kcr_external_secrets_io 3.20260124.94613

// WARNING: generated by kopium - manual changes will be overwritten
// kopium command: kopium --docs --derive=Default --derive=PartialEq --smart-derive-elision --filename crd-catalog/external-secrets/external-secrets/external-secrets.io/v1/clustersecretstores.yaml
// kopium version: 0.22.5

#[allow(unused_imports)]
mod prelude {
    pub use kube::CustomResource;
    pub use serde::{Serialize, Deserialize};
    pub use std::collections::BTreeMap;
    pub use k8s_openapi::apimachinery::pkg::apis::meta::v1::Condition;
}
use self::prelude::*;

/// SecretStoreSpec defines the desired state of SecretStore.
#[derive(CustomResource, Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
#[kube(group = "external-secrets.io", version = "v1", kind = "ClusterSecretStore", plural = "clustersecretstores")]
#[kube(status = "ClusterSecretStoreStatus")]
#[kube(schema = "disabled")]
#[kube(derive="Default")]
#[kube(derive="PartialEq")]
pub struct ClusterSecretStoreSpec {
    /// Used to constrain a ClusterSecretStore to specific namespaces. Relevant only to ClusterSecretStore.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub conditions: Option<Vec<ClusterSecretStoreConditions>>,
    /// Used to select the correct ESO controller (think: ingress.ingressClassName)
    /// The ESO controller is instantiated with a specific controller name and filters ES based on this property
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub controller: Option<String>,
    /// Used to configure the provider. Only one provider may be set
    pub provider: ClusterSecretStoreProvider,
    /// Used to configure store refresh interval in seconds. Empty or 0 will default to the controller config.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "refreshInterval")]
    pub refresh_interval: Option<i64>,
    /// Used to configure HTTP retries on failures.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "retrySettings")]
    pub retry_settings: Option<ClusterSecretStoreRetrySettings>,
}

/// ClusterSecretStoreCondition describes a condition by which to choose namespaces to process ExternalSecrets in
/// for a ClusterSecretStore instance.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreConditions {
    /// Choose namespaces by using regex matching
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "namespaceRegexes")]
    pub namespace_regexes: Option<Vec<String>>,
    /// Choose namespace using a labelSelector
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "namespaceSelector")]
    pub namespace_selector: Option<ClusterSecretStoreConditionsNamespaceSelector>,
    /// Choose namespaces by name
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespaces: Option<Vec<String>>,
}

/// Choose namespace using a labelSelector
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreConditionsNamespaceSelector {
    /// matchExpressions is a list of label selector requirements. The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchExpressions")]
    pub match_expressions: Option<Vec<ClusterSecretStoreConditionsNamespaceSelectorMatchExpressions>>,
    /// matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels
    /// map is equivalent to an element of matchExpressions, whose key field is "key", the
    /// operator is "In", and the values array contains only "value". The requirements are ANDed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "matchLabels")]
    pub match_labels: Option<BTreeMap<String, String>>,
}

/// A label selector requirement is a selector that contains values, a key, and an operator that
/// relates the key and values.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreConditionsNamespaceSelectorMatchExpressions {
    /// key is the label key that the selector applies to.
    pub key: String,
    /// operator represents a key's relationship to a set of values.
    /// Valid operators are In, NotIn, Exists and DoesNotExist.
    pub operator: String,
    /// values is an array of string values. If the operator is In or NotIn,
    /// the values array must be non-empty. If the operator is Exists or DoesNotExist,
    /// the values array must be empty. This array is replaced during a strategic
    /// merge patch.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub values: Option<Vec<String>>,
}

/// Used to configure the provider. Only one provider may be set
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProvider {
    /// Akeyless configures this store to sync secrets using Akeyless Vault provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub akeyless: Option<ClusterSecretStoreProviderAkeyless>,
    /// Alibaba configures this store to sync secrets using Alibaba Cloud provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub alibaba: Option<ClusterSecretStoreProviderAlibaba>,
    /// AWS configures this store to sync secrets using AWS Secret Manager provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub aws: Option<ClusterSecretStoreProviderAws>,
    /// AzureKV configures this store to sync secrets using Azure Key Vault provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub azurekv: Option<ClusterSecretStoreProviderAzurekv>,
    /// Barbican configures this store to sync secrets using the OpenStack Barbican provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub barbican: Option<ClusterSecretStoreProviderBarbican>,
    /// Beyondtrust configures this store to sync secrets using Password Safe provider.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub beyondtrust: Option<ClusterSecretStoreProviderBeyondtrust>,
    /// BitwardenSecretsManager configures this store to sync secrets using BitwardenSecretsManager provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub bitwardensecretsmanager: Option<ClusterSecretStoreProviderBitwardensecretsmanager>,
    /// Chef configures this store to sync secrets with chef server
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub chef: Option<ClusterSecretStoreProviderChef>,
    /// CloudruSM configures this store to sync secrets using the Cloud.ru Secret Manager provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub cloudrusm: Option<ClusterSecretStoreProviderCloudrusm>,
    /// Conjur configures this store to sync secrets using conjur provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub conjur: Option<ClusterSecretStoreProviderConjur>,
    /// Delinea DevOps Secrets Vault
    /// <https://docs.delinea.com/online-help/products/devops-secrets-vault/current>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub delinea: Option<ClusterSecretStoreProviderDelinea>,
    /// Device42 configures this store to sync secrets using the Device42 provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub device42: Option<ClusterSecretStoreProviderDevice42>,
    /// Doppler configures this store to sync secrets using the Doppler provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub doppler: Option<ClusterSecretStoreProviderDoppler>,
    /// DVLS configures this store to sync secrets using Devolutions Server provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub dvls: Option<ClusterSecretStoreProviderDvls>,
    /// Fake configures a store with static key/value pairs
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub fake: Option<ClusterSecretStoreProviderFake>,
    /// Fortanix configures this store to sync secrets using the Fortanix provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub fortanix: Option<ClusterSecretStoreProviderFortanix>,
    /// GCPSM configures this store to sync secrets using Google Cloud Platform Secret Manager provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub gcpsm: Option<ClusterSecretStoreProviderGcpsm>,
    /// Github configures this store to push GitHub Actions secrets using the GitHub API provider.
    /// Note: This provider only supports write operations (PushSecret) and cannot fetch secrets from GitHub
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub github: Option<ClusterSecretStoreProviderGithub>,
    /// GitLab configures this store to sync secrets using GitLab Variables provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub gitlab: Option<ClusterSecretStoreProviderGitlab>,
    /// IBM configures this store to sync secrets using IBM Cloud provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub ibm: Option<ClusterSecretStoreProviderIbm>,
    /// Infisical configures this store to sync secrets using the Infisical provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub infisical: Option<ClusterSecretStoreProviderInfisical>,
    /// KeeperSecurity configures this store to sync secrets using the KeeperSecurity provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub keepersecurity: Option<ClusterSecretStoreProviderKeepersecurity>,
    /// Kubernetes configures this store to sync secrets using a Kubernetes cluster provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub kubernetes: Option<ClusterSecretStoreProviderKubernetes>,
    /// Ngrok configures this store to sync secrets using the ngrok provider.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub ngrok: Option<ClusterSecretStoreProviderNgrok>,
    /// Onboardbase configures this store to sync secrets using the Onboardbase provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub onboardbase: Option<ClusterSecretStoreProviderOnboardbase>,
    /// OnePassword configures this store to sync secrets using the 1Password Cloud provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub onepassword: Option<ClusterSecretStoreProviderOnepassword>,
    /// OnePasswordSDK configures this store to use 1Password's new Go SDK to sync secrets.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "onepasswordSDK")]
    pub onepassword_sdk: Option<ClusterSecretStoreProviderOnepasswordSdk>,
    /// Oracle configures this store to sync secrets using Oracle Vault provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub oracle: Option<ClusterSecretStoreProviderOracle>,
    /// PassboltProvider provides access to Passbolt secrets manager.
    /// See: <https://www.passbolt.com.>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub passbolt: Option<ClusterSecretStoreProviderPassbolt>,
    /// PasswordDepotProvider configures a store to sync secrets with a Password Depot instance.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub passworddepot: Option<ClusterSecretStoreProviderPassworddepot>,
    /// Previder configures this store to sync secrets using the Previder provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub previder: Option<ClusterSecretStoreProviderPrevider>,
    /// Pulumi configures this store to sync secrets using the Pulumi provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub pulumi: Option<ClusterSecretStoreProviderPulumi>,
    /// Scaleway configures this store to sync secrets using the Scaleway provider.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub scaleway: Option<ClusterSecretStoreProviderScaleway>,
    /// SecretServer configures this store to sync secrets using SecretServer provider
    /// <https://docs.delinea.com/online-help/secret-server/start.htm>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub secretserver: Option<ClusterSecretStoreProviderSecretserver>,
    /// Senhasegura configures this store to sync secrets using senhasegura provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub senhasegura: Option<ClusterSecretStoreProviderSenhasegura>,
    /// Vault configures this store to sync secrets using the HashiCorp Vault provider.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub vault: Option<ClusterSecretStoreProviderVault>,
    /// Volcengine configures this store to sync secrets using the Volcengine provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub volcengine: Option<ClusterSecretStoreProviderVolcengine>,
    /// Webhook configures this store to sync secrets using a generic templated webhook
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub webhook: Option<ClusterSecretStoreProviderWebhook>,
    /// YandexCertificateManager configures this store to sync secrets using Yandex Certificate Manager provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub yandexcertificatemanager: Option<ClusterSecretStoreProviderYandexcertificatemanager>,
    /// YandexLockbox configures this store to sync secrets using Yandex Lockbox provider
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub yandexlockbox: Option<ClusterSecretStoreProviderYandexlockbox>,
}

/// Akeyless configures this store to sync secrets using Akeyless Vault provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAkeyless {
    /// Akeyless GW API Url from which the secrets to be fetched from.
    #[serde(rename = "akeylessGWApiURL")]
    pub akeyless_gw_api_url: String,
    /// Auth configures how the operator authenticates with Akeyless.
    #[serde(rename = "authSecretRef")]
    pub auth_secret_ref: ClusterSecretStoreProviderAkeylessAuthSecretRef,
    /// PEM/base64 encoded CA bundle used to validate Akeyless Gateway certificate. Only used
    /// if the AkeylessGWApiURL URL is using HTTPS protocol. If not set the system root certificates
    /// are used to validate the TLS connection.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caBundle")]
    pub ca_bundle: Option<String>,
    /// The provider for the CA bundle to use to validate Akeyless Gateway certificate.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caProvider")]
    pub ca_provider: Option<ClusterSecretStoreProviderAkeylessCaProvider>,
}

/// Auth configures how the operator authenticates with Akeyless.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAkeylessAuthSecretRef {
    /// Kubernetes authenticates with Akeyless by passing the ServiceAccount
    /// token stored in the named Secret resource.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "kubernetesAuth")]
    pub kubernetes_auth: Option<ClusterSecretStoreProviderAkeylessAuthSecretRefKubernetesAuth>,
    /// Reference to a Secret that contains the details
    /// to authenticate with Akeyless.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderAkeylessAuthSecretRefSecretRef>,
}

/// Kubernetes authenticates with Akeyless by passing the ServiceAccount
/// token stored in the named Secret resource.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAkeylessAuthSecretRefKubernetesAuth {
    /// the Akeyless Kubernetes auth-method access-id
    #[serde(rename = "accessID")]
    pub access_id: String,
    /// Kubernetes-auth configuration name in Akeyless-Gateway
    #[serde(rename = "k8sConfName")]
    pub k8s_conf_name: String,
    /// Optional secret field containing a Kubernetes ServiceAccount JWT used
    /// for authenticating with Akeyless. If a name is specified without a key,
    /// `token` is the default. If one is not specified, the one bound to
    /// the controller will be used.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderAkeylessAuthSecretRefKubernetesAuthSecretRef>,
    /// Optional service account field containing the name of a kubernetes ServiceAccount.
    /// If the service account is specified, the service account secret token JWT will be used
    /// for authenticating with Akeyless. If the service account selector is not supplied,
    /// the secretRef will be used instead.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceAccountRef")]
    pub service_account_ref: Option<ClusterSecretStoreProviderAkeylessAuthSecretRefKubernetesAuthServiceAccountRef>,
}

/// Optional secret field containing a Kubernetes ServiceAccount JWT used
/// for authenticating with Akeyless. If a name is specified without a key,
/// `token` is the default. If one is not specified, the one bound to
/// the controller will be used.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAkeylessAuthSecretRefKubernetesAuthSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Optional service account field containing the name of a kubernetes ServiceAccount.
/// If the service account is specified, the service account secret token JWT will be used
/// for authenticating with Akeyless. If the service account selector is not supplied,
/// the secretRef will be used instead.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAkeylessAuthSecretRefKubernetesAuthServiceAccountRef {
    /// Audience specifies the `aud` claim for the service account token
    /// If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
    /// then this audiences will be appended to the list
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audiences: Option<Vec<String>>,
    /// The name of the ServiceAccount resource being referred to.
    pub name: String,
    /// Namespace of the resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Reference to a Secret that contains the details
/// to authenticate with Akeyless.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAkeylessAuthSecretRefSecretRef {
    /// The SecretAccessID is used for authentication
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "accessID")]
    pub access_id: Option<ClusterSecretStoreProviderAkeylessAuthSecretRefSecretRefAccessId>,
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "accessType")]
    pub access_type: Option<ClusterSecretStoreProviderAkeylessAuthSecretRefSecretRefAccessType>,
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "accessTypeParam")]
    pub access_type_param: Option<ClusterSecretStoreProviderAkeylessAuthSecretRefSecretRefAccessTypeParam>,
}

/// The SecretAccessID is used for authentication
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAkeylessAuthSecretRefSecretRefAccessId {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAkeylessAuthSecretRefSecretRefAccessType {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAkeylessAuthSecretRefSecretRefAccessTypeParam {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// The provider for the CA bundle to use to validate Akeyless Gateway certificate.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub struct ClusterSecretStoreProviderAkeylessCaProvider {
    /// The key where the CA certificate can be found in the Secret or ConfigMap.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the object located at the provider type.
    pub name: String,
    /// The namespace the Provider type is in.
    /// Can only be defined when used in a ClusterSecretStore.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
    /// The type of provider to use such as "Secret", or "ConfigMap".
    #[serde(rename = "type")]
    pub r#type: ClusterSecretStoreProviderAkeylessCaProviderType,
}

/// The provider for the CA bundle to use to validate Akeyless Gateway certificate.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum ClusterSecretStoreProviderAkeylessCaProviderType {
    Secret,
    ConfigMap,
}

/// Alibaba configures this store to sync secrets using Alibaba Cloud provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAlibaba {
    /// AlibabaAuth contains a secretRef for credentials.
    pub auth: ClusterSecretStoreProviderAlibabaAuth,
    /// Alibaba Region to be used for the provider
    #[serde(rename = "regionID")]
    pub region_id: String,
}

/// AlibabaAuth contains a secretRef for credentials.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAlibabaAuth {
    /// AlibabaRRSAAuth authenticates against Alibaba using RRSA.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub rrsa: Option<ClusterSecretStoreProviderAlibabaAuthRrsa>,
    /// AlibabaAuthSecretRef holds secret references for Alibaba credentials.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderAlibabaAuthSecretRef>,
}

/// AlibabaRRSAAuth authenticates against Alibaba using RRSA.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAlibabaAuthRrsa {
    #[serde(rename = "oidcProviderArn")]
    pub oidc_provider_arn: String,
    #[serde(rename = "oidcTokenFilePath")]
    pub oidc_token_file_path: String,
    #[serde(rename = "roleArn")]
    pub role_arn: String,
    #[serde(rename = "sessionName")]
    pub session_name: String,
}

/// AlibabaAuthSecretRef holds secret references for Alibaba credentials.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAlibabaAuthSecretRef {
    /// The AccessKeyID is used for authentication
    #[serde(rename = "accessKeyIDSecretRef")]
    pub access_key_id_secret_ref: ClusterSecretStoreProviderAlibabaAuthSecretRefAccessKeyIdSecretRef,
    /// The AccessKeySecret is used for authentication
    #[serde(rename = "accessKeySecretSecretRef")]
    pub access_key_secret_secret_ref: ClusterSecretStoreProviderAlibabaAuthSecretRefAccessKeySecretSecretRef,
}

