`list`): A list of database statements to be executed to rotate the root user&#39;s credentials. When `null`, the `root_rotation_statements` field will be omitted from the resulting object.
+  - `service_account_json` (`string`): A JSON encoded credential for use with IAM authorization When `null`, the `service_account_json` field will be omitted from the resulting object.
+  - `tls_ca` (`string`): x509 CA file for validating the certificate presented by the MySQL server. Must be PEM encoded. When `null`, the `tls_ca` field will be omitted from the resulting object.
+  - `tls_certificate_key` (`string`): x509 certificate for connecting to the database. This must be a PEM encoded version of the private key and the certificate combined. When `null`, the `tls_certificate_key` field will be omitted from the resulting object.
   - `username` (`string`): The root credential username used in the connection URL When `null`, the `username` field will be omitted from the resulting object.
   - `username_template` (`string`): Username generation template. When `null`, the `username_template` field will be omitted from the resulting object.
   - `verify_connection` (`bool`): Specifies if the connection is verified during initial configuration. When `null`, the `verify_connection` field will be omitted from the resulting object.
diff --git a/docs/3.x/gcp_auth_backend.md b/docs/3.x/gcp_auth_backend.md
index da2708e..7756b45 100644
--- a/docs/3.x/gcp_auth_backend.md
+++ b/docs/3.x/gcp_auth_backend.md
@@ -27,6 +27,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withPath()`](#fn-withpath)
 * [`fn withPrivateKeyId()`](#fn-withprivatekeyid)
 * [`fn withProjectId()`](#fn-withprojectid)
+* [`fn withTune()`](#fn-withtune)
 * [`obj custom_endpoint`](#obj-custom_endpoint)
   * [`fn new()`](#fn-custom_endpointnew)
 
@@ -69,6 +70,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `path` (`string`): Set the `path` field on the resulting resource block. When `null`, the `path` field will be omitted from the resulting object.
   - `private_key_id` (`string`): Set the `private_key_id` field on the resulting resource block. When `null`, the `private_key_id` field will be omitted from the resulting object.
   - `project_id` (`string`): Set the `project_id` field on the resulting resource block. When `null`, the `project_id` field will be omitted from the resulting object.
+  - `tune` (`list`): Set the `tune` field on the resulting resource block. When `null`, the `tune` field will be omitted from the resulting object.
   - `custom_endpoint` (`list[obj]`): Specifies overrides to service endpoints used when making API requests to GCP. When `null`, the `custom_endpoint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.gcp_auth_backend.custom_endpoint.new](#fn-custom_endpointnew) constructor.
 
 **Returns**:
@@ -103,6 +105,7 @@ injecting into a complete block.
   - `path` (`string`): Set the `path` field on the resulting object. When `null`, the `path` field will be omitted from the resulting object.
   - `private_key_id` (`string`): Set the `private_key_id` field on the resulting object. When `null`, the `private_key_id` field will be omitted from the resulting object.
   - `project_id` (`string`): Set the `project_id` field on the resulting object. When `null`, the `project_id` field will be omitted from the resulting object.
+  - `tune` (`list`): Set the `tune` field on the resulting object. When `null`, the `tune` field will be omitted from the resulting object.
   - `custom_endpoint` (`list[obj]`): Specifies overrides to service endpoints used when making API requests to GCP. When `null`, the `custom_endpoint` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.gcp_auth_backend.custom_endpoint.new](#fn-custom_endpointnew) constructor.
 
 **Returns**:
@@ -306,6 +309,22 @@ Terraform resource block to set or update the project_id field.
   - `value` (`string`): The value to set for the `project_id` field.
 
 
+### fn withTune
+
+```ts
+withTune()
+```
+
+`vault.list.withTune` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the tune field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `tune` field.
+
+
 ## obj custom_endpoint
 
 
diff --git a/docs/3.x/kubernetes_auth_backend_config.md b/docs/3.x/kubernetes_auth_backend_config.md
index 565fb3e..08b1a4b 100644
--- a/docs/3.x/kubernetes_auth_backend_config.md
+++ b/docs/3.x/kubernetes_auth_backend_config.md
@@ -62,7 +62,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `kubernetes_host` (`string`): Host must be a host string, a host:port pair, or a URL to the base of the Kubernetes API server.
   - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
   - `pem_keys` (`list`): Optional list of PEM-formatted public keys or certificates used to verify the signatures of Kubernetes service account JWTs. If a certificate is given, its public key will be extracted. Not every installation of Kubernetes exposes these keys. When `null`, the `pem_keys` field will be omitted from the resulting object.
-  - `token_reviewer_jwt` (`string`): A service account JWT used to access the TokenReview API to validate other JWTs during login. If not set the JWT used for login will be used to access the API. When `null`, the `token_reviewer_jwt` field will be omitted from the resulting object.
+  - `token_reviewer_jwt` (`string`): A service account JWT (or other token) used as a bearer token to access the TokenReview API to validate other JWTs during login. If not set the JWT used for login will be used to access the API. When `null`, the `token_reviewer_jwt` field will be omitted from the resulting object.
 
