diff --git a/3.x/_gen/data/aws_static_access_credentials.libsonnet b/3.x/_gen/data/aws_static_access_credentials.libsonnet
new file mode 100644
index 0000000..a0ac5fa
--- /dev/null
+++ b/3.x/_gen/data/aws_static_access_credentials.libsonnet
@@ -0,0 +1,58 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='aws_static_access_credentials', url='', help='`aws_static_access_credentials` represents the `vault_aws_static_access_credentials` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`vault.data.aws_static_access_credentials.new` injects a new `data_vault_aws_static_access_credentials` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.data.aws_static_access_credentials.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.data.aws_static_access_credentials` using the reference:\n\n    $._ref.data_vault_aws_static_access_credentials.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_vault_aws_static_access_credentials.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `backend` (`string`): AWS Secret Backend to read credentials from.\n  - `name` (`string`): Name of the role.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    backend,
+    name,
+    namespace=null,
+    _meta={}
+  ):: tf.withData(
+    type='vault_aws_static_access_credentials',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(backend=backend, name=name, namespace=namespace),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`vault.data.aws_static_access_credentials.newAttrs` constructs a new object with attributes and blocks configured for the `aws_static_access_credentials`\nTerraform data source.\n\nUnlike [vault.data.aws_static_access_credentials.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `backend` (`string`): AWS Secret Backend to read credentials from.\n  - `name` (`string`): Name of the role.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `aws_static_access_credentials` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    backend,
+    name,
+    namespace=null
+  ):: std.prune(a={
+    backend: backend,
+    name: name,
+    namespace: namespace,
+  }),
+  '#withBackend':: d.fn(help='`vault.string.withBackend` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the backend field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `backend` field.\n', args=[]),
+  withBackend(dataSrcLabel, value): {
+    data+: {
+      vault_aws_static_access_credentials+: {
+        [dataSrcLabel]+: {
+          backend: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`vault.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the name field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(dataSrcLabel, value): {
+    data+: {
+      vault_aws_static_access_credentials+: {
+        [dataSrcLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withNamespace':: d.fn(help='`vault.string.withNamespace` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the namespace field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `namespace` field.\n', args=[]),
+  withNamespace(dataSrcLabel, value): {
+    data+: {
+      vault_aws_static_access_credentials+: {
+        [dataSrcLabel]+: {
+          namespace: value,
+        },
+      },
+    },
+  },
+}
diff --git a/3.x/_gen/data/main.libsonnet b/3.x/_gen/data/main.libsonnet
index 9a40323..da67592 100644
--- a/3.x/_gen/data/main.libsonnet
+++ b/3.x/_gen/data/main.libsonnet
@@ -6,6 +6,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   auth_backend: (import 'auth_backend.libsonnet'),
   auth_backends: (import 'auth_backends.libsonnet'),
   aws_access_credentials: (import 'aws_access_credentials.libsonnet'),
+  aws_static_access_credentials: (import 'aws_static_access_credentials.libsonnet'),
   azure_access_credentials: (import 'azure_access_credentials.libsonnet'),
   gcp_auth_backend_role: (import 'gcp_auth_backend_role.libsonnet'),
   generic_secret: (import 'generic_secret.libsonnet'),
@@ -25,6 +26,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   ldap_dynamic_credentials: (import 'ldap_dynamic_credentials.libsonnet'),
   ldap_static_credentials: (import 'ldap_static_credentials.libsonnet'),
   nomad_access_token: (import 'nomad_access_token.libsonnet'),
+  pki_secret_backend_issuer: (import 'pki_secret_backend_issuer.libsonnet'),
+  pki_secret_backend_issuers: (import 'pki_secret_backend_issuers.libsonnet'),
+  pki_secret_backend_key: (import 'pki_secret_backend_key.libsonnet'),
+  pki_secret_backend_keys: (import 'pki_secret_backend_keys.libsonnet'),
   policy_document: (import 'policy_document.libsonnet'),
   raft_autopilot_state: (import 'raft_autopilot_state.libsonnet'),
   transform_decode: (import 'transform_decode.libsonnet'),
diff --git a/3.x/_gen/data/pki_secret_backend_issuer.libsonnet b/3.x/_gen/data/pki_secret_backend_issuer.libsonnet
new file mode 100644
index 0000000..cf55cd6
--- /dev/null
+++ b/3.x/_gen/data/pki_secret_backend_issuer.libsonnet
@@ -0,0 +1,58 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='pki_secret_backend_issuer', url='', help='`pki_secret_backend_issuer` represents the `vault_pki_secret_backend_issuer` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`vault.data.pki_secret_backend_issuer.new` injects a new `data_vault_pki_secret_backend_issuer` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.data.pki_secret_backend_issuer.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.data.pki_secret_backend_issuer` using the reference:\n\n    $._ref.data_vault_pki_secret_backend_issuer.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_vault_pki_secret_backend_issuer.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `backend` (`string`): Full path where PKI backend is mounted.\n  - `issuer_ref` (`string`): Reference to an existing issuer.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    backend,
+    issuer_ref,
+    namespace=null,
+    _meta={}
+  ):: tf.withData(
+    type='vault_pki_secret_backend_issuer',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(backend=backend, issuer_ref=issuer_ref, namespace=namespace),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`vault.data.pki_secret_backend_issuer.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_issuer`\nTerraform data source.\n\nUnlike [vault.data.pki_secret_backend_issuer.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `backend` (`string`): Full path where PKI backend is mounted.\n  - `issuer_ref` (`string`): Reference to an existing issuer.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `pki_secret_backend_issuer` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    backend,
+    issuer_ref,
+    namespace=null
+  ):: std.prune(a={
+    backend: backend,
+    issuer_ref: issuer_ref,
+    namespace: namespace,
+  }),
+  '#withBackend':: d.fn(help='`vault.string.withBackend` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the backend field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `backend` field.\n', args=[]),
+  withBackend(dataSrcLabel, value): {
+    data+: {
+      vault_pki_secret_backend_issuer+: {
+        [dataSrcLabel]+: {
+          backend: value,
+        },
+      },
+    },
+  },
+  '#withIssuerRef':: d.fn(help='`vault.string.withIssuerRef` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the issuer_ref field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `issuer_ref` field.\n', args=[]),
+  withIssuerRef(dataSrcLabel, value): {
+    data+: {
+      vault_pki_secret_backend_issuer+: {
+        [dataSrcLabel]+: {
+          issuer_ref: value,
+        },
+      },
+    },
+  },
+  '#withNamespace':: d.fn(help='`vault.string.withNamespace` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the namespace field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `namespace` field.\n', args=[]),
+  withNamespace(dataSrcLabel, value): {
+    data+: {
+      vault_pki_secret_backend_issuer+: {
+        [dataSrcLabel]+: {
+          namespace: value,
+        },
+      },
+    },
+  },
+}
diff --git a/3.x/_gen/data/pki_secret_backend_issuers.libsonnet b/3.x/_gen/data/pki_secret_backend_issuers.libsonnet
new file mode 100644
index 0000000..0c4c5bc
--- /dev/null
+++ b/3.x/_gen/data/pki_secret_backend_issuers.libsonnet
@@ -0,0 +1,45 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='pki_secret_backend_issuers', url='', help='`pki_secret_backend_issuers` represents the `vault_pki_secret_backend_issuers` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`vault.data.pki_secret_backend_issuers.new` injects a new `data_vault_pki_secret_backend_issuers` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.data.pki_secret_backend_issuers.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.data.pki_secret_backend_issuers` using the reference:\n\n    $._ref.data_vault_pki_secret_backend_issuers.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_vault_pki_secret_backend_issuers.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `backend` (`string`): Full path where PKI backend is mounted.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    backend,
+    namespace=null,
+    _meta={}
+  ):: tf.withData(
+    type='vault_pki_secret_backend_issuers',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(backend=backend, namespace=namespace),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`vault.data.pki_secret_backend_issuers.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_issuers`\nTerraform data source.\n\nUnlike [vault.data.pki_secret_backend_issuers.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `backend` (`string`): Full path where PKI backend is mounted.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `pki_secret_backend_issuers` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    backend,
+    namespace=null
+  ):: std.prune(a={
+    backend: backend,
+    namespace: namespace,
+  }),
+  '#withBackend':: d.fn(help='`vault.string.withBackend` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the backend field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `backend` field.\n', args=[]),
+  withBackend(dataSrcLabel, value): {
+    data+: {
+      vault_pki_secret_backend_issuers+: {
+        [dataSrcLabel]+: {
+          backend: value,
+        },
+      },
+    },
+  },
+  '#withNamespace':: d.fn(help='`vault.string.withNamespace` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the namespace field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `namespace` field.\n', args=[]),
+  withNamespace(dataSrcLabel, value): {
+    data+: {
+      vault_pki_secret_backend_issuers+: {
+        [dataSrcLabel]+: {
+          namespace: value,
+        },
+      },
+    },
+  },
+}
diff --git a/3.x/_gen/data/pki_secret_backend_key.libsonnet b/3.x/_gen/data/pki_secret_backend_key.libsonnet
new file mode 100644
index 0000000..9c8a9d3
--- /dev/null
+++ b/3.x/_gen/data/pki_secret_backend_key.libsonnet
@@ -0,0 +1,58 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='pki_secret_backend_key', url='', help='`pki_secret_backend_key` represents the `vault_pki_secret_backend_key` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`vault.data.pki_secret_backend_key.new` injects a new `data_vault_pki_secret_backend_key` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.data.pki_secret_backend_key.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.data.pki_secret_backend_key` using the reference:\n\n    $._ref.data_vault_pki_secret_backend_key.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_vault_pki_secret_backend_key.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `backend` (`string`): Full path where PKI backend is mounted.\n  - `key_ref` (`string`): Reference to an existing key.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    backend,
+    key_ref,
+    namespace=null,
+    _meta={}
+  ):: tf.withData(
+    type='vault_pki_secret_backend_key',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(backend=backend, key_ref=key_ref, namespace=namespace),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`vault.data.pki_secret_backend_key.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_key`\nTerraform data source.\n\nUnlike [vault.data.pki_secret_backend_key.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `backend` (`string`): Full path where PKI backend is mounted.\n  - `key_ref` (`string`): Reference to an existing key.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `pki_secret_backend_key` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    backend,
+    key_ref,
+    namespace=null
+  ):: std.prune(a={
+    backend: backend,
+    key_ref: key_ref,
+    namespace: namespace,
+  }),
+  '#withBackend':: d.fn(help='`vault.string.withBackend` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the backend field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `backend` field.\n', args=[]),
+  withBackend(dataSrcLabel, value): {
+    data+: {
+      vault_pki_secret_backend_key+: {
+        [dataSrcLabel]+: {
+          backend: value,
+        },
+      },
+    },
+  },
+  '#withKeyRef':: d.fn(help='`vault.string.withKeyRef` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the key_ref field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `key_ref` field.\n', args=[]),
+  withKeyRef(dataSrcLabel, value): {
+    data+: {
+      vault_pki_secret_backend_key+: {
+        [dataSrcLabel]+: {
+          key_ref: value,
+        },
+      },
+    },
+  },
+  '#withNamespace':: d.fn(help='`vault.string.withNamespace` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the namespace field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `namespace` field.\n', args=[]),
+  withNamespace(dataSrcLabel, value): {
+    data+: {
+      vault_pki_secret_backend_key+: {
+        [dataSrcLabel]+: {
+          namespace: value,
+        },
+      },
+    },
+  },
+}
diff --git a/3.x/_gen/data/pki_secret_backend_keys.libsonnet b/3.x/_gen/data/pki_secret_backend_keys.libsonnet
new file mode 100644
index 0000000..2e3b194
--- /dev/null
+++ b/3.x/_gen/data/pki_secret_backend_keys.libsonnet
@@ -0,0 +1,45 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='pki_secret_backend_keys', url='', help='`pki_secret_backend_keys` represents the `vault_pki_secret_backend_keys` Terraform data source.\n\n\n\nThis package contains functions and utilities for setting up the data source using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`vault.data.pki_secret_backend_keys.new` injects a new `data_vault_pki_secret_backend_keys` Terraform `data source`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.data.pki_secret_backend_keys.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.data.pki_secret_backend_keys` using the reference:\n\n    $._ref.data_vault_pki_secret_backend_keys.some_id.get('id')\n\nThis is the same as directly entering `\"${ data_vault_pki_secret_backend_keys.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block.\n  - `backend` (`string`): Full path where PKI backend is mounted.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new data source into the root Terraform configuration.\n", args=[]),
+  new(
+    dataSrcLabel,
+    backend,
+    namespace=null,
+    _meta={}
+  ):: tf.withData(
+    type='vault_pki_secret_backend_keys',
+    label=dataSrcLabel,
+    attrs=self.newAttrs(backend=backend, namespace=namespace),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`vault.data.pki_secret_backend_keys.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_keys`\nTerraform data source.\n\nUnlike [vault.data.pki_secret_backend_keys.new](#fn-new), this function will not inject the `data source`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `backend` (`string`): Full path where PKI backend is mounted.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `pki_secret_backend_keys` data source into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    backend,
+    namespace=null
+  ):: std.prune(a={
+    backend: backend,
+    namespace: namespace,
+  }),
+  '#withBackend':: d.fn(help='`vault.string.withBackend` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the backend field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `backend` field.\n', args=[]),
+  withBackend(dataSrcLabel, value): {
+    data+: {
+      vault_pki_secret_backend_keys+: {
+        [dataSrcLabel]+: {
+          backend: value,
+        },
+      },
+    },
+  },
+  '#withNamespace':: d.fn(help='`vault.string.withNamespace` constructs a mixin object that can be merged into the `string`\nTerraform data source block to set or update the namespace field.\n\n\n\n**Args**:\n  - `dataSrcLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `namespace` field.\n', args=[]),
+  withNamespace(dataSrcLabel, value): {
+    data+: {
+      vault_pki_secret_backend_keys+: {
+        [dataSrcLabel]+: {
+          namespace: value,
+        },
+      },
+    },
+  },
+}
diff --git a/3.x/_gen/main.libsonnet b/3.x/_gen/main.libsonnet
index f9f255b..197fc0e 100644
--- a/3.x/_gen/main.libsonnet
+++ b/3.x/_gen/main.libsonnet
@@ -23,6 +23,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   aws_auth_backend_sts_role: (import 'resources/aws_auth_backend_sts_role.libsonnet'),
   aws_secret_backend: (import 'resources/aws_secret_backend.libsonnet'),
   aws_secret_backend_role: (import 'resources/aws_secret_backend_role.libsonnet'),
+  aws_secret_backend_static_role: (import 'resources/aws_secret_backend_static_role.libsonnet'),
   azure_auth_backend_config: (import 'resources/azure_auth_backend_config.libsonnet'),
   azure_auth_backend_role: (import 'resources/azure_auth_backend_role.libsonnet'),
   azure_secret_backend: (import 'resources/azure_secret_backend.libsonnet'),
@@ -107,6 +108,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   pki_secret_backend_crl_config: (import 'resources/pki_secret_backend_crl_config.libsonnet'),
   pki_secret_backend_intermediate_cert_request: (import 'resources/pki_secret_backend_intermediate_cert_request.libsonnet'),
   pki_secret_backend_intermediate_set_signed: (import 'resources/pki_secret_backend_intermediate_set_signed.libsonnet'),
+  pki_secret_backend_issuer: (import 'resources/pki_secret_backend_issuer.libsonnet'),
+  pki_secret_backend_key: (import 'resources/pki_secret_backend_key.libsonnet'),
   pki_secret_backend_role: (import 'resources/pki_secret_backend_role.libsonnet'),
   pki_secret_backend_root_cert: (import 'resources/pki_secret_backend_root_cert.libsonnet'),
   pki_secret_backend_root_sign_intermediate: (import 'resources/pki_secret_backend_root_sign_intermediate.libsonnet'),
diff --git a/3.x/_gen/resources/aws_secret_backend_static_role.libsonnet b/3.x/_gen/resources/aws_secret_backend_static_role.libsonnet
new file mode 100644
index 0000000..0efd56f
--- /dev/null
+++ b/3.x/_gen/resources/aws_secret_backend_static_role.libsonnet
@@ -0,0 +1,90 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='aws_secret_backend_static_role', url='', help='`aws_secret_backend_static_role` represents the `vault_aws_secret_backend_static_role` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`vault.aws_secret_backend_static_role.new` injects a new `vault_aws_secret_backend_static_role` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.aws_secret_backend_static_role.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.aws_secret_backend_static_role` using the reference:\n\n    $._ref.vault_aws_secret_backend_static_role.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_aws_secret_backend_static_role.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `backend` (`string`): The path where the AWS secrets backend is mounted. When `null`, the `backend` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the role.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `rotation_period` (`number`): How often Vault should rotate the password of the user entry.\n  - `username` (`string`): The username of the existing AWS IAM user to manage password rotation for.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    name,
+    rotation_period,
+    username,
+    backend=null,
+    namespace=null,
+    _meta={}
+  ):: tf.withResource(
+    type='vault_aws_secret_backend_static_role',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      backend=backend,
+      name=name,
+      namespace=namespace,
+      rotation_period=rotation_period,
+      username=username
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`vault.aws_secret_backend_static_role.newAttrs` constructs a new object with attributes and blocks configured for the `aws_secret_backend_static_role`\nTerraform resource.\n\nUnlike [vault.aws_secret_backend_static_role.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `backend` (`string`): The path where the AWS secrets backend is mounted. When `null`, the `backend` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the role.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `rotation_period` (`number`): How often Vault should rotate the password of the user entry.\n  - `username` (`string`): The username of the existing AWS IAM user to manage password rotation for.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `aws_secret_backend_static_role` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    name,
+    rotation_period,
+    username,
+    backend=null,
+    namespace=null
+  ):: std.prune(a={
+    backend: backend,
+    name: name,
+    namespace: namespace,
+    rotation_period: rotation_period,
+    username: username,
+  }),
+  '#withBackend':: d.fn(help='`vault.string.withBackend` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the backend field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `backend` field.\n', args=[]),
+  withBackend(resourceLabel, value): {
+    resource+: {
+      vault_aws_secret_backend_static_role+: {
+        [resourceLabel]+: {
+          backend: value,
+        },
+      },
+    },
+  },
+  '#withName':: d.fn(help='`vault.string.withName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `name` field.\n', args=[]),
+  withName(resourceLabel, value): {
+    resource+: {
+      vault_aws_secret_backend_static_role+: {
+        [resourceLabel]+: {
+          name: value,
+        },
+      },
+    },
+  },
+  '#withNamespace':: d.fn(help='`vault.string.withNamespace` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the namespace field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `namespace` field.\n', args=[]),
+  withNamespace(resourceLabel, value): {
+    resource+: {
+      vault_aws_secret_backend_static_role+: {
+        [resourceLabel]+: {
+          namespace: value,
+        },
+      },
+    },
+  },
+  '#withRotationPeriod':: d.fn(help='`vault.number.withRotationPeriod` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the rotation_period field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `rotation_period` field.\n', args=[]),
+  withRotationPeriod(resourceLabel, value): {
+    resource+: {
+      vault_aws_secret_backend_static_role+: {
+        [resourceLabel]+: {
+          rotation_period: value,
+        },
+      },
+    },
+  },
+  '#withUsername':: d.fn(help='`vault.string.withUsername` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the username field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `username` field.\n', args=[]),
+  withUsername(resourceLabel, value): {
+    resource+: {
+      vault_aws_secret_backend_static_role+: {
+        [resourceLabel]+: {
+          username: value,
+        },
+      },
+    },
+  },
+}
diff --git a/3.x/_gen/resources/database_secret_backend_role.libsonnet b/3.x/_gen/resources/database_secret_backend_role.libsonnet
index 93a4f0c..f35d40a 100644
--- a/3.x/_gen/resources/database_secret_backend_role.libsonnet
+++ b/3.x/_gen/resources/database_secret_backend_role.libsonnet
@@ -2,13 +2,15 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='database_secret_backend_role', url='', help='`database_secret_backend_role` represents the `vault_database_secret_backend_role` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`vault.database_secret_backend_role.new` injects a new `vault_database_secret_backend_role` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.database_secret_backend_role.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.database_secret_backend_role` using the reference:\n\n    $._ref.vault_database_secret_backend_role.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_database_secret_backend_role.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `backend` (`string`): The path of the Database Secret Backend the role belongs to.\n  - `creation_statements` (`list`): Database statements to execute to create and configure a user.\n  - `db_name` (`string`): Database connection to use for this role.\n  - `default_ttl` (`number`): Default TTL for leases associated with this role, in seconds. When `null`, the `default_ttl` field will be omitted from the resulting object.\n  - `max_ttl` (`number`): Maximum TTL for leases associated with this role, in seconds. When `null`, the `max_ttl` field will be omitted from the resulting object.\n  - `name` (`string`): Unique name for the role.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `renew_statements` (`list`): Database statements to execute to renew a user. When `null`, the `renew_statements` field will be omitted from the resulting object.\n  - `revocation_statements` (`list`): Database statements to execute to revoke a user. When `null`, the `revocation_statements` field will be omitted from the resulting object.\n  - `rollback_statements` (`list`): Database statements to execute to rollback a create operation in the event of an error. When `null`, the `rollback_statements` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`vault.database_secret_backend_role.new` injects a new `vault_database_secret_backend_role` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.database_secret_backend_role.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.database_secret_backend_role` using the reference:\n\n    $._ref.vault_database_secret_backend_role.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_database_secret_backend_role.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `backend` (`string`): The path of the Database Secret Backend the role belongs to.\n  - `creation_statements` (`list`): Database statements to execute to create and configure a user.\n  - `credential_config` (`obj`): Specifies the configuration for the given credential_type. When `null`, the `credential_config` field will be omitted from the resulting object.\n  - `credential_type` (`string`): Specifies the type of credential that will be generated for the role. When `null`, the `credential_type` field will be omitted from the resulting object.\n  - `db_name` (`string`): Database connection to use for this role.\n  - `default_ttl` (`number`): Default TTL for leases associated with this role, in seconds. When `null`, the `default_ttl` field will be omitted from the resulting object.\n  - `max_ttl` (`number`): Maximum TTL for leases associated with this role, in seconds. When `null`, the `max_ttl` field will be omitted from the resulting object.\n  - `name` (`string`): Unique name for the role.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `renew_statements` (`list`): Database statements to execute to renew a user. When `null`, the `renew_statements` field will be omitted from the resulting object.\n  - `revocation_statements` (`list`): Database statements to execute to revoke a user. When `null`, the `revocation_statements` field will be omitted from the resulting object.\n  - `rollback_statements` (`list`): Database statements to execute to rollback a create operation in the event of an error. When `null`, the `rollback_statements` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     backend,
     creation_statements,
     db_name,
     name,
+    credential_config=null,
+    credential_type=null,
     default_ttl=null,
     max_ttl=null,
     namespace=null,
@@ -22,6 +24,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     attrs=self.newAttrs(
       backend=backend,
       creation_statements=creation_statements,
+      credential_config=credential_config,
+      credential_type=credential_type,
       db_name=db_name,
       default_ttl=default_ttl,
       max_ttl=max_ttl,
@@ -33,12 +37,14 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`vault.database_secret_backend_role.newAttrs` constructs a new object with attributes and blocks configured for the `database_secret_backend_role`\nTerraform resource.\n\nUnlike [vault.database_secret_backend_role.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `backend` (`string`): The path of the Database Secret Backend the role belongs to.\n  - `creation_statements` (`list`): Database statements to execute to create and configure a user.\n  - `db_name` (`string`): Database connection to use for this role.\n  - `default_ttl` (`number`): Default TTL for leases associated with this role, in seconds. When `null`, the `default_ttl` field will be omitted from the resulting object.\n  - `max_ttl` (`number`): Maximum TTL for leases associated with this role, in seconds. When `null`, the `max_ttl` field will be omitted from the resulting object.\n  - `name` (`string`): Unique name for the role.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `renew_statements` (`list`): Database statements to execute to renew a user. When `null`, the `renew_statements` field will be omitted from the resulting object.\n  - `revocation_statements` (`list`): Database statements to execute to revoke a user. When `null`, the `revocation_statements` field will be omitted from the resulting object.\n  - `rollback_statements` (`list`): Database statements to execute to rollback a create operation in the event of an error. When `null`, the `rollback_statements` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `database_secret_backend_role` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`vault.database_secret_backend_role.newAttrs` constructs a new object with attributes and blocks configured for the `database_secret_backend_role`\nTerraform resource.\n\nUnlike [vault.database_secret_backend_role.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `backend` (`string`): The path of the Database Secret Backend the role belongs to.\n  - `creation_statements` (`list`): Database statements to execute to create and configure a user.\n  - `credential_config` (`obj`): Specifies the configuration for the given credential_type. When `null`, the `credential_config` field will be omitted from the resulting object.\n  - `credential_type` (`string`): Specifies the type of credential that will be generated for the role. When `null`, the `credential_type` field will be omitted from the resulting object.\n  - `db_name` (`string`): Database connection to use for this role.\n  - `default_ttl` (`number`): Default TTL for leases associated with this role, in seconds. When `null`, the `default_ttl` field will be omitted from the resulting object.\n  - `max_ttl` (`number`): Maximum TTL for leases associated with this role, in seconds. When `null`, the `max_ttl` field will be omitted from the resulting object.\n  - `name` (`string`): Unique name for the role.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `renew_statements` (`list`): Database statements to execute to renew a user. When `null`, the `renew_statements` field will be omitted from the resulting object.\n  - `revocation_statements` (`list`): Database statements to execute to revoke a user. When `null`, the `revocation_statements` field will be omitted from the resulting object.\n  - `rollback_statements` (`list`): Database statements to execute to rollback a create operation in the event of an error. When `null`, the `rollback_statements` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `database_secret_backend_role` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     backend,
     creation_statements,
     db_name,
     name,
+    credential_config=null,
+    credential_type=null,
     default_ttl=null,
     max_ttl=null,
     namespace=null,
@@ -48,6 +54,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
   ):: std.prune(a={
     backend: backend,
     creation_statements: creation_statements,
+    credential_config: credential_config,
+    credential_type: credential_type,
     db_name: db_name,
     default_ttl: default_ttl,