/// The AccessKeyID is used for authentication
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAlibabaAuthSecretRefAccessKeyIdSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// The AccessKeySecret is used for authentication
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAlibabaAuthSecretRefAccessKeySecretSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// AWS configures this store to sync secrets using AWS Secret Manager provider
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub struct ClusterSecretStoreProviderAws {
    /// AdditionalRoles is a chained list of Role ARNs which the provider will sequentially assume before assuming the Role
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "additionalRoles")]
    pub additional_roles: Option<Vec<String>>,
    /// Auth defines the information necessary to authenticate against AWS
    /// if not set aws sdk will infer credentials from your environment
    /// see: <https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub auth: Option<ClusterSecretStoreProviderAwsAuth>,
    /// AWS External ID set on assumed IAM roles
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "externalID")]
    pub external_id: Option<String>,
    /// Prefix adds a prefix to all retrieved values.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub prefix: Option<String>,
    /// AWS Region to be used for the provider
    pub region: String,
    /// Role is a Role ARN which the provider will assume
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub role: Option<String>,
    /// SecretsManager defines how the provider behaves when interacting with AWS SecretsManager
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretsManager")]
    pub secrets_manager: Option<ClusterSecretStoreProviderAwsSecretsManager>,
    /// Service defines which service should be used to fetch the secrets
    pub service: ClusterSecretStoreProviderAwsService,
    /// AWS STS assume role session tags
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "sessionTags")]
    pub session_tags: Option<Vec<ClusterSecretStoreProviderAwsSessionTags>>,
    /// AWS STS assume role transitive session tags. Required when multiple rules are used with the provider
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "transitiveTagKeys")]
    pub transitive_tag_keys: Option<Vec<String>>,
}

/// Auth defines the information necessary to authenticate against AWS
/// if not set aws sdk will infer credentials from your environment
/// see: <https://docs.aws.amazon.com/sdk-for-go/v1/developer-guide/configuring-sdk.html#specifying-credentials>
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAwsAuth {
    /// AWSJWTAuth stores reference to Authenticate against AWS using service account tokens.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub jwt: Option<ClusterSecretStoreProviderAwsAuthJwt>,
    /// AWSAuthSecretRef holds secret references for AWS credentials
    /// both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderAwsAuthSecretRef>,
}

/// AWSJWTAuth stores reference to Authenticate against AWS using service account tokens.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAwsAuthJwt {
    /// ServiceAccountSelector is a reference to a ServiceAccount resource.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceAccountRef")]
    pub service_account_ref: Option<ClusterSecretStoreProviderAwsAuthJwtServiceAccountRef>,
}

/// ServiceAccountSelector is a reference to a ServiceAccount resource.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAwsAuthJwtServiceAccountRef {
    /// Audience specifies the `aud` claim for the service account token
    /// If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
    /// then this audiences will be appended to the list
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audiences: Option<Vec<String>>,
    /// The name of the ServiceAccount resource being referred to.
    pub name: String,
    /// Namespace of the resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// AWSAuthSecretRef holds secret references for AWS credentials
/// both AccessKeyID and SecretAccessKey must be defined in order to properly authenticate.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAwsAuthSecretRef {
    /// The AccessKeyID is used for authentication
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "accessKeyIDSecretRef")]
    pub access_key_id_secret_ref: Option<ClusterSecretStoreProviderAwsAuthSecretRefAccessKeyIdSecretRef>,
    /// The SecretAccessKey is used for authentication
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretAccessKeySecretRef")]
    pub secret_access_key_secret_ref: Option<ClusterSecretStoreProviderAwsAuthSecretRefSecretAccessKeySecretRef>,
    /// The SessionToken used for authentication
    /// This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
    /// see: <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "sessionTokenSecretRef")]
    pub session_token_secret_ref: Option<ClusterSecretStoreProviderAwsAuthSecretRefSessionTokenSecretRef>,
}

/// The AccessKeyID is used for authentication
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAwsAuthSecretRefAccessKeyIdSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// The SecretAccessKey is used for authentication
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAwsAuthSecretRefSecretAccessKeySecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// The SessionToken used for authentication
/// This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
/// see: <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html>
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAwsAuthSecretRefSessionTokenSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// SecretsManager defines how the provider behaves when interacting with AWS SecretsManager
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAwsSecretsManager {
    /// Specifies whether to delete the secret without any recovery window. You
    /// can't use both this parameter and RecoveryWindowInDays in the same call.
    /// If you don't use either, then by default Secrets Manager uses a 30 day
    /// recovery window.
    /// see: <https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html#SecretsManager-DeleteSecret-request-ForceDeleteWithoutRecovery>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "forceDeleteWithoutRecovery")]
    pub force_delete_without_recovery: Option<bool>,
    /// The number of days from 7 to 30 that Secrets Manager waits before
    /// permanently deleting the secret. You can't use both this parameter and
    /// ForceDeleteWithoutRecovery in the same call. If you don't use either,
    /// then by default Secrets Manager uses a 30-day recovery window.
    /// see: <https://docs.aws.amazon.com/secretsmanager/latest/apireference/API_DeleteSecret.html#SecretsManager-DeleteSecret-request-RecoveryWindowInDays>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "recoveryWindowInDays")]
    pub recovery_window_in_days: Option<i64>,
}

/// AWS configures this store to sync secrets using AWS Secret Manager provider
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum ClusterSecretStoreProviderAwsService {
    SecretsManager,
    ParameterStore,
}

/// Tag is a key-value pair that can be attached to an AWS resource.
/// see: <https://docs.aws.amazon.com/general/latest/gr/aws_tagging.html>
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAwsSessionTags {
    pub key: String,
    pub value: String,
}

/// AzureKV configures this store to sync secrets using Azure Key Vault provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAzurekv {
    /// Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "authSecretRef")]
    pub auth_secret_ref: Option<ClusterSecretStoreProviderAzurekvAuthSecretRef>,
    /// Auth type defines how to authenticate to the keyvault service.
    /// Valid values are:
    /// - "ServicePrincipal" (default): Using a service principal (tenantId, clientId, clientSecret)
    /// - "ManagedIdentity": Using Managed Identity assigned to the pod (see aad-pod-identity)
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "authType")]
    pub auth_type: Option<ClusterSecretStoreProviderAzurekvAuthType>,
    /// CustomCloudConfig defines custom Azure endpoints for non-standard clouds.
    /// Required when EnvironmentType is AzureStackCloud.
    /// Optional for other environment types - useful for Azure China when using Workload Identity
    /// with AKS, where the OIDC issuer (login.partner.microsoftonline.cn) differs from the
    /// standard China Cloud endpoint (login.chinacloudapi.cn).
    /// IMPORTANT: This feature REQUIRES UseAzureSDK to be set to true. Custom cloud
    /// configuration is not supported with the legacy go-autorest SDK.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "customCloudConfig")]
    pub custom_cloud_config: Option<ClusterSecretStoreProviderAzurekvCustomCloudConfig>,
    /// EnvironmentType specifies the Azure cloud environment endpoints to use for
    /// connecting and authenticating with Azure. By default it points to the public cloud AAD endpoint.
    /// The following endpoints are available, also see here: <https://github.com/Azure/go-autorest/blob/main/autorest/azure/environments.go#L152>
    /// PublicCloud, USGovernmentCloud, ChinaCloud, GermanCloud, AzureStackCloud
    /// Use AzureStackCloud when you need to configure custom Azure Stack Hub or Azure Stack Edge endpoints.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "environmentType")]
    pub environment_type: Option<ClusterSecretStoreProviderAzurekvEnvironmentType>,
    /// If multiple Managed Identity is assigned to the pod, you can select the one to be used
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "identityId")]
    pub identity_id: Option<String>,
    /// ServiceAccountRef specified the service account
    /// that should be used when authenticating with WorkloadIdentity.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceAccountRef")]
    pub service_account_ref: Option<ClusterSecretStoreProviderAzurekvServiceAccountRef>,
    /// TenantID configures the Azure Tenant to send requests to. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "tenantId")]
    pub tenant_id: Option<String>,
    /// UseAzureSDK enables the use of the new Azure SDK for Go (azcore-based) instead of the legacy go-autorest SDK.
    /// This is experimental and may have behavioral differences. Defaults to false (legacy SDK).
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "useAzureSDK")]
    pub use_azure_sdk: Option<bool>,
    /// Vault Url from which the secrets to be fetched from.
    #[serde(rename = "vaultUrl")]
    pub vault_url: String,
}

/// Auth configures how the operator authenticates with Azure. Required for ServicePrincipal auth type. Optional for WorkloadIdentity.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAzurekvAuthSecretRef {
    /// The Azure ClientCertificate of the service principle used for authentication.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "clientCertificate")]
    pub client_certificate: Option<ClusterSecretStoreProviderAzurekvAuthSecretRefClientCertificate>,
    /// The Azure clientId of the service principle or managed identity used for authentication.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "clientId")]
    pub client_id: Option<ClusterSecretStoreProviderAzurekvAuthSecretRefClientId>,
    /// The Azure ClientSecret of the service principle used for authentication.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "clientSecret")]
    pub client_secret: Option<ClusterSecretStoreProviderAzurekvAuthSecretRefClientSecret>,
    /// The Azure tenantId of the managed identity used for authentication.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "tenantId")]
    pub tenant_id: Option<ClusterSecretStoreProviderAzurekvAuthSecretRefTenantId>,
}

/// The Azure ClientCertificate of the service principle used for authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAzurekvAuthSecretRefClientCertificate {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// The Azure clientId of the service principle or managed identity used for authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAzurekvAuthSecretRefClientId {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// The Azure ClientSecret of the service principle used for authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAzurekvAuthSecretRefClientSecret {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// The Azure tenantId of the managed identity used for authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAzurekvAuthSecretRefTenantId {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// AzureKV configures this store to sync secrets using Azure Key Vault provider
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum ClusterSecretStoreProviderAzurekvAuthType {
    ServicePrincipal,
    ManagedIdentity,
    WorkloadIdentity,
}

/// CustomCloudConfig defines custom Azure endpoints for non-standard clouds.
/// Required when EnvironmentType is AzureStackCloud.
/// Optional for other environment types - useful for Azure China when using Workload Identity
/// with AKS, where the OIDC issuer (login.partner.microsoftonline.cn) differs from the
/// standard China Cloud endpoint (login.chinacloudapi.cn).
/// IMPORTANT: This feature REQUIRES UseAzureSDK to be set to true. Custom cloud
/// configuration is not supported with the legacy go-autorest SDK.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAzurekvCustomCloudConfig {
    /// ActiveDirectoryEndpoint is the AAD endpoint for authentication
    /// Required when using custom cloud configuration
    #[serde(rename = "activeDirectoryEndpoint")]
    pub active_directory_endpoint: String,
    /// KeyVaultDNSSuffix is the DNS suffix for Key Vault URLs
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "keyVaultDNSSuffix")]
    pub key_vault_dns_suffix: Option<String>,
    /// KeyVaultEndpoint is the Key Vault service endpoint
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "keyVaultEndpoint")]
    pub key_vault_endpoint: Option<String>,
    /// ResourceManagerEndpoint is the Azure Resource Manager endpoint
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "resourceManagerEndpoint")]
    pub resource_manager_endpoint: Option<String>,
}

/// AzureKV configures this store to sync secrets using Azure Key Vault provider
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum ClusterSecretStoreProviderAzurekvEnvironmentType {
    PublicCloud,
    #[serde(rename = "USGovernmentCloud")]
    UsGovernmentCloud,
    ChinaCloud,
    GermanCloud,
    AzureStackCloud,
}

/// ServiceAccountRef specified the service account
/// that should be used when authenticating with WorkloadIdentity.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderAzurekvServiceAccountRef {
    /// Audience specifies the `aud` claim for the service account token
    /// If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
    /// then this audiences will be appended to the list
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audiences: Option<Vec<String>>,
    /// The name of the ServiceAccount resource being referred to.
    pub name: String,
    /// Namespace of the resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Barbican configures this store to sync secrets using the OpenStack Barbican provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderBarbican {
    /// BarbicanAuth contains the authentication information for Barbican.
    pub auth: ClusterSecretStoreProviderBarbicanAuth,
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "authURL")]
    pub auth_url: Option<String>,
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "domainName")]
    pub domain_name: Option<String>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub region: Option<String>,
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "tenantName")]
    pub tenant_name: Option<String>,
}

/// BarbicanAuth contains the authentication information for Barbican.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderBarbicanAuth {
    /// BarbicanProviderPasswordRef defines a reference to a secret containing password for the Barbican provider.
    pub password: ClusterSecretStoreProviderBarbicanAuthPassword,
    /// BarbicanProviderUsernameRef defines a reference to a secret containing username for the Barbican provider.
    pub username: ClusterSecretStoreProviderBarbicanAuthUsername,
}

/// BarbicanProviderPasswordRef defines a reference to a secret containing password for the Barbican provider.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderBarbicanAuthPassword {
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(rename = "secretRef")]
    pub secret_ref: ClusterSecretStoreProviderBarbicanAuthPasswordSecretRef,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderBarbicanAuthPasswordSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// BarbicanProviderUsernameRef defines a reference to a secret containing username for the Barbican provider.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderBarbicanAuthUsername {
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderBarbicanAuthUsernameSecretRef>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub value: Option<String>,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderBarbicanAuthUsernameSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Beyondtrust configures this store to sync secrets using Password Safe provider.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderBeyondtrust {
    /// Auth configures how the operator authenticates with Beyondtrust.
    pub auth: ClusterSecretStoreProviderBeyondtrustAuth,
    /// Auth configures how API server works.
    pub server: ClusterSecretStoreProviderBeyondtrustServer,
}

/// Auth configures how the operator authenticates with Beyondtrust.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderBeyondtrustAuth {
    /// APIKey If not provided then ClientID/ClientSecret become required.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "apiKey")]
    pub api_key: Option<ClusterSecretStoreProviderBeyondtrustAuthApiKey>,
    /// Certificate (cert.pem) for use when authenticating with an OAuth client Id using a Client Certificate.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub certificate: Option<ClusterSecretStoreProviderBeyondtrustAuthCertificate>,
    /// Certificate private key (key.pem). For use when authenticating with an OAuth client Id
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "certificateKey")]
    pub certificate_key: Option<ClusterSecretStoreProviderBeyondtrustAuthCertificateKey>,
    /// ClientID is the API OAuth Client ID.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "clientId")]
    pub client_id: Option<ClusterSecretStoreProviderBeyondtrustAuthClientId>,
    /// ClientSecret is the API OAuth Client Secret.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "clientSecret")]
    pub client_secret: Option<ClusterSecretStoreProviderBeyondtrustAuthClientSecret>,
}

/// APIKey If not provided then ClientID/ClientSecret become required.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderBeyondtrustAuthApiKey {
    /// SecretRef references a key in a secret that will be used as value.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderBeyondtrustAuthApiKeySecretRef>,
    /// Value can be specified directly to set a value without using a secret.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub value: Option<String>,
}

/// SecretRef references a key in a secret that will be used as value.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderBeyondtrustAuthApiKeySecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Certificate (cert.pem) for use when authenticating with an OAuth client Id using a Client Certificate.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderBeyondtrustAuthCertificate {
    /// SecretRef references a key in a secret that will be used as value.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderBeyondtrustAuthCertificateSecretRef>,
    /// Value can be specified directly to set a value without using a secret.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub value: Option<String>,
}

/// SecretRef references a key in a secret that will be used as value.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderBeyondtrustAuthCertificateSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Certificate private key (key.pem). For use when authenticating with an OAuth client Id
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderBeyondtrustAuthCertificateKey {
    /// SecretRef references a key in a secret that will be used as value.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderBeyondtrustAuthCertificateKeySecretRef>,
    /// Value can be specified directly to set a value without using a secret.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub value: Option<String>,
}

/// SecretRef references a key in a secret that will be used as value.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderBeyondtrustAuthCertificateKeySecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// ClientID is the API OAuth Client ID.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderBeyondtrustAuthClientId {
    /// SecretRef references a key in a secret that will be used as value.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderBeyondtrustAuthClientIdSecretRef>,
    /// Value can be specified directly to set a value without using a secret.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub value: Option<String>,
}

/// SecretRef references a key in a secret that will be used as value.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderBeyondtrustAuthClientIdSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// ClientSecret is the API OAuth Client Secret.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderBeyondtrustAuthClientSecret {
    /// SecretRef references a key in a secret that will be used as value.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderBeyondtrustAuthClientSecretSecretRef>,
    /// Value can be specified directly to set a value without using a secret.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub value: Option<String>,
}

