Add ValidatingAdmissionPolicy resource (#2794)

* Add kubernetes_validating_admission_policy resource * Update to use admissionregistration/v1 * Add changelog * tidy up validating_admission_policy resource * add copy-write headers, and tidy up resource * Fix identity schema * Fix md * Update dep * Tidy mod/sum
2025-12-18 23:06:07 -05:00 · 2025-10-24 08:00:08 -05:00 · 2025-10-24 08:00:08 -05:00 · 8496b96e80
commit 8496b96e80
parent a3ec3b3c6d
18 changed files with 1708 additions and 142 deletions
--- a/.changelog/2794.txt
+++ b/.changelog/2794.txt
@ -0,0 +1,3 @@
+```release-note:enhancement
+Add support for ValidatingAdmissionPolicy
+```
--- a/docs/resources/validating_admission_policy.md
+++ b/docs/resources/validating_admission_policy.md
@ -0,0 +1,197 @@
+---
+subcategory: "admissionregistration/v1"
+page_title: "Kubernetes: kubernetes_validating_admission_policy_v1"
+description: |-
+  A Validating Admission Policy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
+---
+
+# kubernetes_validating_admission_policy_v1
+
+A Validating Admission Policy describes the definition of an admission validation policy that accepts or rejects an object without changing it.
+
+<!-- schema generated by tfplugindocs -->
+
+## Schema
+
+### Required
+
+- `metadata` (Block, Min: 1, Max: 1) Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata (see below for nested schema)
+spec (Block, Min: 1, Max: 1) Specification of the desired behavior of the ValidatingAdmissionPolicy. (see below for nested schema)
+
+### Optional
+
+- `timeouts` (Block) Configurable timeout for CRUD operations (see below for nested schema)
+
+### Read-Only
+
+- `id` (String) The ID of this resource.
+
+<a id="nestedblock--metadata"></a>
+Nested Schema for `metadata`
+
+### Optional
+
+- `annotations` (Map of String) An unstructured key value map stored with the resource that may be used to store arbitrary metadata. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+- `generate_name` (String) GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency
+labels (Map of String) Map of string keys and values that can be used to organize and categorize (scope and select) objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
+- `name` (String) Name of the ValidatingAdmissionPolicy, must be unique. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
+- `namespace` (String) Namespace defines the space within which the resource name must be unique. Note: ValidatingAdmissionPolicy is a cluster-scoped resource, so namespace should typically not be set.
+
+### Read-Only
+
+- `generation` (Number) A sequence number representing a specific generation of the desired state.
+- `resource_version` (String) An opaque value that represents the internal version of this object that can be used by clients to determine when the object has changed. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency
+uid (String) The unique in time and space value for this object. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#uids
+
+<a id="nestedblock--spec"></a>
+Nested Schema for `spec`
+
+### Required
+
+- `audit_annotations` (Block List, Min: 1) AuditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the API request. (see below for nested schema)
+- `failure_policy` (String) FailurePolicy defines how to handle failures for the admission policy. Failures can occur from CEL expression parse errors, type check errors, runtime errors and invalid or misconfigured policy definitions or bindings. Allowed values are Fail or Ignore. Defaults to Fail.
+- `match_constraints` (Block, Min: 1, Max: 1) MatchConstraints specifies what resources this policy is designed to validate. The policy cares about a request if it matches all Constraints. (see below for nested schema)
+
+### Optional
+
+- `match_conditions` (Block List) MatchConditions is a list of conditions that must be met for a request to be validated. Match conditions filter requests that have already been matched by the rules. An empty list of matchConditions matches all requests. (see below for nested schema)
+- `param_kind` (Block, Max: 1) ParamKind specifies the kind of resources used to parameterize this policy. If absent, there are no parameters for this policy. (see below for nested schema)
+- `validations` (Block List) Validations contain CEL expressions which is used to apply the validation. (see below for nested schema)
+- `variables` (Block List) Variables contain definitions of variables that can be used in composition of other expressions. (see below for nested schema)
+
+<a id="nestedblock--spec--audit_annotations"></a>
+Nested Schema for `spec.audit_annotations`
+
+### Required
+
+- `key` (String) Key specifies the audit annotation key. The audit annotation keys of a ValidatingAdmissionPolicy must be unique. The key must be a qualified name no more than 63 bytes in length.
+- `value_expression` (String) ValueExpression represents the expression which is evaluated by CEL to produce an audit annotation value. The expression must evaluate to either a string or null value.
+
+<a id="nestedblock--spec--match_conditions"></a>
+Nested Schema for `spec.match_conditions`
+
+### Required
+
+- `expression` (String) Expression represents the expression which will be evaluated by CEL. Must evaluate to bool. CEL expressions have access to the contents of the AdmissionRequest and Authorizer.
+- `name` (String) Name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes.
+
+<a id="nestedblock--spec--match_constraints"></a>
+Nested Schema for `spec.match_constraints`
+
+### Optional
+
+- `exclude_resource_rules` (Block List) ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about. The exclude rules take precedence over include rules. (see below for nested schema)
+- `match_policy` (String) MatchPolicy defines how the "MatchResources" list is used to match incoming requests. Allowed values are Exact or Equivalent. Defaults to Equivalent.