     max_ttl: max_ttl,
@@ -77,6 +85,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withCredentialConfig':: d.fn(help='`vault.obj.withCredentialConfig` constructs a mixin object that can be merged into the `obj`\nTerraform resource block to set or update the credential_config field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`obj`): The value to set for the `credential_config` field.\n', args=[]),
+  withCredentialConfig(resourceLabel, value): {
+    resource+: {
+      vault_database_secret_backend_role+: {
+        [resourceLabel]+: {
+          credential_config: value,
+        },
+      },
+    },
+  },
+  '#withCredentialType':: d.fn(help='`vault.string.withCredentialType` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the credential_type field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `credential_type` field.\n', args=[]),
+  withCredentialType(resourceLabel, value): {
+    resource+: {
+      vault_database_secret_backend_role+: {
+        [resourceLabel]+: {
+          credential_type: value,
+        },
+      },
+    },
+  },
   '#withDbName':: d.fn(help='`vault.string.withDbName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the db_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `db_name` field.\n', args=[]),
   withDbName(resourceLabel, value): {
     resource+: {
diff --git a/3.x/_gen/resources/ldap_auth_backend.libsonnet b/3.x/_gen/resources/ldap_auth_backend.libsonnet
index de9959b..9d42897 100644
--- a/3.x/_gen/resources/ldap_auth_backend.libsonnet
+++ b/3.x/_gen/resources/ldap_auth_backend.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='ldap_auth_backend', url='', help='`ldap_auth_backend` represents the `vault_ldap_auth_backend` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`vault.ldap_auth_backend.new` injects a new `vault_ldap_auth_backend` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.ldap_auth_backend.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.ldap_auth_backend` using the reference:\n\n    $._ref.vault_ldap_auth_backend.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_ldap_auth_backend.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `binddn` (`string`): Set the `binddn` field on the resulting resource block. When `null`, the `binddn` field will be omitted from the resulting object.\n  - `bindpass` (`string`): Set the `bindpass` field on the resulting resource block. When `null`, the `bindpass` field will be omitted from the resulting object.\n  - `case_sensitive_names` (`bool`): Set the `case_sensitive_names` field on the resulting resource block. When `null`, the `case_sensitive_names` field will be omitted from the resulting object.\n  - `certificate` (`string`): Set the `certificate` field on the resulting resource block. When `null`, the `certificate` field will be omitted from the resulting object.\n  - `client_tls_cert` (`string`): Set the `client_tls_cert` field on the resulting resource block. When `null`, the `client_tls_cert` field will be omitted from the resulting object.\n  - `client_tls_key` (`string`): Set the `client_tls_key` field on the resulting resource block. When `null`, the `client_tls_key` field will be omitted from the resulting object.\n  - `deny_null_bind` (`bool`): Set the `deny_null_bind` field on the resulting resource block. When `null`, the `deny_null_bind` field will be omitted from the resulting object.\n  - `description` (`string`): Set the `description` field on the resulting resource block. When `null`, the `description` field will be omitted from the resulting object.\n  - `disable_remount` (`bool`): If set, opts out of mount migration on path updates. When `null`, the `disable_remount` field will be omitted from the resulting object.\n  - `discoverdn` (`bool`): Set the `discoverdn` field on the resulting resource block. When `null`, the `discoverdn` field will be omitted from the resulting object.\n  - `groupattr` (`string`): Set the `groupattr` field on the resulting resource block. When `null`, the `groupattr` field will be omitted from the resulting object.\n  - `groupdn` (`string`): Set the `groupdn` field on the resulting resource block. When `null`, the `groupdn` field will be omitted from the resulting object.\n  - `groupfilter` (`string`): Set the `groupfilter` field on the resulting resource block. When `null`, the `groupfilter` field will be omitted from the resulting object.\n  - `insecure_tls` (`bool`): Set the `insecure_tls` field on the resulting resource block. When `null`, the `insecure_tls` field will be omitted from the resulting object.\n  - `local_` (`bool`): Specifies if the auth method is local only When `null`, the `local_` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `path` (`string`): Set the `path` field on the resulting resource block. When `null`, the `path` field will be omitted from the resulting object.\n  - `starttls` (`bool`): Set the `starttls` field on the resulting resource block. When `null`, the `starttls` field will be omitted from the resulting object.\n  - `tls_max_version` (`string`): Set the `tls_max_version` field on the resulting resource block. When `null`, the `tls_max_version` field will be omitted from the resulting object.\n  - `tls_min_version` (`string`): Set the `tls_min_version` field on the resulting resource block. When `null`, the `tls_min_version` field will be omitted from the resulting object.\n  - `token_bound_cidrs` (`list`): Specifies the blocks of IP addresses which are allowed to use the generated token When `null`, the `token_bound_cidrs` field will be omitted from the resulting object.\n  - `token_explicit_max_ttl` (`number`): Generated Token\u0026#39;s Explicit Maximum TTL in seconds When `null`, the `token_explicit_max_ttl` field will be omitted from the resulting object.\n  - `token_max_ttl` (`number`): The maximum lifetime of the generated token When `null`, the `token_max_ttl` field will be omitted from the resulting object.\n  - `token_no_default_policy` (`bool`): If true, the \u0026#39;default\u0026#39; policy will not automatically be added to generated tokens When `null`, the `token_no_default_policy` field will be omitted from the resulting object.\n  - `token_num_uses` (`number`): The maximum number of times a token may be used, a value of zero means unlimited When `null`, the `token_num_uses` field will be omitted from the resulting object.\n  - `token_period` (`number`): Generated Token\u0026#39;s Period When `null`, the `token_period` field will be omitted from the resulting object.\n  - `token_policies` (`list`): Generated Token\u0026#39;s Policies When `null`, the `token_policies` field will be omitted from the resulting object.\n  - `token_ttl` (`number`): The initial ttl of the token to generate in seconds When `null`, the `token_ttl` field will be omitted from the resulting object.\n  - `token_type` (`string`): The type of token to generate, service or batch When `null`, the `token_type` field will be omitted from the resulting object.\n  - `upndomain` (`string`): Set the `upndomain` field on the resulting resource block. When `null`, the `upndomain` field will be omitted from the resulting object.\n  - `url` (`string`): Set the `url` field on the resulting resource block.\n  - `use_token_groups` (`bool`): Set the `use_token_groups` field on the resulting resource block. When `null`, the `use_token_groups` field will be omitted from the resulting object.\n  - `userattr` (`string`): Set the `userattr` field on the resulting resource block. When `null`, the `userattr` field will be omitted from the resulting object.\n  - `userdn` (`string`): Set the `userdn` field on the resulting resource block. When `null`, the `userdn` field will be omitted from the resulting object.\n  - `userfilter` (`string`): Set the `userfilter` field on the resulting resource block. When `null`, the `userfilter` field will be omitted from the resulting object.\n  - `username_as_alias` (`bool`): Force the auth method to use the username passed by the user as the alias name. When `null`, the `username_as_alias` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`vault.ldap_auth_backend.new` injects a new `vault_ldap_auth_backend` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.ldap_auth_backend.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.ldap_auth_backend` using the reference:\n\n    $._ref.vault_ldap_auth_backend.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_ldap_auth_backend.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `binddn` (`string`): Set the `binddn` field on the resulting resource block. When `null`, the `binddn` field will be omitted from the resulting object.\n  - `bindpass` (`string`): Set the `bindpass` field on the resulting resource block. When `null`, the `bindpass` field will be omitted from the resulting object.\n  - `case_sensitive_names` (`bool`): Set the `case_sensitive_names` field on the resulting resource block. When `null`, the `case_sensitive_names` field will be omitted from the resulting object.\n  - `certificate` (`string`): Set the `certificate` field on the resulting resource block. When `null`, the `certificate` field will be omitted from the resulting object.\n  - `client_tls_cert` (`string`): Set the `client_tls_cert` field on the resulting resource block. When `null`, the `client_tls_cert` field will be omitted from the resulting object.\n  - `client_tls_key` (`string`): Set the `client_tls_key` field on the resulting resource block. When `null`, the `client_tls_key` field will be omitted from the resulting object.\n  - `deny_null_bind` (`bool`): Set the `deny_null_bind` field on the resulting resource block. When `null`, the `deny_null_bind` field will be omitted from the resulting object.\n  - `description` (`string`): Set the `description` field on the resulting resource block. When `null`, the `description` field will be omitted from the resulting object.\n  - `disable_remount` (`bool`): If set, opts out of mount migration on path updates. When `null`, the `disable_remount` field will be omitted from the resulting object.\n  - `discoverdn` (`bool`): Set the `discoverdn` field on the resulting resource block. When `null`, the `discoverdn` field will be omitted from the resulting object.\n  - `groupattr` (`string`): Set the `groupattr` field on the resulting resource block. When `null`, the `groupattr` field will be omitted from the resulting object.\n  - `groupdn` (`string`): Set the `groupdn` field on the resulting resource block. When `null`, the `groupdn` field will be omitted from the resulting object.\n  - `groupfilter` (`string`): Set the `groupfilter` field on the resulting resource block. When `null`, the `groupfilter` field will be omitted from the resulting object.\n  - `insecure_tls` (`bool`): Set the `insecure_tls` field on the resulting resource block. When `null`, the `insecure_tls` field will be omitted from the resulting object.\n  - `local_` (`bool`): Specifies if the auth method is local only When `null`, the `local_` field will be omitted from the resulting object.\n  - `max_page_size` (`number`): Set the `max_page_size` field on the resulting resource block. When `null`, the `max_page_size` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `path` (`string`): Set the `path` field on the resulting resource block. When `null`, the `path` field will be omitted from the resulting object.\n  - `starttls` (`bool`): Set the `starttls` field on the resulting resource block. When `null`, the `starttls` field will be omitted from the resulting object.\n  - `tls_max_version` (`string`): Set the `tls_max_version` field on the resulting resource block. When `null`, the `tls_max_version` field will be omitted from the resulting object.\n  - `tls_min_version` (`string`): Set the `tls_min_version` field on the resulting resource block. When `null`, the `tls_min_version` field will be omitted from the resulting object.\n  - `token_bound_cidrs` (`list`): Specifies the blocks of IP addresses which are allowed to use the generated token When `null`, the `token_bound_cidrs` field will be omitted from the resulting object.\n  - `token_explicit_max_ttl` (`number`): Generated Token\u0026#39;s Explicit Maximum TTL in seconds When `null`, the `token_explicit_max_ttl` field will be omitted from the resulting object.\n  - `token_max_ttl` (`number`): The maximum lifetime of the generated token When `null`, the `token_max_ttl` field will be omitted from the resulting object.\n  - `token_no_default_policy` (`bool`): If true, the \u0026#39;default\u0026#39; policy will not automatically be added to generated tokens When `null`, the `token_no_default_policy` field will be omitted from the resulting object.\n  - `token_num_uses` (`number`): The maximum number of times a token may be used, a value of zero means unlimited When `null`, the `token_num_uses` field will be omitted from the resulting object.\n  - `token_period` (`number`): Generated Token\u0026#39;s Period When `null`, the `token_period` field will be omitted from the resulting object.\n  - `token_policies` (`list`): Generated Token\u0026#39;s Policies When `null`, the `token_policies` field will be omitted from the resulting object.\n  - `token_ttl` (`number`): The initial ttl of the token to generate in seconds When `null`, the `token_ttl` field will be omitted from the resulting object.\n  - `token_type` (`string`): The type of token to generate, service or batch When `null`, the `token_type` field will be omitted from the resulting object.\n  - `upndomain` (`string`): Set the `upndomain` field on the resulting resource block. When `null`, the `upndomain` field will be omitted from the resulting object.\n  - `url` (`string`): Set the `url` field on the resulting resource block.\n  - `use_token_groups` (`bool`): Set the `use_token_groups` field on the resulting resource block. When `null`, the `use_token_groups` field will be omitted from the resulting object.\n  - `userattr` (`string`): Set the `userattr` field on the resulting resource block. When `null`, the `userattr` field will be omitted from the resulting object.\n  - `userdn` (`string`): Set the `userdn` field on the resulting resource block. When `null`, the `userdn` field will be omitted from the resulting object.\n  - `userfilter` (`string`): Set the `userfilter` field on the resulting resource block. When `null`, the `userfilter` field will be omitted from the resulting object.\n  - `username_as_alias` (`bool`): Force the auth method to use the username passed by the user as the alias name. When `null`, the `username_as_alias` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     url,
@@ -21,6 +21,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     groupfilter=null,
     insecure_tls=null,
     local_=null,
+    max_page_size=null,
     namespace=null,
     path=null,
     starttls=null,
@@ -61,6 +62,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       groupfilter=groupfilter,
       insecure_tls=insecure_tls,
       local_=local_,
+      max_page_size=max_page_size,
       namespace=namespace,
       path=path,
       starttls=starttls,
@@ -85,7 +87,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`vault.ldap_auth_backend.newAttrs` constructs a new object with attributes and blocks configured for the `ldap_auth_backend`\nTerraform resource.\n\nUnlike [vault.ldap_auth_backend.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `binddn` (`string`): Set the `binddn` field on the resulting object. When `null`, the `binddn` field will be omitted from the resulting object.\n  - `bindpass` (`string`): Set the `bindpass` field on the resulting object. When `null`, the `bindpass` field will be omitted from the resulting object.\n  - `case_sensitive_names` (`bool`): Set the `case_sensitive_names` field on the resulting object. When `null`, the `case_sensitive_names` field will be omitted from the resulting object.\n  - `certificate` (`string`): Set the `certificate` field on the resulting object. When `null`, the `certificate` field will be omitted from the resulting object.\n  - `client_tls_cert` (`string`): Set the `client_tls_cert` field on the resulting object. When `null`, the `client_tls_cert` field will be omitted from the resulting object.\n  - `client_tls_key` (`string`): Set the `client_tls_key` field on the resulting object. When `null`, the `client_tls_key` field will be omitted from the resulting object.\n  - `deny_null_bind` (`bool`): Set the `deny_null_bind` field on the resulting object. When `null`, the `deny_null_bind` field will be omitted from the resulting object.\n  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.\n  - `disable_remount` (`bool`): If set, opts out of mount migration on path updates. When `null`, the `disable_remount` field will be omitted from the resulting object.\n  - `discoverdn` (`bool`): Set the `discoverdn` field on the resulting object. When `null`, the `discoverdn` field will be omitted from the resulting object.\n  - `groupattr` (`string`): Set the `groupattr` field on the resulting object. When `null`, the `groupattr` field will be omitted from the resulting object.\n  - `groupdn` (`string`): Set the `groupdn` field on the resulting object. When `null`, the `groupdn` field will be omitted from the resulting object.\n  - `groupfilter` (`string`): Set the `groupfilter` field on the resulting object. When `null`, the `groupfilter` field will be omitted from the resulting object.\n  - `insecure_tls` (`bool`): Set the `insecure_tls` field on the resulting object. When `null`, the `insecure_tls` field will be omitted from the resulting object.\n  - `local_` (`bool`): Specifies if the auth method is local only When `null`, the `local_` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `path` (`string`): Set the `path` field on the resulting object. When `null`, the `path` field will be omitted from the resulting object.\n  - `starttls` (`bool`): Set the `starttls` field on the resulting object. When `null`, the `starttls` field will be omitted from the resulting object.\n  - `tls_max_version` (`string`): Set the `tls_max_version` field on the resulting object. When `null`, the `tls_max_version` field will be omitted from the resulting object.\n  - `tls_min_version` (`string`): Set the `tls_min_version` field on the resulting object. When `null`, the `tls_min_version` field will be omitted from the resulting object.\n  - `token_bound_cidrs` (`list`): Specifies the blocks of IP addresses which are allowed to use the generated token When `null`, the `token_bound_cidrs` field will be omitted from the resulting object.\n  - `token_explicit_max_ttl` (`number`): Generated Token's Explicit Maximum TTL in seconds When `null`, the `token_explicit_max_ttl` field will be omitted from the resulting object.\n  - `token_max_ttl` (`number`): The maximum lifetime of the generated token When `null`, the `token_max_ttl` field will be omitted from the resulting object.\n  - `token_no_default_policy` (`bool`): If true, the 'default' policy will not automatically be added to generated tokens When `null`, the `token_no_default_policy` field will be omitted from the resulting object.\n  - `token_num_uses` (`number`): The maximum number of times a token may be used, a value of zero means unlimited When `null`, the `token_num_uses` field will be omitted from the resulting object.\n  - `token_period` (`number`): Generated Token's Period When `null`, the `token_period` field will be omitted from the resulting object.\n  - `token_policies` (`list`): Generated Token's Policies When `null`, the `token_policies` field will be omitted from the resulting object.\n  - `token_ttl` (`number`): The initial ttl of the token to generate in seconds When `null`, the `token_ttl` field will be omitted from the resulting object.\n  - `token_type` (`string`): The type of token to generate, service or batch When `null`, the `token_type` field will be omitted from the resulting object.\n  - `upndomain` (`string`): Set the `upndomain` field on the resulting object. When `null`, the `upndomain` field will be omitted from the resulting object.\n  - `url` (`string`): Set the `url` field on the resulting object.\n  - `use_token_groups` (`bool`): Set the `use_token_groups` field on the resulting object. When `null`, the `use_token_groups` field will be omitted from the resulting object.\n  - `userattr` (`string`): Set the `userattr` field on the resulting object. When `null`, the `userattr` field will be omitted from the resulting object.\n  - `userdn` (`string`): Set the `userdn` field on the resulting object. When `null`, the `userdn` field will be omitted from the resulting object.\n  - `userfilter` (`string`): Set the `userfilter` field on the resulting object. When `null`, the `userfilter` field will be omitted from the resulting object.\n  - `username_as_alias` (`bool`): Force the auth method to use the username passed by the user as the alias name. When `null`, the `username_as_alias` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `ldap_auth_backend` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`vault.ldap_auth_backend.newAttrs` constructs a new object with attributes and blocks configured for the `ldap_auth_backend`\nTerraform resource.\n\nUnlike [vault.ldap_auth_backend.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `binddn` (`string`): Set the `binddn` field on the resulting object. When `null`, the `binddn` field will be omitted from the resulting object.\n  - `bindpass` (`string`): Set the `bindpass` field on the resulting object. When `null`, the `bindpass` field will be omitted from the resulting object.\n  - `case_sensitive_names` (`bool`): Set the `case_sensitive_names` field on the resulting object. When `null`, the `case_sensitive_names` field will be omitted from the resulting object.\n  - `certificate` (`string`): Set the `certificate` field on the resulting object. When `null`, the `certificate` field will be omitted from the resulting object.\n  - `client_tls_cert` (`string`): Set the `client_tls_cert` field on the resulting object. When `null`, the `client_tls_cert` field will be omitted from the resulting object.\n  - `client_tls_key` (`string`): Set the `client_tls_key` field on the resulting object. When `null`, the `client_tls_key` field will be omitted from the resulting object.\n  - `deny_null_bind` (`bool`): Set the `deny_null_bind` field on the resulting object. When `null`, the `deny_null_bind` field will be omitted from the resulting object.\n  - `description` (`string`): Set the `description` field on the resulting object. When `null`, the `description` field will be omitted from the resulting object.\n  - `disable_remount` (`bool`): If set, opts out of mount migration on path updates. When `null`, the `disable_remount` field will be omitted from the resulting object.\n  - `discoverdn` (`bool`): Set the `discoverdn` field on the resulting object. When `null`, the `discoverdn` field will be omitted from the resulting object.\n  - `groupattr` (`string`): Set the `groupattr` field on the resulting object. When `null`, the `groupattr` field will be omitted from the resulting object.\n  - `groupdn` (`string`): Set the `groupdn` field on the resulting object. When `null`, the `groupdn` field will be omitted from the resulting object.\n  - `groupfilter` (`string`): Set the `groupfilter` field on the resulting object. When `null`, the `groupfilter` field will be omitted from the resulting object.\n  - `insecure_tls` (`bool`): Set the `insecure_tls` field on the resulting object. When `null`, the `insecure_tls` field will be omitted from the resulting object.\n  - `local_` (`bool`): Specifies if the auth method is local only When `null`, the `local_` field will be omitted from the resulting object.\n  - `max_page_size` (`number`): Set the `max_page_size` field on the resulting object. When `null`, the `max_page_size` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `path` (`string`): Set the `path` field on the resulting object. When `null`, the `path` field will be omitted from the resulting object.\n  - `starttls` (`bool`): Set the `starttls` field on the resulting object. When `null`, the `starttls` field will be omitted from the resulting object.\n  - `tls_max_version` (`string`): Set the `tls_max_version` field on the resulting object. When `null`, the `tls_max_version` field will be omitted from the resulting object.\n  - `tls_min_version` (`string`): Set the `tls_min_version` field on the resulting object. When `null`, the `tls_min_version` field will be omitted from the resulting object.\n  - `token_bound_cidrs` (`list`): Specifies the blocks of IP addresses which are allowed to use the generated token When `null`, the `token_bound_cidrs` field will be omitted from the resulting object.\n  - `token_explicit_max_ttl` (`number`): Generated Token's Explicit Maximum TTL in seconds When `null`, the `token_explicit_max_ttl` field will be omitted from the resulting object.\n  - `token_max_ttl` (`number`): The maximum lifetime of the generated token When `null`, the `token_max_ttl` field will be omitted from the resulting object.\n  - `token_no_default_policy` (`bool`): If true, the 'default' policy will not automatically be added to generated tokens When `null`, the `token_no_default_policy` field will be omitted from the resulting object.\n  - `token_num_uses` (`number`): The maximum number of times a token may be used, a value of zero means unlimited When `null`, the `token_num_uses` field will be omitted from the resulting object.\n  - `token_period` (`number`): Generated Token's Period When `null`, the `token_period` field will be omitted from the resulting object.\n  - `token_policies` (`list`): Generated Token's Policies When `null`, the `token_policies` field will be omitted from the resulting object.\n  - `token_ttl` (`number`): The initial ttl of the token to generate in seconds When `null`, the `token_ttl` field will be omitted from the resulting object.\n  - `token_type` (`string`): The type of token to generate, service or batch When `null`, the `token_type` field will be omitted from the resulting object.\n  - `upndomain` (`string`): Set the `upndomain` field on the resulting object. When `null`, the `upndomain` field will be omitted from the resulting object.\n  - `url` (`string`): Set the `url` field on the resulting object.\n  - `use_token_groups` (`bool`): Set the `use_token_groups` field on the resulting object. When `null`, the `use_token_groups` field will be omitted from the resulting object.\n  - `userattr` (`string`): Set the `userattr` field on the resulting object. When `null`, the `userattr` field will be omitted from the resulting object.\n  - `userdn` (`string`): Set the `userdn` field on the resulting object. When `null`, the `userdn` field will be omitted from the resulting object.\n  - `userfilter` (`string`): Set the `userfilter` field on the resulting object. When `null`, the `userfilter` field will be omitted from the resulting object.\n  - `username_as_alias` (`bool`): Force the auth method to use the username passed by the user as the alias name. When `null`, the `username_as_alias` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `ldap_auth_backend` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     url,
     binddn=null,
@@ -103,6 +105,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     groupfilter=null,
     insecure_tls=null,
     local_=null,
+    max_page_size=null,
     namespace=null,
     path=null,
     starttls=null,
@@ -139,6 +142,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     groupfilter: groupfilter,
     insecure_tls: insecure_tls,
     'local': local_,
+    max_page_size: max_page_size,
     namespace: namespace,
     path: path,
     starttls: starttls,
@@ -311,6 +315,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withMaxPageSize':: d.fn(help='`vault.number.withMaxPageSize` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the max_page_size field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `max_page_size` field.\n', args=[]),
+  withMaxPageSize(resourceLabel, value): {
+    resource+: {
+      vault_ldap_auth_backend+: {
+        [resourceLabel]+: {
+          max_page_size: value,
+        },
+      },
+    },
+  },
   '#withNamespace':: d.fn(help='`vault.string.withNamespace` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the namespace field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `namespace` field.\n', args=[]),
   withNamespace(resourceLabel, value): {
     resource+: {
diff --git a/3.x/_gen/resources/pki_secret_backend_cert.libsonnet b/3.x/_gen/resources/pki_secret_backend_cert.libsonnet
index 75d7f54..ee64577 100644
--- a/3.x/_gen/resources/pki_secret_backend_cert.libsonnet
+++ b/3.x/_gen/resources/pki_secret_backend_cert.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='pki_secret_backend_cert', url='', help='`pki_secret_backend_cert` represents the `vault_pki_secret_backend_cert` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`vault.pki_secret_backend_cert.new` injects a new `vault_pki_secret_backend_cert` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.pki_secret_backend_cert.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.pki_secret_backend_cert` using the reference:\n\n    $._ref.vault_pki_secret_backend_cert.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_pki_secret_backend_cert.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `alt_names` (`list`): List of alternative names. When `null`, the `alt_names` field will be omitted from the resulting object.\n  - `auto_renew` (`bool`): If enabled, a new certificate will be generated if the expiration is within min_seconds_remaining When `null`, the `auto_renew` field will be omitted from the resulting object.\n  - `backend` (`string`): The PKI secret backend the resource belongs to.\n  - `common_name` (`string`): CN of the certificate to create.\n  - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.\n  - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.\n  - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.\n  - `min_seconds_remaining` (`number`): Generate a new certificate when the expiration is within this number of seconds When `null`, the `min_seconds_remaining` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the role to create the certificate against.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `other_sans` (`list`): List of other SANs. When `null`, the `other_sans` field will be omitted from the resulting object.\n  - `private_key_format` (`string`): The private key format. When `null`, the `private_key_format` field will be omitted from the resulting object.\n  - `revoke` (`bool`): Revoke the certificate upon resource destruction. When `null`, the `revoke` field will be omitted from the resulting object.\n  - `ttl` (`string`): Time to live. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `uri_sans` (`list`): List of alternative URIs. When `null`, the `uri_sans` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`vault.pki_secret_backend_cert.new` injects a new `vault_pki_secret_backend_cert` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.pki_secret_backend_cert.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.pki_secret_backend_cert` using the reference:\n\n    $._ref.vault_pki_secret_backend_cert.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_pki_secret_backend_cert.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `alt_names` (`list`): List of alternative names. When `null`, the `alt_names` field will be omitted from the resulting object.\n  - `auto_renew` (`bool`): If enabled, a new certificate will be generated if the expiration is within min_seconds_remaining When `null`, the `auto_renew` field will be omitted from the resulting object.\n  - `backend` (`string`): The PKI secret backend the resource belongs to.\n  - `common_name` (`string`): CN of the certificate to create.\n  - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.\n  - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.\n  - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.\n  - `issuer_ref` (`string`): Specifies the default issuer of this request. When `null`, the `issuer_ref` field will be omitted from the resulting object.\n  - `min_seconds_remaining` (`number`): Generate a new certificate when the expiration is within this number of seconds When `null`, the `min_seconds_remaining` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the role to create the certificate against.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `other_sans` (`list`): List of other SANs. When `null`, the `other_sans` field will be omitted from the resulting object.\n  - `private_key_format` (`string`): The private key format. When `null`, the `private_key_format` field will be omitted from the resulting object.\n  - `revoke` (`bool`): Revoke the certificate upon resource destruction. When `null`, the `revoke` field will be omitted from the resulting object.\n  - `ttl` (`string`): Time to live. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `uri_sans` (`list`): List of alternative URIs. When `null`, the `uri_sans` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     backend,