/// SecretRef references a key in a secret that will be used as value.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderBeyondtrustAuthClientSecretSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Auth configures how API server works.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderBeyondtrustServer {
    #[serde(rename = "apiUrl")]
    pub api_url: String,
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "apiVersion")]
    pub api_version: Option<String>,
    /// Timeout specifies a time limit for requests made by this Client. The timeout includes connection time, any redirects, and reading the response body. Defaults to 45 seconds.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "clientTimeOutSeconds")]
    pub client_time_out_seconds: Option<i64>,
    /// When true, the response includes the decrypted password. When false, the password field is omitted. This option only applies to the SECRET retrieval type. Default: true.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub decrypt: Option<bool>,
    /// The secret retrieval type. SECRET = Secrets Safe (credential, text, file). MANAGED_ACCOUNT = Password Safe account associated with a system.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "retrievalType")]
    pub retrieval_type: Option<String>,
    /// A character that separates the folder names.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub separator: Option<String>,
    #[serde(rename = "verifyCA")]
    pub verify_ca: bool,
}

/// BitwardenSecretsManager configures this store to sync secrets using BitwardenSecretsManager provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderBitwardensecretsmanager {
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "apiURL")]
    pub api_url: Option<String>,
    /// Auth configures how secret-manager authenticates with a bitwarden machine account instance.
    /// Make sure that the token being used has permissions on the given secret.
    pub auth: ClusterSecretStoreProviderBitwardensecretsmanagerAuth,
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "bitwardenServerSDKURL")]
    pub bitwarden_server_sdkurl: Option<String>,
    /// Base64 encoded certificate for the bitwarden server sdk. The sdk MUST run with HTTPS to make sure no MITM attack
    /// can be performed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caBundle")]
    pub ca_bundle: Option<String>,
    /// see: <https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caProvider")]
    pub ca_provider: Option<ClusterSecretStoreProviderBitwardensecretsmanagerCaProvider>,
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "identityURL")]
    pub identity_url: Option<String>,
    /// OrganizationID determines which organization this secret store manages.
    #[serde(rename = "organizationID")]
    pub organization_id: String,
    /// ProjectID determines which project this secret store manages.
    #[serde(rename = "projectID")]
    pub project_id: String,
}

/// Auth configures how secret-manager authenticates with a bitwarden machine account instance.
/// Make sure that the token being used has permissions on the given secret.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderBitwardensecretsmanagerAuth {
    /// BitwardenSecretsManagerSecretRef contains the credential ref to the bitwarden instance.
    #[serde(rename = "secretRef")]
    pub secret_ref: ClusterSecretStoreProviderBitwardensecretsmanagerAuthSecretRef,
}

/// BitwardenSecretsManagerSecretRef contains the credential ref to the bitwarden instance.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderBitwardensecretsmanagerAuthSecretRef {
    /// AccessToken used for the bitwarden instance.
    pub credentials: ClusterSecretStoreProviderBitwardensecretsmanagerAuthSecretRefCredentials,
}

/// AccessToken used for the bitwarden instance.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderBitwardensecretsmanagerAuthSecretRefCredentials {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// see: <https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider>
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub struct ClusterSecretStoreProviderBitwardensecretsmanagerCaProvider {
    /// The key where the CA certificate can be found in the Secret or ConfigMap.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the object located at the provider type.
    pub name: String,
    /// The namespace the Provider type is in.
    /// Can only be defined when used in a ClusterSecretStore.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
    /// The type of provider to use such as "Secret", or "ConfigMap".
    #[serde(rename = "type")]
    pub r#type: ClusterSecretStoreProviderBitwardensecretsmanagerCaProviderType,
}

/// see: <https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider>
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum ClusterSecretStoreProviderBitwardensecretsmanagerCaProviderType {
    Secret,
    ConfigMap,
}

/// Chef configures this store to sync secrets with chef server
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderChef {
    /// Auth defines the information necessary to authenticate against chef Server
    pub auth: ClusterSecretStoreProviderChefAuth,
    /// ServerURL is the chef server URL used to connect to. If using orgs you should include your org in the url and terminate the url with a "/"
    #[serde(rename = "serverUrl")]
    pub server_url: String,
    /// UserName should be the user ID on the chef server
    pub username: String,
}

/// Auth defines the information necessary to authenticate against chef Server
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderChefAuth {
    /// ChefAuthSecretRef holds secret references for chef server login credentials.
    #[serde(rename = "secretRef")]
    pub secret_ref: ClusterSecretStoreProviderChefAuthSecretRef,
}

/// ChefAuthSecretRef holds secret references for chef server login credentials.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderChefAuthSecretRef {
    /// SecretKey is the Signing Key in PEM format, used for authentication.
    #[serde(rename = "privateKeySecretRef")]
    pub private_key_secret_ref: ClusterSecretStoreProviderChefAuthSecretRefPrivateKeySecretRef,
}

/// SecretKey is the Signing Key in PEM format, used for authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderChefAuthSecretRefPrivateKeySecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// CloudruSM configures this store to sync secrets using the Cloud.ru Secret Manager provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderCloudrusm {
    /// CSMAuth contains a secretRef for credentials.
    pub auth: ClusterSecretStoreProviderCloudrusmAuth,
    /// ProjectID is the project, which the secrets are stored in.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "projectID")]
    pub project_id: Option<String>,
}

/// CSMAuth contains a secretRef for credentials.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderCloudrusmAuth {
    /// CSMAuthSecretRef holds secret references for Cloud.ru credentials.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderCloudrusmAuthSecretRef>,
}

/// CSMAuthSecretRef holds secret references for Cloud.ru credentials.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderCloudrusmAuthSecretRef {
    /// The AccessKeyID is used for authentication
    #[serde(rename = "accessKeyIDSecretRef")]
    pub access_key_id_secret_ref: ClusterSecretStoreProviderCloudrusmAuthSecretRefAccessKeyIdSecretRef,
    /// The AccessKeySecret is used for authentication
    #[serde(rename = "accessKeySecretSecretRef")]
    pub access_key_secret_secret_ref: ClusterSecretStoreProviderCloudrusmAuthSecretRefAccessKeySecretSecretRef,
}

/// The AccessKeyID is used for authentication
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderCloudrusmAuthSecretRefAccessKeyIdSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// The AccessKeySecret is used for authentication
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderCloudrusmAuthSecretRefAccessKeySecretSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Conjur configures this store to sync secrets using conjur provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderConjur {
    /// Defines authentication settings for connecting to Conjur.
    pub auth: ClusterSecretStoreProviderConjurAuth,
    /// CABundle is a PEM encoded CA bundle that will be used to validate the Conjur server certificate.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caBundle")]
    pub ca_bundle: Option<String>,
    /// Used to provide custom certificate authority (CA) certificates
    /// for a secret store. The CAProvider points to a Secret or ConfigMap resource
    /// that contains a PEM-encoded certificate.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caProvider")]
    pub ca_provider: Option<ClusterSecretStoreProviderConjurCaProvider>,
    /// URL is the endpoint of the Conjur instance.
    pub url: String,
}

/// Defines authentication settings for connecting to Conjur.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderConjurAuth {
    /// Authenticates with Conjur using an API key.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub apikey: Option<ClusterSecretStoreProviderConjurAuthApikey>,
    /// Jwt enables JWT authentication using Kubernetes service account tokens.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub jwt: Option<ClusterSecretStoreProviderConjurAuthJwt>,
}

/// Authenticates with Conjur using an API key.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderConjurAuthApikey {
    /// Account is the Conjur organization account name.
    pub account: String,
    /// A reference to a specific 'key' containing the Conjur API key
    /// within a Secret resource. In some instances, `key` is a required field.
    #[serde(rename = "apiKeyRef")]
    pub api_key_ref: ClusterSecretStoreProviderConjurAuthApikeyApiKeyRef,
    /// A reference to a specific 'key' containing the Conjur username
    /// within a Secret resource. In some instances, `key` is a required field.
    #[serde(rename = "userRef")]
    pub user_ref: ClusterSecretStoreProviderConjurAuthApikeyUserRef,
}

/// A reference to a specific 'key' containing the Conjur API key
/// within a Secret resource. In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderConjurAuthApikeyApiKeyRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// A reference to a specific 'key' containing the Conjur username
/// within a Secret resource. In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderConjurAuthApikeyUserRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Jwt enables JWT authentication using Kubernetes service account tokens.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderConjurAuthJwt {
    /// Account is the Conjur organization account name.
    pub account: String,
    /// Optional HostID for JWT authentication. This may be used depending
    /// on how the Conjur JWT authenticator policy is configured.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "hostId")]
    pub host_id: Option<String>,
    /// Optional SecretRef that refers to a key in a Secret resource containing JWT token to
    /// authenticate with Conjur using the JWT authentication method.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderConjurAuthJwtSecretRef>,
    /// Optional ServiceAccountRef specifies the Kubernetes service account for which to request
    /// a token for with the `TokenRequest` API.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceAccountRef")]
    pub service_account_ref: Option<ClusterSecretStoreProviderConjurAuthJwtServiceAccountRef>,
    /// The conjur authn jwt webservice id
    #[serde(rename = "serviceID")]
    pub service_id: String,
}

/// Optional SecretRef that refers to a key in a Secret resource containing JWT token to
/// authenticate with Conjur using the JWT authentication method.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderConjurAuthJwtSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Optional ServiceAccountRef specifies the Kubernetes service account for which to request
/// a token for with the `TokenRequest` API.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderConjurAuthJwtServiceAccountRef {
    /// Audience specifies the `aud` claim for the service account token
    /// If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
    /// then this audiences will be appended to the list
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audiences: Option<Vec<String>>,
    /// The name of the ServiceAccount resource being referred to.
    pub name: String,
    /// Namespace of the resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Used to provide custom certificate authority (CA) certificates
/// for a secret store. The CAProvider points to a Secret or ConfigMap resource
/// that contains a PEM-encoded certificate.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub struct ClusterSecretStoreProviderConjurCaProvider {
    /// The key where the CA certificate can be found in the Secret or ConfigMap.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the object located at the provider type.
    pub name: String,
    /// The namespace the Provider type is in.
    /// Can only be defined when used in a ClusterSecretStore.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
    /// The type of provider to use such as "Secret", or "ConfigMap".
    #[serde(rename = "type")]
    pub r#type: ClusterSecretStoreProviderConjurCaProviderType,
}

/// Used to provide custom certificate authority (CA) certificates
/// for a secret store. The CAProvider points to a Secret or ConfigMap resource
/// that contains a PEM-encoded certificate.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum ClusterSecretStoreProviderConjurCaProviderType {
    Secret,
    ConfigMap,
}

/// Delinea DevOps Secrets Vault
/// <https://docs.delinea.com/online-help/products/devops-secrets-vault/current>
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderDelinea {
    /// ClientID is the non-secret part of the credential.
    #[serde(rename = "clientId")]
    pub client_id: ClusterSecretStoreProviderDelineaClientId,
    /// ClientSecret is the secret part of the credential.
    #[serde(rename = "clientSecret")]
    pub client_secret: ClusterSecretStoreProviderDelineaClientSecret,
    /// Tenant is the chosen hostname / site name.
    pub tenant: String,
    /// TLD is based on the server location that was chosen during provisioning.
    /// If unset, defaults to "com".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub tld: Option<String>,
    /// URLTemplate
    /// If unset, defaults to "<https://%s.secretsvaultcloud.%s/v1/%s%s".>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "urlTemplate")]
    pub url_template: Option<String>,
}

/// ClientID is the non-secret part of the credential.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderDelineaClientId {
    /// SecretRef references a key in a secret that will be used as value.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderDelineaClientIdSecretRef>,
    /// Value can be specified directly to set a value without using a secret.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub value: Option<String>,
}

/// SecretRef references a key in a secret that will be used as value.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderDelineaClientIdSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// ClientSecret is the secret part of the credential.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderDelineaClientSecret {
    /// SecretRef references a key in a secret that will be used as value.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderDelineaClientSecretSecretRef>,
    /// Value can be specified directly to set a value without using a secret.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub value: Option<String>,
}

/// SecretRef references a key in a secret that will be used as value.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderDelineaClientSecretSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Device42 configures this store to sync secrets using the Device42 provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderDevice42 {
    /// Auth configures how secret-manager authenticates with a Device42 instance.
    pub auth: ClusterSecretStoreProviderDevice42Auth,
    /// URL configures the Device42 instance URL.
    pub host: String,
}

/// Auth configures how secret-manager authenticates with a Device42 instance.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderDevice42Auth {
    /// Device42SecretRef contains the secret reference for accessing the Device42 instance.
    #[serde(rename = "secretRef")]
    pub secret_ref: ClusterSecretStoreProviderDevice42AuthSecretRef,
}

/// Device42SecretRef contains the secret reference for accessing the Device42 instance.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderDevice42AuthSecretRef {
    /// Username / Password is used for authentication.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub credentials: Option<ClusterSecretStoreProviderDevice42AuthSecretRefCredentials>,
}

/// Username / Password is used for authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderDevice42AuthSecretRefCredentials {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Doppler configures this store to sync secrets using the Doppler provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderDoppler {
    /// Auth configures how the Operator authenticates with the Doppler API
    pub auth: ClusterSecretStoreProviderDopplerAuth,
    /// Doppler config (required if not using a Service Token)
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub config: Option<String>,
    /// Format enables the downloading of secrets as a file (string)
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub format: Option<ClusterSecretStoreProviderDopplerFormat>,
    /// Environment variable compatible name transforms that change secret names to a different format
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "nameTransformer")]
    pub name_transformer: Option<ClusterSecretStoreProviderDopplerNameTransformer>,
    /// Doppler project (required if not using a Service Token)
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub project: Option<String>,
}

/// Auth configures how the Operator authenticates with the Doppler API
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderDopplerAuth {
    /// OIDCConfig authenticates using Kubernetes ServiceAccount tokens via OIDC.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "oidcConfig")]
    pub oidc_config: Option<ClusterSecretStoreProviderDopplerAuthOidcConfig>,
    /// SecretRef authenticates using a Doppler service token stored in a Kubernetes Secret.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderDopplerAuthSecretRef>,
}

/// OIDCConfig authenticates using Kubernetes ServiceAccount tokens via OIDC.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderDopplerAuthOidcConfig {
    /// ExpirationSeconds sets the ServiceAccount token validity duration.
    /// Defaults to 10 minutes.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "expirationSeconds")]
    pub expiration_seconds: Option<i64>,
    /// Identity is the Doppler Service Account Identity ID configured for OIDC authentication.
    pub identity: String,
    /// ServiceAccountRef specifies the Kubernetes ServiceAccount to use for authentication.
    #[serde(rename = "serviceAccountRef")]
    pub service_account_ref: ClusterSecretStoreProviderDopplerAuthOidcConfigServiceAccountRef,
}

/// ServiceAccountRef specifies the Kubernetes ServiceAccount to use for authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderDopplerAuthOidcConfigServiceAccountRef {
    /// Audience specifies the `aud` claim for the service account token
    /// If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
    /// then this audiences will be appended to the list
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audiences: Option<Vec<String>>,
    /// The name of the ServiceAccount resource being referred to.
    pub name: String,
    /// Namespace of the resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// SecretRef authenticates using a Doppler service token stored in a Kubernetes Secret.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderDopplerAuthSecretRef {
    /// The DopplerToken is used for authentication.
    /// See <https://docs.doppler.com/reference/api#authentication> for auth token types.
    /// The Key attribute defaults to dopplerToken if not specified.
    #[serde(rename = "dopplerToken")]
    pub doppler_token: ClusterSecretStoreProviderDopplerAuthSecretRefDopplerToken,
}

/// The DopplerToken is used for authentication.
/// See <https://docs.doppler.com/reference/api#authentication> for auth token types.
/// The Key attribute defaults to dopplerToken if not specified.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderDopplerAuthSecretRefDopplerToken {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Doppler configures this store to sync secrets using the Doppler provider
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum ClusterSecretStoreProviderDopplerFormat {
    #[serde(rename = "json")]
    Json,
    #[serde(rename = "dotnet-json")]
    DotnetJson,
    #[serde(rename = "env")]
    Env,
    #[serde(rename = "yaml")]
    Yaml,
    #[serde(rename = "docker")]
    Docker,
}

/// Doppler configures this store to sync secrets using the Doppler provider
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum ClusterSecretStoreProviderDopplerNameTransformer {
    #[serde(rename = "upper-camel")]
    UpperCamel,
    #[serde(rename = "camel")]
    Camel,
    #[serde(rename = "lower-snake")]
    LowerSnake,
    #[serde(rename = "tf-var")]
    TfVar,
    #[serde(rename = "dotnet-env")]
    DotnetEnv,
    #[serde(rename = "lower-kebab")]
    LowerKebab,
}