 **Returns**:
 - A mixin object that injects the new resource into the root Terraform configuration.
@@ -94,7 +94,7 @@ injecting into a complete block.
   - `kubernetes_host` (`string`): Host must be a host string, a host:port pair, or a URL to the base of the Kubernetes API server.
   - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
   - `pem_keys` (`list`): Optional list of PEM-formatted public keys or certificates used to verify the signatures of Kubernetes service account JWTs. If a certificate is given, its public key will be extracted. Not every installation of Kubernetes exposes these keys. When `null`, the `pem_keys` field will be omitted from the resulting object.
-  - `token_reviewer_jwt` (`string`): A service account JWT used to access the TokenReview API to validate other JWTs during login. If not set the JWT used for login will be used to access the API. When `null`, the `token_reviewer_jwt` field will be omitted from the resulting object.
+  - `token_reviewer_jwt` (`string`): A service account JWT (or other token) used as a bearer token to access the TokenReview API to validate other JWTs during login. If not set the JWT used for login will be used to access the API. When `null`, the `token_reviewer_jwt` field will be omitted from the resulting object.
 
 **Returns**:
   - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `kubernetes_auth_backend_config` resource into the root Terraform configuration.
diff --git a/docs/3.x/pki_secret_backend_role.md b/docs/3.x/pki_secret_backend_role.md
index 89994c8..6a18649 100644
--- a/docs/3.x/pki_secret_backend_role.md
+++ b/docs/3.x/pki_secret_backend_role.md
@@ -37,6 +37,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withEmailProtectionFlag()`](#fn-withemailprotectionflag)
 * [`fn withEnforceHostnames()`](#fn-withenforcehostnames)
 * [`fn withExtKeyUsage()`](#fn-withextkeyusage)
+* [`fn withExtKeyUsageOids()`](#fn-withextkeyusageoids)
 * [`fn withGenerateLease()`](#fn-withgeneratelease)
 * [`fn withIssuerRef()`](#fn-withissuerref)
 * [`fn withKeyBits()`](#fn-withkeybits)
@@ -115,6 +116,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `email_protection_flag` (`bool`): Flag to specify certificates for email protection use. When `null`, the `email_protection_flag` field will be omitted from the resulting object.
   - `enforce_hostnames` (`bool`): Flag to allow only valid host names When `null`, the `enforce_hostnames` field will be omitted from the resulting object.
   - `ext_key_usage` (`list`): Specify the allowed extended key usage constraint on issued certificates. When `null`, the `ext_key_usage` field will be omitted from the resulting object.
+  - `ext_key_usage_oids` (`list`): A list of extended key usage OIDs. When `null`, the `ext_key_usage_oids` field will be omitted from the resulting object.
   - `generate_lease` (`bool`): Flag to generate leases with certificates. When `null`, the `generate_lease` field will be omitted from the resulting object.
   - `issuer_ref` (`string`): Specifies the default issuer of this request. When `null`, the `issuer_ref` field will be omitted from the resulting object.
   - `key_bits` (`number`): The number of bits of generated keys. When `null`, the `key_bits` field will be omitted from the resulting object.
@@ -183,6 +185,7 @@ injecting into a complete block.
   - `email_protection_flag` (`bool`): Flag to specify certificates for email protection use. When `null`, the `email_protection_flag` field will be omitted from the resulting object.
   - `enforce_hostnames` (`bool`): Flag to allow only valid host names When `null`, the `enforce_hostnames` field will be omitted from the resulting object.
   - `ext_key_usage` (`list`): Specify the allowed extended key usage constraint on issued certificates. When `null`, the `ext_key_usage` field will be omitted from the resulting object.
+  - `ext_key_usage_oids` (`list`): A list of extended key usage OIDs. When `null`, the `ext_key_usage_oids` field will be omitted from the resulting object.
   - `generate_lease` (`bool`): Flag to generate leases with certificates. When `null`, the `generate_lease` field will be omitted from the resulting object.
   - `issuer_ref` (`string`): Specifies the default issuer of this request. When `null`, the `issuer_ref` field will be omitted from the resulting object.
   - `key_bits` (`number`): The number of bits of generated keys. When `null`, the `key_bits` field will be omitted from the resulting object.
@@ -563,6 +566,22 @@ Terraform resource block to set or update the ext_key_usage field.
   - `value` (`list`): The value to set for the `ext_key_usage` field.
 
 
+### fn withExtKeyUsageOids
+
+```ts
+withExtKeyUsageOids()
+```
+
+`vault.list.withExtKeyUsageOids` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the ext_key_usage_oids field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `ext_key_usage_oids` field.
+
+
 ### fn withGenerateLease
 
 ```ts