@@ -13,6 +13,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     exclude_cn_from_sans=null,
     format=null,
     ip_sans=null,
+    issuer_ref=null,
     min_seconds_remaining=null,
     namespace=null,
     other_sans=null,
@@ -32,6 +33,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       exclude_cn_from_sans=exclude_cn_from_sans,
       format=format,
       ip_sans=ip_sans,
+      issuer_ref=issuer_ref,
       min_seconds_remaining=min_seconds_remaining,
       name=name,
       namespace=namespace,
@@ -43,7 +45,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`vault.pki_secret_backend_cert.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_cert`\nTerraform resource.\n\nUnlike [vault.pki_secret_backend_cert.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `alt_names` (`list`): List of alternative names. When `null`, the `alt_names` field will be omitted from the resulting object.\n  - `auto_renew` (`bool`): If enabled, a new certificate will be generated if the expiration is within min_seconds_remaining When `null`, the `auto_renew` field will be omitted from the resulting object.\n  - `backend` (`string`): The PKI secret backend the resource belongs to.\n  - `common_name` (`string`): CN of the certificate to create.\n  - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.\n  - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.\n  - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.\n  - `min_seconds_remaining` (`number`): Generate a new certificate when the expiration is within this number of seconds When `null`, the `min_seconds_remaining` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the role to create the certificate against.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `other_sans` (`list`): List of other SANs. When `null`, the `other_sans` field will be omitted from the resulting object.\n  - `private_key_format` (`string`): The private key format. When `null`, the `private_key_format` field will be omitted from the resulting object.\n  - `revoke` (`bool`): Revoke the certificate upon resource destruction. When `null`, the `revoke` field will be omitted from the resulting object.\n  - `ttl` (`string`): Time to live. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `uri_sans` (`list`): List of alternative URIs. When `null`, the `uri_sans` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pki_secret_backend_cert` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`vault.pki_secret_backend_cert.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_cert`\nTerraform resource.\n\nUnlike [vault.pki_secret_backend_cert.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `alt_names` (`list`): List of alternative names. When `null`, the `alt_names` field will be omitted from the resulting object.\n  - `auto_renew` (`bool`): If enabled, a new certificate will be generated if the expiration is within min_seconds_remaining When `null`, the `auto_renew` field will be omitted from the resulting object.\n  - `backend` (`string`): The PKI secret backend the resource belongs to.\n  - `common_name` (`string`): CN of the certificate to create.\n  - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.\n  - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.\n  - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.\n  - `issuer_ref` (`string`): Specifies the default issuer of this request. When `null`, the `issuer_ref` field will be omitted from the resulting object.\n  - `min_seconds_remaining` (`number`): Generate a new certificate when the expiration is within this number of seconds When `null`, the `min_seconds_remaining` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the role to create the certificate against.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `other_sans` (`list`): List of other SANs. When `null`, the `other_sans` field will be omitted from the resulting object.\n  - `private_key_format` (`string`): The private key format. When `null`, the `private_key_format` field will be omitted from the resulting object.\n  - `revoke` (`bool`): Revoke the certificate upon resource destruction. When `null`, the `revoke` field will be omitted from the resulting object.\n  - `ttl` (`string`): Time to live. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `uri_sans` (`list`): List of alternative URIs. When `null`, the `uri_sans` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pki_secret_backend_cert` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     backend,
     common_name,
@@ -53,6 +55,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     exclude_cn_from_sans=null,
     format=null,
     ip_sans=null,
+    issuer_ref=null,
     min_seconds_remaining=null,
     namespace=null,
     other_sans=null,
@@ -68,6 +71,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     exclude_cn_from_sans: exclude_cn_from_sans,
     format: format,
     ip_sans: ip_sans,
+    issuer_ref: issuer_ref,
     min_seconds_remaining: min_seconds_remaining,
     name: name,
     namespace: namespace,
@@ -147,6 +151,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withIssuerRef':: d.fn(help='`vault.string.withIssuerRef` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the issuer_ref field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `issuer_ref` field.\n', args=[]),
+  withIssuerRef(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_cert+: {
+        [resourceLabel]+: {
+          issuer_ref: value,
+        },
+      },
+    },
+  },
   '#withMinSecondsRemaining':: d.fn(help='`vault.number.withMinSecondsRemaining` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the min_seconds_remaining field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `min_seconds_remaining` field.\n', args=[]),
   withMinSecondsRemaining(resourceLabel, value): {
     resource+: {
diff --git a/3.x/_gen/resources/pki_secret_backend_intermediate_cert_request.libsonnet b/3.x/_gen/resources/pki_secret_backend_intermediate_cert_request.libsonnet
index 1820ca5..2220c8d 100644
--- a/3.x/_gen/resources/pki_secret_backend_intermediate_cert_request.libsonnet
+++ b/3.x/_gen/resources/pki_secret_backend_intermediate_cert_request.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='pki_secret_backend_intermediate_cert_request', url='', help='`pki_secret_backend_intermediate_cert_request` represents the `vault_pki_secret_backend_intermediate_cert_request` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`vault.pki_secret_backend_intermediate_cert_request.new` injects a new `vault_pki_secret_backend_intermediate_cert_request` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.pki_secret_backend_intermediate_cert_request.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.pki_secret_backend_intermediate_cert_request` using the reference:\n\n    $._ref.vault_pki_secret_backend_intermediate_cert_request.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_pki_secret_backend_intermediate_cert_request.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `add_basic_constraints` (`bool`): Set \u0026#39;CA: true\u0026#39; in a Basic Constraints extension. Only needed as\na workaround in some compatibility scenarios with Active Directory Certificate Services. When `null`, the `add_basic_constraints` field will be omitted from the resulting object.\n  - `alt_names` (`list`): List of alternative names. When `null`, the `alt_names` field will be omitted from the resulting object.\n  - `backend` (`string`): The PKI secret backend the resource belongs to.\n  - `common_name` (`string`): CN of intermediate to create.\n  - `country` (`string`): The country. When `null`, the `country` field will be omitted from the resulting object.\n  - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.\n  - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.\n  - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.\n  - `key_bits` (`number`): The number of bits to use. When `null`, the `key_bits` field will be omitted from the resulting object.\n  - `key_type` (`string`): The desired key type. When `null`, the `key_type` field will be omitted from the resulting object.\n  - `locality` (`string`): The locality. When `null`, the `locality` field will be omitted from the resulting object.\n  - `managed_key_id` (`string`): The ID of the previously configured managed key. When `null`, the `managed_key_id` field will be omitted from the resulting object.\n  - `managed_key_name` (`string`): The name of the previously configured managed key. When `null`, the `managed_key_name` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `organization` (`string`): The organization. When `null`, the `organization` field will be omitted from the resulting object.\n  - `other_sans` (`list`): List of other SANs. When `null`, the `other_sans` field will be omitted from the resulting object.\n  - `ou` (`string`): The organization unit. When `null`, the `ou` field will be omitted from the resulting object.\n  - `postal_code` (`string`): The postal code. When `null`, the `postal_code` field will be omitted from the resulting object.\n  - `private_key_format` (`string`): The private key format. When `null`, the `private_key_format` field will be omitted from the resulting object.\n  - `province` (`string`): The province. When `null`, the `province` field will be omitted from the resulting object.\n  - `street_address` (`string`): The street address. When `null`, the `street_address` field will be omitted from the resulting object.\n  - `type` (`string`): Type of intermediate to create. Must be either \u0026#34;exported\u0026#34; or \u0026#34;internal\u0026#34;.\n  - `uri_sans` (`list`): List of alternative URIs. When `null`, the `uri_sans` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`vault.pki_secret_backend_intermediate_cert_request.new` injects a new `vault_pki_secret_backend_intermediate_cert_request` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.pki_secret_backend_intermediate_cert_request.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.pki_secret_backend_intermediate_cert_request` using the reference:\n\n    $._ref.vault_pki_secret_backend_intermediate_cert_request.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_pki_secret_backend_intermediate_cert_request.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `add_basic_constraints` (`bool`): Set \u0026#39;CA: true\u0026#39; in a Basic Constraints extension. Only needed as\na workaround in some compatibility scenarios with Active Directory Certificate Services. When `null`, the `add_basic_constraints` field will be omitted from the resulting object.\n  - `alt_names` (`list`): List of alternative names. When `null`, the `alt_names` field will be omitted from the resulting object.\n  - `backend` (`string`): The PKI secret backend the resource belongs to.\n  - `common_name` (`string`): CN of intermediate to create.\n  - `country` (`string`): The country. When `null`, the `country` field will be omitted from the resulting object.\n  - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.\n  - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.\n  - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.\n  - `key_bits` (`number`): The number of bits to use. When `null`, the `key_bits` field will be omitted from the resulting object.\n  - `key_name` (`string`): When a new key is created with this request, optionally specifies the name for this. When `null`, the `key_name` field will be omitted from the resulting object.\n  - `key_ref` (`string`): Specifies the key to use for generating this request. When `null`, the `key_ref` field will be omitted from the resulting object.\n  - `key_type` (`string`): The desired key type. When `null`, the `key_type` field will be omitted from the resulting object.\n  - `locality` (`string`): The locality. When `null`, the `locality` field will be omitted from the resulting object.\n  - `managed_key_id` (`string`): The ID of the previously configured managed key. When `null`, the `managed_key_id` field will be omitted from the resulting object.\n  - `managed_key_name` (`string`): The name of the previously configured managed key. When `null`, the `managed_key_name` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `organization` (`string`): The organization. When `null`, the `organization` field will be omitted from the resulting object.\n  - `other_sans` (`list`): List of other SANs. When `null`, the `other_sans` field will be omitted from the resulting object.\n  - `ou` (`string`): The organization unit. When `null`, the `ou` field will be omitted from the resulting object.\n  - `postal_code` (`string`): The postal code. When `null`, the `postal_code` field will be omitted from the resulting object.\n  - `private_key_format` (`string`): The private key format. When `null`, the `private_key_format` field will be omitted from the resulting object.\n  - `province` (`string`): The province. When `null`, the `province` field will be omitted from the resulting object.\n  - `street_address` (`string`): The street address. When `null`, the `street_address` field will be omitted from the resulting object.\n  - `type` (`string`): Type of intermediate to create. Must be either \u0026#34;existing\u0026#34;, \u0026#34;exported\u0026#34;, \u0026#34;internal\u0026#34; or \u0026#34;kms\u0026#34;\n  - `uri_sans` (`list`): List of alternative URIs. When `null`, the `uri_sans` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     backend,
@@ -15,6 +15,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     format=null,
     ip_sans=null,
     key_bits=null,
+    key_name=null,
+    key_ref=null,
     key_type=null,
     locality=null,
     managed_key_id=null,
@@ -42,6 +44,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       format=format,
       ip_sans=ip_sans,
       key_bits=key_bits,
+      key_name=key_name,
+      key_ref=key_ref,
       key_type=key_type,
       locality=locality,
       managed_key_id=managed_key_id,
@@ -59,7 +63,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`vault.pki_secret_backend_intermediate_cert_request.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_intermediate_cert_request`\nTerraform resource.\n\nUnlike [vault.pki_secret_backend_intermediate_cert_request.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `add_basic_constraints` (`bool`): Set 'CA: true' in a Basic Constraints extension. Only needed as\na workaround in some compatibility scenarios with Active Directory Certificate Services. When `null`, the `add_basic_constraints` field will be omitted from the resulting object.\n  - `alt_names` (`list`): List of alternative names. When `null`, the `alt_names` field will be omitted from the resulting object.\n  - `backend` (`string`): The PKI secret backend the resource belongs to.\n  - `common_name` (`string`): CN of intermediate to create.\n  - `country` (`string`): The country. When `null`, the `country` field will be omitted from the resulting object.\n  - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.\n  - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.\n  - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.\n  - `key_bits` (`number`): The number of bits to use. When `null`, the `key_bits` field will be omitted from the resulting object.\n  - `key_type` (`string`): The desired key type. When `null`, the `key_type` field will be omitted from the resulting object.\n  - `locality` (`string`): The locality. When `null`, the `locality` field will be omitted from the resulting object.\n  - `managed_key_id` (`string`): The ID of the previously configured managed key. When `null`, the `managed_key_id` field will be omitted from the resulting object.\n  - `managed_key_name` (`string`): The name of the previously configured managed key. When `null`, the `managed_key_name` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `organization` (`string`): The organization. When `null`, the `organization` field will be omitted from the resulting object.\n  - `other_sans` (`list`): List of other SANs. When `null`, the `other_sans` field will be omitted from the resulting object.\n  - `ou` (`string`): The organization unit. When `null`, the `ou` field will be omitted from the resulting object.\n  - `postal_code` (`string`): The postal code. When `null`, the `postal_code` field will be omitted from the resulting object.\n  - `private_key_format` (`string`): The private key format. When `null`, the `private_key_format` field will be omitted from the resulting object.\n  - `province` (`string`): The province. When `null`, the `province` field will be omitted from the resulting object.\n  - `street_address` (`string`): The street address. When `null`, the `street_address` field will be omitted from the resulting object.\n  - `type` (`string`): Type of intermediate to create. Must be either "exported" or "internal".\n  - `uri_sans` (`list`): List of alternative URIs. When `null`, the `uri_sans` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pki_secret_backend_intermediate_cert_request` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`vault.pki_secret_backend_intermediate_cert_request.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_intermediate_cert_request`\nTerraform resource.\n\nUnlike [vault.pki_secret_backend_intermediate_cert_request.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `add_basic_constraints` (`bool`): Set 'CA: true' in a Basic Constraints extension. Only needed as\na workaround in some compatibility scenarios with Active Directory Certificate Services. When `null`, the `add_basic_constraints` field will be omitted from the resulting object.\n  - `alt_names` (`list`): List of alternative names. When `null`, the `alt_names` field will be omitted from the resulting object.\n  - `backend` (`string`): The PKI secret backend the resource belongs to.\n  - `common_name` (`string`): CN of intermediate to create.\n  - `country` (`string`): The country. When `null`, the `country` field will be omitted from the resulting object.\n  - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.\n  - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.\n  - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.\n  - `key_bits` (`number`): The number of bits to use. When `null`, the `key_bits` field will be omitted from the resulting object.\n  - `key_name` (`string`): When a new key is created with this request, optionally specifies the name for this. When `null`, the `key_name` field will be omitted from the resulting object.\n  - `key_ref` (`string`): Specifies the key to use for generating this request. When `null`, the `key_ref` field will be omitted from the resulting object.\n  - `key_type` (`string`): The desired key type. When `null`, the `key_type` field will be omitted from the resulting object.\n  - `locality` (`string`): The locality. When `null`, the `locality` field will be omitted from the resulting object.\n  - `managed_key_id` (`string`): The ID of the previously configured managed key. When `null`, the `managed_key_id` field will be omitted from the resulting object.\n  - `managed_key_name` (`string`): The name of the previously configured managed key. When `null`, the `managed_key_name` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `organization` (`string`): The organization. When `null`, the `organization` field will be omitted from the resulting object.\n  - `other_sans` (`list`): List of other SANs. When `null`, the `other_sans` field will be omitted from the resulting object.\n  - `ou` (`string`): The organization unit. When `null`, the `ou` field will be omitted from the resulting object.\n  - `postal_code` (`string`): The postal code. When `null`, the `postal_code` field will be omitted from the resulting object.\n  - `private_key_format` (`string`): The private key format. When `null`, the `private_key_format` field will be omitted from the resulting object.\n  - `province` (`string`): The province. When `null`, the `province` field will be omitted from the resulting object.\n  - `street_address` (`string`): The street address. When `null`, the `street_address` field will be omitted from the resulting object.\n  - `type` (`string`): Type of intermediate to create. Must be either "existing", "exported", "internal" or "kms"\n  - `uri_sans` (`list`): List of alternative URIs. When `null`, the `uri_sans` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pki_secret_backend_intermediate_cert_request` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     backend,
     common_name,
@@ -71,6 +75,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     format=null,
     ip_sans=null,
     key_bits=null,
+    key_name=null,
+    key_ref=null,
     key_type=null,
     locality=null,
     managed_key_id=null,
@@ -94,6 +100,8 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     format: format,
     ip_sans: ip_sans,
     key_bits: key_bits,
+    key_name: key_name,
+    key_ref: key_ref,
     key_type: key_type,
     locality: locality,
     managed_key_id: managed_key_id,
@@ -199,6 +207,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withKeyName':: d.fn(help='`vault.string.withKeyName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the key_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `key_name` field.\n', args=[]),
+  withKeyName(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_intermediate_cert_request+: {
+        [resourceLabel]+: {
+          key_name: value,
+        },
+      },
+    },
+  },
+  '#withKeyRef':: d.fn(help='`vault.string.withKeyRef` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the key_ref field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `key_ref` field.\n', args=[]),
+  withKeyRef(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_intermediate_cert_request+: {
+        [resourceLabel]+: {
+          key_ref: value,
+        },
+      },
+    },
+  },
   '#withKeyType':: d.fn(help='`vault.string.withKeyType` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the key_type field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `key_type` field.\n', args=[]),
   withKeyType(resourceLabel, value): {
     resource+: {
diff --git a/3.x/_gen/resources/pki_secret_backend_issuer.libsonnet b/3.x/_gen/resources/pki_secret_backend_issuer.libsonnet
new file mode 100644
index 0000000..e800de7
--- /dev/null
+++ b/3.x/_gen/resources/pki_secret_backend_issuer.libsonnet
@@ -0,0 +1,188 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='pki_secret_backend_issuer', url='', help='`pki_secret_backend_issuer` represents the `vault_pki_secret_backend_issuer` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`vault.pki_secret_backend_issuer.new` injects a new `vault_pki_secret_backend_issuer` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.pki_secret_backend_issuer.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.pki_secret_backend_issuer` using the reference:\n\n    $._ref.vault_pki_secret_backend_issuer.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_pki_secret_backend_issuer.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `backend` (`string`): Full path where PKI backend is mounted.\n  - `crl_distribution_points` (`list`): Specifies the URL values for the CRL Distribution Points field. When `null`, the `crl_distribution_points` field will be omitted from the resulting object.\n  - `enable_aia_url_templating` (`bool`): Specifies that the AIA URL values should be templated. When `null`, the `enable_aia_url_templating` field will be omitted from the resulting object.\n  - `issuer_name` (`string`): Reference to an existing issuer. When `null`, the `issuer_name` field will be omitted from the resulting object.\n  - `issuer_ref` (`string`): Reference to an existing issuer.\n  - `issuing_certificates` (`list`): Specifies the URL values for the Issuing Certificate field. When `null`, the `issuing_certificates` field will be omitted from the resulting object.\n  - `leaf_not_after_behavior` (`string`): Behavior of a leaf\u0026#39;s \u0026#39;NotAfter\u0026#39; field during issuance. When `null`, the `leaf_not_after_behavior` field will be omitted from the resulting object.\n  - `manual_chain` (`list`): Chain of issuer references to build this issuer\u0026#39;s computed CAChain field from, when non-empty. When `null`, the `manual_chain` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `ocsp_servers` (`list`): Specifies the URL values for the OCSP Servers field. When `null`, the `ocsp_servers` field will be omitted from the resulting object.\n  - `revocation_signature_algorithm` (`string`): Which signature algorithm to use when building CRLs. When `null`, the `revocation_signature_algorithm` field will be omitted from the resulting object.\n  - `usage` (`string`): Comma-separated list of allowed usages for this issuer. When `null`, the `usage` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    backend,
+    issuer_ref,
+    crl_distribution_points=null,
+    enable_aia_url_templating=null,
+    issuer_name=null,
+    issuing_certificates=null,
+    leaf_not_after_behavior=null,
+    manual_chain=null,
+    namespace=null,
+    ocsp_servers=null,
+    revocation_signature_algorithm=null,
+    usage=null,
+    _meta={}
+  ):: tf.withResource(
+    type='vault_pki_secret_backend_issuer',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      backend=backend,
+      crl_distribution_points=crl_distribution_points,
+      enable_aia_url_templating=enable_aia_url_templating,
+      issuer_name=issuer_name,
+      issuer_ref=issuer_ref,
+      issuing_certificates=issuing_certificates,
+      leaf_not_after_behavior=leaf_not_after_behavior,
+      manual_chain=manual_chain,
+      namespace=namespace,
+      ocsp_servers=ocsp_servers,
+      revocation_signature_algorithm=revocation_signature_algorithm,
+      usage=usage
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`vault.pki_secret_backend_issuer.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_issuer`\nTerraform resource.\n\nUnlike [vault.pki_secret_backend_issuer.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `backend` (`string`): Full path where PKI backend is mounted.\n  - `crl_distribution_points` (`list`): Specifies the URL values for the CRL Distribution Points field. When `null`, the `crl_distribution_points` field will be omitted from the resulting object.\n  - `enable_aia_url_templating` (`bool`): Specifies that the AIA URL values should be templated. When `null`, the `enable_aia_url_templating` field will be omitted from the resulting object.\n  - `issuer_name` (`string`): Reference to an existing issuer. When `null`, the `issuer_name` field will be omitted from the resulting object.\n  - `issuer_ref` (`string`): Reference to an existing issuer.\n  - `issuing_certificates` (`list`): Specifies the URL values for the Issuing Certificate field. When `null`, the `issuing_certificates` field will be omitted from the resulting object.\n  - `leaf_not_after_behavior` (`string`): Behavior of a leaf's 'NotAfter' field during issuance. When `null`, the `leaf_not_after_behavior` field will be omitted from the resulting object.\n  - `manual_chain` (`list`): Chain of issuer references to build this issuer's computed CAChain field from, when non-empty. When `null`, the `manual_chain` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `ocsp_servers` (`list`): Specifies the URL values for the OCSP Servers field. When `null`, the `ocsp_servers` field will be omitted from the resulting object.\n  - `revocation_signature_algorithm` (`string`): Which signature algorithm to use when building CRLs. When `null`, the `revocation_signature_algorithm` field will be omitted from the resulting object.\n  - `usage` (`string`): Comma-separated list of allowed usages for this issuer. When `null`, the `usage` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pki_secret_backend_issuer` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    backend,
+    issuer_ref,
+    crl_distribution_points=null,
+    enable_aia_url_templating=null,
+    issuer_name=null,
+    issuing_certificates=null,
+    leaf_not_after_behavior=null,
+    manual_chain=null,
+    namespace=null,
+    ocsp_servers=null,
+    revocation_signature_algorithm=null,
+    usage=null
+  ):: std.prune(a={
+    backend: backend,
+    crl_distribution_points: crl_distribution_points,
+    enable_aia_url_templating: enable_aia_url_templating,
+    issuer_name: issuer_name,
+    issuer_ref: issuer_ref,
+    issuing_certificates: issuing_certificates,
+    leaf_not_after_behavior: leaf_not_after_behavior,
+    manual_chain: manual_chain,
+    namespace: namespace,
+    ocsp_servers: ocsp_servers,
+    revocation_signature_algorithm: revocation_signature_algorithm,
+    usage: usage,
+  }),
+  '#withBackend':: d.fn(help='`vault.string.withBackend` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the backend field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `backend` field.\n', args=[]),
+  withBackend(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_issuer+: {
+        [resourceLabel]+: {
+          backend: value,
+        },
+      },
+    },
+  },
+  '#withCrlDistributionPoints':: d.fn(help='`vault.list.withCrlDistributionPoints` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the crl_distribution_points field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `crl_distribution_points` field.\n', args=[]),
+  withCrlDistributionPoints(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_issuer+: {
+        [resourceLabel]+: {
+          crl_distribution_points: value,
+        },
+      },
+    },
+  },
+  '#withEnableAiaUrlTemplating':: d.fn(help='`vault.bool.withEnableAiaUrlTemplating` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the enable_aia_url_templating field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `enable_aia_url_templating` field.\n', args=[]),
+  withEnableAiaUrlTemplating(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_issuer+: {
+        [resourceLabel]+: {
+          enable_aia_url_templating: value,
+        },
+      },
+    },
+  },
+  '#withIssuerName':: d.fn(help='`vault.string.withIssuerName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the issuer_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `issuer_name` field.\n', args=[]),
+  withIssuerName(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_issuer+: {
+        [resourceLabel]+: {
+          issuer_name: value,
+        },
+      },
+    },
+  },
+  '#withIssuerRef':: d.fn(help='`vault.string.withIssuerRef` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the issuer_ref field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `issuer_ref` field.\n', args=[]),
+  withIssuerRef(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_issuer+: {
+        [resourceLabel]+: {
+          issuer_ref: value,
+        },
+      },
+    },
+  },
+  '#withIssuingCertificates':: d.fn(help='`vault.list.withIssuingCertificates` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the issuing_certificates field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `issuing_certificates` field.\n', args=[]),
+  withIssuingCertificates(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_issuer+: {
+        [resourceLabel]+: {
+          issuing_certificates: value,
+        },
+      },
+    },
+  },
+  '#withLeafNotAfterBehavior':: d.fn(help='`vault.string.withLeafNotAfterBehavior` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the leaf_not_after_behavior field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `leaf_not_after_behavior` field.\n', args=[]),