/// DVLS configures this store to sync secrets using Devolutions Server provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderDvls {
    /// Auth defines the authentication method to use.
    pub auth: ClusterSecretStoreProviderDvlsAuth,
    /// Insecure allows connecting to DVLS over plain HTTP.
    /// This is NOT RECOMMENDED for production use.
    /// Set to true only if you understand the security implications.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub insecure: Option<bool>,
    /// ServerURL is the DVLS instance URL (e.g., <https://dvls.example.com).>
    #[serde(rename = "serverUrl")]
    pub server_url: String,
}

/// Auth defines the authentication method to use.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderDvlsAuth {
    /// SecretRef contains the Application ID and Application Secret for authentication.
    #[serde(rename = "secretRef")]
    pub secret_ref: ClusterSecretStoreProviderDvlsAuthSecretRef,
}

/// SecretRef contains the Application ID and Application Secret for authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderDvlsAuthSecretRef {
    /// AppID is the reference to the secret containing the Application ID.
    #[serde(rename = "appId")]
    pub app_id: ClusterSecretStoreProviderDvlsAuthSecretRefAppId,
    /// AppSecret is the reference to the secret containing the Application Secret.
    #[serde(rename = "appSecret")]
    pub app_secret: ClusterSecretStoreProviderDvlsAuthSecretRefAppSecret,
}

/// AppID is the reference to the secret containing the Application ID.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderDvlsAuthSecretRefAppId {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// AppSecret is the reference to the secret containing the Application Secret.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderDvlsAuthSecretRefAppSecret {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Fake configures a store with static key/value pairs
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderFake {
    pub data: Vec<ClusterSecretStoreProviderFakeData>,
    /// ValidationResult is defined type for the number of validation results.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "validationResult")]
    pub validation_result: Option<i64>,
}

/// FakeProviderData defines a key-value pair with optional version for the fake provider.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderFakeData {
    pub key: String,
    pub value: String,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub version: Option<String>,
}

/// Fortanix configures this store to sync secrets using the Fortanix provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderFortanix {
    /// APIKey is the API token to access SDKMS Applications.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "apiKey")]
    pub api_key: Option<ClusterSecretStoreProviderFortanixApiKey>,
    /// APIURL is the URL of SDKMS API. Defaults to `sdkms.fortanix.com`.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "apiUrl")]
    pub api_url: Option<String>,
}

/// APIKey is the API token to access SDKMS Applications.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderFortanixApiKey {
    /// SecretRef is a reference to a secret containing the SDKMS API Key.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderFortanixApiKeySecretRef>,
}

/// SecretRef is a reference to a secret containing the SDKMS API Key.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderFortanixApiKeySecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// GCPSM configures this store to sync secrets using Google Cloud Platform Secret Manager provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGcpsm {
    /// Auth defines the information necessary to authenticate against GCP
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub auth: Option<ClusterSecretStoreProviderGcpsmAuth>,
    /// Location optionally defines a location for a secret
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub location: Option<String>,
    /// ProjectID project where secret is located
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "projectID")]
    pub project_id: Option<String>,
    /// SecretVersionSelectionPolicy specifies how the provider selects a secret version
    /// when "latest" is disabled or destroyed.
    /// Possible values are:
    /// - LatestOrFail: the provider always uses "latest", or fails if that version is disabled/destroyed.
    /// - LatestOrFetch: the provider falls back to fetching the latest version if the version is DESTROYED or DISABLED
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretVersionSelectionPolicy")]
    pub secret_version_selection_policy: Option<String>,
}

/// Auth defines the information necessary to authenticate against GCP
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGcpsmAuth {
    /// GCPSMAuthSecretRef contains the secret references for GCP Secret Manager authentication.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderGcpsmAuthSecretRef>,
    /// GCPWorkloadIdentity defines configuration for workload identity authentication to GCP.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "workloadIdentity")]
    pub workload_identity: Option<ClusterSecretStoreProviderGcpsmAuthWorkloadIdentity>,
    /// GCPWorkloadIdentityFederation holds the configurations required for generating federated access tokens.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "workloadIdentityFederation")]
    pub workload_identity_federation: Option<ClusterSecretStoreProviderGcpsmAuthWorkloadIdentityFederation>,
}

/// GCPSMAuthSecretRef contains the secret references for GCP Secret Manager authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGcpsmAuthSecretRef {
    /// The SecretAccessKey is used for authentication
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretAccessKeySecretRef")]
    pub secret_access_key_secret_ref: Option<ClusterSecretStoreProviderGcpsmAuthSecretRefSecretAccessKeySecretRef>,
}

/// The SecretAccessKey is used for authentication
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGcpsmAuthSecretRefSecretAccessKeySecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// GCPWorkloadIdentity defines configuration for workload identity authentication to GCP.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGcpsmAuthWorkloadIdentity {
    /// ClusterLocation is the location of the cluster
    /// If not specified, it fetches information from the metadata server
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "clusterLocation")]
    pub cluster_location: Option<String>,
    /// ClusterName is the name of the cluster
    /// If not specified, it fetches information from the metadata server
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "clusterName")]
    pub cluster_name: Option<String>,
    /// ClusterProjectID is the project ID of the cluster
    /// If not specified, it fetches information from the metadata server
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "clusterProjectID")]
    pub cluster_project_id: Option<String>,
    /// ServiceAccountSelector is a reference to a ServiceAccount resource.
    #[serde(rename = "serviceAccountRef")]
    pub service_account_ref: ClusterSecretStoreProviderGcpsmAuthWorkloadIdentityServiceAccountRef,
}

/// ServiceAccountSelector is a reference to a ServiceAccount resource.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGcpsmAuthWorkloadIdentityServiceAccountRef {
    /// Audience specifies the `aud` claim for the service account token
    /// If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
    /// then this audiences will be appended to the list
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audiences: Option<Vec<String>>,
    /// The name of the ServiceAccount resource being referred to.
    pub name: String,
    /// Namespace of the resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// GCPWorkloadIdentityFederation holds the configurations required for generating federated access tokens.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGcpsmAuthWorkloadIdentityFederation {
    /// audience is the Secure Token Service (STS) audience which contains the resource name for the workload identity pool and the provider identifier in that pool.
    /// If specified, Audience found in the external account credential config will be overridden with the configured value.
    /// audience must be provided when serviceAccountRef or awsSecurityCredentials is configured.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audience: Option<String>,
    /// awsSecurityCredentials is for configuring AWS region and credentials to use for obtaining the access token,
    /// when using the AWS metadata server is not an option.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "awsSecurityCredentials")]
    pub aws_security_credentials: Option<ClusterSecretStoreProviderGcpsmAuthWorkloadIdentityFederationAwsSecurityCredentials>,
    /// credConfig holds the configmap reference containing the GCP external account credential configuration in JSON format and the key name containing the json data.
    /// For using Kubernetes cluster as the identity provider, use serviceAccountRef instead. Operators mounted serviceaccount token cannot be used as the token source, instead
    /// serviceAccountRef must be used by providing operators service account details.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "credConfig")]
    pub cred_config: Option<ClusterSecretStoreProviderGcpsmAuthWorkloadIdentityFederationCredConfig>,
    /// externalTokenEndpoint is the endpoint explicitly set up to provide tokens, which will be matched against the
    /// credential_source.url in the provided credConfig. This field is merely to double-check the external token source
    /// URL is having the expected value.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "externalTokenEndpoint")]
    pub external_token_endpoint: Option<String>,
    /// serviceAccountRef is the reference to the kubernetes ServiceAccount to be used for obtaining the tokens,
    /// when Kubernetes is configured as provider in workload identity pool.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceAccountRef")]
    pub service_account_ref: Option<ClusterSecretStoreProviderGcpsmAuthWorkloadIdentityFederationServiceAccountRef>,
}

/// awsSecurityCredentials is for configuring AWS region and credentials to use for obtaining the access token,
/// when using the AWS metadata server is not an option.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGcpsmAuthWorkloadIdentityFederationAwsSecurityCredentials {
    /// awsCredentialsSecretRef is the reference to the secret which holds the AWS credentials.
    /// Secret should be created with below names for keys
    /// - aws_access_key_id: Access Key ID, which is the unique identifier for the AWS account or the IAM user.
    /// - aws_secret_access_key: Secret Access Key, which is used to authenticate requests made to AWS services.
    /// - aws_session_token: Session Token, is the short-lived token to authenticate requests made to AWS services.
    #[serde(rename = "awsCredentialsSecretRef")]
    pub aws_credentials_secret_ref: ClusterSecretStoreProviderGcpsmAuthWorkloadIdentityFederationAwsSecurityCredentialsAwsCredentialsSecretRef,
    /// region is for configuring the AWS region to be used.
    pub region: String,
}

/// awsCredentialsSecretRef is the reference to the secret which holds the AWS credentials.
/// Secret should be created with below names for keys
/// - aws_access_key_id: Access Key ID, which is the unique identifier for the AWS account or the IAM user.
/// - aws_secret_access_key: Secret Access Key, which is used to authenticate requests made to AWS services.
/// - aws_session_token: Session Token, is the short-lived token to authenticate requests made to AWS services.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGcpsmAuthWorkloadIdentityFederationAwsSecurityCredentialsAwsCredentialsSecretRef {
    /// name of the secret.
    pub name: String,
    /// namespace in which the secret exists. If empty, secret will looked up in local namespace.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// credConfig holds the configmap reference containing the GCP external account credential configuration in JSON format and the key name containing the json data.
/// For using Kubernetes cluster as the identity provider, use serviceAccountRef instead. Operators mounted serviceaccount token cannot be used as the token source, instead
/// serviceAccountRef must be used by providing operators service account details.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGcpsmAuthWorkloadIdentityFederationCredConfig {
    /// key name holding the external account credential config.
    pub key: String,
    /// name of the configmap.
    pub name: String,
    /// namespace in which the configmap exists. If empty, configmap will looked up in local namespace.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// serviceAccountRef is the reference to the kubernetes ServiceAccount to be used for obtaining the tokens,
/// when Kubernetes is configured as provider in workload identity pool.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGcpsmAuthWorkloadIdentityFederationServiceAccountRef {
    /// Audience specifies the `aud` claim for the service account token
    /// If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
    /// then this audiences will be appended to the list
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audiences: Option<Vec<String>>,
    /// The name of the ServiceAccount resource being referred to.
    pub name: String,
    /// Namespace of the resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Github configures this store to push GitHub Actions secrets using the GitHub API provider.
/// Note: This provider only supports write operations (PushSecret) and cannot fetch secrets from GitHub
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGithub {
    /// appID specifies the Github APP that will be used to authenticate the client
    #[serde(rename = "appID")]
    pub app_id: i64,
    /// auth configures how secret-manager authenticates with a Github instance.
    pub auth: ClusterSecretStoreProviderGithubAuth,
    /// environment will be used to fetch secrets from a particular environment within a github repository
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub environment: Option<String>,
    /// installationID specifies the Github APP installation that will be used to authenticate the client
    #[serde(rename = "installationID")]
    pub installation_id: i64,
    /// organization will be used to fetch secrets from the Github organization
    pub organization: String,
    /// repository will be used to fetch secrets from the Github repository within an organization
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub repository: Option<String>,
    /// Upload URL for enterprise instances. Default to URL.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "uploadURL")]
    pub upload_url: Option<String>,
    /// URL configures the Github instance URL. Defaults to <https://github.com/.>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub url: Option<String>,
}

/// auth configures how secret-manager authenticates with a Github instance.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGithubAuth {
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(rename = "privateKey")]
    pub private_key: ClusterSecretStoreProviderGithubAuthPrivateKey,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGithubAuthPrivateKey {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// GitLab configures this store to sync secrets using GitLab Variables provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGitlab {
    /// Auth configures how secret-manager authenticates with a GitLab instance.
    pub auth: ClusterSecretStoreProviderGitlabAuth,
    /// Base64 encoded certificate for the GitLab server sdk. The sdk MUST run with HTTPS to make sure no MITM attack
    /// can be performed.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caBundle")]
    pub ca_bundle: Option<String>,
    /// see: <https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caProvider")]
    pub ca_provider: Option<ClusterSecretStoreProviderGitlabCaProvider>,
    /// Environment environment_scope of gitlab CI/CD variables (Please see <https://docs.gitlab.com/ee/ci/environments/#create-a-static-environment> on how to create environments)
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub environment: Option<String>,
    /// GroupIDs specify, which gitlab groups to pull secrets from. Group secrets are read from left to right followed by the project variables.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "groupIDs")]
    pub group_i_ds: Option<Vec<String>>,
    /// InheritFromGroups specifies whether parent groups should be discovered and checked for secrets.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "inheritFromGroups")]
    pub inherit_from_groups: Option<bool>,
    /// ProjectID specifies a project where secrets are located.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "projectID")]
    pub project_id: Option<String>,
    /// URL configures the GitLab instance URL. Defaults to <https://gitlab.com/.>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub url: Option<String>,
}

/// Auth configures how secret-manager authenticates with a GitLab instance.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGitlabAuth {
    /// GitlabSecretRef contains the secret reference for GitLab authentication credentials.
    #[serde(rename = "SecretRef")]
    pub secret_ref: ClusterSecretStoreProviderGitlabAuthSecretRef,
}

/// GitlabSecretRef contains the secret reference for GitLab authentication credentials.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGitlabAuthSecretRef {
    /// AccessToken is used for authentication.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "accessToken")]
    pub access_token: Option<ClusterSecretStoreProviderGitlabAuthSecretRefAccessToken>,
}

/// AccessToken is used for authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderGitlabAuthSecretRefAccessToken {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// see: <https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider>
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub struct ClusterSecretStoreProviderGitlabCaProvider {
    /// The key where the CA certificate can be found in the Secret or ConfigMap.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the object located at the provider type.
    pub name: String,
    /// The namespace the Provider type is in.
    /// Can only be defined when used in a ClusterSecretStore.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
    /// The type of provider to use such as "Secret", or "ConfigMap".
    #[serde(rename = "type")]
    pub r#type: ClusterSecretStoreProviderGitlabCaProviderType,
}

/// see: <https://external-secrets.io/latest/spec/#external-secrets.io/v1alpha1.CAProvider>
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum ClusterSecretStoreProviderGitlabCaProviderType {
    Secret,
    ConfigMap,
}

/// IBM configures this store to sync secrets using IBM Cloud provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderIbm {
    /// Auth configures how secret-manager authenticates with the IBM secrets manager.
    pub auth: ClusterSecretStoreProviderIbmAuth,
    /// ServiceURL is the Endpoint URL that is specific to the Secrets Manager service instance
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceUrl")]
    pub service_url: Option<String>,
}

/// Auth configures how secret-manager authenticates with the IBM secrets manager.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderIbmAuth {
    /// IBMAuthContainerAuth defines container-based authentication with IAM Trusted Profile.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "containerAuth")]
    pub container_auth: Option<ClusterSecretStoreProviderIbmAuthContainerAuth>,
    /// IBMAuthSecretRef contains the secret reference for IBM Cloud API key authentication.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderIbmAuthSecretRef>,
}

/// IBMAuthContainerAuth defines container-based authentication with IAM Trusted Profile.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderIbmAuthContainerAuth {
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "iamEndpoint")]
    pub iam_endpoint: Option<String>,
    /// the IBM Trusted Profile
    pub profile: String,
    /// Location the token is mounted on the pod
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "tokenLocation")]
    pub token_location: Option<String>,
}

/// IBMAuthSecretRef contains the secret reference for IBM Cloud API key authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderIbmAuthSecretRef {
    /// The IAM endpoint used to obain a token
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "iamEndpoint")]
    pub iam_endpoint: Option<String>,
    /// The SecretAccessKey is used for authentication
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretApiKeySecretRef")]
    pub secret_api_key_secret_ref: Option<ClusterSecretStoreProviderIbmAuthSecretRefSecretApiKeySecretRef>,
}

/// The SecretAccessKey is used for authentication
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderIbmAuthSecretRefSecretApiKeySecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Infisical configures this store to sync secrets using the Infisical provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisical {
    /// Auth configures how the Operator authenticates with the Infisical API
    pub auth: ClusterSecretStoreProviderInfisicalAuth,
    /// CABundle is a PEM-encoded CA certificate bundle used to validate
    /// the Infisical server's TLS certificate. Mutually exclusive with CAProvider.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caBundle")]
    pub ca_bundle: Option<String>,
    /// CAProvider is a reference to a Secret or ConfigMap that contains a CA certificate.
    /// The certificate is used to validate the Infisical server's TLS certificate.
    /// Mutually exclusive with CABundle.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caProvider")]
    pub ca_provider: Option<ClusterSecretStoreProviderInfisicalCaProvider>,
    /// HostAPI specifies the base URL of the Infisical API. If not provided, it defaults to "<https://app.infisical.com/api".>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "hostAPI")]
    pub host_api: Option<String>,
    /// SecretsScope defines the scope of the secrets within the workspace
    #[serde(rename = "secretsScope")]
    pub secrets_scope: ClusterSecretStoreProviderInfisicalSecretsScope,
}

/// Auth configures how the Operator authenticates with the Infisical API
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuth {
    /// AwsAuthCredentials represents the credentials for AWS authentication.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "awsAuthCredentials")]
    pub aws_auth_credentials: Option<ClusterSecretStoreProviderInfisicalAuthAwsAuthCredentials>,
    /// AzureAuthCredentials represents the credentials for Azure authentication.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "azureAuthCredentials")]
    pub azure_auth_credentials: Option<ClusterSecretStoreProviderInfisicalAuthAzureAuthCredentials>,
    /// GcpIamAuthCredentials represents the credentials for GCP IAM authentication.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "gcpIamAuthCredentials")]
    pub gcp_iam_auth_credentials: Option<ClusterSecretStoreProviderInfisicalAuthGcpIamAuthCredentials>,
    /// GcpIDTokenAuthCredentials represents the credentials for GCP ID token authentication.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "gcpIdTokenAuthCredentials")]
    pub gcp_id_token_auth_credentials: Option<ClusterSecretStoreProviderInfisicalAuthGcpIdTokenAuthCredentials>,
    /// JwtAuthCredentials represents the credentials for JWT authentication.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "jwtAuthCredentials")]
    pub jwt_auth_credentials: Option<ClusterSecretStoreProviderInfisicalAuthJwtAuthCredentials>,
    /// KubernetesAuthCredentials represents the credentials for Kubernetes authentication.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "kubernetesAuthCredentials")]
    pub kubernetes_auth_credentials: Option<ClusterSecretStoreProviderInfisicalAuthKubernetesAuthCredentials>,
    /// LdapAuthCredentials represents the credentials for LDAP authentication.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "ldapAuthCredentials")]
    pub ldap_auth_credentials: Option<ClusterSecretStoreProviderInfisicalAuthLdapAuthCredentials>,
    /// OciAuthCredentials represents the credentials for OCI authentication.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "ociAuthCredentials")]
    pub oci_auth_credentials: Option<ClusterSecretStoreProviderInfisicalAuthOciAuthCredentials>,
    /// TokenAuthCredentials represents the credentials for access token-based authentication.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "tokenAuthCredentials")]
    pub token_auth_credentials: Option<ClusterSecretStoreProviderInfisicalAuthTokenAuthCredentials>,
    /// UniversalAuthCredentials represents the client credentials for universal authentication.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "universalAuthCredentials")]
    pub universal_auth_credentials: Option<ClusterSecretStoreProviderInfisicalAuthUniversalAuthCredentials>,
}

/// AwsAuthCredentials represents the credentials for AWS authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthAwsAuthCredentials {
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(rename = "identityId")]
    pub identity_id: ClusterSecretStoreProviderInfisicalAuthAwsAuthCredentialsIdentityId,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthAwsAuthCredentialsIdentityId {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// AzureAuthCredentials represents the credentials for Azure authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthAzureAuthCredentials {
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(rename = "identityId")]
    pub identity_id: ClusterSecretStoreProviderInfisicalAuthAzureAuthCredentialsIdentityId,
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub resource: Option<ClusterSecretStoreProviderInfisicalAuthAzureAuthCredentialsResource>,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthAzureAuthCredentialsIdentityId {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthAzureAuthCredentialsResource {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// GcpIamAuthCredentials represents the credentials for GCP IAM authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthGcpIamAuthCredentials {
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(rename = "identityId")]
    pub identity_id: ClusterSecretStoreProviderInfisicalAuthGcpIamAuthCredentialsIdentityId,
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(rename = "serviceAccountKeyFilePath")]
    pub service_account_key_file_path: ClusterSecretStoreProviderInfisicalAuthGcpIamAuthCredentialsServiceAccountKeyFilePath,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthGcpIamAuthCredentialsIdentityId {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthGcpIamAuthCredentialsServiceAccountKeyFilePath {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// GcpIDTokenAuthCredentials represents the credentials for GCP ID token authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthGcpIdTokenAuthCredentials {
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(rename = "identityId")]
    pub identity_id: ClusterSecretStoreProviderInfisicalAuthGcpIdTokenAuthCredentialsIdentityId,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthGcpIdTokenAuthCredentialsIdentityId {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// JwtAuthCredentials represents the credentials for JWT authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthJwtAuthCredentials {
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(rename = "identityId")]
    pub identity_id: ClusterSecretStoreProviderInfisicalAuthJwtAuthCredentialsIdentityId,
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    pub jwt: ClusterSecretStoreProviderInfisicalAuthJwtAuthCredentialsJwt,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthJwtAuthCredentialsIdentityId {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthJwtAuthCredentialsJwt {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// KubernetesAuthCredentials represents the credentials for Kubernetes authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthKubernetesAuthCredentials {
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(rename = "identityId")]
    pub identity_id: ClusterSecretStoreProviderInfisicalAuthKubernetesAuthCredentialsIdentityId,
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceAccountTokenPath")]
    pub service_account_token_path: Option<ClusterSecretStoreProviderInfisicalAuthKubernetesAuthCredentialsServiceAccountTokenPath>,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthKubernetesAuthCredentialsIdentityId {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthKubernetesAuthCredentialsServiceAccountTokenPath {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// LdapAuthCredentials represents the credentials for LDAP authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthLdapAuthCredentials {
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(rename = "identityId")]
    pub identity_id: ClusterSecretStoreProviderInfisicalAuthLdapAuthCredentialsIdentityId,
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(rename = "ldapPassword")]
    pub ldap_password: ClusterSecretStoreProviderInfisicalAuthLdapAuthCredentialsLdapPassword,
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(rename = "ldapUsername")]
    pub ldap_username: ClusterSecretStoreProviderInfisicalAuthLdapAuthCredentialsLdapUsername,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthLdapAuthCredentialsIdentityId {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthLdapAuthCredentialsLdapPassword {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthLdapAuthCredentialsLdapUsername {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// OciAuthCredentials represents the credentials for OCI authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthOciAuthCredentials {
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    pub fingerprint: ClusterSecretStoreProviderInfisicalAuthOciAuthCredentialsFingerprint,
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(rename = "identityId")]
    pub identity_id: ClusterSecretStoreProviderInfisicalAuthOciAuthCredentialsIdentityId,
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(rename = "privateKey")]
    pub private_key: ClusterSecretStoreProviderInfisicalAuthOciAuthCredentialsPrivateKey,
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "privateKeyPassphrase")]
    pub private_key_passphrase: Option<ClusterSecretStoreProviderInfisicalAuthOciAuthCredentialsPrivateKeyPassphrase>,
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    pub region: ClusterSecretStoreProviderInfisicalAuthOciAuthCredentialsRegion,
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(rename = "tenancyId")]
    pub tenancy_id: ClusterSecretStoreProviderInfisicalAuthOciAuthCredentialsTenancyId,
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(rename = "userId")]
    pub user_id: ClusterSecretStoreProviderInfisicalAuthOciAuthCredentialsUserId,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthOciAuthCredentialsFingerprint {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthOciAuthCredentialsIdentityId {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthOciAuthCredentialsPrivateKey {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthOciAuthCredentialsPrivateKeyPassphrase {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthOciAuthCredentialsRegion {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthOciAuthCredentialsTenancyId {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthOciAuthCredentialsUserId {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// TokenAuthCredentials represents the credentials for access token-based authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthTokenAuthCredentials {
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(rename = "accessToken")]
    pub access_token: ClusterSecretStoreProviderInfisicalAuthTokenAuthCredentialsAccessToken,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthTokenAuthCredentialsAccessToken {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// UniversalAuthCredentials represents the client credentials for universal authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthUniversalAuthCredentials {
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(rename = "clientId")]
    pub client_id: ClusterSecretStoreProviderInfisicalAuthUniversalAuthCredentialsClientId,
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(rename = "clientSecret")]
    pub client_secret: ClusterSecretStoreProviderInfisicalAuthUniversalAuthCredentialsClientSecret,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthUniversalAuthCredentialsClientId {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalAuthUniversalAuthCredentialsClientSecret {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// CAProvider is a reference to a Secret or ConfigMap that contains a CA certificate.
/// The certificate is used to validate the Infisical server's TLS certificate.
/// Mutually exclusive with CABundle.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalCaProvider {
    /// The key where the CA certificate can be found in the Secret or ConfigMap.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the object located at the provider type.
    pub name: String,
    /// The namespace the Provider type is in.
    /// Can only be defined when used in a ClusterSecretStore.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
    /// The type of provider to use such as "Secret", or "ConfigMap".
    #[serde(rename = "type")]
    pub r#type: ClusterSecretStoreProviderInfisicalCaProviderType,
}

/// CAProvider is a reference to a Secret or ConfigMap that contains a CA certificate.
/// The certificate is used to validate the Infisical server's TLS certificate.
/// Mutually exclusive with CABundle.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum ClusterSecretStoreProviderInfisicalCaProviderType {
    Secret,
    ConfigMap,
}

/// SecretsScope defines the scope of the secrets within the workspace
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderInfisicalSecretsScope {
    /// EnvironmentSlug is the required slug identifier for the environment.
    #[serde(rename = "environmentSlug")]
    pub environment_slug: String,
    /// ExpandSecretReferences indicates whether secret references should be expanded. Defaults to true if not provided.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "expandSecretReferences")]
    pub expand_secret_references: Option<bool>,
    /// ProjectSlug is the required slug identifier for the project.
    #[serde(rename = "projectSlug")]
    pub project_slug: String,
    /// Recursive indicates whether the secrets should be fetched recursively. Defaults to false if not provided.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub recursive: Option<bool>,
    /// SecretsPath specifies the path to the secrets within the workspace. Defaults to "/" if not provided.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretsPath")]
    pub secrets_path: Option<String>,
}

/// KeeperSecurity configures this store to sync secrets using the KeeperSecurity provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderKeepersecurity {
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(rename = "authRef")]
    pub auth_ref: ClusterSecretStoreProviderKeepersecurityAuthRef,
    #[serde(rename = "folderID")]
    pub folder_id: String,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderKeepersecurityAuthRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Kubernetes configures this store to sync secrets using a Kubernetes cluster provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderKubernetes {
    /// Auth configures how secret-manager authenticates with a Kubernetes instance.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub auth: Option<ClusterSecretStoreProviderKubernetesAuth>,
    /// A reference to a secret that contains the auth information.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "authRef")]
    pub auth_ref: Option<ClusterSecretStoreProviderKubernetesAuthRef>,
    /// Remote namespace to fetch the secrets from
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "remoteNamespace")]
    pub remote_namespace: Option<String>,
    /// configures the Kubernetes server Address.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub server: Option<ClusterSecretStoreProviderKubernetesServer>,
}

/// Auth configures how secret-manager authenticates with a Kubernetes instance.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderKubernetesAuth {
    /// has both clientCert and clientKey as secretKeySelector
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub cert: Option<ClusterSecretStoreProviderKubernetesAuthCert>,
    /// points to a service account that should be used for authentication
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceAccount")]
    pub service_account: Option<ClusterSecretStoreProviderKubernetesAuthServiceAccount>,
    /// use static token to authenticate with
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub token: Option<ClusterSecretStoreProviderKubernetesAuthToken>,
}

/// has both clientCert and clientKey as secretKeySelector
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderKubernetesAuthCert {
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "clientCert")]
    pub client_cert: Option<ClusterSecretStoreProviderKubernetesAuthCertClientCert>,
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "clientKey")]
    pub client_key: Option<ClusterSecretStoreProviderKubernetesAuthCertClientKey>,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderKubernetesAuthCertClientCert {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderKubernetesAuthCertClientKey {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// points to a service account that should be used for authentication
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderKubernetesAuthServiceAccount {
    /// Audience specifies the `aud` claim for the service account token
    /// If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
    /// then this audiences will be appended to the list
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audiences: Option<Vec<String>>,
    /// The name of the ServiceAccount resource being referred to.
    pub name: String,
    /// Namespace of the resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// use static token to authenticate with
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderKubernetesAuthToken {
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "bearerToken")]
    pub bearer_token: Option<ClusterSecretStoreProviderKubernetesAuthTokenBearerToken>,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderKubernetesAuthTokenBearerToken {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// A reference to a secret that contains the auth information.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderKubernetesAuthRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// configures the Kubernetes server Address.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderKubernetesServer {
    /// CABundle is a base64-encoded CA certificate
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caBundle")]
    pub ca_bundle: Option<String>,
    /// see: <https://external-secrets.io/v0.4.1/spec/#external-secrets.io/v1alpha1.CAProvider>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caProvider")]
    pub ca_provider: Option<ClusterSecretStoreProviderKubernetesServerCaProvider>,
    /// configures the Kubernetes server Address.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub url: Option<String>,
}

/// see: <https://external-secrets.io/v0.4.1/spec/#external-secrets.io/v1alpha1.CAProvider>
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub struct ClusterSecretStoreProviderKubernetesServerCaProvider {
    /// The key where the CA certificate can be found in the Secret or ConfigMap.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the object located at the provider type.
    pub name: String,
    /// The namespace the Provider type is in.
    /// Can only be defined when used in a ClusterSecretStore.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
    /// The type of provider to use such as "Secret", or "ConfigMap".
    #[serde(rename = "type")]
    pub r#type: ClusterSecretStoreProviderKubernetesServerCaProviderType,
}

/// see: <https://external-secrets.io/v0.4.1/spec/#external-secrets.io/v1alpha1.CAProvider>
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum ClusterSecretStoreProviderKubernetesServerCaProviderType {
    Secret,
    ConfigMap,
}

/// Ngrok configures this store to sync secrets using the ngrok provider.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderNgrok {
    /// APIURL is the URL of the ngrok API.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "apiUrl")]
    pub api_url: Option<String>,
    /// Auth configures how the ngrok provider authenticates with the ngrok API.
    pub auth: ClusterSecretStoreProviderNgrokAuth,
    /// Vault configures the ngrok vault to sync secrets with.
    pub vault: ClusterSecretStoreProviderNgrokVault,
}

/// Auth configures how the ngrok provider authenticates with the ngrok API.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderNgrokAuth {
    /// APIKey is the API Key used to authenticate with ngrok. See <https://ngrok.com/docs/api/#authentication>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "apiKey")]
    pub api_key: Option<ClusterSecretStoreProviderNgrokAuthApiKey>,
}

/// APIKey is the API Key used to authenticate with ngrok. See <https://ngrok.com/docs/api/#authentication>
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderNgrokAuthApiKey {
    /// SecretRef is a reference to a secret containing the ngrok API key.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderNgrokAuthApiKeySecretRef>,
}

/// SecretRef is a reference to a secret containing the ngrok API key.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderNgrokAuthApiKeySecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Vault configures the ngrok vault to sync secrets with.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderNgrokVault {
    /// Name is the name of the ngrok vault to sync secrets with.
    pub name: String,
}

/// Onboardbase configures this store to sync secrets using the Onboardbase provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderOnboardbase {
    /// APIHost use this to configure the host url for the API for selfhosted installation, default is <https://public.onboardbase.com/api/v1/>
    #[serde(rename = "apiHost")]
    pub api_host: String,
    /// Auth configures how the Operator authenticates with the Onboardbase API
    pub auth: ClusterSecretStoreProviderOnboardbaseAuth,
    /// Environment is the name of an environmnent within a project to pull the secrets from
    pub environment: String,
    /// Project is an onboardbase project that the secrets should be pulled from
    pub project: String,
}

/// Auth configures how the Operator authenticates with the Onboardbase API
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderOnboardbaseAuth {
    /// OnboardbaseAPIKey is the APIKey generated by an admin account.
    /// It is used to recognize and authorize access to a project and environment within onboardbase
    #[serde(rename = "apiKeyRef")]
    pub api_key_ref: ClusterSecretStoreProviderOnboardbaseAuthApiKeyRef,
    /// OnboardbasePasscode is the passcode attached to the API Key
    #[serde(rename = "passcodeRef")]
    pub passcode_ref: ClusterSecretStoreProviderOnboardbaseAuthPasscodeRef,
}