+  withLeafNotAfterBehavior(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_issuer+: {
+        [resourceLabel]+: {
+          leaf_not_after_behavior: value,
+        },
+      },
+    },
+  },
+  '#withManualChain':: d.fn(help='`vault.list.withManualChain` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the manual_chain field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `manual_chain` field.\n', args=[]),
+  withManualChain(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_issuer+: {
+        [resourceLabel]+: {
+          manual_chain: value,
+        },
+      },
+    },
+  },
+  '#withNamespace':: d.fn(help='`vault.string.withNamespace` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the namespace field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `namespace` field.\n', args=[]),
+  withNamespace(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_issuer+: {
+        [resourceLabel]+: {
+          namespace: value,
+        },
+      },
+    },
+  },
+  '#withOcspServers':: d.fn(help='`vault.list.withOcspServers` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the ocsp_servers field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `ocsp_servers` field.\n', args=[]),
+  withOcspServers(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_issuer+: {
+        [resourceLabel]+: {
+          ocsp_servers: value,
+        },
+      },
+    },
+  },
+  '#withRevocationSignatureAlgorithm':: d.fn(help='`vault.string.withRevocationSignatureAlgorithm` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the revocation_signature_algorithm field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `revocation_signature_algorithm` field.\n', args=[]),
+  withRevocationSignatureAlgorithm(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_issuer+: {
+        [resourceLabel]+: {
+          revocation_signature_algorithm: value,
+        },
+      },
+    },
+  },
+  '#withUsage':: d.fn(help='`vault.string.withUsage` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the usage field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `usage` field.\n', args=[]),
+  withUsage(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_issuer+: {
+        [resourceLabel]+: {
+          usage: value,
+        },
+      },
+    },
+  },
+}
diff --git a/3.x/_gen/resources/pki_secret_backend_key.libsonnet b/3.x/_gen/resources/pki_secret_backend_key.libsonnet
new file mode 100644
index 0000000..2318c62
--- /dev/null
+++ b/3.x/_gen/resources/pki_secret_backend_key.libsonnet
@@ -0,0 +1,132 @@
+local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
+local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
+{
+  '#':: d.pkg(name='pki_secret_backend_key', url='', help='`pki_secret_backend_key` represents the `vault_pki_secret_backend_key` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
+  '#new':: d.fn(help="\n`vault.pki_secret_backend_key.new` injects a new `vault_pki_secret_backend_key` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.pki_secret_backend_key.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.pki_secret_backend_key` using the reference:\n\n    $._ref.vault_pki_secret_backend_key.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_pki_secret_backend_key.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `backend` (`string`): Full path where PKI backend is mounted.\n  - `key_bits` (`number`): Specifies the number of bits to use for the generated keys. When `null`, the `key_bits` field will be omitted from the resulting object.\n  - `key_name` (`string`): When a new key is created with this request, optionally specifies the name for this. When `null`, the `key_name` field will be omitted from the resulting object.\n  - `key_type` (`string`): Specifies the desired key type; must be \u0026#39;rsa\u0026#39;, \u0026#39;ed25519\u0026#39; or \u0026#39;ec\u0026#39;. When `null`, the `key_type` field will be omitted from the resulting object.\n  - `managed_key_id` (`string`): The managed key\u0026#39;s UUID. When `null`, the `managed_key_id` field will be omitted from the resulting object.\n  - `managed_key_name` (`string`): The managed key\u0026#39;s configured name. When `null`, the `managed_key_name` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `type` (`string`): Specifies the type of the key to create.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  new(
+    resourceLabel,
+    backend,
+    type,
+    key_bits=null,
+    key_name=null,
+    key_type=null,
+    managed_key_id=null,
+    managed_key_name=null,
+    namespace=null,
+    _meta={}
+  ):: tf.withResource(
+    type='vault_pki_secret_backend_key',
+    label=resourceLabel,
+    attrs=self.newAttrs(
+      backend=backend,
+      key_bits=key_bits,
+      key_name=key_name,
+      key_type=key_type,
+      managed_key_id=managed_key_id,
+      managed_key_name=managed_key_name,
+      namespace=namespace,
+      type=type
+    ),
+    _meta=_meta
+  ),
+  '#newAttrs':: d.fn(help='\n`vault.pki_secret_backend_key.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_key`\nTerraform resource.\n\nUnlike [vault.pki_secret_backend_key.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `backend` (`string`): Full path where PKI backend is mounted.\n  - `key_bits` (`number`): Specifies the number of bits to use for the generated keys. When `null`, the `key_bits` field will be omitted from the resulting object.\n  - `key_name` (`string`): When a new key is created with this request, optionally specifies the name for this. When `null`, the `key_name` field will be omitted from the resulting object.\n  - `key_type` (`string`): Specifies the desired key type; must be 'rsa', 'ed25519' or 'ec'. When `null`, the `key_type` field will be omitted from the resulting object.\n  - `managed_key_id` (`string`): The managed key's UUID. When `null`, the `managed_key_id` field will be omitted from the resulting object.\n  - `managed_key_name` (`string`): The managed key's configured name. When `null`, the `managed_key_name` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `type` (`string`): Specifies the type of the key to create.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pki_secret_backend_key` resource into the root Terraform configuration.\n', args=[]),
+  newAttrs(
+    backend,
+    type,
+    key_bits=null,
+    key_name=null,
+    key_type=null,
+    managed_key_id=null,
+    managed_key_name=null,
+    namespace=null
+  ):: std.prune(a={
+    backend: backend,
+    key_bits: key_bits,
+    key_name: key_name,
+    key_type: key_type,
+    managed_key_id: managed_key_id,
+    managed_key_name: managed_key_name,
+    namespace: namespace,
+    type: type,
+  }),
+  '#withBackend':: d.fn(help='`vault.string.withBackend` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the backend field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `backend` field.\n', args=[]),
+  withBackend(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_key+: {
+        [resourceLabel]+: {
+          backend: value,
+        },
+      },
+    },
+  },
+  '#withKeyBits':: d.fn(help='`vault.number.withKeyBits` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the key_bits field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `key_bits` field.\n', args=[]),
+  withKeyBits(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_key+: {
+        [resourceLabel]+: {
+          key_bits: value,
+        },
+      },
+    },
+  },
+  '#withKeyName':: d.fn(help='`vault.string.withKeyName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the key_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `key_name` field.\n', args=[]),
+  withKeyName(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_key+: {
+        [resourceLabel]+: {
+          key_name: value,
+        },
+      },
+    },
+  },
+  '#withKeyType':: d.fn(help='`vault.string.withKeyType` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the key_type field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `key_type` field.\n', args=[]),
+  withKeyType(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_key+: {
+        [resourceLabel]+: {
+          key_type: value,
+        },
+      },
+    },
+  },
+  '#withManagedKeyId':: d.fn(help='`vault.string.withManagedKeyId` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the managed_key_id field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `managed_key_id` field.\n', args=[]),
+  withManagedKeyId(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_key+: {
+        [resourceLabel]+: {
+          managed_key_id: value,
+        },
+      },
+    },
+  },
+  '#withManagedKeyName':: d.fn(help='`vault.string.withManagedKeyName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the managed_key_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `managed_key_name` field.\n', args=[]),
+  withManagedKeyName(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_key+: {
+        [resourceLabel]+: {
+          managed_key_name: value,
+        },
+      },
+    },
+  },
+  '#withNamespace':: d.fn(help='`vault.string.withNamespace` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the namespace field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `namespace` field.\n', args=[]),
+  withNamespace(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_key+: {
+        [resourceLabel]+: {
+          namespace: value,
+        },
+      },
+    },
+  },
+  '#withType':: d.fn(help='`vault.string.withType` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the type field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `type` field.\n', args=[]),
+  withType(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_key+: {
+        [resourceLabel]+: {
+          type: value,
+        },
+      },
+    },
+  },
+}
diff --git a/3.x/_gen/resources/pki_secret_backend_role.libsonnet b/3.x/_gen/resources/pki_secret_backend_role.libsonnet
index c2e114a..5651c7c 100644
--- a/3.x/_gen/resources/pki_secret_backend_role.libsonnet
+++ b/3.x/_gen/resources/pki_secret_backend_role.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='pki_secret_backend_role', url='', help='`pki_secret_backend_role` represents the `vault_pki_secret_backend_role` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`vault.pki_secret_backend_role.new` injects a new `vault_pki_secret_backend_role` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.pki_secret_backend_role.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.pki_secret_backend_role` using the reference:\n\n    $._ref.vault_pki_secret_backend_role.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_pki_secret_backend_role.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `allow_any_name` (`bool`): Flag to allow any name When `null`, the `allow_any_name` field will be omitted from the resulting object.\n  - `allow_bare_domains` (`bool`): Flag to allow certificates matching the actual domain. When `null`, the `allow_bare_domains` field will be omitted from the resulting object.\n  - `allow_glob_domains` (`bool`): Flag to allow names containing glob patterns. When `null`, the `allow_glob_domains` field will be omitted from the resulting object.\n  - `allow_ip_sans` (`bool`): Flag to allow IP SANs When `null`, the `allow_ip_sans` field will be omitted from the resulting object.\n  - `allow_localhost` (`bool`): Flag to allow certificates for localhost. When `null`, the `allow_localhost` field will be omitted from the resulting object.\n  - `allow_subdomains` (`bool`): Flag to allow certificates matching subdomains. When `null`, the `allow_subdomains` field will be omitted from the resulting object.\n  - `allowed_domains` (`list`): The domains of the role. When `null`, the `allowed_domains` field will be omitted from the resulting object.\n  - `allowed_domains_template` (`bool`): Flag to indicate that `allowed_domains` specifies a template expression (e.g. {{identity.entity.aliases.\u0026lt;mount accessor\u0026gt;.name}}) When `null`, the `allowed_domains_template` field will be omitted from the resulting object.\n  - `allowed_other_sans` (`list`): Defines allowed custom SANs When `null`, the `allowed_other_sans` field will be omitted from the resulting object.\n  - `allowed_serial_numbers` (`list`): Defines allowed Subject serial numbers. When `null`, the `allowed_serial_numbers` field will be omitted from the resulting object.\n  - `allowed_uri_sans` (`list`): Defines allowed URI SANs When `null`, the `allowed_uri_sans` field will be omitted from the resulting object.\n  - `backend` (`string`): The path of the PKI secret backend the resource belongs to.\n  - `basic_constraints_valid_for_non_ca` (`bool`): Flag to mark basic constraints valid when issuing non-CA certificates. When `null`, the `basic_constraints_valid_for_non_ca` field will be omitted from the resulting object.\n  - `client_flag` (`bool`): Flag to specify certificates for client use. When `null`, the `client_flag` field will be omitted from the resulting object.\n  - `code_signing_flag` (`bool`): Flag to specify certificates for code signing use. When `null`, the `code_signing_flag` field will be omitted from the resulting object.\n  - `country` (`list`): The country of generated certificates. When `null`, the `country` field will be omitted from the resulting object.\n  - `email_protection_flag` (`bool`): Flag to specify certificates for email protection use. When `null`, the `email_protection_flag` field will be omitted from the resulting object.\n  - `enforce_hostnames` (`bool`): Flag to allow only valid host names When `null`, the `enforce_hostnames` field will be omitted from the resulting object.\n  - `ext_key_usage` (`list`): Specify the allowed extended key usage constraint on issued certificates. When `null`, the `ext_key_usage` field will be omitted from the resulting object.\n  - `generate_lease` (`bool`): Flag to generate leases with certificates. When `null`, the `generate_lease` field will be omitted from the resulting object.\n  - `key_bits` (`number`): The number of bits of generated keys. When `null`, the `key_bits` field will be omitted from the resulting object.\n  - `key_type` (`string`): The generated key type. When `null`, the `key_type` field will be omitted from the resulting object.\n  - `key_usage` (`list`): Specify the allowed key usage constraint on issued certificates. When `null`, the `key_usage` field will be omitted from the resulting object.\n  - `locality` (`list`): The locality of generated certificates. When `null`, the `locality` field will be omitted from the resulting object.\n  - `max_ttl` (`string`): The maximum TTL. When `null`, the `max_ttl` field will be omitted from the resulting object.\n  - `name` (`string`): Unique name for the role.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `no_store` (`bool`): Flag to not store certificates in the storage backend. When `null`, the `no_store` field will be omitted from the resulting object.\n  - `not_before_duration` (`string`): Specifies the duration by which to backdate the NotBefore property. When `null`, the `not_before_duration` field will be omitted from the resulting object.\n  - `organization` (`list`): The organization of generated certificates. When `null`, the `organization` field will be omitted from the resulting object.\n  - `ou` (`list`): The organization unit of generated certificates. When `null`, the `ou` field will be omitted from the resulting object.\n  - `policy_identifiers` (`list`): Specify the list of allowed policies OIDs. When `null`, the `policy_identifiers` field will be omitted from the resulting object.\n  - `postal_code` (`list`): The postal code of generated certificates. When `null`, the `postal_code` field will be omitted from the resulting object.\n  - `province` (`list`): The province of generated certificates. When `null`, the `province` field will be omitted from the resulting object.\n  - `require_cn` (`bool`): Flag to force CN usage. When `null`, the `require_cn` field will be omitted from the resulting object.\n  - `server_flag` (`bool`): Flag to specify certificates for server use. When `null`, the `server_flag` field will be omitted from the resulting object.\n  - `street_address` (`list`): The street address of generated certificates. When `null`, the `street_address` field will be omitted from the resulting object.\n  - `ttl` (`string`): The TTL. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `use_csr_common_name` (`bool`): Flag to use the CN in the CSR. When `null`, the `use_csr_common_name` field will be omitted from the resulting object.\n  - `use_csr_sans` (`bool`): Flag to use the SANs in the CSR. When `null`, the `use_csr_sans` field will be omitted from the resulting object.\n  - `policy_identifier` (`list[obj]`): Policy identifier block; can only be used with Vault 1.11\u0026#43; When `null`, the `policy_identifier` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.pki_secret_backend_role.policy_identifier.new](#fn-policy_identifiernew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`vault.pki_secret_backend_role.new` injects a new `vault_pki_secret_backend_role` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.pki_secret_backend_role.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.pki_secret_backend_role` using the reference:\n\n    $._ref.vault_pki_secret_backend_role.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_pki_secret_backend_role.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `allow_any_name` (`bool`): Flag to allow any name When `null`, the `allow_any_name` field will be omitted from the resulting object.\n  - `allow_bare_domains` (`bool`): Flag to allow certificates matching the actual domain. When `null`, the `allow_bare_domains` field will be omitted from the resulting object.\n  - `allow_glob_domains` (`bool`): Flag to allow names containing glob patterns. When `null`, the `allow_glob_domains` field will be omitted from the resulting object.\n  - `allow_ip_sans` (`bool`): Flag to allow IP SANs When `null`, the `allow_ip_sans` field will be omitted from the resulting object.\n  - `allow_localhost` (`bool`): Flag to allow certificates for localhost. When `null`, the `allow_localhost` field will be omitted from the resulting object.\n  - `allow_subdomains` (`bool`): Flag to allow certificates matching subdomains. When `null`, the `allow_subdomains` field will be omitted from the resulting object.\n  - `allow_wildcard_certificates` (`bool`): Flag to allow wildcard certificates When `null`, the `allow_wildcard_certificates` field will be omitted from the resulting object.\n  - `allowed_domains` (`list`): The domains of the role. When `null`, the `allowed_domains` field will be omitted from the resulting object.\n  - `allowed_domains_template` (`bool`): Flag to indicate that `allowed_domains` specifies a template expression (e.g. {{identity.entity.aliases.\u0026lt;mount accessor\u0026gt;.name}}) When `null`, the `allowed_domains_template` field will be omitted from the resulting object.\n  - `allowed_other_sans` (`list`): Defines allowed custom SANs When `null`, the `allowed_other_sans` field will be omitted from the resulting object.\n  - `allowed_serial_numbers` (`list`): Defines allowed Subject serial numbers. When `null`, the `allowed_serial_numbers` field will be omitted from the resulting object.\n  - `allowed_uri_sans` (`list`): Defines allowed URI SANs When `null`, the `allowed_uri_sans` field will be omitted from the resulting object.\n  - `allowed_uri_sans_template` (`bool`): Flag to indicate that `allowed_uri_sans` specifies a template expression (e.g. {{identity.entity.aliases.\u0026lt;mount accessor\u0026gt;.name}}) When `null`, the `allowed_uri_sans_template` field will be omitted from the resulting object.\n  - `backend` (`string`): The path of the PKI secret backend the resource belongs to.\n  - `basic_constraints_valid_for_non_ca` (`bool`): Flag to mark basic constraints valid when issuing non-CA certificates. When `null`, the `basic_constraints_valid_for_non_ca` field will be omitted from the resulting object.\n  - `client_flag` (`bool`): Flag to specify certificates for client use. When `null`, the `client_flag` field will be omitted from the resulting object.\n  - `code_signing_flag` (`bool`): Flag to specify certificates for code signing use. When `null`, the `code_signing_flag` field will be omitted from the resulting object.\n  - `country` (`list`): The country of generated certificates. When `null`, the `country` field will be omitted from the resulting object.\n  - `email_protection_flag` (`bool`): Flag to specify certificates for email protection use. When `null`, the `email_protection_flag` field will be omitted from the resulting object.\n  - `enforce_hostnames` (`bool`): Flag to allow only valid host names When `null`, the `enforce_hostnames` field will be omitted from the resulting object.\n  - `ext_key_usage` (`list`): Specify the allowed extended key usage constraint on issued certificates. When `null`, the `ext_key_usage` field will be omitted from the resulting object.\n  - `generate_lease` (`bool`): Flag to generate leases with certificates. When `null`, the `generate_lease` field will be omitted from the resulting object.\n  - `issuer_ref` (`string`): Specifies the default issuer of this request. When `null`, the `issuer_ref` field will be omitted from the resulting object.\n  - `key_bits` (`number`): The number of bits of generated keys. When `null`, the `key_bits` field will be omitted from the resulting object.\n  - `key_type` (`string`): The generated key type. When `null`, the `key_type` field will be omitted from the resulting object.\n  - `key_usage` (`list`): Specify the allowed key usage constraint on issued certificates. When `null`, the `key_usage` field will be omitted from the resulting object.\n  - `locality` (`list`): The locality of generated certificates. When `null`, the `locality` field will be omitted from the resulting object.\n  - `max_ttl` (`string`): The maximum TTL. When `null`, the `max_ttl` field will be omitted from the resulting object.\n  - `name` (`string`): Unique name for the role.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `no_store` (`bool`): Flag to not store certificates in the storage backend. When `null`, the `no_store` field will be omitted from the resulting object.\n  - `not_before_duration` (`string`): Specifies the duration by which to backdate the NotBefore property. When `null`, the `not_before_duration` field will be omitted from the resulting object.\n  - `organization` (`list`): The organization of generated certificates. When `null`, the `organization` field will be omitted from the resulting object.\n  - `ou` (`list`): The organization unit of generated certificates. When `null`, the `ou` field will be omitted from the resulting object.\n  - `policy_identifiers` (`list`): Specify the list of allowed policies OIDs. When `null`, the `policy_identifiers` field will be omitted from the resulting object.\n  - `postal_code` (`list`): The postal code of generated certificates. When `null`, the `postal_code` field will be omitted from the resulting object.\n  - `province` (`list`): The province of generated certificates. When `null`, the `province` field will be omitted from the resulting object.\n  - `require_cn` (`bool`): Flag to force CN usage. When `null`, the `require_cn` field will be omitted from the resulting object.\n  - `server_flag` (`bool`): Flag to specify certificates for server use. When `null`, the `server_flag` field will be omitted from the resulting object.\n  - `street_address` (`list`): The street address of generated certificates. When `null`, the `street_address` field will be omitted from the resulting object.\n  - `ttl` (`string`): The TTL. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `use_csr_common_name` (`bool`): Flag to use the CN in the CSR. When `null`, the `use_csr_common_name` field will be omitted from the resulting object.\n  - `use_csr_sans` (`bool`): Flag to use the SANs in the CSR. When `null`, the `use_csr_sans` field will be omitted from the resulting object.\n  - `policy_identifier` (`list[obj]`): Policy identifier block; can only be used with Vault 1.11\u0026#43; When `null`, the `policy_identifier` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.pki_secret_backend_role.policy_identifier.new](#fn-policy_identifiernew) constructor.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     backend,
@@ -13,11 +13,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     allow_ip_sans=null,
     allow_localhost=null,
     allow_subdomains=null,
+    allow_wildcard_certificates=null,
     allowed_domains=null,
     allowed_domains_template=null,
     allowed_other_sans=null,
     allowed_serial_numbers=null,
     allowed_uri_sans=null,
+    allowed_uri_sans_template=null,
     basic_constraints_valid_for_non_ca=null,
     client_flag=null,
     code_signing_flag=null,
@@ -26,6 +28,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     enforce_hostnames=null,
     ext_key_usage=null,
     generate_lease=null,
+    issuer_ref=null,
     key_bits=null,
     key_type=null,
     key_usage=null,
@@ -57,11 +60,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       allow_ip_sans=allow_ip_sans,
       allow_localhost=allow_localhost,
       allow_subdomains=allow_subdomains,
+      allow_wildcard_certificates=allow_wildcard_certificates,
       allowed_domains=allowed_domains,
       allowed_domains_template=allowed_domains_template,
       allowed_other_sans=allowed_other_sans,
       allowed_serial_numbers=allowed_serial_numbers,
       allowed_uri_sans=allowed_uri_sans,
+      allowed_uri_sans_template=allowed_uri_sans_template,
       backend=backend,
       basic_constraints_valid_for_non_ca=basic_constraints_valid_for_non_ca,
       client_flag=client_flag,
@@ -71,6 +76,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       enforce_hostnames=enforce_hostnames,
       ext_key_usage=ext_key_usage,
       generate_lease=generate_lease,
+      issuer_ref=issuer_ref,
       key_bits=key_bits,
       key_type=key_type,
       key_usage=key_usage,
@@ -95,7 +101,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`vault.pki_secret_backend_role.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_role`\nTerraform resource.\n\nUnlike [vault.pki_secret_backend_role.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `allow_any_name` (`bool`): Flag to allow any name When `null`, the `allow_any_name` field will be omitted from the resulting object.\n  - `allow_bare_domains` (`bool`): Flag to allow certificates matching the actual domain. When `null`, the `allow_bare_domains` field will be omitted from the resulting object.\n  - `allow_glob_domains` (`bool`): Flag to allow names containing glob patterns. When `null`, the `allow_glob_domains` field will be omitted from the resulting object.\n  - `allow_ip_sans` (`bool`): Flag to allow IP SANs When `null`, the `allow_ip_sans` field will be omitted from the resulting object.\n  - `allow_localhost` (`bool`): Flag to allow certificates for localhost. When `null`, the `allow_localhost` field will be omitted from the resulting object.\n  - `allow_subdomains` (`bool`): Flag to allow certificates matching subdomains. When `null`, the `allow_subdomains` field will be omitted from the resulting object.\n  - `allowed_domains` (`list`): The domains of the role. When `null`, the `allowed_domains` field will be omitted from the resulting object.\n  - `allowed_domains_template` (`bool`): Flag to indicate that `allowed_domains` specifies a template expression (e.g. {{identity.entity.aliases.<mount accessor>.name}}) When `null`, the `allowed_domains_template` field will be omitted from the resulting object.\n  - `allowed_other_sans` (`list`): Defines allowed custom SANs When `null`, the `allowed_other_sans` field will be omitted from the resulting object.\n  - `allowed_serial_numbers` (`list`): Defines allowed Subject serial numbers. When `null`, the `allowed_serial_numbers` field will be omitted from the resulting object.\n  - `allowed_uri_sans` (`list`): Defines allowed URI SANs When `null`, the `allowed_uri_sans` field will be omitted from the resulting object.\n  - `backend` (`string`): The path of the PKI secret backend the resource belongs to.\n  - `basic_constraints_valid_for_non_ca` (`bool`): Flag to mark basic constraints valid when issuing non-CA certificates. When `null`, the `basic_constraints_valid_for_non_ca` field will be omitted from the resulting object.\n  - `client_flag` (`bool`): Flag to specify certificates for client use. When `null`, the `client_flag` field will be omitted from the resulting object.\n  - `code_signing_flag` (`bool`): Flag to specify certificates for code signing use. When `null`, the `code_signing_flag` field will be omitted from the resulting object.\n  - `country` (`list`): The country of generated certificates. When `null`, the `country` field will be omitted from the resulting object.\n  - `email_protection_flag` (`bool`): Flag to specify certificates for email protection use. When `null`, the `email_protection_flag` field will be omitted from the resulting object.\n  - `enforce_hostnames` (`bool`): Flag to allow only valid host names When `null`, the `enforce_hostnames` field will be omitted from the resulting object.\n  - `ext_key_usage` (`list`): Specify the allowed extended key usage constraint on issued certificates. When `null`, the `ext_key_usage` field will be omitted from the resulting object.\n  - `generate_lease` (`bool`): Flag to generate leases with certificates. When `null`, the `generate_lease` field will be omitted from the resulting object.\n  - `key_bits` (`number`): The number of bits of generated keys. When `null`, the `key_bits` field will be omitted from the resulting object.\n  - `key_type` (`string`): The generated key type. When `null`, the `key_type` field will be omitted from the resulting object.\n  - `key_usage` (`list`): Specify the allowed key usage constraint on issued certificates. When `null`, the `key_usage` field will be omitted from the resulting object.\n  - `locality` (`list`): The locality of generated certificates. When `null`, the `locality` field will be omitted from the resulting object.\n  - `max_ttl` (`string`): The maximum TTL. When `null`, the `max_ttl` field will be omitted from the resulting object.\n  - `name` (`string`): Unique name for the role.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `no_store` (`bool`): Flag to not store certificates in the storage backend. When `null`, the `no_store` field will be omitted from the resulting object.\n  - `not_before_duration` (`string`): Specifies the duration by which to backdate the NotBefore property. When `null`, the `not_before_duration` field will be omitted from the resulting object.\n  - `organization` (`list`): The organization of generated certificates. When `null`, the `organization` field will be omitted from the resulting object.\n  - `ou` (`list`): The organization unit of generated certificates. When `null`, the `ou` field will be omitted from the resulting object.\n  - `policy_identifiers` (`list`): Specify the list of allowed policies OIDs. When `null`, the `policy_identifiers` field will be omitted from the resulting object.\n  - `postal_code` (`list`): The postal code of generated certificates. When `null`, the `postal_code` field will be omitted from the resulting object.\n  - `province` (`list`): The province of generated certificates. When `null`, the `province` field will be omitted from the resulting object.\n  - `require_cn` (`bool`): Flag to force CN usage. When `null`, the `require_cn` field will be omitted from the resulting object.\n  - `server_flag` (`bool`): Flag to specify certificates for server use. When `null`, the `server_flag` field will be omitted from the resulting object.\n  - `street_address` (`list`): The street address of generated certificates. When `null`, the `street_address` field will be omitted from the resulting object.\n  - `ttl` (`string`): The TTL. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `use_csr_common_name` (`bool`): Flag to use the CN in the CSR. When `null`, the `use_csr_common_name` field will be omitted from the resulting object.\n  - `use_csr_sans` (`bool`): Flag to use the SANs in the CSR. When `null`, the `use_csr_sans` field will be omitted from the resulting object.