/// OnboardbaseAPIKey is the APIKey generated by an admin account.
/// It is used to recognize and authorize access to a project and environment within onboardbase
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderOnboardbaseAuthApiKeyRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// OnboardbasePasscode is the passcode attached to the API Key
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderOnboardbaseAuthPasscodeRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// OnePassword configures this store to sync secrets using the 1Password Cloud provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderOnepassword {
    /// Auth defines the information necessary to authenticate against OnePassword Connect Server
    pub auth: ClusterSecretStoreProviderOnepasswordAuth,
    /// ConnectHost defines the OnePassword Connect Server to connect to
    #[serde(rename = "connectHost")]
    pub connect_host: String,
    /// Vaults defines which OnePassword vaults to search in which order
    pub vaults: BTreeMap<String, i64>,
}

/// Auth defines the information necessary to authenticate against OnePassword Connect Server
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderOnepasswordAuth {
    /// OnePasswordAuthSecretRef holds secret references for 1Password credentials.
    #[serde(rename = "secretRef")]
    pub secret_ref: ClusterSecretStoreProviderOnepasswordAuthSecretRef,
}

/// OnePasswordAuthSecretRef holds secret references for 1Password credentials.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderOnepasswordAuthSecretRef {
    /// The ConnectToken is used for authentication to a 1Password Connect Server.
    #[serde(rename = "connectTokenSecretRef")]
    pub connect_token_secret_ref: ClusterSecretStoreProviderOnepasswordAuthSecretRefConnectTokenSecretRef,
}

/// The ConnectToken is used for authentication to a 1Password Connect Server.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderOnepasswordAuthSecretRefConnectTokenSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// OnePasswordSDK configures this store to use 1Password's new Go SDK to sync secrets.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderOnepasswordSdk {
    /// Auth defines the information necessary to authenticate against OnePassword API.
    pub auth: ClusterSecretStoreProviderOnepasswordSdkAuth,
    /// Cache configures client-side caching for read operations (GetSecret, GetSecretMap).
    /// When enabled, secrets are cached with the specified TTL.
    /// Write operations (PushSecret, DeleteSecret) automatically invalidate relevant cache entries.
    /// If omitted, caching is disabled (default).
    /// cache: {} is a valid option to set.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub cache: Option<ClusterSecretStoreProviderOnepasswordSdkCache>,
    /// IntegrationInfo specifies the name and version of the integration built using the 1Password Go SDK.
    /// If you don't know which name and version to use, use `DefaultIntegrationName` and `DefaultIntegrationVersion`, respectively.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "integrationInfo")]
    pub integration_info: Option<ClusterSecretStoreProviderOnepasswordSdkIntegrationInfo>,
    /// Vault defines the vault's name or uuid to access. Do NOT add op:// prefix. This will be done automatically.
    pub vault: String,
}

/// Auth defines the information necessary to authenticate against OnePassword API.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderOnepasswordSdkAuth {
    /// ServiceAccountSecretRef points to the secret containing the token to access 1Password vault.
    #[serde(rename = "serviceAccountSecretRef")]
    pub service_account_secret_ref: ClusterSecretStoreProviderOnepasswordSdkAuthServiceAccountSecretRef,
}

/// ServiceAccountSecretRef points to the secret containing the token to access 1Password vault.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderOnepasswordSdkAuthServiceAccountSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Cache configures client-side caching for read operations (GetSecret, GetSecretMap).
/// When enabled, secrets are cached with the specified TTL.
/// Write operations (PushSecret, DeleteSecret) automatically invalidate relevant cache entries.
/// If omitted, caching is disabled (default).
/// cache: {} is a valid option to set.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderOnepasswordSdkCache {
    /// MaxSize is the maximum number of secrets to cache.
    /// When the cache is full, least-recently-used entries are evicted.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "maxSize")]
    pub max_size: Option<i64>,
    /// TTL is the time-to-live for cached secrets.
    /// Format: duration string (e.g., "5m", "1h", "30s")
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub ttl: Option<String>,
}

/// IntegrationInfo specifies the name and version of the integration built using the 1Password Go SDK.
/// If you don't know which name and version to use, use `DefaultIntegrationName` and `DefaultIntegrationVersion`, respectively.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderOnepasswordSdkIntegrationInfo {
    /// Name defaults to "1Password SDK".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// Version defaults to "v1.0.0".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub version: Option<String>,
}

/// Oracle configures this store to sync secrets using Oracle Vault provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderOracle {
    /// Auth configures how secret-manager authenticates with the Oracle Vault.
    /// If empty, use the instance principal, otherwise the user credentials specified in Auth.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub auth: Option<ClusterSecretStoreProviderOracleAuth>,
    /// Compartment is the vault compartment OCID.
    /// Required for PushSecret
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub compartment: Option<String>,
    /// EncryptionKey is the OCID of the encryption key within the vault.
    /// Required for PushSecret
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "encryptionKey")]
    pub encryption_key: Option<String>,
    /// The type of principal to use for authentication. If left blank, the Auth struct will
    /// determine the principal type. This optional field must be specified if using
    /// workload identity.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "principalType")]
    pub principal_type: Option<ClusterSecretStoreProviderOraclePrincipalType>,
    /// Region is the region where vault is located.
    pub region: String,
    /// ServiceAccountRef specified the service account
    /// that should be used when authenticating with WorkloadIdentity.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceAccountRef")]
    pub service_account_ref: Option<ClusterSecretStoreProviderOracleServiceAccountRef>,
    /// Vault is the vault's OCID of the specific vault where secret is located.
    pub vault: String,
}

/// Auth configures how secret-manager authenticates with the Oracle Vault.
/// If empty, use the instance principal, otherwise the user credentials specified in Auth.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderOracleAuth {
    /// SecretRef to pass through sensitive information.
    #[serde(rename = "secretRef")]
    pub secret_ref: ClusterSecretStoreProviderOracleAuthSecretRef,
    /// Tenancy is the tenancy OCID where user is located.
    pub tenancy: String,
    /// User is an access OCID specific to the account.
    pub user: String,
}

/// SecretRef to pass through sensitive information.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderOracleAuthSecretRef {
    /// Fingerprint is the fingerprint of the API private key.
    pub fingerprint: ClusterSecretStoreProviderOracleAuthSecretRefFingerprint,
    /// PrivateKey is the user's API Signing Key in PEM format, used for authentication.
    pub privatekey: ClusterSecretStoreProviderOracleAuthSecretRefPrivatekey,
}

/// Fingerprint is the fingerprint of the API private key.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderOracleAuthSecretRefFingerprint {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// PrivateKey is the user's API Signing Key in PEM format, used for authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderOracleAuthSecretRefPrivatekey {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Oracle configures this store to sync secrets using Oracle Vault provider
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum ClusterSecretStoreProviderOraclePrincipalType {
    #[serde(rename = "")]
    KopiumEmpty,
    UserPrincipal,
    InstancePrincipal,
    Workload,
}

/// ServiceAccountRef specified the service account
/// that should be used when authenticating with WorkloadIdentity.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderOracleServiceAccountRef {
    /// Audience specifies the `aud` claim for the service account token
    /// If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
    /// then this audiences will be appended to the list
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audiences: Option<Vec<String>>,
    /// The name of the ServiceAccount resource being referred to.
    pub name: String,
    /// Namespace of the resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// PassboltProvider provides access to Passbolt secrets manager.
/// See: <https://www.passbolt.com.>
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderPassbolt {
    /// Auth defines the information necessary to authenticate against Passbolt Server
    pub auth: ClusterSecretStoreProviderPassboltAuth,
    /// Host defines the Passbolt Server to connect to
    pub host: String,
}

/// Auth defines the information necessary to authenticate against Passbolt Server
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderPassboltAuth {
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(rename = "passwordSecretRef")]
    pub password_secret_ref: ClusterSecretStoreProviderPassboltAuthPasswordSecretRef,
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(rename = "privateKeySecretRef")]
    pub private_key_secret_ref: ClusterSecretStoreProviderPassboltAuthPrivateKeySecretRef,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderPassboltAuthPasswordSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderPassboltAuthPrivateKeySecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// PasswordDepotProvider configures a store to sync secrets with a Password Depot instance.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderPassworddepot {
    /// Auth configures how secret-manager authenticates with a Password Depot instance.
    pub auth: ClusterSecretStoreProviderPassworddepotAuth,
    /// Database to use as source
    pub database: String,
    /// URL configures the Password Depot instance URL.
    pub host: String,
}

/// Auth configures how secret-manager authenticates with a Password Depot instance.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderPassworddepotAuth {
    /// PasswordDepotSecretRef contains the secret reference for Password Depot authentication.
    #[serde(rename = "secretRef")]
    pub secret_ref: ClusterSecretStoreProviderPassworddepotAuthSecretRef,
}

/// PasswordDepotSecretRef contains the secret reference for Password Depot authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderPassworddepotAuthSecretRef {
    /// Username / Password is used for authentication.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub credentials: Option<ClusterSecretStoreProviderPassworddepotAuthSecretRefCredentials>,
}

/// Username / Password is used for authentication.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderPassworddepotAuthSecretRefCredentials {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Previder configures this store to sync secrets using the Previder provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderPrevider {
    /// PreviderAuth contains a secretRef for credentials.
    pub auth: ClusterSecretStoreProviderPreviderAuth,
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "baseUri")]
    pub base_uri: Option<String>,
}

/// PreviderAuth contains a secretRef for credentials.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderPreviderAuth {
    /// PreviderAuthSecretRef holds secret references for Previder Vault credentials.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderPreviderAuthSecretRef>,
}

/// PreviderAuthSecretRef holds secret references for Previder Vault credentials.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderPreviderAuthSecretRef {
    /// The AccessToken is used for authentication
    #[serde(rename = "accessToken")]
    pub access_token: ClusterSecretStoreProviderPreviderAuthSecretRefAccessToken,
}

/// The AccessToken is used for authentication
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderPreviderAuthSecretRefAccessToken {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Pulumi configures this store to sync secrets using the Pulumi provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderPulumi {
    /// AccessToken is the access tokens to sign in to the Pulumi Cloud Console.
    #[serde(rename = "accessToken")]
    pub access_token: ClusterSecretStoreProviderPulumiAccessToken,
    /// APIURL is the URL of the Pulumi API.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "apiUrl")]
    pub api_url: Option<String>,
    /// Environment are YAML documents composed of static key-value pairs, programmatic expressions,
    /// dynamically retrieved values from supported providers including all major clouds,
    /// and other Pulumi ESC environments.
    /// To create a new environment, visit <https://www.pulumi.com/docs/esc/environments/> for more information.
    pub environment: String,
    /// Organization are a space to collaborate on shared projects and stacks.
    /// To create a new organization, visit <https://app.pulumi.com/> and click "New Organization".
    pub organization: String,
    /// Project is the name of the Pulumi ESC project the environment belongs to.
    pub project: String,
}

/// AccessToken is the access tokens to sign in to the Pulumi Cloud Console.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderPulumiAccessToken {
    /// SecretRef is a reference to a secret containing the Pulumi API token.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderPulumiAccessTokenSecretRef>,
}

/// SecretRef is a reference to a secret containing the Pulumi API token.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderPulumiAccessTokenSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Scaleway configures this store to sync secrets using the Scaleway provider.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderScaleway {
    /// AccessKey is the non-secret part of the api key.
    #[serde(rename = "accessKey")]
    pub access_key: ClusterSecretStoreProviderScalewayAccessKey,
    /// APIURL is the url of the api to use. Defaults to <https://api.scaleway.com>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "apiUrl")]
    pub api_url: Option<String>,
    /// ProjectID is the id of your project, which you can find in the console: <https://console.scaleway.com/project/settings>
    #[serde(rename = "projectId")]
    pub project_id: String,
    /// Region where your secrets are located: <https://developers.scaleway.com/en/quickstart/#region-and-zone>
    pub region: String,
    /// SecretKey is the non-secret part of the api key.
    #[serde(rename = "secretKey")]
    pub secret_key: ClusterSecretStoreProviderScalewaySecretKey,
}

/// AccessKey is the non-secret part of the api key.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderScalewayAccessKey {
    /// SecretRef references a key in a secret that will be used as value.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderScalewayAccessKeySecretRef>,
    /// Value can be specified directly to set a value without using a secret.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub value: Option<String>,
}

/// SecretRef references a key in a secret that will be used as value.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderScalewayAccessKeySecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// SecretKey is the non-secret part of the api key.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderScalewaySecretKey {
    /// SecretRef references a key in a secret that will be used as value.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderScalewaySecretKeySecretRef>,
    /// Value can be specified directly to set a value without using a secret.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub value: Option<String>,
}

/// SecretRef references a key in a secret that will be used as value.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderScalewaySecretKeySecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// SecretServer configures this store to sync secrets using SecretServer provider
/// <https://docs.delinea.com/online-help/secret-server/start.htm>
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderSecretserver {
    /// PEM/base64 encoded CA bundle used to validate Secret ServerURL. Only used
    /// if the ServerURL URL is using HTTPS protocol. If not set the system root certificates
    /// are used to validate the TLS connection.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caBundle")]
    pub ca_bundle: Option<String>,
    /// The provider for the CA bundle to use to validate Secret ServerURL certificate.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caProvider")]
    pub ca_provider: Option<ClusterSecretStoreProviderSecretserverCaProvider>,
    /// Domain is the secret server domain.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub domain: Option<String>,
    /// Password is the secret server account password.
    pub password: ClusterSecretStoreProviderSecretserverPassword,
    /// ServerURL
    /// URL to your secret server installation
    #[serde(rename = "serverURL")]
    pub server_url: String,
    /// Username is the secret server account username.
    pub username: ClusterSecretStoreProviderSecretserverUsername,
}

/// The provider for the CA bundle to use to validate Secret ServerURL certificate.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub struct ClusterSecretStoreProviderSecretserverCaProvider {
    /// The key where the CA certificate can be found in the Secret or ConfigMap.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the object located at the provider type.
    pub name: String,
    /// The namespace the Provider type is in.
    /// Can only be defined when used in a ClusterSecretStore.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
    /// The type of provider to use such as "Secret", or "ConfigMap".
    #[serde(rename = "type")]
    pub r#type: ClusterSecretStoreProviderSecretserverCaProviderType,
}

/// The provider for the CA bundle to use to validate Secret ServerURL certificate.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum ClusterSecretStoreProviderSecretserverCaProviderType {
    Secret,
    ConfigMap,
}

/// Password is the secret server account password.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderSecretserverPassword {
    /// SecretRef references a key in a secret that will be used as value.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderSecretserverPasswordSecretRef>,
    /// Value can be specified directly to set a value without using a secret.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub value: Option<String>,
}

/// SecretRef references a key in a secret that will be used as value.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderSecretserverPasswordSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Username is the secret server account username.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderSecretserverUsername {
    /// SecretRef references a key in a secret that will be used as value.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderSecretserverUsernameSecretRef>,
    /// Value can be specified directly to set a value without using a secret.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub value: Option<String>,
}

/// SecretRef references a key in a secret that will be used as value.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderSecretserverUsernameSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Senhasegura configures this store to sync secrets using senhasegura provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderSenhasegura {
    /// Auth defines parameters to authenticate in senhasegura
    pub auth: ClusterSecretStoreProviderSenhaseguraAuth,
    /// IgnoreSslCertificate defines if SSL certificate must be ignored
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "ignoreSslCertificate")]
    pub ignore_ssl_certificate: Option<bool>,
    /// Module defines which senhasegura module should be used to get secrets
    pub module: String,
    /// URL of senhasegura
    pub url: String,
}

/// Auth defines parameters to authenticate in senhasegura
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderSenhaseguraAuth {
    #[serde(rename = "clientId")]
    pub client_id: String,
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(rename = "clientSecretSecretRef")]
    pub client_secret_secret_ref: ClusterSecretStoreProviderSenhaseguraAuthClientSecretSecretRef,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderSenhaseguraAuthClientSecretSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Vault configures this store to sync secrets using the HashiCorp Vault provider.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVault {
    /// Auth configures how secret-manager authenticates with the Vault server.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub auth: Option<ClusterSecretStoreProviderVaultAuth>,
    /// PEM encoded CA bundle used to validate Vault server certificate. Only used
    /// if the Server URL is using HTTPS protocol. This parameter is ignored for
    /// plain HTTP protocol connection. If not set the system root certificates
    /// are used to validate the TLS connection.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caBundle")]
    pub ca_bundle: Option<String>,
    /// The provider for the CA bundle to use to validate Vault server certificate.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caProvider")]
    pub ca_provider: Option<ClusterSecretStoreProviderVaultCaProvider>,
    /// CheckAndSet defines the Check-And-Set (CAS) settings for PushSecret operations.
    /// Only applies to Vault KV v2 stores. When enabled, write operations must include
    /// the current version of the secret to prevent unintentional overwrites.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "checkAndSet")]
    pub check_and_set: Option<ClusterSecretStoreProviderVaultCheckAndSet>,
    /// ForwardInconsistent tells Vault to forward read-after-write requests to the Vault
    /// leader instead of simply retrying within a loop. This can increase performance if
    /// the option is enabled serverside.
    /// <https://www.vaultproject.io/docs/configuration/replication#allow_forwarding_via_header>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "forwardInconsistent")]
    pub forward_inconsistent: Option<bool>,
    /// Headers to be added in Vault request
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub headers: Option<BTreeMap<String, String>>,
    /// Name of the vault namespace. Namespaces is a set of features within Vault Enterprise that allows
    /// Vault environments to support Secure Multi-tenancy. e.g: "ns1".
    /// More about namespaces can be found here <https://www.vaultproject.io/docs/enterprise/namespaces>
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
    /// Path is the mount path of the Vault KV backend endpoint, e.g:
    /// "secret". The v2 KV secret engine version specific "/data" path suffix
    /// for fetching secrets from Vault is optional and will be appended
    /// if not present in specified path.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub path: Option<String>,
    /// ReadYourWrites ensures isolated read-after-write semantics by
    /// providing discovered cluster replication states in each request.
    /// More information about eventual consistency in Vault can be found here
    /// <https://www.vaultproject.io/docs/enterprise/consistency>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "readYourWrites")]
    pub read_your_writes: Option<bool>,
    /// Server is the connection address for the Vault server, e.g: "<https://vault.example.com:8200".>
    pub server: String,
    /// The configuration used for client side related TLS communication, when the Vault server
    /// requires mutual authentication. Only used if the Server URL is using HTTPS protocol.
    /// This parameter is ignored for plain HTTP protocol connection.
    /// It's worth noting this configuration is different from the "TLS certificates auth method",
    /// which is available under the `auth.cert` section.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub tls: Option<ClusterSecretStoreProviderVaultTls>,
    /// Version is the Vault KV secret engine version. This can be either "v1" or
    /// "v2". Version defaults to "v2".
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub version: Option<ClusterSecretStoreProviderVaultVersion>,
}

/// Auth configures how secret-manager authenticates with the Vault server.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuth {
    /// AppRole authenticates with Vault using the App Role auth mechanism,
    /// with the role and secret stored in a Kubernetes Secret resource.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "appRole")]
    pub app_role: Option<ClusterSecretStoreProviderVaultAuthAppRole>,
    /// Cert authenticates with TLS Certificates by passing client certificate, private key and ca certificate
    /// Cert authentication method
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub cert: Option<ClusterSecretStoreProviderVaultAuthCert>,
    /// Gcp authenticates with Vault using Google Cloud Platform authentication method
    /// GCP authentication method
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub gcp: Option<ClusterSecretStoreProviderVaultAuthGcp>,
    /// Iam authenticates with vault by passing a special AWS request signed with AWS IAM credentials
    /// AWS IAM authentication method
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub iam: Option<ClusterSecretStoreProviderVaultAuthIam>,
    /// Jwt authenticates with Vault by passing role and JWT token using the
    /// JWT/OIDC authentication method
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub jwt: Option<ClusterSecretStoreProviderVaultAuthJwt>,
    /// Kubernetes authenticates with Vault by passing the ServiceAccount
    /// token stored in the named Secret resource to the Vault server.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub kubernetes: Option<ClusterSecretStoreProviderVaultAuthKubernetes>,
    /// Ldap authenticates with Vault by passing username/password pair using
    /// the LDAP authentication method
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub ldap: Option<ClusterSecretStoreProviderVaultAuthLdap>,
    /// Name of the vault namespace to authenticate to. This can be different than the namespace your secret is in.
    /// Namespaces is a set of features within Vault Enterprise that allows
    /// Vault environments to support Secure Multi-tenancy. e.g: "ns1".
    /// More about namespaces can be found here <https://www.vaultproject.io/docs/enterprise/namespaces>
    /// This will default to Vault.Namespace field if set, or empty otherwise
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
    /// TokenSecretRef authenticates with Vault by presenting a token.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "tokenSecretRef")]
    pub token_secret_ref: Option<ClusterSecretStoreProviderVaultAuthTokenSecretRef>,
    /// UserPass authenticates with Vault by passing username/password pair
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "userPass")]
    pub user_pass: Option<ClusterSecretStoreProviderVaultAuthUserPass>,
}

/// AppRole authenticates with Vault using the App Role auth mechanism,
/// with the role and secret stored in a Kubernetes Secret resource.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthAppRole {
    /// Path where the App Role authentication backend is mounted
    /// in Vault, e.g: "approle"
    pub path: String,
    /// RoleID configured in the App Role authentication backend when setting
    /// up the authentication backend in Vault.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "roleId")]
    pub role_id: Option<String>,
    /// Reference to a key in a Secret that contains the App Role ID used
    /// to authenticate with Vault.
    /// The `key` field must be specified and denotes which entry within the Secret
    /// resource is used as the app role id.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "roleRef")]
    pub role_ref: Option<ClusterSecretStoreProviderVaultAuthAppRoleRoleRef>,
    /// Reference to a key in a Secret that contains the App Role secret used
    /// to authenticate with Vault.
    /// The `key` field must be specified and denotes which entry within the Secret
    /// resource is used as the app role secret.
    #[serde(rename = "secretRef")]
    pub secret_ref: ClusterSecretStoreProviderVaultAuthAppRoleSecretRef,
}

/// Reference to a key in a Secret that contains the App Role ID used
/// to authenticate with Vault.
/// The `key` field must be specified and denotes which entry within the Secret
/// resource is used as the app role id.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthAppRoleRoleRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Reference to a key in a Secret that contains the App Role secret used
/// to authenticate with Vault.
/// The `key` field must be specified and denotes which entry within the Secret
/// resource is used as the app role secret.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthAppRoleSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Cert authenticates with TLS Certificates by passing client certificate, private key and ca certificate
/// Cert authentication method
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthCert {
    /// ClientCert is a certificate to authenticate using the Cert Vault
    /// authentication method
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "clientCert")]
    pub client_cert: Option<ClusterSecretStoreProviderVaultAuthCertClientCert>,
    /// Path where the Certificate authentication backend is mounted
    /// in Vault, e.g: "cert"
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub path: Option<String>,
    /// SecretRef to a key in a Secret resource containing client private key to
    /// authenticate with Vault using the Cert authentication method
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderVaultAuthCertSecretRef>,
}

/// ClientCert is a certificate to authenticate using the Cert Vault
/// authentication method
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthCertClientCert {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// SecretRef to a key in a Secret resource containing client private key to
/// authenticate with Vault using the Cert authentication method
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthCertSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Gcp authenticates with Vault using Google Cloud Platform authentication method
/// GCP authentication method
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthGcp {
    /// Location optionally defines a location/region for the secret
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub location: Option<String>,
    /// Path where the GCP auth method is enabled in Vault, e.g: "gcp"
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub path: Option<String>,
    /// Project ID of the Google Cloud Platform project
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "projectID")]
    pub project_id: Option<String>,
    /// Vault Role. In Vault, a role describes an identity with a set of permissions, groups, or policies you want to attach to a user of the secrets engine.
    pub role: String,
    /// Specify credentials in a Secret object
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderVaultAuthGcpSecretRef>,
    /// ServiceAccountRef to a service account for impersonation
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceAccountRef")]
    pub service_account_ref: Option<ClusterSecretStoreProviderVaultAuthGcpServiceAccountRef>,
    /// Specify a service account with Workload Identity
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "workloadIdentity")]
    pub workload_identity: Option<ClusterSecretStoreProviderVaultAuthGcpWorkloadIdentity>,
}

/// Specify credentials in a Secret object
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthGcpSecretRef {
    /// The SecretAccessKey is used for authentication
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretAccessKeySecretRef")]
    pub secret_access_key_secret_ref: Option<ClusterSecretStoreProviderVaultAuthGcpSecretRefSecretAccessKeySecretRef>,
}

/// The SecretAccessKey is used for authentication
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthGcpSecretRefSecretAccessKeySecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// ServiceAccountRef to a service account for impersonation
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthGcpServiceAccountRef {
    /// Audience specifies the `aud` claim for the service account token
    /// If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
    /// then this audiences will be appended to the list
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audiences: Option<Vec<String>>,
    /// The name of the ServiceAccount resource being referred to.
    pub name: String,
    /// Namespace of the resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Specify a service account with Workload Identity
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthGcpWorkloadIdentity {
    /// ClusterLocation is the location of the cluster
    /// If not specified, it fetches information from the metadata server
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "clusterLocation")]
    pub cluster_location: Option<String>,
    /// ClusterName is the name of the cluster
    /// If not specified, it fetches information from the metadata server
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "clusterName")]
    pub cluster_name: Option<String>,
    /// ClusterProjectID is the project ID of the cluster
    /// If not specified, it fetches information from the metadata server
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "clusterProjectID")]
    pub cluster_project_id: Option<String>,
    /// ServiceAccountSelector is a reference to a ServiceAccount resource.
    #[serde(rename = "serviceAccountRef")]
    pub service_account_ref: ClusterSecretStoreProviderVaultAuthGcpWorkloadIdentityServiceAccountRef,
}

/// ServiceAccountSelector is a reference to a ServiceAccount resource.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthGcpWorkloadIdentityServiceAccountRef {
    /// Audience specifies the `aud` claim for the service account token
    /// If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
    /// then this audiences will be appended to the list
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audiences: Option<Vec<String>>,
    /// The name of the ServiceAccount resource being referred to.
    pub name: String,
    /// Namespace of the resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Iam authenticates with vault by passing a special AWS request signed with AWS IAM credentials
/// AWS IAM authentication method
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthIam {
    /// AWS External ID set on assumed IAM roles
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "externalID")]
    pub external_id: Option<String>,
    /// Specify a service account with IRSA enabled
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub jwt: Option<ClusterSecretStoreProviderVaultAuthIamJwt>,
    /// Path where the AWS auth method is enabled in Vault, e.g: "aws"
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub path: Option<String>,
    /// AWS region
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub region: Option<String>,
    /// This is the AWS role to be assumed before talking to vault
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub role: Option<String>,
    /// Specify credentials in a Secret object
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderVaultAuthIamSecretRef>,
    /// X-Vault-AWS-IAM-Server-ID is an additional header used by Vault IAM auth method to mitigate against different types of replay attacks. More details here: <https://developer.hashicorp.com/vault/docs/auth/aws>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "vaultAwsIamServerID")]
    pub vault_aws_iam_server_id: Option<String>,
    /// Vault Role. In vault, a role describes an identity with a set of permissions, groups, or policies you want to attach a user of the secrets engine
    #[serde(rename = "vaultRole")]
    pub vault_role: String,
}

/// Specify a service account with IRSA enabled
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthIamJwt {
    /// ServiceAccountSelector is a reference to a ServiceAccount resource.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceAccountRef")]
    pub service_account_ref: Option<ClusterSecretStoreProviderVaultAuthIamJwtServiceAccountRef>,
}

/// ServiceAccountSelector is a reference to a ServiceAccount resource.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthIamJwtServiceAccountRef {
    /// Audience specifies the `aud` claim for the service account token
    /// If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
    /// then this audiences will be appended to the list
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audiences: Option<Vec<String>>,
    /// The name of the ServiceAccount resource being referred to.
    pub name: String,
    /// Namespace of the resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Specify credentials in a Secret object
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthIamSecretRef {
    /// The AccessKeyID is used for authentication
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "accessKeyIDSecretRef")]
    pub access_key_id_secret_ref: Option<ClusterSecretStoreProviderVaultAuthIamSecretRefAccessKeyIdSecretRef>,
    /// The SecretAccessKey is used for authentication
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretAccessKeySecretRef")]
    pub secret_access_key_secret_ref: Option<ClusterSecretStoreProviderVaultAuthIamSecretRefSecretAccessKeySecretRef>,
    /// The SessionToken used for authentication
    /// This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
    /// see: <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html>
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "sessionTokenSecretRef")]
    pub session_token_secret_ref: Option<ClusterSecretStoreProviderVaultAuthIamSecretRefSessionTokenSecretRef>,
}

/// The AccessKeyID is used for authentication
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthIamSecretRefAccessKeyIdSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// The SecretAccessKey is used for authentication
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthIamSecretRefSecretAccessKeySecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// The SessionToken used for authentication
/// This must be defined if AccessKeyID and SecretAccessKey are temporary credentials
/// see: <https://docs.aws.amazon.com/IAM/latest/UserGuide/id_credentials_temp_use-resources.html>
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthIamSecretRefSessionTokenSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Jwt authenticates with Vault by passing role and JWT token using the
/// JWT/OIDC authentication method
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthJwt {
    /// Optional ServiceAccountToken specifies the Kubernetes service account for which to request
    /// a token for with the `TokenRequest` API.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "kubernetesServiceAccountToken")]
    pub kubernetes_service_account_token: Option<ClusterSecretStoreProviderVaultAuthJwtKubernetesServiceAccountToken>,
    /// Path where the JWT authentication backend is mounted
    /// in Vault, e.g: "jwt"
    pub path: String,
    /// Role is a JWT role to authenticate using the JWT/OIDC Vault
    /// authentication method
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub role: Option<String>,
    /// Optional SecretRef that refers to a key in a Secret resource containing JWT token to
    /// authenticate with Vault using the JWT/OIDC authentication method.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderVaultAuthJwtSecretRef>,
}

/// Optional ServiceAccountToken specifies the Kubernetes service account for which to request
/// a token for with the `TokenRequest` API.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthJwtKubernetesServiceAccountToken {
    /// Optional audiences field that will be used to request a temporary Kubernetes service
    /// account token for the service account referenced by `serviceAccountRef`.
    /// Defaults to a single audience `vault` it not specified.
    /// Deprecated: use serviceAccountRef.Audiences instead
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audiences: Option<Vec<String>>,
    /// Optional expiration time in seconds that will be used to request a temporary
    /// Kubernetes service account token for the service account referenced by
    /// `serviceAccountRef`.
    /// Deprecated: this will be removed in the future.
    /// Defaults to 10 minutes.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "expirationSeconds")]
    pub expiration_seconds: Option<i64>,
    /// Service account field containing the name of a kubernetes ServiceAccount.
    #[serde(rename = "serviceAccountRef")]
    pub service_account_ref: ClusterSecretStoreProviderVaultAuthJwtKubernetesServiceAccountTokenServiceAccountRef,
}

/// Service account field containing the name of a kubernetes ServiceAccount.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthJwtKubernetesServiceAccountTokenServiceAccountRef {
    /// Audience specifies the `aud` claim for the service account token
    /// If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
    /// then this audiences will be appended to the list
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audiences: Option<Vec<String>>,
    /// The name of the ServiceAccount resource being referred to.
    pub name: String,
    /// Namespace of the resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Optional SecretRef that refers to a key in a Secret resource containing JWT token to
/// authenticate with Vault using the JWT/OIDC authentication method.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthJwtSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Kubernetes authenticates with Vault by passing the ServiceAccount
/// token stored in the named Secret resource to the Vault server.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthKubernetes {
    /// Path where the Kubernetes authentication backend is mounted in Vault, e.g:
    /// "kubernetes"
    #[serde(rename = "mountPath")]
    pub mount_path: String,
    /// A required field containing the Vault Role to assume. A Role binds a
    /// Kubernetes ServiceAccount with a set of Vault policies.
    pub role: String,
    /// Optional secret field containing a Kubernetes ServiceAccount JWT used
    /// for authenticating with Vault. If a name is specified without a key,
    /// `token` is the default. If one is not specified, the one bound to
    /// the controller will be used.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderVaultAuthKubernetesSecretRef>,
    /// Optional service account field containing the name of a kubernetes ServiceAccount.
    /// If the service account is specified, the service account secret token JWT will be used
    /// for authenticating with Vault. If the service account selector is not supplied,
    /// the secretRef will be used instead.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "serviceAccountRef")]
    pub service_account_ref: Option<ClusterSecretStoreProviderVaultAuthKubernetesServiceAccountRef>,
}