\n  - `policy_identifier` (`list[obj]`): Policy identifier block; can only be used with Vault 1.11+ When `null`, the `policy_identifier` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.pki_secret_backend_role.policy_identifier.new](#fn-policy_identifiernew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pki_secret_backend_role` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`vault.pki_secret_backend_role.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_role`\nTerraform resource.\n\nUnlike [vault.pki_secret_backend_role.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `allow_any_name` (`bool`): Flag to allow any name When `null`, the `allow_any_name` field will be omitted from the resulting object.\n  - `allow_bare_domains` (`bool`): Flag to allow certificates matching the actual domain. When `null`, the `allow_bare_domains` field will be omitted from the resulting object.\n  - `allow_glob_domains` (`bool`): Flag to allow names containing glob patterns. When `null`, the `allow_glob_domains` field will be omitted from the resulting object.\n  - `allow_ip_sans` (`bool`): Flag to allow IP SANs When `null`, the `allow_ip_sans` field will be omitted from the resulting object.\n  - `allow_localhost` (`bool`): Flag to allow certificates for localhost. When `null`, the `allow_localhost` field will be omitted from the resulting object.\n  - `allow_subdomains` (`bool`): Flag to allow certificates matching subdomains. When `null`, the `allow_subdomains` field will be omitted from the resulting object.\n  - `allow_wildcard_certificates` (`bool`): Flag to allow wildcard certificates When `null`, the `allow_wildcard_certificates` field will be omitted from the resulting object.\n  - `allowed_domains` (`list`): The domains of the role. When `null`, the `allowed_domains` field will be omitted from the resulting object.\n  - `allowed_domains_template` (`bool`): Flag to indicate that `allowed_domains` specifies a template expression (e.g. {{identity.entity.aliases.<mount accessor>.name}}) When `null`, the `allowed_domains_template` field will be omitted from the resulting object.\n  - `allowed_other_sans` (`list`): Defines allowed custom SANs When `null`, the `allowed_other_sans` field will be omitted from the resulting object.\n  - `allowed_serial_numbers` (`list`): Defines allowed Subject serial numbers. When `null`, the `allowed_serial_numbers` field will be omitted from the resulting object.\n  - `allowed_uri_sans` (`list`): Defines allowed URI SANs When `null`, the `allowed_uri_sans` field will be omitted from the resulting object.\n  - `allowed_uri_sans_template` (`bool`): Flag to indicate that `allowed_uri_sans` specifies a template expression (e.g. {{identity.entity.aliases.<mount accessor>.name}}) When `null`, the `allowed_uri_sans_template` field will be omitted from the resulting object.\n  - `backend` (`string`): The path of the PKI secret backend the resource belongs to.\n  - `basic_constraints_valid_for_non_ca` (`bool`): Flag to mark basic constraints valid when issuing non-CA certificates. When `null`, the `basic_constraints_valid_for_non_ca` field will be omitted from the resulting object.\n  - `client_flag` (`bool`): Flag to specify certificates for client use. When `null`, the `client_flag` field will be omitted from the resulting object.\n  - `code_signing_flag` (`bool`): Flag to specify certificates for code signing use. When `null`, the `code_signing_flag` field will be omitted from the resulting object.\n  - `country` (`list`): The country of generated certificates. When `null`, the `country` field will be omitted from the resulting object.\n  - `email_protection_flag` (`bool`): Flag to specify certificates for email protection use. When `null`, the `email_protection_flag` field will be omitted from the resulting object.\n  - `enforce_hostnames` (`bool`): Flag to allow only valid host names When `null`, the `enforce_hostnames` field will be omitted from the resulting object.\n  - `ext_key_usage` (`list`): Specify the allowed extended key usage constraint on issued certificates. When `null`, the `ext_key_usage` field will be omitted from the resulting object.\n  - `generate_lease` (`bool`): Flag to generate leases with certificates. When `null`, the `generate_lease` field will be omitted from the resulting object.\n  - `issuer_ref` (`string`): Specifies the default issuer of this request. When `null`, the `issuer_ref` field will be omitted from the resulting object.\n  - `key_bits` (`number`): The number of bits of generated keys. When `null`, the `key_bits` field will be omitted from the resulting object.\n  - `key_type` (`string`): The generated key type. When `null`, the `key_type` field will be omitted from the resulting object.\n  - `key_usage` (`list`): Specify the allowed key usage constraint on issued certificates. When `null`, the `key_usage` field will be omitted from the resulting object.\n  - `locality` (`list`): The locality of generated certificates. When `null`, the `locality` field will be omitted from the resulting object.\n  - `max_ttl` (`string`): The maximum TTL. When `null`, the `max_ttl` field will be omitted from the resulting object.\n  - `name` (`string`): Unique name for the role.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `no_store` (`bool`): Flag to not store certificates in the storage backend. When `null`, the `no_store` field will be omitted from the resulting object.\n  - `not_before_duration` (`string`): Specifies the duration by which to backdate the NotBefore property. When `null`, the `not_before_duration` field will be omitted from the resulting object.\n  - `organization` (`list`): The organization of generated certificates. When `null`, the `organization` field will be omitted from the resulting object.\n  - `ou` (`list`): The organization unit of generated certificates. When `null`, the `ou` field will be omitted from the resulting object.\n  - `policy_identifiers` (`list`): Specify the list of allowed policies OIDs. When `null`, the `policy_identifiers` field will be omitted from the resulting object.\n  - `postal_code` (`list`): The postal code of generated certificates. When `null`, the `postal_code` field will be omitted from the resulting object.\n  - `province` (`list`): The province of generated certificates. When `null`, the `province` field will be omitted from the resulting object.\n  - `require_cn` (`bool`): Flag to force CN usage. When `null`, the `require_cn` field will be omitted from the resulting object.\n  - `server_flag` (`bool`): Flag to specify certificates for server use. When `null`, the `server_flag` field will be omitted from the resulting object.\n  - `street_address` (`list`): The street address of generated certificates. When `null`, the `street_address` field will be omitted from the resulting object.\n  - `ttl` (`string`): The TTL. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `use_csr_common_name` (`bool`): Flag to use the CN in the CSR. When `null`, the `use_csr_common_name` field will be omitted from the resulting object.\n  - `use_csr_sans` (`bool`): Flag to use the SANs in the CSR. When `null`, the `use_csr_sans` field will be omitted from the resulting object.\n  - `policy_identifier` (`list[obj]`): Policy identifier block; can only be used with Vault 1.11+ When `null`, the `policy_identifier` sub block will be omitted from the resulting object. When setting the sub block, it is recommended to construct the object using the [vault.pki_secret_backend_role.policy_identifier.new](#fn-policy_identifiernew) constructor.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pki_secret_backend_role` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     backend,
     name,
@@ -105,11 +111,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     allow_ip_sans=null,
     allow_localhost=null,
     allow_subdomains=null,
+    allow_wildcard_certificates=null,
     allowed_domains=null,
     allowed_domains_template=null,
     allowed_other_sans=null,
     allowed_serial_numbers=null,
     allowed_uri_sans=null,
+    allowed_uri_sans_template=null,
     basic_constraints_valid_for_non_ca=null,
     client_flag=null,
     code_signing_flag=null,
@@ -118,6 +126,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     enforce_hostnames=null,
     ext_key_usage=null,
     generate_lease=null,
+    issuer_ref=null,
     key_bits=null,
     key_type=null,
     key_usage=null,
@@ -145,11 +154,13 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     allow_ip_sans: allow_ip_sans,
     allow_localhost: allow_localhost,
     allow_subdomains: allow_subdomains,
+    allow_wildcard_certificates: allow_wildcard_certificates,
     allowed_domains: allowed_domains,
     allowed_domains_template: allowed_domains_template,
     allowed_other_sans: allowed_other_sans,
     allowed_serial_numbers: allowed_serial_numbers,
     allowed_uri_sans: allowed_uri_sans,
+    allowed_uri_sans_template: allowed_uri_sans_template,
     backend: backend,
     basic_constraints_valid_for_non_ca: basic_constraints_valid_for_non_ca,
     client_flag: client_flag,
@@ -159,6 +170,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     enforce_hostnames: enforce_hostnames,
     ext_key_usage: ext_key_usage,
     generate_lease: generate_lease,
+    issuer_ref: issuer_ref,
     key_bits: key_bits,
     key_type: key_type,
     key_usage: key_usage,
@@ -253,6 +265,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withAllowWildcardCertificates':: d.fn(help='`vault.bool.withAllowWildcardCertificates` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the allow_wildcard_certificates field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `allow_wildcard_certificates` field.\n', args=[]),
+  withAllowWildcardCertificates(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_role+: {
+        [resourceLabel]+: {
+          allow_wildcard_certificates: value,
+        },
+      },
+    },
+  },
   '#withAllowedDomains':: d.fn(help='`vault.list.withAllowedDomains` constructs a mixin object that can be merged into the `list`\nTerraform resource block to set or update the allowed_domains field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`list`): The value to set for the `allowed_domains` field.\n', args=[]),
   withAllowedDomains(resourceLabel, value): {
     resource+: {
@@ -303,6 +325,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withAllowedUriSansTemplate':: d.fn(help='`vault.bool.withAllowedUriSansTemplate` constructs a mixin object that can be merged into the `bool`\nTerraform resource block to set or update the allowed_uri_sans_template field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`bool`): The value to set for the `allowed_uri_sans_template` field.\n', args=[]),
+  withAllowedUriSansTemplate(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_role+: {
+        [resourceLabel]+: {
+          allowed_uri_sans_template: value,
+        },
+      },
+    },
+  },
   '#withBackend':: d.fn(help='`vault.string.withBackend` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the backend field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `backend` field.\n', args=[]),
   withBackend(resourceLabel, value): {
     resource+: {
@@ -393,6 +425,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withIssuerRef':: d.fn(help='`vault.string.withIssuerRef` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the issuer_ref field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `issuer_ref` field.\n', args=[]),
+  withIssuerRef(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_role+: {
+        [resourceLabel]+: {
+          issuer_ref: value,
+        },
+      },
+    },
+  },
   '#withKeyBits':: d.fn(help='`vault.number.withKeyBits` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the key_bits field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `key_bits` field.\n', args=[]),
   withKeyBits(resourceLabel, value): {
     resource+: {
diff --git a/3.x/_gen/resources/pki_secret_backend_root_cert.libsonnet b/3.x/_gen/resources/pki_secret_backend_root_cert.libsonnet
index a9ad82d..50ee8e5 100644
--- a/3.x/_gen/resources/pki_secret_backend_root_cert.libsonnet
+++ b/3.x/_gen/resources/pki_secret_backend_root_cert.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='pki_secret_backend_root_cert', url='', help='`pki_secret_backend_root_cert` represents the `vault_pki_secret_backend_root_cert` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`vault.pki_secret_backend_root_cert.new` injects a new `vault_pki_secret_backend_root_cert` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.pki_secret_backend_root_cert.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.pki_secret_backend_root_cert` using the reference:\n\n    $._ref.vault_pki_secret_backend_root_cert.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_pki_secret_backend_root_cert.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `alt_names` (`list`): List of alternative names. When `null`, the `alt_names` field will be omitted from the resulting object.\n  - `backend` (`string`): The PKI secret backend the resource belongs to.\n  - `common_name` (`string`): CN of root to create.\n  - `country` (`string`): The country. When `null`, the `country` field will be omitted from the resulting object.\n  - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.\n  - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.\n  - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.\n  - `key_bits` (`number`): The number of bits to use. When `null`, the `key_bits` field will be omitted from the resulting object.\n  - `key_type` (`string`): The desired key type. When `null`, the `key_type` field will be omitted from the resulting object.\n  - `locality` (`string`): The locality. When `null`, the `locality` field will be omitted from the resulting object.\n  - `managed_key_id` (`string`): The ID of the previously configured managed key. When `null`, the `managed_key_id` field will be omitted from the resulting object.\n  - `managed_key_name` (`string`): The name of the previously configured managed key. When `null`, the `managed_key_name` field will be omitted from the resulting object.\n  - `max_path_length` (`number`): The maximum path length to encode in the generated certificate. When `null`, the `max_path_length` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `organization` (`string`): The organization. When `null`, the `organization` field will be omitted from the resulting object.\n  - `other_sans` (`list`): List of other SANs. When `null`, the `other_sans` field will be omitted from the resulting object.\n  - `ou` (`string`): The organization unit. When `null`, the `ou` field will be omitted from the resulting object.\n  - `permitted_dns_domains` (`list`): List of domains for which certificates are allowed to be issued. When `null`, the `permitted_dns_domains` field will be omitted from the resulting object.\n  - `postal_code` (`string`): The postal code. When `null`, the `postal_code` field will be omitted from the resulting object.\n  - `private_key_format` (`string`): The private key format. When `null`, the `private_key_format` field will be omitted from the resulting object.\n  - `province` (`string`): The province. When `null`, the `province` field will be omitted from the resulting object.\n  - `street_address` (`string`): The street address. When `null`, the `street_address` field will be omitted from the resulting object.\n  - `ttl` (`string`): Time to live. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `type` (`string`): Type of root to create. Must be either \u0026#34;exported\u0026#34; or \u0026#34;internal\u0026#34;.\n  - `uri_sans` (`list`): List of alternative URIs. When `null`, the `uri_sans` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`vault.pki_secret_backend_root_cert.new` injects a new `vault_pki_secret_backend_root_cert` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.pki_secret_backend_root_cert.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.pki_secret_backend_root_cert` using the reference:\n\n    $._ref.vault_pki_secret_backend_root_cert.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_pki_secret_backend_root_cert.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `alt_names` (`list`): List of alternative names. When `null`, the `alt_names` field will be omitted from the resulting object.\n  - `backend` (`string`): The PKI secret backend the resource belongs to.\n  - `common_name` (`string`): CN of root to create.\n  - `country` (`string`): The country. When `null`, the `country` field will be omitted from the resulting object.\n  - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.\n  - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.\n  - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.\n  - `issuer_name` (`string`): Provides a name to the specified issuer. The name must be unique across all issuers and not be the reserved value \u0026#39;default\u0026#39;. When `null`, the `issuer_name` field will be omitted from the resulting object.\n  - `key_bits` (`number`): The number of bits to use. When `null`, the `key_bits` field will be omitted from the resulting object.\n  - `key_name` (`string`): When a new key is created with this request, optionally specifies the name for this. When `null`, the `key_name` field will be omitted from the resulting object.\n  - `key_ref` (`string`): Specifies the key to use for generating this request. When `null`, the `key_ref` field will be omitted from the resulting object.\n  - `key_type` (`string`): The desired key type. When `null`, the `key_type` field will be omitted from the resulting object.\n  - `locality` (`string`): The locality. When `null`, the `locality` field will be omitted from the resulting object.\n  - `managed_key_id` (`string`): The ID of the previously configured managed key. When `null`, the `managed_key_id` field will be omitted from the resulting object.\n  - `managed_key_name` (`string`): The name of the previously configured managed key. When `null`, the `managed_key_name` field will be omitted from the resulting object.\n  - `max_path_length` (`number`): The maximum path length to encode in the generated certificate. When `null`, the `max_path_length` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `organization` (`string`): The organization. When `null`, the `organization` field will be omitted from the resulting object.\n  - `other_sans` (`list`): List of other SANs. When `null`, the `other_sans` field will be omitted from the resulting object.\n  - `ou` (`string`): The organization unit. When `null`, the `ou` field will be omitted from the resulting object.\n  - `permitted_dns_domains` (`list`): List of domains for which certificates are allowed to be issued. When `null`, the `permitted_dns_domains` field will be omitted from the resulting object.\n  - `postal_code` (`string`): The postal code. When `null`, the `postal_code` field will be omitted from the resulting object.\n  - `private_key_format` (`string`): The private key format. When `null`, the `private_key_format` field will be omitted from the resulting object.\n  - `province` (`string`): The province. When `null`, the `province` field will be omitted from the resulting object.\n  - `street_address` (`string`): The street address. When `null`, the `street_address` field will be omitted from the resulting object.\n  - `ttl` (`string`): Time to live. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `type` (`string`): Type of root to create. Must be either \u0026#34;existing\u0026#34;, \u0026#34;exported\u0026#34;, \u0026#34;internal\u0026#34; or \u0026#34;kms\u0026#34;\n  - `uri_sans` (`list`): List of alternative URIs. When `null`, the `uri_sans` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     backend,
@@ -13,7 +13,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     exclude_cn_from_sans=null,
     format=null,
     ip_sans=null,
+    issuer_name=null,
     key_bits=null,
+    key_name=null,
+    key_ref=null,
     key_type=null,
     locality=null,
     managed_key_id=null,
@@ -42,7 +45,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       exclude_cn_from_sans=exclude_cn_from_sans,
       format=format,
       ip_sans=ip_sans,
+      issuer_name=issuer_name,
       key_bits=key_bits,
+      key_name=key_name,
+      key_ref=key_ref,
       key_type=key_type,
       locality=locality,
       managed_key_id=managed_key_id,
@@ -63,7 +69,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`vault.pki_secret_backend_root_cert.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_root_cert`\nTerraform resource.\n\nUnlike [vault.pki_secret_backend_root_cert.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `alt_names` (`list`): List of alternative names. When `null`, the `alt_names` field will be omitted from the resulting object.\n  - `backend` (`string`): The PKI secret backend the resource belongs to.\n  - `common_name` (`string`): CN of root to create.\n  - `country` (`string`): The country. When `null`, the `country` field will be omitted from the resulting object.\n  - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.\n  - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.\n  - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.\n  - `key_bits` (`number`): The number of bits to use. When `null`, the `key_bits` field will be omitted from the resulting object.\n  - `key_type` (`string`): The desired key type. When `null`, the `key_type` field will be omitted from the resulting object.\n  - `locality` (`string`): The locality. When `null`, the `locality` field will be omitted from the resulting object.\n  - `managed_key_id` (`string`): The ID of the previously configured managed key. When `null`, the `managed_key_id` field will be omitted from the resulting object.\n  - `managed_key_name` (`string`): The name of the previously configured managed key. When `null`, the `managed_key_name` field will be omitted from the resulting object.\n  - `max_path_length` (`number`): The maximum path length to encode in the generated certificate. When `null`, the `max_path_length` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `organization` (`string`): The organization. When `null`, the `organization` field will be omitted from the resulting object.\n  - `other_sans` (`list`): List of other SANs. When `null`, the `other_sans` field will be omitted from the resulting object.\n  - `ou` (`string`): The organization unit. When `null`, the `ou` field will be omitted from the resulting object.\n  - `permitted_dns_domains` (`list`): List of domains for which certificates are allowed to be issued. When `null`, the `permitted_dns_domains` field will be omitted from the resulting object.\n  - `postal_code` (`string`): The postal code. When `null`, the `postal_code` field will be omitted from the resulting object.\n  - `private_key_format` (`string`): The private key format. When `null`, the `private_key_format` field will be omitted from the resulting object.\n  - `province` (`string`): The province. When `null`, the `province` field will be omitted from the resulting object.\n  - `street_address` (`string`): The street address. When `null`, the `street_address` field will be omitted from the resulting object.\n  - `ttl` (`string`): Time to live. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `type` (`string`): Type of root to create. Must be either "exported" or "internal".\n  - `uri_sans` (`list`): List of alternative URIs. When `null`, the `uri_sans` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pki_secret_backend_root_cert` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`vault.pki_secret_backend_root_cert.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_root_cert`\nTerraform resource.\n\nUnlike [vault.pki_secret_backend_root_cert.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `alt_names` (`list`): List of alternative names. When `null`, the `alt_names` field will be omitted from the resulting object.\n  - `backend` (`string`): The PKI secret backend the resource belongs to.\n  - `common_name` (`string`): CN of root to create.\n  - `country` (`string`): The country. When `null`, the `country` field will be omitted from the resulting object.\n  - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.\n  - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.\n  - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.\n  - `issuer_name` (`string`): Provides a name to the specified issuer. The name must be unique across all issuers and not be the reserved value 'default'. When `null`, the `issuer_name` field will be omitted from the resulting object.\n  - `key_bits` (`number`): The number of bits to use. When `null`, the `key_bits` field will be omitted from the resulting object.\n  - `key_name` (`string`): When a new key is created with this request, optionally specifies the name for this. When `null`, the `key_name` field will be omitted from the resulting object.\n  - `key_ref` (`string`): Specifies the key to use for generating this request. When `null`, the `key_ref` field will be omitted from the resulting object.\n  - `key_type` (`string`): The desired key type. When `null`, the `key_type` field will be omitted from the resulting object.\n  - `locality` (`string`): The locality. When `null`, the `locality` field will be omitted from the resulting object.\n  - `managed_key_id` (`string`): The ID of the previously configured managed key. When `null`, the `managed_key_id` field will be omitted from the resulting object.\n  - `managed_key_name` (`string`): The name of the previously configured managed key. When `null`, the `managed_key_name` field will be omitted from the resulting object.\n  - `max_path_length` (`number`): The maximum path length to encode in the generated certificate. When `null`, the `max_path_length` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `organization` (`string`): The organization. When `null`, the `organization` field will be omitted from the resulting object.\n  - `other_sans` (`list`): List of other SANs. When `null`, the `other_sans` field will be omitted from the resulting object.\n  - `ou` (`string`): The organization unit. When `null`, the `ou` field will be omitted from the resulting object.\n  - `permitted_dns_domains` (`list`): List of domains for which certificates are allowed to be issued. When `null`, the `permitted_dns_domains` field will be omitted from the resulting object.\n  - `postal_code` (`string`): The postal code. When `null`, the `postal_code` field will be omitted from the resulting object.\n  - `private_key_format` (`string`): The private key format. When `null`, the `private_key_format` field will be omitted from the resulting object.\n  - `province` (`string`): The province. When `null`, the `province` field will be omitted from the resulting object.\n  - `street_address` (`string`): The street address. When `null`, the `street_address` field will be omitted from the resulting object.\n  - `ttl` (`string`): Time to live. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `type` (`string`): Type of root to create. Must be either "existing", "exported", "internal" or "kms"\n  - `uri_sans` (`list`): List of alternative URIs. When `null`, the `uri_sans` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pki_secret_backend_root_cert` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     backend,
     common_name,
@@ -73,7 +79,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     exclude_cn_from_sans=null,
     format=null,
     ip_sans=null,
+    issuer_name=null,
     key_bits=null,
+    key_name=null,
+    key_ref=null,
     key_type=null,
     locality=null,
     managed_key_id=null,
@@ -98,7 +107,10 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     exclude_cn_from_sans: exclude_cn_from_sans,
     format: format,
     ip_sans: ip_sans,
+    issuer_name: issuer_name,
     key_bits: key_bits,
+    key_name: key_name,
+    key_ref: key_ref,
     key_type: key_type,
     locality: locality,
     managed_key_id: managed_key_id,
@@ -187,6 +199,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withIssuerName':: d.fn(help='`vault.string.withIssuerName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the issuer_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `issuer_name` field.\n', args=[]),
+  withIssuerName(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_root_cert+: {
+        [resourceLabel]+: {
+          issuer_name: value,
+        },
+      },
+    },
+  },
   '#withKeyBits':: d.fn(help='`vault.number.withKeyBits` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the key_bits field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `key_bits` field.\n', args=[]),
   withKeyBits(resourceLabel, value): {
     resource+: {
@@ -197,6 +219,26 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withKeyName':: d.fn(help='`vault.string.withKeyName` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the key_name field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `key_name` field.\n', args=[]),
+  withKeyName(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_root_cert+: {
+        [resourceLabel]+: {
+          key_name: value,
+        },
+      },
+    },
+  },
+  '#withKeyRef':: d.fn(help='`vault.string.withKeyRef` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the key_ref field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `key_ref` field.\n', args=[]),
+  withKeyRef(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_root_cert+: {
+        [resourceLabel]+: {
+          key_ref: value,
+        },
+      },
+    },
+  },
   '#withKeyType':: d.fn(help='`vault.string.withKeyType` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the key_type field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `key_type` field.\n', args=[]),
   withKeyType(resourceLabel, value): {
     resource+: {
diff --git a/3.x/_gen/resources/pki_secret_backend_root_sign_intermediate.libsonnet b/3.x/_gen/resources/pki_secret_backend_root_sign_intermediate.libsonnet
index ce3c78b..ddbfd44 100644
--- a/3.x/_gen/resources/pki_secret_backend_root_sign_intermediate.libsonnet
+++ b/3.x/_gen/resources/pki_secret_backend_root_sign_intermediate.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='pki_secret_backend_root_sign_intermediate', url='', help='`pki_secret_backend_root_sign_intermediate` represents the `vault_pki_secret_backend_root_sign_intermediate` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`vault.pki_secret_backend_root_sign_intermediate.new` injects a new `vault_pki_secret_backend_root_sign_intermediate` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.pki_secret_backend_root_sign_intermediate.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.pki_secret_backend_root_sign_intermediate` using the reference:\n\n    $._ref.vault_pki_secret_backend_root_sign_intermediate.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_pki_secret_backend_root_sign_intermediate.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `alt_names` (`list`): List of alternative names. When `null`, the `alt_names` field will be omitted from the resulting object.\n  - `backend` (`string`): The PKI secret backend the resource belongs to.\n  - `common_name` (`string`): CN of intermediate to create.\n  - `country` (`string`): The country. When `null`, the `country` field will be omitted from the resulting object.\n  - `csr` (`string`): The CSR.\n  - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.\n  - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.\n  - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.\n  - `locality` (`string`): The locality. When `null`, the `locality` field will be omitted from the resulting object.\n  - `max_path_length` (`number`): The maximum path length to encode in the generated certificate. When `null`, the `max_path_length` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `organization` (`string`): The organization. When `null`, the `organization` field will be omitted from the resulting object.\n  - `other_sans` (`list`): List of other SANs. When `null`, the `other_sans` field will be omitted from the resulting object.\n  - `ou` (`string`): The organization unit. When `null`, the `ou` field will be omitted from the resulting object.\n  - `permitted_dns_domains` (`list`): List of domains for which certificates are allowed to be issued. When `null`, the `permitted_dns_domains` field will be omitted from the resulting object.\n  - `postal_code` (`string`): The postal code. When `null`, the `postal_code` field will be omitted from the resulting object.\n  - `province` (`string`): The province. When `null`, the `province` field will be omitted from the resulting object.\n  - `revoke` (`bool`): Revoke the certificate upon resource destruction. When `null`, the `revoke` field will be omitted from the resulting object.\n  - `street_address` (`string`): The street address. When `null`, the `street_address` field will be omitted from the resulting object.\n  - `ttl` (`string`): Time to live. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `uri_sans` (`list`): List of alternative URIs. When `null`, the `uri_sans` field will be omitted from the resulting object.\n  - `use_csr_values` (`bool`): Preserve CSR values. When `null`, the `use_csr_values` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`vault.pki_secret_backend_root_sign_intermediate.new` injects a new `vault_pki_secret_backend_root_sign_intermediate` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.pki_secret_backend_root_sign_intermediate.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.pki_secret_backend_root_sign_intermediate` using the reference:\n\n    $._ref.vault_pki_secret_backend_root_sign_intermediate.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_pki_secret_backend_root_sign_intermediate.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `alt_names` (`list`): List of alternative names. When `null`, the `alt_names` field will be omitted from the resulting object.\n  - `backend` (`string`): The PKI secret backend the resource belongs to.\n  - `common_name` (`string`): CN of intermediate to create.\n  - `country` (`string`): The country. When `null`, the `country` field will be omitted from the resulting object.\n  - `csr` (`string`): The CSR.\n  - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.\n  - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.\n  - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.\n  - `issuer_ref` (`string`): Specifies the default issuer of this request. When `null`, the `issuer_ref` field will be omitted from the resulting object.\n  - `locality` (`string`): The locality. When `null`, the `locality` field will be omitted from the resulting object.\n  - `max_path_length` (`number`): The maximum path length to encode in the generated certificate. When `null`, the `max_path_length` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `organization` (`string`): The organization. When `null`, the `organization` field will be omitted from the resulting object.\n  - `other_sans` (`list`): List of other SANs. When `null`, the `other_sans` field will be omitted from the resulting object.\n  - `ou` (`string`): The organization unit. When `null`, the `ou` field will be omitted from the resulting object.\n  - `permitted_dns_domains` (`list`): List of domains for which certificates are allowed to be issued. When `null`, the `permitted_dns_domains` field will be omitted from the resulting object.\n  - `postal_code` (`string`): The postal code. When `null`, the `postal_code` field will be omitted from the resulting object.\n  - `province` (`string`): The province. When `null`, the `province` field will be omitted from the resulting object.\n  - `revoke` (`bool`): Revoke the certificate upon resource destruction. When `null`, the `revoke` field will be omitted from the resulting object.\n  - `street_address` (`string`): The street address. When `null`, the `street_address` field will be omitted from the resulting object.\n  - `ttl` (`string`): Time to live. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `uri_sans` (`list`): List of alternative URIs. When `null`, the `uri_sans` field will be omitted from the resulting object.\n  - `use_csr_values` (`bool`): Preserve CSR values. When `null`, the `use_csr_values` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     backend,
@@ -13,6 +13,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     exclude_cn_from_sans=null,
     format=null,
     ip_sans=null,
+    issuer_ref=null,
     locality=null,
     max_path_length=null,
     namespace=null,
@@ -40,6 +41,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       exclude_cn_from_sans=exclude_cn_from_sans,
       format=format,
       ip_sans=ip_sans,
+      issuer_ref=issuer_ref,
       locality=locality,
       max_path_length=max_path_length,
       namespace=namespace,
@@ -57,7 +59,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`vault.pki_secret_backend_root_sign_intermediate.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_root_sign_intermediate`\nTerraform resource.\n\nUnlike [vault.pki_secret_backend_root_sign_intermediate.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `alt_names` (`list`): List of alternative names. When `null`, the `alt_names` field will be omitted from the resulting object.\n  - `backend` (`string`): The PKI secret backend the resource belongs to.\n  - `common_name` (`string`): CN of intermediate to create.\n  - `country` (`string`): The country. When `null`, the `country` field will be omitted from the resulting object.\n  - `csr` (`string`): The CSR.\n  - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.\n  - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.\n  - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.\n  - `locality` (`string`): The locality. When `null`, the `locality` field will be omitted from the resulting object.\n  - `max_path_length` (`number`): The maximum path length to encode in the generated certificate. When `null`, the `max_path_length` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `organization` (`string`): The organization. When `null`, the `organization` field will be omitted from the resulting object.\n  - `other_sans` (`list`): List of other SANs. When `null`, the `other_sans` field will be omitted from the resulting object.\n  - `ou` (`string`): The organization unit. When `null`, the `ou` field will be omitted from the resulting object.\n  - `permitted_dns_domains` (`list`): List of domains for which certificates are allowed to be issued. When `null`, the `permitted_dns_domains` field will be omitted from the resulting object.\n  - `postal_code` (`string`): The postal code. When `null`, the `postal_code` field will be omitted from the resulting object.\n  - `province` (`string`): The province. When `null`, the `province` field will be omitted from the resulting object.\n  - `revoke` (`bool`): Revoke the certificate upon resource destruction. When `null`, the `revoke` field will be omitted from the resulting object.\n  - `street_address` (`string`): The street address. When `null`, the `street_address` field will be omitted from the resulting object.\n  - `ttl` (`string`): Time to live. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `uri_sans` (`list`): List of alternative URIs. When `null`, the `uri_sans` field will be omitted from the resulting object.\n  - `use_csr_values` (`bool`): Preserve CSR values. When `null`, the `use_csr_values` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pki_secret_backend_root_sign_intermediate` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`vault.pki_secret_backend_root_sign_intermediate.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_root_sign_intermediate`\nTerraform resource.\n\nUnlike [vault.pki_secret_backend_root_sign_intermediate.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `alt_names` (`list`): List of alternative names. When `null`, the `alt_names` field will be omitted from the resulting object.\n  - `backend` (`string`): The PKI secret backend the resource belongs to.\n  - `common_name` (`string`): CN of intermediate to create.\n  - `country` (`string`): The country. When `null`, the `country` field will be omitted from the resulting object.\n  - `csr` (`string`): The CSR.\n  - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.\n  - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.\n  - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.\n  - `issuer_ref` (`string`): Specifies the default issuer of this request. When `null`, the `issuer_ref` field will be omitted from the resulting object.\n  - `locality` (`string`): The locality. When `null`, the `locality` field will be omitted from the resulting object.\n  - `max_path_length` (`number`): The maximum path length to encode in the generated certificate. When `null`, the `max_path_length` field will be omitted from the resulting object.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `organization` (`string`): The organization. When `null`, the `organization` field will be omitted from the resulting object.\n  - `other_sans` (`list`): List of other SANs. When `null`, the `other_sans` field will be omitted from the resulting object.\n  - `ou` (`string`): The organization unit. When `null`, the `ou` field will be omitted from the resulting object.\n  - `permitted_dns_domains` (`list`): List of domains for which certificates are allowed to be issued. When `null`, the `permitted_dns_domains` field will be omitted from the resulting object.\n  - `postal_code` (`string`): The postal code. When `null`, the `postal_code` field will be omitted from the resulting object.\n  - `province` (`string`): The province. When `null`, the `province` field will be omitted from the resulting object.\n  - `revoke` (`bool`): Revoke the certificate upon resource destruction. When `null`, the `revoke` field will be omitted from the resulting object.\n  - `street_address` (`string`): The street address. When `null`, the `street_address` field will be omitted from the resulting object.\n  - `ttl` (`string`): Time to live. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `uri_sans` (`list`): List of alternative URIs. When `null`, the `uri_sans` field will be omitted from the resulting object.\n  - `use_csr_values` (`bool`): Preserve CSR values. When `null`, the `use_csr_values` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pki_secret_backend_root_sign_intermediate` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     backend,
     common_name,
@@ -67,6 +69,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     exclude_cn_from_sans=null,
     format=null,
     ip_sans=null,
+    issuer_ref=null,
     locality=null,
     max_path_length=null,
     namespace=null,
@@ -90,6 +93,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     exclude_cn_from_sans: exclude_cn_from_sans,
     format: format,
     ip_sans: ip_sans,
+    issuer_ref: issuer_ref,
     locality: locality,
     max_path_length: max_path_length,
     namespace: namespace,
@@ -185,6 +189,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withIssuerRef':: d.fn(help='`vault.string.withIssuerRef` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the issuer_ref field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `issuer_ref` field.\n', args=[]),
+  withIssuerRef(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_root_sign_intermediate+: {
+        [resourceLabel]+: {
+          issuer_ref: value,
+        },
+      },
+    },
+  },
   '#withLocality':: d.fn(help='`vault.string.withLocality` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the locality field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `locality` field.\n', args=[]),
   withLocality(resourceLabel, value): {
     resource+: {
diff --git a/3.x/_gen/resources/pki_secret_backend_sign.libsonnet b/3.x/_gen/resources/pki_secret_backend_sign.libsonnet
index ff84413..d28f557 100644
--- a/3.x/_gen/resources/pki_secret_backend_sign.libsonnet
+++ b/3.x/_gen/resources/pki_secret_backend_sign.libsonnet
@@ -2,7 +2,7 @@ local tf = (import 'github.com/tf-libsonnet/core/main.libsonnet');
 local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
 {
   '#':: d.pkg(name='pki_secret_backend_sign', url='', help='`pki_secret_backend_sign` represents the `vault_pki_secret_backend_sign` Terraform resource.\n\n\n\nThis package contains functions and utilities for setting up the resource using Jsonnet code.\n'),
-  '#new':: d.fn(help="\n`vault.pki_secret_backend_sign.new` injects a new `vault_pki_secret_backend_sign` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.pki_secret_backend_sign.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.pki_secret_backend_sign` using the reference:\n\n    $._ref.vault_pki_secret_backend_sign.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_pki_secret_backend_sign.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `alt_names` (`list`): List of alternative names. When `null`, the `alt_names` field will be omitted from the resulting object.\n  - `auto_renew` (`bool`): If enabled, a new certificate will be generated if the expiration is within min_seconds_remaining When `null`, the `auto_renew` field will be omitted from the resulting object.\n  - `backend` (`string`): The PKI secret backend the resource belongs to.\n  - `common_name` (`string`): CN of intermediate to create.\n  - `csr` (`string`): The CSR.\n  - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.\n  - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.\n  - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.\n  - `min_seconds_remaining` (`number`): Generate a new certificate when the expiration is within this number of seconds When `null`, the `min_seconds_remaining` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the role to create the certificate against.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `other_sans` (`list`): List of other SANs. When `null`, the `other_sans` field will be omitted from the resulting object.\n  - `ttl` (`string`): Time to live. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `uri_sans` (`list`): List of alternative URIs. When `null`, the `uri_sans` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
+  '#new':: d.fn(help="\n`vault.pki_secret_backend_sign.new` injects a new `vault_pki_secret_backend_sign` Terraform `resource`\nblock into the root module document.\n\nAdditionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the\nresource. For example, if you added a new instance to the root using:\n\n    # arguments omitted for brevity\n    vault.pki_secret_backend_sign.new('some_id')\n\nYou can get the reference to the `id` field of the created `vault.pki_secret_backend_sign` using the reference:\n\n    $._ref.vault_pki_secret_backend_sign.some_id.get('id')\n\nThis is the same as directly entering `\"${ vault_pki_secret_backend_sign.some_id.id }\"` as the value.\n\nNOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,\nor `$` to refer to the root object. Instead, make an explicit outer object using `local`.\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block.\n  - `alt_names` (`list`): List of alternative names. When `null`, the `alt_names` field will be omitted from the resulting object.\n  - `auto_renew` (`bool`): If enabled, a new certificate will be generated if the expiration is within min_seconds_remaining When `null`, the `auto_renew` field will be omitted from the resulting object.\n  - `backend` (`string`): The PKI secret backend the resource belongs to.\n  - `common_name` (`string`): CN of intermediate to create.\n  - `csr` (`string`): The CSR.\n  - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.\n  - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.\n  - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.\n  - `issuer_ref` (`string`): Specifies the default issuer of this request. When `null`, the `issuer_ref` field will be omitted from the resulting object.\n  - `min_seconds_remaining` (`number`): Generate a new certificate when the expiration is within this number of seconds When `null`, the `min_seconds_remaining` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the role to create the certificate against.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `other_sans` (`list`): List of other SANs. When `null`, the `other_sans` field will be omitted from the resulting object.\n  - `ttl` (`string`): Time to live. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `uri_sans` (`list`): List of alternative URIs. When `null`, the `uri_sans` field will be omitted from the resulting object.\n\n**Returns**:\n- A mixin object that injects the new resource into the root Terraform configuration.\n", args=[]),
   new(
     resourceLabel,
     backend,
@@ -14,6 +14,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     exclude_cn_from_sans=null,
     format=null,
     ip_sans=null,
+    issuer_ref=null,
     min_seconds_remaining=null,
     namespace=null,
     other_sans=null,
@@ -32,6 +33,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       exclude_cn_from_sans=exclude_cn_from_sans,
       format=format,
       ip_sans=ip_sans,
+      issuer_ref=issuer_ref,
       min_seconds_remaining=min_seconds_remaining,
       name=name,
       namespace=namespace,
@@ -41,7 +43,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     ),
     _meta=_meta
   ),
-  '#newAttrs':: d.fn(help='\n`vault.pki_secret_backend_sign.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_sign`\nTerraform resource.\n\nUnlike [vault.pki_secret_backend_sign.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `alt_names` (`list`): List of alternative names. When `null`, the `alt_names` field will be omitted from the resulting object.\n  - `auto_renew` (`bool`): If enabled, a new certificate will be generated if the expiration is within min_seconds_remaining When `null`, the `auto_renew` field will be omitted from the resulting object.\n  - `backend` (`string`): The PKI secret backend the resource belongs to.\n  - `common_name` (`string`): CN of intermediate to create.\n  - `csr` (`string`): The CSR.\n  - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.\n  - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.\n  - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.\n  - `min_seconds_remaining` (`number`): Generate a new certificate when the expiration is within this number of seconds When `null`, the `min_seconds_remaining` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the role to create the certificate against.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `other_sans` (`list`): List of other SANs. When `null`, the `other_sans` field will be omitted from the resulting object.\n  - `ttl` (`string`): Time to live. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `uri_sans` (`list`): List of alternative URIs. When `null`, the `uri_sans` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pki_secret_backend_sign` resource into the root Terraform configuration.\n', args=[]),
+  '#newAttrs':: d.fn(help='\n`vault.pki_secret_backend_sign.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_sign`\nTerraform resource.\n\nUnlike [vault.pki_secret_backend_sign.new](#fn-new), this function will not inject the `resource`\nblock into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the\n[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.\n\nThis is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to\ninjecting into a complete block.\n\n**Args**:\n  - `alt_names` (`list`): List of alternative names. When `null`, the `alt_names` field will be omitted from the resulting object.\n  - `auto_renew` (`bool`): If enabled, a new certificate will be generated if the expiration is within min_seconds_remaining When `null`, the `auto_renew` field will be omitted from the resulting object.\n  - `backend` (`string`): The PKI secret backend the resource belongs to.\n  - `common_name` (`string`): CN of intermediate to create.\n  - `csr` (`string`): The CSR.\n  - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.\n  - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.\n  - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.\n  - `issuer_ref` (`string`): Specifies the default issuer of this request. When `null`, the `issuer_ref` field will be omitted from the resulting object.\n  - `min_seconds_remaining` (`number`): Generate a new certificate when the expiration is within this number of seconds When `null`, the `min_seconds_remaining` field will be omitted from the resulting object.\n  - `name` (`string`): Name of the role to create the certificate against.\n  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.\n  - `other_sans` (`list`): List of other SANs. When `null`, the `other_sans` field will be omitted from the resulting object.\n  - `ttl` (`string`): Time to live. When `null`, the `ttl` field will be omitted from the resulting object.\n  - `uri_sans` (`list`): List of alternative URIs. When `null`, the `uri_sans` field will be omitted from the resulting object.\n\n**Returns**:\n  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pki_secret_backend_sign` resource into the root Terraform configuration.\n', args=[]),
   newAttrs(
     backend,
     common_name,
@@ -52,6 +54,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     exclude_cn_from_sans=null,
     format=null,
     ip_sans=null,
+    issuer_ref=null,
     min_seconds_remaining=null,
     namespace=null,
     other_sans=null,
@@ -66,6 +69,7 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
     exclude_cn_from_sans: exclude_cn_from_sans,
     format: format,
     ip_sans: ip_sans,
+    issuer_ref: issuer_ref,
     min_seconds_remaining: min_seconds_remaining,
     name: name,
     namespace: namespace,
@@ -153,6 +157,16 @@ local d = (import 'github.com/jsonnet-libs/docsonnet/doc-util/main.libsonnet');
       },
     },
   },
+  '#withIssuerRef':: d.fn(help='`vault.string.withIssuerRef` constructs a mixin object that can be merged into the `string`\nTerraform resource block to set or update the issuer_ref field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`string`): The value to set for the `issuer_ref` field.\n', args=[]),
+  withIssuerRef(resourceLabel, value): {
+    resource+: {
+      vault_pki_secret_backend_sign+: {
+        [resourceLabel]+: {
+          issuer_ref: value,
+        },
+      },
+    },
+  },
   '#withMinSecondsRemaining':: d.fn(help='`vault.number.withMinSecondsRemaining` constructs a mixin object that can be merged into the `number`\nTerraform resource block to set or update the min_seconds_remaining field.\n\n\n\n**Args**:\n  - `resourceLabel` (`string`): The name label of the block to update.\n  - `value` (`number`): The value to set for the `min_seconds_remaining` field.\n', args=[]),
   withMinSecondsRemaining(resourceLabel, value): {
     resource+: {
diff --git a/docs/3.x/README.md b/docs/3.x/README.md
index 7675fb4..0e89d4d 100644
--- a/docs/3.x/README.md
+++ b/docs/3.x/README.md
@@ -32,6 +32,7 @@ project.
 * [aws_auth_backend_sts_role](aws_auth_backend_sts_role.md)
 * [aws_secret_backend](aws_secret_backend.md)
 * [aws_secret_backend_role](aws_secret_backend_role.md)
+* [aws_secret_backend_static_role](aws_secret_backend_static_role.md)
 * [azure_auth_backend_config](azure_auth_backend_config.md)
 * [azure_auth_backend_role](azure_auth_backend_role.md)
 * [azure_secret_backend](azure_secret_backend.md)
@@ -117,6 +118,8 @@ project.
 * [pki_secret_backend_crl_config](pki_secret_backend_crl_config.md)
 * [pki_secret_backend_intermediate_cert_request](pki_secret_backend_intermediate_cert_request.md)
 * [pki_secret_backend_intermediate_set_signed](pki_secret_backend_intermediate_set_signed.md)
+* [pki_secret_backend_issuer](pki_secret_backend_issuer.md)
+* [pki_secret_backend_key](pki_secret_backend_key.md)
 * [pki_secret_backend_role](pki_secret_backend_role.md)
 * [pki_secret_backend_root_cert](pki_secret_backend_root_cert.md)
 * [pki_secret_backend_root_sign_intermediate](pki_secret_backend_root_sign_intermediate.md)
diff --git a/docs/3.x/aws_secret_backend_static_role.md b/docs/3.x/aws_secret_backend_static_role.md
new file mode 100644
index 0000000..75e714f
--- /dev/null
+++ b/docs/3.x/aws_secret_backend_static_role.md
@@ -0,0 +1,168 @@
+---
+permalink: /aws_secret_backend_static_role/
+---
+
+# aws_secret_backend_static_role
+
+`aws_secret_backend_static_role` represents the `vault_aws_secret_backend_static_role` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withBackend()`](#fn-withbackend)
+* [`fn withName()`](#fn-withname)
+* [`fn withNamespace()`](#fn-withnamespace)
+* [`fn withRotationPeriod()`](#fn-withrotationperiod)
+* [`fn withUsername()`](#fn-withusername)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`vault.aws_secret_backend_static_role.new` injects a new `vault_aws_secret_backend_static_role` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    vault.aws_secret_backend_static_role.new('some_id')
+
+You can get the reference to the `id` field of the created `vault.aws_secret_backend_static_role` using the reference:
+
+    $._ref.vault_aws_secret_backend_static_role.some_id.get('id')
+
+This is the same as directly entering `"${ vault_aws_secret_backend_static_role.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `backend` (`string`): The path where the AWS secrets backend is mounted. When `null`, the `backend` field will be omitted from the resulting object.
+  - `name` (`string`): Name of the role.
+  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
+  - `rotation_period` (`number`): How often Vault should rotate the password of the user entry.
+  - `username` (`string`): The username of the existing AWS IAM user to manage password rotation for.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`vault.aws_secret_backend_static_role.newAttrs` constructs a new object with attributes and blocks configured for the `aws_secret_backend_static_role`
+Terraform resource.
+
+Unlike [vault.aws_secret_backend_static_role.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `backend` (`string`): The path where the AWS secrets backend is mounted. When `null`, the `backend` field will be omitted from the resulting object.
+  - `name` (`string`): Name of the role.
+  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
+  - `rotation_period` (`number`): How often Vault should rotate the password of the user entry.
+  - `username` (`string`): The username of the existing AWS IAM user to manage password rotation for.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `aws_secret_backend_static_role` resource into the root Terraform configuration.
+
+
+### fn withBackend
+
+```ts
+withBackend()
+```
+
+`vault.string.withBackend` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the backend field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `backend` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`vault.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withNamespace
+
+```ts
+withNamespace()
+```
+
+`vault.string.withNamespace` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the namespace field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `namespace` field.
+
+
+### fn withRotationPeriod
+
+```ts
+withRotationPeriod()
+```
+
+`vault.number.withRotationPeriod` constructs a mixin object that can be merged into the `number`
+Terraform resource block to set or update the rotation_period field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`number`): The value to set for the `rotation_period` field.
+
+
+### fn withUsername
+
+```ts
+withUsername()
+```
+
+`vault.string.withUsername` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the username field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `username` field.
diff --git a/docs/3.x/data/aws_static_access_credentials.md b/docs/3.x/data/aws_static_access_credentials.md
new file mode 100644
index 0000000..dd90a59
--- /dev/null
+++ b/docs/3.x/data/aws_static_access_credentials.md
@@ -0,0 +1,130 @@
+---
+permalink: /data/aws_static_access_credentials/
+---
+
+# data.aws_static_access_credentials
+
+`aws_static_access_credentials` represents the `vault_aws_static_access_credentials` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withBackend()`](#fn-withbackend)
+* [`fn withName()`](#fn-withname)
+* [`fn withNamespace()`](#fn-withnamespace)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`vault.data.aws_static_access_credentials.new` injects a new `data_vault_aws_static_access_credentials` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    vault.data.aws_static_access_credentials.new('some_id')
+
+You can get the reference to the `id` field of the created `vault.data.aws_static_access_credentials` using the reference:
+
+    $._ref.data_vault_aws_static_access_credentials.some_id.get('id')
+
+This is the same as directly entering `"${ data_vault_aws_static_access_credentials.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `backend` (`string`): AWS Secret Backend to read credentials from.
+  - `name` (`string`): Name of the role.
+  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`vault.data.aws_static_access_credentials.newAttrs` constructs a new object with attributes and blocks configured for the `aws_static_access_credentials`
+Terraform data source.
+
+Unlike [vault.data.aws_static_access_credentials.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `backend` (`string`): AWS Secret Backend to read credentials from.
+  - `name` (`string`): Name of the role.
+  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `aws_static_access_credentials` data source into the root Terraform configuration.
+
+
+### fn withBackend
+
+```ts
+withBackend()
+```
+
+`vault.string.withBackend` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the backend field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `backend` field.
+
+
+### fn withName
+
+```ts
+withName()
+```
+
+`vault.string.withName` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the name field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `name` field.
+
+
+### fn withNamespace
+
+```ts
+withNamespace()
+```
+
+`vault.string.withNamespace` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the namespace field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `namespace` field.
diff --git a/docs/3.x/data/index.md b/docs/3.x/data/index.md
index 4228453..1e54ba1 100644
--- a/docs/3.x/data/index.md
+++ b/docs/3.x/data/index.md
@@ -11,6 +11,7 @@ permalink: /data/
 * [auth_backend](auth_backend.md)
 * [auth_backends](auth_backends.md)
 * [aws_access_credentials](aws_access_credentials.md)
+* [aws_static_access_credentials](aws_static_access_credentials.md)
 * [azure_access_credentials](azure_access_credentials.md)
 * [gcp_auth_backend_role](gcp_auth_backend_role.md)
 * [generic_secret](generic_secret.md)
@@ -30,6 +31,10 @@ permalink: /data/
 * [ldap_dynamic_credentials](ldap_dynamic_credentials.md)
 * [ldap_static_credentials](ldap_static_credentials.md)
 * [nomad_access_token](nomad_access_token.md)
+* [pki_secret_backend_issuer](pki_secret_backend_issuer.md)
+* [pki_secret_backend_issuers](pki_secret_backend_issuers.md)
+* [pki_secret_backend_key](pki_secret_backend_key.md)
+* [pki_secret_backend_keys](pki_secret_backend_keys.md)
 * [policy_document](policy_document.md)
 * [raft_autopilot_state](raft_autopilot_state.md)
 * [transform_decode](transform_decode.md)
diff --git a/docs/3.x/data/pki_secret_backend_issuer.md b/docs/3.x/data/pki_secret_backend_issuer.md
new file mode 100644
index 0000000..c07687d
--- /dev/null
+++ b/docs/3.x/data/pki_secret_backend_issuer.md
@@ -0,0 +1,130 @@
+---
+permalink: /data/pki_secret_backend_issuer/
+---
+
+# data.pki_secret_backend_issuer
+
+`pki_secret_backend_issuer` represents the `vault_pki_secret_backend_issuer` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withBackend()`](#fn-withbackend)
+* [`fn withIssuerRef()`](#fn-withissuerref)
+* [`fn withNamespace()`](#fn-withnamespace)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`vault.data.pki_secret_backend_issuer.new` injects a new `data_vault_pki_secret_backend_issuer` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    vault.data.pki_secret_backend_issuer.new('some_id')
+
+You can get the reference to the `id` field of the created `vault.data.pki_secret_backend_issuer` using the reference:
+
+    $._ref.data_vault_pki_secret_backend_issuer.some_id.get('id')
+
+This is the same as directly entering `"${ data_vault_pki_secret_backend_issuer.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `backend` (`string`): Full path where PKI backend is mounted.