/// Optional secret field containing a Kubernetes ServiceAccount JWT used
/// for authenticating with Vault. If a name is specified without a key,
/// `token` is the default. If one is not specified, the one bound to
/// the controller will be used.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthKubernetesSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Optional service account field containing the name of a kubernetes ServiceAccount.
/// If the service account is specified, the service account secret token JWT will be used
/// for authenticating with Vault. If the service account selector is not supplied,
/// the secretRef will be used instead.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthKubernetesServiceAccountRef {
    /// Audience specifies the `aud` claim for the service account token
    /// If the service account uses a well-known annotation for e.g. IRSA or GCP Workload Identity
    /// then this audiences will be appended to the list
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub audiences: Option<Vec<String>>,
    /// The name of the ServiceAccount resource being referred to.
    pub name: String,
    /// Namespace of the resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Ldap authenticates with Vault by passing username/password pair using
/// the LDAP authentication method
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthLdap {
    /// Path where the LDAP authentication backend is mounted
    /// in Vault, e.g: "ldap"
    pub path: String,
    /// SecretRef to a key in a Secret resource containing password for the LDAP
    /// user used to authenticate with Vault using the LDAP authentication
    /// method
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderVaultAuthLdapSecretRef>,
    /// Username is an LDAP username used to authenticate using the LDAP Vault
    /// authentication method
    pub username: String,
}

/// SecretRef to a key in a Secret resource containing password for the LDAP
/// user used to authenticate with Vault using the LDAP authentication
/// method
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthLdapSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// TokenSecretRef authenticates with Vault by presenting a token.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthTokenSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// UserPass authenticates with Vault by passing username/password pair
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthUserPass {
    /// Path where the UserPassword authentication backend is mounted
    /// in Vault, e.g: "userpass"
    pub path: String,
    /// SecretRef to a key in a Secret resource containing password for the
    /// user used to authenticate with Vault using the UserPass authentication
    /// method
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderVaultAuthUserPassSecretRef>,
    /// Username is a username used to authenticate using the UserPass Vault
    /// authentication method
    pub username: String,
}

/// SecretRef to a key in a Secret resource containing password for the
/// user used to authenticate with Vault using the UserPass authentication
/// method
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultAuthUserPassSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// The provider for the CA bundle to use to validate Vault server certificate.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub struct ClusterSecretStoreProviderVaultCaProvider {
    /// The key where the CA certificate can be found in the Secret or ConfigMap.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the object located at the provider type.
    pub name: String,
    /// The namespace the Provider type is in.
    /// Can only be defined when used in a ClusterSecretStore.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
    /// The type of provider to use such as "Secret", or "ConfigMap".
    #[serde(rename = "type")]
    pub r#type: ClusterSecretStoreProviderVaultCaProviderType,
}

/// The provider for the CA bundle to use to validate Vault server certificate.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum ClusterSecretStoreProviderVaultCaProviderType {
    Secret,
    ConfigMap,
}

/// CheckAndSet defines the Check-And-Set (CAS) settings for PushSecret operations.
/// Only applies to Vault KV v2 stores. When enabled, write operations must include
/// the current version of the secret to prevent unintentional overwrites.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultCheckAndSet {
    /// Required when true, all write operations must include a check-and-set parameter.
    /// This helps prevent unintentional overwrites of secrets.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub required: Option<bool>,
}

/// The configuration used for client side related TLS communication, when the Vault server
/// requires mutual authentication. Only used if the Server URL is using HTTPS protocol.
/// This parameter is ignored for plain HTTP protocol connection.
/// It's worth noting this configuration is different from the "TLS certificates auth method",
/// which is available under the `auth.cert` section.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultTls {
    /// CertSecretRef is a certificate added to the transport layer
    /// when communicating with the Vault server.
    /// If no key for the Secret is specified, external-secret will default to 'tls.crt'.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "certSecretRef")]
    pub cert_secret_ref: Option<ClusterSecretStoreProviderVaultTlsCertSecretRef>,
    /// KeySecretRef to a key in a Secret resource containing client private key
    /// added to the transport layer when communicating with the Vault server.
    /// If no key for the Secret is specified, external-secret will default to 'tls.key'.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "keySecretRef")]
    pub key_secret_ref: Option<ClusterSecretStoreProviderVaultTlsKeySecretRef>,
}

/// CertSecretRef is a certificate added to the transport layer
/// when communicating with the Vault server.
/// If no key for the Secret is specified, external-secret will default to 'tls.crt'.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultTlsCertSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// KeySecretRef to a key in a Secret resource containing client private key
/// added to the transport layer when communicating with the Vault server.
/// If no key for the Secret is specified, external-secret will default to 'tls.key'.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVaultTlsKeySecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Vault configures this store to sync secrets using the HashiCorp Vault provider.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum ClusterSecretStoreProviderVaultVersion {
    #[serde(rename = "v1")]
    V1,
    #[serde(rename = "v2")]
    V2,
}

/// Volcengine configures this store to sync secrets using the Volcengine provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVolcengine {
    /// Auth defines the authentication method to use.
    /// If not specified, the provider will try to use IRSA (IAM Role for Service Account).
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub auth: Option<ClusterSecretStoreProviderVolcengineAuth>,
    /// Region specifies the Volcengine region to connect to.
    pub region: String,
}

/// Auth defines the authentication method to use.
/// If not specified, the provider will try to use IRSA (IAM Role for Service Account).
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVolcengineAuth {
    /// SecretRef defines the static credentials to use for authentication.
    /// If not set, IRSA is used.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "secretRef")]
    pub secret_ref: Option<ClusterSecretStoreProviderVolcengineAuthSecretRef>,
}

/// SecretRef defines the static credentials to use for authentication.
/// If not set, IRSA is used.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVolcengineAuthSecretRef {
    /// AccessKeyID is the reference to the secret containing the Access Key ID.
    #[serde(rename = "accessKeyID")]
    pub access_key_id: ClusterSecretStoreProviderVolcengineAuthSecretRefAccessKeyId,
    /// SecretAccessKey is the reference to the secret containing the Secret Access Key.
    #[serde(rename = "secretAccessKey")]
    pub secret_access_key: ClusterSecretStoreProviderVolcengineAuthSecretRefSecretAccessKey,
    /// Token is the reference to the secret containing the STS(Security Token Service) Token.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub token: Option<ClusterSecretStoreProviderVolcengineAuthSecretRefToken>,
}

/// AccessKeyID is the reference to the secret containing the Access Key ID.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVolcengineAuthSecretRefAccessKeyId {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// SecretAccessKey is the reference to the secret containing the Secret Access Key.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVolcengineAuthSecretRefSecretAccessKey {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Token is the reference to the secret containing the STS(Security Token Service) Token.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderVolcengineAuthSecretRefToken {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// Webhook configures this store to sync secrets using a generic templated webhook
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderWebhook {
    /// Auth specifies a authorization protocol. Only one protocol may be set.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub auth: Option<ClusterSecretStoreProviderWebhookAuth>,
    /// Body
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub body: Option<String>,
    /// PEM encoded CA bundle used to validate webhook server certificate. Only used
    /// if the Server URL is using HTTPS protocol. This parameter is ignored for
    /// plain HTTP protocol connection. If not set the system root certificates
    /// are used to validate the TLS connection.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caBundle")]
    pub ca_bundle: Option<String>,
    /// The provider for the CA bundle to use to validate webhook server certificate.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caProvider")]
    pub ca_provider: Option<ClusterSecretStoreProviderWebhookCaProvider>,
    /// Headers
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub headers: Option<BTreeMap<String, String>>,
    /// Webhook Method
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub method: Option<String>,
    /// Result formatting
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub result: Option<ClusterSecretStoreProviderWebhookResult>,
    /// Secrets to fill in templates
    /// These secrets will be passed to the templating function as key value pairs under the given name
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub secrets: Option<Vec<ClusterSecretStoreProviderWebhookSecrets>>,
    /// Timeout
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub timeout: Option<String>,
    /// Webhook url to call
    pub url: String,
}

/// Auth specifies a authorization protocol. Only one protocol may be set.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderWebhookAuth {
    /// NTLMProtocol configures the store to use NTLM for auth
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub ntlm: Option<ClusterSecretStoreProviderWebhookAuthNtlm>,
}

/// NTLMProtocol configures the store to use NTLM for auth
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderWebhookAuthNtlm {
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(rename = "passwordSecret")]
    pub password_secret: ClusterSecretStoreProviderWebhookAuthNtlmPasswordSecret,
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(rename = "usernameSecret")]
    pub username_secret: ClusterSecretStoreProviderWebhookAuthNtlmUsernameSecret,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderWebhookAuthNtlmPasswordSecret {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderWebhookAuthNtlmUsernameSecret {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// The provider for the CA bundle to use to validate webhook server certificate.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub struct ClusterSecretStoreProviderWebhookCaProvider {
    /// The key where the CA certificate can be found in the Secret or ConfigMap.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the object located at the provider type.
    pub name: String,
    /// The namespace the Provider type is in.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
    /// The type of provider to use such as "Secret", or "ConfigMap".
    #[serde(rename = "type")]
    pub r#type: ClusterSecretStoreProviderWebhookCaProviderType,
}

/// The provider for the CA bundle to use to validate webhook server certificate.
#[derive(Serialize, Deserialize, Clone, Debug, PartialEq)]
pub enum ClusterSecretStoreProviderWebhookCaProviderType {
    Secret,
    ConfigMap,
}

/// Result formatting
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderWebhookResult {
    /// Json path of return value
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "jsonPath")]
    pub json_path: Option<String>,
}

/// WebhookSecret defines a secret that will be passed to the webhook request.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderWebhookSecrets {
    /// Name of this secret in templates
    pub name: String,
    /// Secret ref to fill in credentials
    #[serde(rename = "secretRef")]
    pub secret_ref: ClusterSecretStoreProviderWebhookSecretsSecretRef,
}

/// Secret ref to fill in credentials
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderWebhookSecretsSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// YandexCertificateManager configures this store to sync secrets using Yandex Certificate Manager provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderYandexcertificatemanager {
    /// Yandex.Cloud API endpoint (e.g. 'api.cloud.yandex.net:443')
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "apiEndpoint")]
    pub api_endpoint: Option<String>,
    /// Auth defines the information necessary to authenticate against Yandex.Cloud
    pub auth: ClusterSecretStoreProviderYandexcertificatemanagerAuth,
    /// The provider for the CA bundle to use to validate Yandex.Cloud server certificate.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caProvider")]
    pub ca_provider: Option<ClusterSecretStoreProviderYandexcertificatemanagerCaProvider>,
    /// FetchingPolicy configures the provider to interpret the `data.secretKey.remoteRef.key` field in ExternalSecret as certificate ID or certificate name
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub fetching: Option<ClusterSecretStoreProviderYandexcertificatemanagerFetching>,
}

/// Auth defines the information necessary to authenticate against Yandex.Cloud
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderYandexcertificatemanagerAuth {
    /// The authorized key used for authentication
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "authorizedKeySecretRef")]
    pub authorized_key_secret_ref: Option<ClusterSecretStoreProviderYandexcertificatemanagerAuthAuthorizedKeySecretRef>,
}

/// The authorized key used for authentication
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderYandexcertificatemanagerAuthAuthorizedKeySecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// The provider for the CA bundle to use to validate Yandex.Cloud server certificate.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderYandexcertificatemanagerCaProvider {
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "certSecretRef")]
    pub cert_secret_ref: Option<ClusterSecretStoreProviderYandexcertificatemanagerCaProviderCertSecretRef>,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderYandexcertificatemanagerCaProviderCertSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// FetchingPolicy configures the provider to interpret the `data.secretKey.remoteRef.key` field in ExternalSecret as certificate ID or certificate name
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderYandexcertificatemanagerFetching {
    /// ByID configures the provider to interpret the `data.secretKey.remoteRef.key` field in ExternalSecret as secret ID.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "byID")]
    pub by_id: Option<ClusterSecretStoreProviderYandexcertificatemanagerFetchingById>,
    /// ByName configures the provider to interpret the `data.secretKey.remoteRef.key` field in ExternalSecret as secret name.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "byName")]
    pub by_name: Option<ClusterSecretStoreProviderYandexcertificatemanagerFetchingByName>,
}

/// ByID configures the provider to interpret the `data.secretKey.remoteRef.key` field in ExternalSecret as secret ID.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderYandexcertificatemanagerFetchingById {
}

/// ByName configures the provider to interpret the `data.secretKey.remoteRef.key` field in ExternalSecret as secret name.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderYandexcertificatemanagerFetchingByName {
    /// The folder to fetch secrets from
    #[serde(rename = "folderID")]
    pub folder_id: String,
}

/// YandexLockbox configures this store to sync secrets using Yandex Lockbox provider
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderYandexlockbox {
    /// Yandex.Cloud API endpoint (e.g. 'api.cloud.yandex.net:443')
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "apiEndpoint")]
    pub api_endpoint: Option<String>,
    /// Auth defines the information necessary to authenticate against Yandex.Cloud
    pub auth: ClusterSecretStoreProviderYandexlockboxAuth,
    /// The provider for the CA bundle to use to validate Yandex.Cloud server certificate.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "caProvider")]
    pub ca_provider: Option<ClusterSecretStoreProviderYandexlockboxCaProvider>,
    /// FetchingPolicy configures the provider to interpret the `data.secretKey.remoteRef.key` field in ExternalSecret as secret ID or secret name
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub fetching: Option<ClusterSecretStoreProviderYandexlockboxFetching>,
}

/// Auth defines the information necessary to authenticate against Yandex.Cloud
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderYandexlockboxAuth {
    /// The authorized key used for authentication
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "authorizedKeySecretRef")]
    pub authorized_key_secret_ref: Option<ClusterSecretStoreProviderYandexlockboxAuthAuthorizedKeySecretRef>,
}

/// The authorized key used for authentication
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderYandexlockboxAuthAuthorizedKeySecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// The provider for the CA bundle to use to validate Yandex.Cloud server certificate.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderYandexlockboxCaProvider {
    /// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
    /// In some instances, `key` is a required field.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "certSecretRef")]
    pub cert_secret_ref: Option<ClusterSecretStoreProviderYandexlockboxCaProviderCertSecretRef>,
}

/// SecretKeySelector is a reference to a specific 'key' within a Secret resource.
/// In some instances, `key` is a required field.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderYandexlockboxCaProviderCertSecretRef {
    /// A key in the referenced Secret.
    /// Some instances of this field may be defaulted, in others it may be required.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub key: Option<String>,
    /// The name of the Secret resource being referred to.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub name: Option<String>,
    /// The namespace of the Secret resource being referred to.
    /// Ignored if referent is not cluster-scoped, otherwise defaults to the namespace of the referent.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub namespace: Option<String>,
}

/// FetchingPolicy configures the provider to interpret the `data.secretKey.remoteRef.key` field in ExternalSecret as secret ID or secret name
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderYandexlockboxFetching {
    /// ByID configures the provider to interpret the `data.secretKey.remoteRef.key` field in ExternalSecret as secret ID.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "byID")]
    pub by_id: Option<ClusterSecretStoreProviderYandexlockboxFetchingById>,
    /// ByName configures the provider to interpret the `data.secretKey.remoteRef.key` field in ExternalSecret as secret name.
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "byName")]
    pub by_name: Option<ClusterSecretStoreProviderYandexlockboxFetchingByName>,
}

/// ByID configures the provider to interpret the `data.secretKey.remoteRef.key` field in ExternalSecret as secret ID.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderYandexlockboxFetchingById {
}

/// ByName configures the provider to interpret the `data.secretKey.remoteRef.key` field in ExternalSecret as secret name.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreProviderYandexlockboxFetchingByName {
    /// The folder to fetch secrets from
    #[serde(rename = "folderID")]
    pub folder_id: String,
}

/// Used to configure HTTP retries on failures.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreRetrySettings {
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "maxRetries")]
    pub max_retries: Option<i32>,
    #[serde(default, skip_serializing_if = "Option::is_none", rename = "retryInterval")]
    pub retry_interval: Option<String>,
}

/// SecretStoreStatus defines the observed state of the SecretStore.
#[derive(Serialize, Deserialize, Clone, Debug, Default, PartialEq)]
pub struct ClusterSecretStoreStatus {
    /// SecretStoreCapabilities defines the possible operations a SecretStore can do.
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub capabilities: Option<String>,
    #[serde(default, skip_serializing_if = "Option::is_none")]
    pub conditions: Option<Vec<Condition>>,
}