+  - `issuer_ref` (`string`): Reference to an existing issuer.
+  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`vault.data.pki_secret_backend_issuer.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_issuer`
+Terraform data source.
+
+Unlike [vault.data.pki_secret_backend_issuer.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `backend` (`string`): Full path where PKI backend is mounted.
+  - `issuer_ref` (`string`): Reference to an existing issuer.
+  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `pki_secret_backend_issuer` data source into the root Terraform configuration.
+
+
+### fn withBackend
+
+```ts
+withBackend()
+```
+
+`vault.string.withBackend` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the backend field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `backend` field.
+
+
+### fn withIssuerRef
+
+```ts
+withIssuerRef()
+```
+
+`vault.string.withIssuerRef` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the issuer_ref field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `issuer_ref` field.
+
+
+### fn withNamespace
+
+```ts
+withNamespace()
+```
+
+`vault.string.withNamespace` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the namespace field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `namespace` field.
diff --git a/docs/3.x/data/pki_secret_backend_issuers.md b/docs/3.x/data/pki_secret_backend_issuers.md
new file mode 100644
index 0000000..f4b1c8e
--- /dev/null
+++ b/docs/3.x/data/pki_secret_backend_issuers.md
@@ -0,0 +1,111 @@
+---
+permalink: /data/pki_secret_backend_issuers/
+---
+
+# data.pki_secret_backend_issuers
+
+`pki_secret_backend_issuers` represents the `vault_pki_secret_backend_issuers` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withBackend()`](#fn-withbackend)
+* [`fn withNamespace()`](#fn-withnamespace)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`vault.data.pki_secret_backend_issuers.new` injects a new `data_vault_pki_secret_backend_issuers` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    vault.data.pki_secret_backend_issuers.new('some_id')
+
+You can get the reference to the `id` field of the created `vault.data.pki_secret_backend_issuers` using the reference:
+
+    $._ref.data_vault_pki_secret_backend_issuers.some_id.get('id')
+
+This is the same as directly entering `"${ data_vault_pki_secret_backend_issuers.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `backend` (`string`): Full path where PKI backend is mounted.
+  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`vault.data.pki_secret_backend_issuers.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_issuers`
+Terraform data source.
+
+Unlike [vault.data.pki_secret_backend_issuers.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `backend` (`string`): Full path where PKI backend is mounted.
+  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `pki_secret_backend_issuers` data source into the root Terraform configuration.
+
+
+### fn withBackend
+
+```ts
+withBackend()
+```
+
+`vault.string.withBackend` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the backend field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `backend` field.
+
+
+### fn withNamespace
+
+```ts
+withNamespace()
+```
+
+`vault.string.withNamespace` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the namespace field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `namespace` field.
diff --git a/docs/3.x/data/pki_secret_backend_key.md b/docs/3.x/data/pki_secret_backend_key.md
new file mode 100644
index 0000000..fe1502d
--- /dev/null
+++ b/docs/3.x/data/pki_secret_backend_key.md
@@ -0,0 +1,130 @@
+---
+permalink: /data/pki_secret_backend_key/
+---
+
+# data.pki_secret_backend_key
+
+`pki_secret_backend_key` represents the `vault_pki_secret_backend_key` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withBackend()`](#fn-withbackend)
+* [`fn withKeyRef()`](#fn-withkeyref)
+* [`fn withNamespace()`](#fn-withnamespace)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`vault.data.pki_secret_backend_key.new` injects a new `data_vault_pki_secret_backend_key` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    vault.data.pki_secret_backend_key.new('some_id')
+
+You can get the reference to the `id` field of the created `vault.data.pki_secret_backend_key` using the reference:
+
+    $._ref.data_vault_pki_secret_backend_key.some_id.get('id')
+
+This is the same as directly entering `"${ data_vault_pki_secret_backend_key.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `backend` (`string`): Full path where PKI backend is mounted.
+  - `key_ref` (`string`): Reference to an existing key.
+  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`vault.data.pki_secret_backend_key.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_key`
+Terraform data source.
+
+Unlike [vault.data.pki_secret_backend_key.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `backend` (`string`): Full path where PKI backend is mounted.
+  - `key_ref` (`string`): Reference to an existing key.
+  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `pki_secret_backend_key` data source into the root Terraform configuration.
+
+
+### fn withBackend
+
+```ts
+withBackend()
+```
+
+`vault.string.withBackend` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the backend field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `backend` field.
+
+
+### fn withKeyRef
+
+```ts
+withKeyRef()
+```
+
+`vault.string.withKeyRef` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the key_ref field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `key_ref` field.
+
+
+### fn withNamespace
+
+```ts
+withNamespace()
+```
+
+`vault.string.withNamespace` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the namespace field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `namespace` field.
diff --git a/docs/3.x/data/pki_secret_backend_keys.md b/docs/3.x/data/pki_secret_backend_keys.md
new file mode 100644
index 0000000..b7b3b42
--- /dev/null
+++ b/docs/3.x/data/pki_secret_backend_keys.md
@@ -0,0 +1,111 @@
+---
+permalink: /data/pki_secret_backend_keys/
+---
+
+# data.pki_secret_backend_keys
+
+`pki_secret_backend_keys` represents the `vault_pki_secret_backend_keys` Terraform data source.
+
+
+
+This package contains functions and utilities for setting up the data source using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withBackend()`](#fn-withbackend)
+* [`fn withNamespace()`](#fn-withnamespace)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`vault.data.pki_secret_backend_keys.new` injects a new `data_vault_pki_secret_backend_keys` Terraform `data source`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    vault.data.pki_secret_backend_keys.new('some_id')
+
+You can get the reference to the `id` field of the created `vault.data.pki_secret_backend_keys` using the reference:
+
+    $._ref.data_vault_pki_secret_backend_keys.some_id.get('id')
+
+This is the same as directly entering `"${ data_vault_pki_secret_backend_keys.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block.
+  - `backend` (`string`): Full path where PKI backend is mounted.
+  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new data source into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`vault.data.pki_secret_backend_keys.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_keys`
+Terraform data source.
+
+Unlike [vault.data.pki_secret_backend_keys.new](#fn-new), this function will not inject the `data source`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `backend` (`string`): Full path where PKI backend is mounted.
+  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withData](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withdata) to construct a new `pki_secret_backend_keys` data source into the root Terraform configuration.
+
+
+### fn withBackend
+
+```ts
+withBackend()
+```
+
+`vault.string.withBackend` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the backend field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `backend` field.
+
+
+### fn withNamespace
+
+```ts
+withNamespace()
+```
+
+`vault.string.withNamespace` constructs a mixin object that can be merged into the `string`
+Terraform data source block to set or update the namespace field.
+
+
+
+**Args**:
+  - `dataSrcLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `namespace` field.
diff --git a/docs/3.x/database_secret_backend_role.md b/docs/3.x/database_secret_backend_role.md
index bee326a..ce56258 100644
--- a/docs/3.x/database_secret_backend_role.md
+++ b/docs/3.x/database_secret_backend_role.md
@@ -17,6 +17,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn newAttrs()`](#fn-newattrs)
 * [`fn withBackend()`](#fn-withbackend)
 * [`fn withCreationStatements()`](#fn-withcreationstatements)
+* [`fn withCredentialConfig()`](#fn-withcredentialconfig)
+* [`fn withCredentialType()`](#fn-withcredentialtype)
 * [`fn withDbName()`](#fn-withdbname)
 * [`fn withDefaultTtl()`](#fn-withdefaultttl)
 * [`fn withMaxTtl()`](#fn-withmaxttl)
@@ -57,6 +59,8 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `resourceLabel` (`string`): The name label of the block.
   - `backend` (`string`): The path of the Database Secret Backend the role belongs to.
   - `creation_statements` (`list`): Database statements to execute to create and configure a user.
+  - `credential_config` (`obj`): Specifies the configuration for the given credential_type. When `null`, the `credential_config` field will be omitted from the resulting object.
+  - `credential_type` (`string`): Specifies the type of credential that will be generated for the role. When `null`, the `credential_type` field will be omitted from the resulting object.
   - `db_name` (`string`): Database connection to use for this role.
   - `default_ttl` (`number`): Default TTL for leases associated with this role, in seconds. When `null`, the `default_ttl` field will be omitted from the resulting object.
   - `max_ttl` (`number`): Maximum TTL for leases associated with this role, in seconds. When `null`, the `max_ttl` field will be omitted from the resulting object.
@@ -90,6 +94,8 @@ injecting into a complete block.
 **Args**:
   - `backend` (`string`): The path of the Database Secret Backend the role belongs to.
   - `creation_statements` (`list`): Database statements to execute to create and configure a user.
+  - `credential_config` (`obj`): Specifies the configuration for the given credential_type. When `null`, the `credential_config` field will be omitted from the resulting object.
+  - `credential_type` (`string`): Specifies the type of credential that will be generated for the role. When `null`, the `credential_type` field will be omitted from the resulting object.
   - `db_name` (`string`): Database connection to use for this role.
   - `default_ttl` (`number`): Default TTL for leases associated with this role, in seconds. When `null`, the `default_ttl` field will be omitted from the resulting object.
   - `max_ttl` (`number`): Maximum TTL for leases associated with this role, in seconds. When `null`, the `max_ttl` field will be omitted from the resulting object.
@@ -135,6 +141,38 @@ Terraform resource block to set or update the creation_statements field.
   - `value` (`list`): The value to set for the `creation_statements` field.
 
 
+### fn withCredentialConfig
+
+```ts
+withCredentialConfig()
+```
+
+`vault.obj.withCredentialConfig` constructs a mixin object that can be merged into the `obj`
+Terraform resource block to set or update the credential_config field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`obj`): The value to set for the `credential_config` field.
+
+
+### fn withCredentialType
+
+```ts
+withCredentialType()
+```
+
+`vault.string.withCredentialType` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the credential_type field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `credential_type` field.
+
+
 ### fn withDbName
 
 ```ts
diff --git a/docs/3.x/ldap_auth_backend.md b/docs/3.x/ldap_auth_backend.md
index 7f75dd5..1bec2d6 100644
--- a/docs/3.x/ldap_auth_backend.md
+++ b/docs/3.x/ldap_auth_backend.md
@@ -30,6 +30,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withGroupfilter()`](#fn-withgroupfilter)
 * [`fn withInsecureTls()`](#fn-withinsecuretls)
 * [`fn withLocal()`](#fn-withlocal)
+* [`fn withMaxPageSize()`](#fn-withmaxpagesize)
 * [`fn withNamespace()`](#fn-withnamespace)
 * [`fn withPath()`](#fn-withpath)
 * [`fn withStarttls()`](#fn-withstarttls)
@@ -96,6 +97,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `groupfilter` (`string`): Set the `groupfilter` field on the resulting resource block. When `null`, the `groupfilter` field will be omitted from the resulting object.
   - `insecure_tls` (`bool`): Set the `insecure_tls` field on the resulting resource block. When `null`, the `insecure_tls` field will be omitted from the resulting object.
   - `local_` (`bool`): Specifies if the auth method is local only When `null`, the `local_` field will be omitted from the resulting object.
+  - `max_page_size` (`number`): Set the `max_page_size` field on the resulting resource block. When `null`, the `max_page_size` field will be omitted from the resulting object.
   - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
   - `path` (`string`): Set the `path` field on the resulting resource block. When `null`, the `path` field will be omitted from the resulting object.
   - `starttls` (`bool`): Set the `starttls` field on the resulting resource block. When `null`, the `starttls` field will be omitted from the resulting object.
@@ -155,6 +157,7 @@ injecting into a complete block.
   - `groupfilter` (`string`): Set the `groupfilter` field on the resulting object. When `null`, the `groupfilter` field will be omitted from the resulting object.
   - `insecure_tls` (`bool`): Set the `insecure_tls` field on the resulting object. When `null`, the `insecure_tls` field will be omitted from the resulting object.
   - `local_` (`bool`): Specifies if the auth method is local only When `null`, the `local_` field will be omitted from the resulting object.
+  - `max_page_size` (`number`): Set the `max_page_size` field on the resulting object. When `null`, the `max_page_size` field will be omitted from the resulting object.
   - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
   - `path` (`string`): Set the `path` field on the resulting object. When `null`, the `path` field will be omitted from the resulting object.
   - `starttls` (`bool`): Set the `starttls` field on the resulting object. When `null`, the `starttls` field will be omitted from the resulting object.
@@ -421,6 +424,22 @@ Terraform resource block to set or update the local field.
   - `value` (`bool`): The value to set for the `local` field.
 
 
+### fn withMaxPageSize
+
+```ts
+withMaxPageSize()
+```
+
+`vault.number.withMaxPageSize` constructs a mixin object that can be merged into the `number`
+Terraform resource block to set or update the max_page_size field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`number`): The value to set for the `max_page_size` field.
+
+
 ### fn withNamespace
 
 ```ts
diff --git a/docs/3.x/pki_secret_backend_cert.md b/docs/3.x/pki_secret_backend_cert.md
index e08887b..2818539 100644
--- a/docs/3.x/pki_secret_backend_cert.md
+++ b/docs/3.x/pki_secret_backend_cert.md
@@ -22,6 +22,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withExcludeCnFromSans()`](#fn-withexcludecnfromsans)
 * [`fn withFormat()`](#fn-withformat)
 * [`fn withIpSans()`](#fn-withipsans)
+* [`fn withIssuerRef()`](#fn-withissuerref)
 * [`fn withMinSecondsRemaining()`](#fn-withminsecondsremaining)
 * [`fn withName()`](#fn-withname)
 * [`fn withNamespace()`](#fn-withnamespace)
@@ -67,6 +68,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.
   - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.
   - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.
+  - `issuer_ref` (`string`): Specifies the default issuer of this request. When `null`, the `issuer_ref` field will be omitted from the resulting object.
   - `min_seconds_remaining` (`number`): Generate a new certificate when the expiration is within this number of seconds When `null`, the `min_seconds_remaining` field will be omitted from the resulting object.
   - `name` (`string`): Name of the role to create the certificate against.
   - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
@@ -105,6 +107,7 @@ injecting into a complete block.
   - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.
   - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.
   - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.
+  - `issuer_ref` (`string`): Specifies the default issuer of this request. When `null`, the `issuer_ref` field will be omitted from the resulting object.
   - `min_seconds_remaining` (`number`): Generate a new certificate when the expiration is within this number of seconds When `null`, the `min_seconds_remaining` field will be omitted from the resulting object.
   - `name` (`string`): Name of the role to create the certificate against.
   - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
@@ -230,6 +233,22 @@ Terraform resource block to set or update the ip_sans field.
   - `value` (`list`): The value to set for the `ip_sans` field.
 
 
+### fn withIssuerRef
+
+```ts
+withIssuerRef()
+```
+
+`vault.string.withIssuerRef` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the issuer_ref field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `issuer_ref` field.
+
+
 ### fn withMinSecondsRemaining
 
 ```ts
diff --git a/docs/3.x/pki_secret_backend_intermediate_cert_request.md b/docs/3.x/pki_secret_backend_intermediate_cert_request.md
index 7fbdbf5..78c91b7 100644
--- a/docs/3.x/pki_secret_backend_intermediate_cert_request.md
+++ b/docs/3.x/pki_secret_backend_intermediate_cert_request.md
@@ -24,6 +24,8 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withFormat()`](#fn-withformat)
 * [`fn withIpSans()`](#fn-withipsans)
 * [`fn withKeyBits()`](#fn-withkeybits)
+* [`fn withKeyName()`](#fn-withkeyname)
+* [`fn withKeyRef()`](#fn-withkeyref)
 * [`fn withKeyType()`](#fn-withkeytype)
 * [`fn withLocality()`](#fn-withlocality)
 * [`fn withManagedKeyId()`](#fn-withmanagedkeyid)
@@ -78,6 +80,8 @@ a workaround in some compatibility scenarios with Active Directory Certificate S
   - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.
   - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.
   - `key_bits` (`number`): The number of bits to use. When `null`, the `key_bits` field will be omitted from the resulting object.
+  - `key_name` (`string`): When a new key is created with this request, optionally specifies the name for this. When `null`, the `key_name` field will be omitted from the resulting object.
+  - `key_ref` (`string`): Specifies the key to use for generating this request. When `null`, the `key_ref` field will be omitted from the resulting object.
   - `key_type` (`string`): The desired key type. When `null`, the `key_type` field will be omitted from the resulting object.
   - `locality` (`string`): The locality. When `null`, the `locality` field will be omitted from the resulting object.
   - `managed_key_id` (`string`): The ID of the previously configured managed key. When `null`, the `managed_key_id` field will be omitted from the resulting object.
@@ -90,7 +94,7 @@ a workaround in some compatibility scenarios with Active Directory Certificate S
   - `private_key_format` (`string`): The private key format. When `null`, the `private_key_format` field will be omitted from the resulting object.
   - `province` (`string`): The province. When `null`, the `province` field will be omitted from the resulting object.
   - `street_address` (`string`): The street address. When `null`, the `street_address` field will be omitted from the resulting object.
-  - `type` (`string`): Type of intermediate to create. Must be either "exported" or "internal".
+  - `type` (`string`): Type of intermediate to create. Must be either "existing", "exported", "internal" or "kms"
   - `uri_sans` (`list`): List of alternative URIs. When `null`, the `uri_sans` field will be omitted from the resulting object.
 
 **Returns**:
@@ -125,6 +129,8 @@ a workaround in some compatibility scenarios with Active Directory Certificate S
   - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.
   - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.
   - `key_bits` (`number`): The number of bits to use. When `null`, the `key_bits` field will be omitted from the resulting object.
+  - `key_name` (`string`): When a new key is created with this request, optionally specifies the name for this. When `null`, the `key_name` field will be omitted from the resulting object.
+  - `key_ref` (`string`): Specifies the key to use for generating this request. When `null`, the `key_ref` field will be omitted from the resulting object.
   - `key_type` (`string`): The desired key type. When `null`, the `key_type` field will be omitted from the resulting object.
   - `locality` (`string`): The locality. When `null`, the `locality` field will be omitted from the resulting object.
   - `managed_key_id` (`string`): The ID of the previously configured managed key. When `null`, the `managed_key_id` field will be omitted from the resulting object.
@@ -137,7 +143,7 @@ a workaround in some compatibility scenarios with Active Directory Certificate S
   - `private_key_format` (`string`): The private key format. When `null`, the `private_key_format` field will be omitted from the resulting object.
   - `province` (`string`): The province. When `null`, the `province` field will be omitted from the resulting object.
   - `street_address` (`string`): The street address. When `null`, the `street_address` field will be omitted from the resulting object.
-  - `type` (`string`): Type of intermediate to create. Must be either "exported" or "internal".
+  - `type` (`string`): Type of intermediate to create. Must be either "existing", "exported", "internal" or "kms"
   - `uri_sans` (`list`): List of alternative URIs. When `null`, the `uri_sans` field will be omitted from the resulting object.
 
 **Returns**:
@@ -288,6 +294,38 @@ Terraform resource block to set or update the key_bits field.
   - `value` (`number`): The value to set for the `key_bits` field.
 
 
+### fn withKeyName
+
+```ts
+withKeyName()
+```
+
+`vault.string.withKeyName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the key_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `key_name` field.
+
+
+### fn withKeyRef
+
+```ts
+withKeyRef()
+```
+
+`vault.string.withKeyRef` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the key_ref field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `key_ref` field.
+
+
 ### fn withKeyType
 
 ```ts
diff --git a/docs/3.x/pki_secret_backend_issuer.md b/docs/3.x/pki_secret_backend_issuer.md
new file mode 100644
index 0000000..c5fdd22
--- /dev/null
+++ b/docs/3.x/pki_secret_backend_issuer.md
@@ -0,0 +1,301 @@
+---
+permalink: /pki_secret_backend_issuer/
+---
+
+# pki_secret_backend_issuer
+
+`pki_secret_backend_issuer` represents the `vault_pki_secret_backend_issuer` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withBackend()`](#fn-withbackend)
+* [`fn withCrlDistributionPoints()`](#fn-withcrldistributionpoints)
+* [`fn withEnableAiaUrlTemplating()`](#fn-withenableaiaurltemplating)
+* [`fn withIssuerName()`](#fn-withissuername)
+* [`fn withIssuerRef()`](#fn-withissuerref)
+* [`fn withIssuingCertificates()`](#fn-withissuingcertificates)
+* [`fn withLeafNotAfterBehavior()`](#fn-withleafnotafterbehavior)
+* [`fn withManualChain()`](#fn-withmanualchain)
+* [`fn withNamespace()`](#fn-withnamespace)
+* [`fn withOcspServers()`](#fn-withocspservers)
+* [`fn withRevocationSignatureAlgorithm()`](#fn-withrevocationsignaturealgorithm)
+* [`fn withUsage()`](#fn-withusage)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`vault.pki_secret_backend_issuer.new` injects a new `vault_pki_secret_backend_issuer` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    vault.pki_secret_backend_issuer.new('some_id')
+
+You can get the reference to the `id` field of the created `vault.pki_secret_backend_issuer` using the reference:
+
+    $._ref.vault_pki_secret_backend_issuer.some_id.get('id')
+
+This is the same as directly entering `"${ vault_pki_secret_backend_issuer.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `backend` (`string`): Full path where PKI backend is mounted.
+  - `crl_distribution_points` (`list`): Specifies the URL values for the CRL Distribution Points field. When `null`, the `crl_distribution_points` field will be omitted from the resulting object.
+  - `enable_aia_url_templating` (`bool`): Specifies that the AIA URL values should be templated. When `null`, the `enable_aia_url_templating` field will be omitted from the resulting object.
+  - `issuer_name` (`string`): Reference to an existing issuer. When `null`, the `issuer_name` field will be omitted from the resulting object.
+  - `issuer_ref` (`string`): Reference to an existing issuer.
+  - `issuing_certificates` (`list`): Specifies the URL values for the Issuing Certificate field. When `null`, the `issuing_certificates` field will be omitted from the resulting object.
+  - `leaf_not_after_behavior` (`string`): Behavior of a leaf's 'NotAfter' field during issuance. When `null`, the `leaf_not_after_behavior` field will be omitted from the resulting object.
+  - `manual_chain` (`list`): Chain of issuer references to build this issuer's computed CAChain field from, when non-empty. When `null`, the `manual_chain` field will be omitted from the resulting object.
+  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
+  - `ocsp_servers` (`list`): Specifies the URL values for the OCSP Servers field. When `null`, the `ocsp_servers` field will be omitted from the resulting object.
+  - `revocation_signature_algorithm` (`string`): Which signature algorithm to use when building CRLs. When `null`, the `revocation_signature_algorithm` field will be omitted from the resulting object.
+  - `usage` (`string`): Comma-separated list of allowed usages for this issuer. When `null`, the `usage` field will be omitted from the resulting object.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`vault.pki_secret_backend_issuer.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_issuer`
+Terraform resource.
+
+Unlike [vault.pki_secret_backend_issuer.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `backend` (`string`): Full path where PKI backend is mounted.
+  - `crl_distribution_points` (`list`): Specifies the URL values for the CRL Distribution Points field. When `null`, the `crl_distribution_points` field will be omitted from the resulting object.
+  - `enable_aia_url_templating` (`bool`): Specifies that the AIA URL values should be templated. When `null`, the `enable_aia_url_templating` field will be omitted from the resulting object.
+  - `issuer_name` (`string`): Reference to an existing issuer. When `null`, the `issuer_name` field will be omitted from the resulting object.
+  - `issuer_ref` (`string`): Reference to an existing issuer.
+  - `issuing_certificates` (`list`): Specifies the URL values for the Issuing Certificate field. When `null`, the `issuing_certificates` field will be omitted from the resulting object.
+  - `leaf_not_after_behavior` (`string`): Behavior of a leaf's 'NotAfter' field during issuance. When `null`, the `leaf_not_after_behavior` field will be omitted from the resulting object.
+  - `manual_chain` (`list`): Chain of issuer references to build this issuer's computed CAChain field from, when non-empty. When `null`, the `manual_chain` field will be omitted from the resulting object.
+  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
+  - `ocsp_servers` (`list`): Specifies the URL values for the OCSP Servers field. When `null`, the `ocsp_servers` field will be omitted from the resulting object.
+  - `revocation_signature_algorithm` (`string`): Which signature algorithm to use when building CRLs. When `null`, the `revocation_signature_algorithm` field will be omitted from the resulting object.
+  - `usage` (`string`): Comma-separated list of allowed usages for this issuer. When `null`, the `usage` field will be omitted from the resulting object.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pki_secret_backend_issuer` resource into the root Terraform configuration.
+
+
+### fn withBackend
+
+```ts
+withBackend()
+```
+
+`vault.string.withBackend` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the backend field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `backend` field.
+
+
+### fn withCrlDistributionPoints
+
+```ts
+withCrlDistributionPoints()
+```
+
+`vault.list.withCrlDistributionPoints` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the crl_distribution_points field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `crl_distribution_points` field.
+
+
+### fn withEnableAiaUrlTemplating
+
+```ts
+withEnableAiaUrlTemplating()
+```
+
+`vault.bool.withEnableAiaUrlTemplating` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the enable_aia_url_templating field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `enable_aia_url_templating` field.
+
+
+### fn withIssuerName
+
+```ts
+withIssuerName()
+```
+
+`vault.string.withIssuerName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the issuer_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `issuer_name` field.
+
+
+### fn withIssuerRef
+
+```ts
+withIssuerRef()
+```
+
+`vault.string.withIssuerRef` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the issuer_ref field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `issuer_ref` field.
+
+
+### fn withIssuingCertificates
+
+```ts
+withIssuingCertificates()
+```
+
+`vault.list.withIssuingCertificates` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the issuing_certificates field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `issuing_certificates` field.
+
+
+### fn withLeafNotAfterBehavior
+
+```ts
+withLeafNotAfterBehavior()
+```
+
+`vault.string.withLeafNotAfterBehavior` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the leaf_not_after_behavior field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `leaf_not_after_behavior` field.
+
+
+### fn withManualChain
+
+```ts
+withManualChain()
+```
+
+`vault.list.withManualChain` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the manual_chain field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `manual_chain` field.
+
+
+### fn withNamespace
+
+```ts
+withNamespace()
+```
+
+`vault.string.withNamespace` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the namespace field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `namespace` field.
+
+
+### fn withOcspServers
+
+```ts
+withOcspServers()
+```
+
+`vault.list.withOcspServers` constructs a mixin object that can be merged into the `list`
+Terraform resource block to set or update the ocsp_servers field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`list`): The value to set for the `ocsp_servers` field.
+
+
+### fn withRevocationSignatureAlgorithm
+
+```ts
+withRevocationSignatureAlgorithm()
+```
+
+`vault.string.withRevocationSignatureAlgorithm` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the revocation_signature_algorithm field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `revocation_signature_algorithm` field.
+
+
+### fn withUsage
+
+```ts
+withUsage()
+```
+
+`vault.string.withUsage` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the usage field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `usage` field.
diff --git a/docs/3.x/pki_secret_backend_key.md b/docs/3.x/pki_secret_backend_key.md
new file mode 100644
index 0000000..553e39a
--- /dev/null
+++ b/docs/3.x/pki_secret_backend_key.md
@@ -0,0 +1,225 @@
+---
+permalink: /pki_secret_backend_key/
+---
+
+# pki_secret_backend_key
+
+`pki_secret_backend_key` represents the `vault_pki_secret_backend_key` Terraform resource.
+
+
+
+This package contains functions and utilities for setting up the resource using Jsonnet code.
+
+
+## Index
+
+* [`fn new()`](#fn-new)
+* [`fn newAttrs()`](#fn-newattrs)
+* [`fn withBackend()`](#fn-withbackend)
+* [`fn withKeyBits()`](#fn-withkeybits)
+* [`fn withKeyName()`](#fn-withkeyname)
+* [`fn withKeyType()`](#fn-withkeytype)
+* [`fn withManagedKeyId()`](#fn-withmanagedkeyid)
+* [`fn withManagedKeyName()`](#fn-withmanagedkeyname)
+* [`fn withNamespace()`](#fn-withnamespace)
+* [`fn withType()`](#fn-withtype)
+
+## Fields
+
+### fn new
+
+```ts
+new()
+```
+
+
+`vault.pki_secret_backend_key.new` injects a new `vault_pki_secret_backend_key` Terraform `resource`
+block into the root module document.
+
+Additionally, this inserts a private function into the `_ref` attribute that generates references to attributes of the
+resource. For example, if you added a new instance to the root using:
+
+    # arguments omitted for brevity
+    vault.pki_secret_backend_key.new('some_id')
+
+You can get the reference to the `id` field of the created `vault.pki_secret_backend_key` using the reference:
+
+    $._ref.vault_pki_secret_backend_key.some_id.get('id')
+
+This is the same as directly entering `"${ vault_pki_secret_backend_key.some_id.id }"` as the value.
+
+NOTE: if you are chaining multiple resources together in a merge operation, you may not be able to use `super`, `self`,
+or `$` to refer to the root object. Instead, make an explicit outer object using `local`.
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block.
+  - `backend` (`string`): Full path where PKI backend is mounted.
+  - `key_bits` (`number`): Specifies the number of bits to use for the generated keys. When `null`, the `key_bits` field will be omitted from the resulting object.
+  - `key_name` (`string`): When a new key is created with this request, optionally specifies the name for this. When `null`, the `key_name` field will be omitted from the resulting object.
+  - `key_type` (`string`): Specifies the desired key type; must be 'rsa', 'ed25519' or 'ec'. When `null`, the `key_type` field will be omitted from the resulting object.
+  - `managed_key_id` (`string`): The managed key's UUID. When `null`, the `managed_key_id` field will be omitted from the resulting object.
+  - `managed_key_name` (`string`): The managed key's configured name. When `null`, the `managed_key_name` field will be omitted from the resulting object.
+  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
+  - `type` (`string`): Specifies the type of the key to create.
+
+**Returns**:
+- A mixin object that injects the new resource into the root Terraform configuration.
+
+
+### fn newAttrs
+
+```ts
+newAttrs()
+```
+
+
+`vault.pki_secret_backend_key.newAttrs` constructs a new object with attributes and blocks configured for the `pki_secret_backend_key`
+Terraform resource.
+
+Unlike [vault.pki_secret_backend_key.new](#fn-new), this function will not inject the `resource`
+block into the root Terraform document. Instead, this must be passed in as the `attrs` argument for the
+[tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) function to build a complete block.
+
+This is most useful when you need to preprocess the attributes with functions, conditional, or looping logic prior to
+injecting into a complete block.
+
+**Args**:
+  - `backend` (`string`): Full path where PKI backend is mounted.
+  - `key_bits` (`number`): Specifies the number of bits to use for the generated keys. When `null`, the `key_bits` field will be omitted from the resulting object.
+  - `key_name` (`string`): When a new key is created with this request, optionally specifies the name for this. When `null`, the `key_name` field will be omitted from the resulting object.
+  - `key_type` (`string`): Specifies the desired key type; must be 'rsa', 'ed25519' or 'ec'. When `null`, the `key_type` field will be omitted from the resulting object.
+  - `managed_key_id` (`string`): The managed key's UUID. When `null`, the `managed_key_id` field will be omitted from the resulting object.
+  - `managed_key_name` (`string`): The managed key's configured name. When `null`, the `managed_key_name` field will be omitted from the resulting object.
+  - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
+  - `type` (`string`): Specifies the type of the key to create.
+
+**Returns**:
+  - An attribute object that can be used with [tf.withResource](https://github.com/tf-libsonnet/core/tree/main/docs#fn-withresource) to construct a new `pki_secret_backend_key` resource into the root Terraform configuration.
+
+
+### fn withBackend
+
+```ts
+withBackend()
+```
+
+`vault.string.withBackend` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the backend field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `backend` field.
+
+
+### fn withKeyBits
+
+```ts
+withKeyBits()
+```
+
+`vault.number.withKeyBits` constructs a mixin object that can be merged into the `number`
+Terraform resource block to set or update the key_bits field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`number`): The value to set for the `key_bits` field.
+
+
+### fn withKeyName
+
+```ts
+withKeyName()
+```
+
+`vault.string.withKeyName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the key_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `key_name` field.
+
+
+### fn withKeyType
+
+```ts
+withKeyType()
+```
+
+`vault.string.withKeyType` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the key_type field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `key_type` field.
+
+
+### fn withManagedKeyId
+
+```ts
+withManagedKeyId()
+```
+
+`vault.string.withManagedKeyId` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the managed_key_id field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `managed_key_id` field.
+
+
+### fn withManagedKeyName
+
+```ts
+withManagedKeyName()
+```
+
+`vault.string.withManagedKeyName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the managed_key_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `managed_key_name` field.
+
+
+### fn withNamespace
+
+```ts
+withNamespace()
+```
+
+`vault.string.withNamespace` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the namespace field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `namespace` field.
+
+
+### fn withType
+
+```ts
+withType()
+```
+
+`vault.string.withType` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the type field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `type` field.
diff --git a/docs/3.x/pki_secret_backend_role.md b/docs/3.x/pki_secret_backend_role.md
index 7ff4309..fa013b3 100644
--- a/docs/3.x/pki_secret_backend_role.md
+++ b/docs/3.x/pki_secret_backend_role.md
@@ -21,11 +21,13 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withAllowIpSans()`](#fn-withallowipsans)
 * [`fn withAllowLocalhost()`](#fn-withallowlocalhost)
 * [`fn withAllowSubdomains()`](#fn-withallowsubdomains)
+* [`fn withAllowWildcardCertificates()`](#fn-withallowwildcardcertificates)
 * [`fn withAllowedDomains()`](#fn-withalloweddomains)
 * [`fn withAllowedDomainsTemplate()`](#fn-withalloweddomainstemplate)
 * [`fn withAllowedOtherSans()`](#fn-withallowedothersans)
 * [`fn withAllowedSerialNumbers()`](#fn-withallowedserialnumbers)
 * [`fn withAllowedUriSans()`](#fn-withallowedurisans)
+* [`fn withAllowedUriSansTemplate()`](#fn-withallowedurisanstemplate)
 * [`fn withBackend()`](#fn-withbackend)
 * [`fn withBasicConstraintsValidForNonCa()`](#fn-withbasicconstraintsvalidfornonca)
 * [`fn withClientFlag()`](#fn-withclientflag)
@@ -35,6 +37,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withEnforceHostnames()`](#fn-withenforcehostnames)
 * [`fn withExtKeyUsage()`](#fn-withextkeyusage)
 * [`fn withGenerateLease()`](#fn-withgeneratelease)
+* [`fn withIssuerRef()`](#fn-withissuerref)
 * [`fn withKeyBits()`](#fn-withkeybits)
 * [`fn withKeyType()`](#fn-withkeytype)
 * [`fn withKeyUsage()`](#fn-withkeyusage)
@@ -95,11 +98,13 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `allow_ip_sans` (`bool`): Flag to allow IP SANs When `null`, the `allow_ip_sans` field will be omitted from the resulting object.
   - `allow_localhost` (`bool`): Flag to allow certificates for localhost. When `null`, the `allow_localhost` field will be omitted from the resulting object.
   - `allow_subdomains` (`bool`): Flag to allow certificates matching subdomains. When `null`, the `allow_subdomains` field will be omitted from the resulting object.
+  - `allow_wildcard_certificates` (`bool`): Flag to allow wildcard certificates When `null`, the `allow_wildcard_certificates` field will be omitted from the resulting object.
   - `allowed_domains` (`list`): The domains of the role. When `null`, the `allowed_domains` field will be omitted from the resulting object.
   - `allowed_domains_template` (`bool`): Flag to indicate that `allowed_domains` specifies a template expression (e.g. {{identity.entity.aliases.<mount accessor>.name}}) When `null`, the `allowed_domains_template` field will be omitted from the resulting object.
   - `allowed_other_sans` (`list`): Defines allowed custom SANs When `null`, the `allowed_other_sans` field will be omitted from the resulting object.
   - `allowed_serial_numbers` (`list`): Defines allowed Subject serial numbers. When `null`, the `allowed_serial_numbers` field will be omitted from the resulting object.
   - `allowed_uri_sans` (`list`): Defines allowed URI SANs When `null`, the `allowed_uri_sans` field will be omitted from the resulting object.
+  - `allowed_uri_sans_template` (`bool`): Flag to indicate that `allowed_uri_sans` specifies a template expression (e.g. {{identity.entity.aliases.<mount accessor>.name}}) When `null`, the `allowed_uri_sans_template` field will be omitted from the resulting object.
   - `backend` (`string`): The path of the PKI secret backend the resource belongs to.
   - `basic_constraints_valid_for_non_ca` (`bool`): Flag to mark basic constraints valid when issuing non-CA certificates. When `null`, the `basic_constraints_valid_for_non_ca` field will be omitted from the resulting object.
   - `client_flag` (`bool`): Flag to specify certificates for client use. When `null`, the `client_flag` field will be omitted from the resulting object.
@@ -109,6 +114,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `enforce_hostnames` (`bool`): Flag to allow only valid host names When `null`, the `enforce_hostnames` field will be omitted from the resulting object.
   - `ext_key_usage` (`list`): Specify the allowed extended key usage constraint on issued certificates. When `null`, the `ext_key_usage` field will be omitted from the resulting object.
   - `generate_lease` (`bool`): Flag to generate leases with certificates. When `null`, the `generate_lease` field will be omitted from the resulting object.
+  - `issuer_ref` (`string`): Specifies the default issuer of this request. When `null`, the `issuer_ref` field will be omitted from the resulting object.
   - `key_bits` (`number`): The number of bits of generated keys. When `null`, the `key_bits` field will be omitted from the resulting object.
   - `key_type` (`string`): The generated key type. When `null`, the `key_type` field will be omitted from the resulting object.
   - `key_usage` (`list`): Specify the allowed key usage constraint on issued certificates. When `null`, the `key_usage` field will be omitted from the resulting object.
@@ -159,11 +165,13 @@ injecting into a complete block.
   - `allow_ip_sans` (`bool`): Flag to allow IP SANs When `null`, the `allow_ip_sans` field will be omitted from the resulting object.
   - `allow_localhost` (`bool`): Flag to allow certificates for localhost. When `null`, the `allow_localhost` field will be omitted from the resulting object.
   - `allow_subdomains` (`bool`): Flag to allow certificates matching subdomains. When `null`, the `allow_subdomains` field will be omitted from the resulting object.
+  - `allow_wildcard_certificates` (`bool`): Flag to allow wildcard certificates When `null`, the `allow_wildcard_certificates` field will be omitted from the resulting object.
   - `allowed_domains` (`list`): The domains of the role. When `null`, the `allowed_domains` field will be omitted from the resulting object.
   - `allowed_domains_template` (`bool`): Flag to indicate that `allowed_domains` specifies a template expression (e.g. {{identity.entity.aliases.<mount accessor>.name}}) When `null`, the `allowed_domains_template` field will be omitted from the resulting object.
   - `allowed_other_sans` (`list`): Defines allowed custom SANs When `null`, the `allowed_other_sans` field will be omitted from the resulting object.
   - `allowed_serial_numbers` (`list`): Defines allowed Subject serial numbers. When `null`, the `allowed_serial_numbers` field will be omitted from the resulting object.
   - `allowed_uri_sans` (`list`): Defines allowed URI SANs When `null`, the `allowed_uri_sans` field will be omitted from the resulting object.
+  - `allowed_uri_sans_template` (`bool`): Flag to indicate that `allowed_uri_sans` specifies a template expression (e.g. {{identity.entity.aliases.<mount accessor>.name}}) When `null`, the `allowed_uri_sans_template` field will be omitted from the resulting object.
   - `backend` (`string`): The path of the PKI secret backend the resource belongs to.
   - `basic_constraints_valid_for_non_ca` (`bool`): Flag to mark basic constraints valid when issuing non-CA certificates. When `null`, the `basic_constraints_valid_for_non_ca` field will be omitted from the resulting object.
   - `client_flag` (`bool`): Flag to specify certificates for client use. When `null`, the `client_flag` field will be omitted from the resulting object.
@@ -173,6 +181,7 @@ injecting into a complete block.
   - `enforce_hostnames` (`bool`): Flag to allow only valid host names When `null`, the `enforce_hostnames` field will be omitted from the resulting object.
   - `ext_key_usage` (`list`): Specify the allowed extended key usage constraint on issued certificates. When `null`, the `ext_key_usage` field will be omitted from the resulting object.
   - `generate_lease` (`bool`): Flag to generate leases with certificates. When `null`, the `generate_lease` field will be omitted from the resulting object.
+  - `issuer_ref` (`string`): Specifies the default issuer of this request. When `null`, the `issuer_ref` field will be omitted from the resulting object.
   - `key_bits` (`number`): The number of bits of generated keys. When `null`, the `key_bits` field will be omitted from the resulting object.
   - `key_type` (`string`): The generated key type. When `null`, the `key_type` field will be omitted from the resulting object.
   - `key_usage` (`list`): Specify the allowed key usage constraint on issued certificates. When `null`, the `key_usage` field will be omitted from the resulting object.
@@ -295,6 +304,22 @@ Terraform resource block to set or update the allow_subdomains field.
   - `value` (`bool`): The value to set for the `allow_subdomains` field.
 
 
+### fn withAllowWildcardCertificates
+
+```ts
+withAllowWildcardCertificates()
+```
+
+`vault.bool.withAllowWildcardCertificates` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the allow_wildcard_certificates field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `allow_wildcard_certificates` field.
+
+
 ### fn withAllowedDomains
 
 ```ts
@@ -375,6 +400,22 @@ Terraform resource block to set or update the allowed_uri_sans field.
   - `value` (`list`): The value to set for the `allowed_uri_sans` field.
 
 
+### fn withAllowedUriSansTemplate
+
+```ts
+withAllowedUriSansTemplate()
+```
+
+`vault.bool.withAllowedUriSansTemplate` constructs a mixin object that can be merged into the `bool`
+Terraform resource block to set or update the allowed_uri_sans_template field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`bool`): The value to set for the `allowed_uri_sans_template` field.
+
+
 ### fn withBackend
 
 ```ts
@@ -519,6 +560,22 @@ Terraform resource block to set or update the generate_lease field.
   - `value` (`bool`): The value to set for the `generate_lease` field.
 
 
+### fn withIssuerRef
+
+```ts
+withIssuerRef()
+```
+
+`vault.string.withIssuerRef` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the issuer_ref field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `issuer_ref` field.
+
+
 ### fn withKeyBits
 
 ```ts
diff --git a/docs/3.x/pki_secret_backend_root_cert.md b/docs/3.x/pki_secret_backend_root_cert.md
index 5d31b8e..f9173dc 100644
--- a/docs/3.x/pki_secret_backend_root_cert.md
+++ b/docs/3.x/pki_secret_backend_root_cert.md
@@ -22,7 +22,10 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withExcludeCnFromSans()`](#fn-withexcludecnfromsans)
 * [`fn withFormat()`](#fn-withformat)
 * [`fn withIpSans()`](#fn-withipsans)
+* [`fn withIssuerName()`](#fn-withissuername)
 * [`fn withKeyBits()`](#fn-withkeybits)
+* [`fn withKeyName()`](#fn-withkeyname)
+* [`fn withKeyRef()`](#fn-withkeyref)
 * [`fn withKeyType()`](#fn-withkeytype)
 * [`fn withLocality()`](#fn-withlocality)
 * [`fn withManagedKeyId()`](#fn-withmanagedkeyid)
@@ -77,7 +80,10 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.
   - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.
   - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.
+  - `issuer_name` (`string`): Provides a name to the specified issuer. The name must be unique across all issuers and not be the reserved value 'default'. When `null`, the `issuer_name` field will be omitted from the resulting object.
   - `key_bits` (`number`): The number of bits to use. When `null`, the `key_bits` field will be omitted from the resulting object.
+  - `key_name` (`string`): When a new key is created with this request, optionally specifies the name for this. When `null`, the `key_name` field will be omitted from the resulting object.
+  - `key_ref` (`string`): Specifies the key to use for generating this request. When `null`, the `key_ref` field will be omitted from the resulting object.
   - `key_type` (`string`): The desired key type. When `null`, the `key_type` field will be omitted from the resulting object.
   - `locality` (`string`): The locality. When `null`, the `locality` field will be omitted from the resulting object.
   - `managed_key_id` (`string`): The ID of the previously configured managed key. When `null`, the `managed_key_id` field will be omitted from the resulting object.
@@ -93,7 +99,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `province` (`string`): The province. When `null`, the `province` field will be omitted from the resulting object.
   - `street_address` (`string`): The street address. When `null`, the `street_address` field will be omitted from the resulting object.
   - `ttl` (`string`): Time to live. When `null`, the `ttl` field will be omitted from the resulting object.
-  - `type` (`string`): Type of root to create. Must be either "exported" or "internal".
+  - `type` (`string`): Type of root to create. Must be either "existing", "exported", "internal" or "kms"
   - `uri_sans` (`list`): List of alternative URIs. When `null`, the `uri_sans` field will be omitted from the resulting object.
 
 **Returns**:
@@ -125,7 +131,10 @@ injecting into a complete block.
   - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.
   - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.
   - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.
+  - `issuer_name` (`string`): Provides a name to the specified issuer. The name must be unique across all issuers and not be the reserved value 'default'. When `null`, the `issuer_name` field will be omitted from the resulting object.
   - `key_bits` (`number`): The number of bits to use. When `null`, the `key_bits` field will be omitted from the resulting object.
+  - `key_name` (`string`): When a new key is created with this request, optionally specifies the name for this. When `null`, the `key_name` field will be omitted from the resulting object.
+  - `key_ref` (`string`): Specifies the key to use for generating this request. When `null`, the `key_ref` field will be omitted from the resulting object.
   - `key_type` (`string`): The desired key type. When `null`, the `key_type` field will be omitted from the resulting object.
   - `locality` (`string`): The locality. When `null`, the `locality` field will be omitted from the resulting object.
   - `managed_key_id` (`string`): The ID of the previously configured managed key. When `null`, the `managed_key_id` field will be omitted from the resulting object.
@@ -141,7 +150,7 @@ injecting into a complete block.
   - `province` (`string`): The province. When `null`, the `province` field will be omitted from the resulting object.
   - `street_address` (`string`): The street address. When `null`, the `street_address` field will be omitted from the resulting object.
   - `ttl` (`string`): Time to live. When `null`, the `ttl` field will be omitted from the resulting object.
-  - `type` (`string`): Type of root to create. Must be either "exported" or "internal".
+  - `type` (`string`): Type of root to create. Must be either "existing", "exported", "internal" or "kms"
   - `uri_sans` (`list`): List of alternative URIs. When `null`, the `uri_sans` field will be omitted from the resulting object.
 
 **Returns**:
@@ -260,6 +269,22 @@ Terraform resource block to set or update the ip_sans field.
   - `value` (`list`): The value to set for the `ip_sans` field.
 
 
+### fn withIssuerName
+
+```ts
+withIssuerName()
+```
+
+`vault.string.withIssuerName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the issuer_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `issuer_name` field.
+
+
 ### fn withKeyBits
 
 ```ts
@@ -276,6 +301,38 @@ Terraform resource block to set or update the key_bits field.
   - `value` (`number`): The value to set for the `key_bits` field.
 
 
+### fn withKeyName
+
+```ts
+withKeyName()
+```
+
+`vault.string.withKeyName` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the key_name field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `key_name` field.
+
+
+### fn withKeyRef
+
+```ts
+withKeyRef()
+```
+
+`vault.string.withKeyRef` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the key_ref field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `key_ref` field.
+
+
 ### fn withKeyType
 
 ```ts
diff --git a/docs/3.x/pki_secret_backend_root_sign_intermediate.md b/docs/3.x/pki_secret_backend_root_sign_intermediate.md
index 21e0e52..daded2d 100644
--- a/docs/3.x/pki_secret_backend_root_sign_intermediate.md
+++ b/docs/3.x/pki_secret_backend_root_sign_intermediate.md
@@ -23,6 +23,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withExcludeCnFromSans()`](#fn-withexcludecnfromsans)
 * [`fn withFormat()`](#fn-withformat)
 * [`fn withIpSans()`](#fn-withipsans)
+* [`fn withIssuerRef()`](#fn-withissuerref)
 * [`fn withLocality()`](#fn-withlocality)
 * [`fn withMaxPathLength()`](#fn-withmaxpathlength)
 * [`fn withNamespace()`](#fn-withnamespace)
@@ -75,6 +76,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.
   - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.
   - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.
+  - `issuer_ref` (`string`): Specifies the default issuer of this request. When `null`, the `issuer_ref` field will be omitted from the resulting object.
   - `locality` (`string`): The locality. When `null`, the `locality` field will be omitted from the resulting object.
   - `max_path_length` (`number`): The maximum path length to encode in the generated certificate. When `null`, the `max_path_length` field will be omitted from the resulting object.
   - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
@@ -120,6 +122,7 @@ injecting into a complete block.
   - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.
   - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.
   - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.
+  - `issuer_ref` (`string`): Specifies the default issuer of this request. When `null`, the `issuer_ref` field will be omitted from the resulting object.
   - `locality` (`string`): The locality. When `null`, the `locality` field will be omitted from the resulting object.
   - `max_path_length` (`number`): The maximum path length to encode in the generated certificate. When `null`, the `max_path_length` field will be omitted from the resulting object.
   - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
@@ -267,6 +270,22 @@ Terraform resource block to set or update the ip_sans field.
   - `value` (`list`): The value to set for the `ip_sans` field.
 
 
+### fn withIssuerRef
+
+```ts
+withIssuerRef()
+```
+
+`vault.string.withIssuerRef` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the issuer_ref field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `issuer_ref` field.
+
+
 ### fn withLocality
 
 ```ts
diff --git a/docs/3.x/pki_secret_backend_sign.md b/docs/3.x/pki_secret_backend_sign.md
index ea05a86..e7265a8 100644
--- a/docs/3.x/pki_secret_backend_sign.md
+++ b/docs/3.x/pki_secret_backend_sign.md
@@ -23,6 +23,7 @@ This package contains functions and utilities for setting up the resource using
 * [`fn withExcludeCnFromSans()`](#fn-withexcludecnfromsans)
 * [`fn withFormat()`](#fn-withformat)
 * [`fn withIpSans()`](#fn-withipsans)
+* [`fn withIssuerRef()`](#fn-withissuerref)
 * [`fn withMinSecondsRemaining()`](#fn-withminsecondsremaining)
 * [`fn withName()`](#fn-withname)
 * [`fn withNamespace()`](#fn-withnamespace)
@@ -67,6 +68,7 @@ or `$` to refer to the root object. Instead, make an explicit outer object using
   - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.
   - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.
   - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.
+  - `issuer_ref` (`string`): Specifies the default issuer of this request. When `null`, the `issuer_ref` field will be omitted from the resulting object.
   - `min_seconds_remaining` (`number`): Generate a new certificate when the expiration is within this number of seconds When `null`, the `min_seconds_remaining` field will be omitted from the resulting object.
   - `name` (`string`): Name of the role to create the certificate against.
   - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
@@ -104,6 +106,7 @@ injecting into a complete block.
   - `exclude_cn_from_sans` (`bool`): Flag to exclude CN from SANs. When `null`, the `exclude_cn_from_sans` field will be omitted from the resulting object.
   - `format` (`string`): The format of data. When `null`, the `format` field will be omitted from the resulting object.
   - `ip_sans` (`list`): List of alternative IPs. When `null`, the `ip_sans` field will be omitted from the resulting object.
+  - `issuer_ref` (`string`): Specifies the default issuer of this request. When `null`, the `issuer_ref` field will be omitted from the resulting object.
   - `min_seconds_remaining` (`number`): Generate a new certificate when the expiration is within this number of seconds When `null`, the `min_seconds_remaining` field will be omitted from the resulting object.
   - `name` (`string`): Name of the role to create the certificate against.
   - `namespace` (`string`): Target namespace. (requires Enterprise) When `null`, the `namespace` field will be omitted from the resulting object.
@@ -243,6 +246,22 @@ Terraform resource block to set or update the ip_sans field.
   - `value` (`list`): The value to set for the `ip_sans` field.
 
 
+### fn withIssuerRef
+
+```ts
+withIssuerRef()
+```
+
+`vault.string.withIssuerRef` constructs a mixin object that can be merged into the `string`
+Terraform resource block to set or update the issuer_ref field.
+
+
+
+**Args**:
+  - `resourceLabel` (`string`): The name label of the block to update.
+  - `value` (`string`): The value to set for the `issuer_ref` field.
+
+
 ### fn withMinSecondsRemaining
 
 ```ts