+- `namespace_selector` (Block, Max: 1) NamespaceSelector decides whether to run the admission control policy on an object based on whether the namespace for that object matches the selector. (see below for nested schema)
+- `object_selector` (Block, Max: 1) ObjectSelector decides whether to run the validation based on if the object has matching labels. (see below for nested schema)
+- `resource_rules` (Block List) ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches. The policy cares about an operation if it matches any Rule. (see below for nested schema)
+
+<a id="nestedblock--spec--match_constraints--exclude_resource_rules"></a>
+Nested Schema for `spec.match_constraints.exclude_resource_rules`
+
+### Required
+
+- `api_groups` (List of String) APIGroups is the API groups the resources belong to. * is all groups. If * is present, the length of the slice must be one.
+- `api_versions` (List of String) APIVersions is the API versions the resources belong to. * is all versions. If * is present, the length of the slice must be one.
+- `operations` (List of String) Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all operations.
+- `resources` (List of String) Resources is a list of resources this rule applies to. For example: pods means pods. pods/log means the log subresource of pods. * means all resources.
+
+### Optional
+
+- `resource_names` (List of String) ResourceNames is an optional allowlist of names that the rule applies to. An empty set means that everything is allowed.
+- `scope` (String) Scope specifies the scope of this rule. Valid values are Cluster, Namespaced, and *. Default is *.
+
+<a id="nestedblock--spec--match_constraints--namespace_selector"></a>
+Nested Schema for `spec.match_constraints.namespace_selector`
+
+### Optional
+
+- `match_expressions` (Block List) A list of label selector requirements. The requirements are ANDed. (see below for nested schema)
+- `match_labels` (Map of String) A map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value".
+
+<a id="nestedblock--spec--match_constraints--namespace_selector--match_expressions"></a>
+Nested Schema for `spec.match_constraints.namespace_selector.match_expressions`
+
+### Optional
+
+- `key` (String) The label key that the selector applies to.
+- `operator` (String) Operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
+- `values` (List of String) An array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty.
+
+<a id="nestedblock--spec--match_constraints--object_selector"></a>
+Nested Schema for `spec.match_constraints.object_selector`
+
+### Optional
+
+- `label_selector` (Block, Max: 1) A label query over a set of resources. (see below for nested schema)
+
+<a id="nestedblock--spec--match_constraints--object_selector--label_selector"></a>
+Nested Schema for `spec.match_constraints.object_selector.label_selector`
+
+### Optional
+
+- `match_expressions` (Block List) A list of label selector requirements. The requirements are ANDed. (see below for nested schema)
+- `match_labels` (Map of String) A map of {key,value} pairs.
+
+<a id="nestedblock--spec--match_constraints--object_selector--label_selector--match_expressions"></a>
+Nested Schema for `spec.match_constraints.object_selector.label_selector.match_expressions`
+
+### Optional
+
+- `key` (String) The label key that the selector applies to.
+- `operator` (String) Operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.
+- `values` (List of String) An array of string values.
+
+<a id="nestedblock--spec--match_constraints--resource_rules"></a>
+Nested Schema for `spec.match_constraints.resource_rules`
+
+### Required
+
+- `api_groups` (List of String) APIGroups is the API groups the resources belong to. * is all groups.
+- `api_versions` (List of String) APIVersions is the API versions the resources belong to. * is all versions.
+- `operations` (List of String) Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all operations.
+- `resources` (List of String) Resources is a list of resources this rule applies to.
+
+### Optional
+
+- `resource_names` (List of String) ResourceNames is an optional allowlist of names that the rule applies to.
+- `scope` (String) Scope specifies the scope of this rule. Valid values are Cluster, Namespaced, and *.
+
+<a id="nestedblock--spec--param_kind"></a>
+Nested Schema for `spec.param_kind`
+
+### Required
+
+- `api_version` (String) APIVersion is the API group version the resources belong to. In format of "group/version".
+- `kind` (String) Kind is the API kind the resources belong to.
+
+<a id="nestedblock--spec--validations"></a>
+Nested Schema for `spec.validations`
+
+### Required
+
+- `expression` (String) Expression represents the CEL expression which is evaluated to validate the resource. Must evaluate to bool.
+- `message` (String) Message represents the message displayed when validation fails. The message is required if the Expression contains line breaks.
+
+### Optional
+
+- `message_expression` (String) MessageExpression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails.
+- `reason` (String) Reason represents a machine-readable description of why this validation failed. Valid values are: Unauthorized, Forbidden, Invalid, RequestEntityTooLarge. If not set, Invalid is used.
+
+<a id="nestedblock--spec--variables"></a>
+Nested Schema for `spec.variables`
+
+### Optional
+
+- `expression` (String) Expression is the expression that will be evaluated as the value of the variable.
+- `name` (String) Name is the name of the variable. The variable can be accessed in other expressions through variables.<name>.
+
+<a id="nestedblock--timeouts"></a>
+Nested Schema for `timeouts`
+
+### Optional
+
+- `create` (String) Timeout for creating the resource. Default is 20 minutes.
+- `delete` (String) Timeout for deleting the resource. Default is 20 minutes.
+- `read` (String) Timeout for reading the resource. Default is 20 minutes.
+- `update` (String) Timeout for updating the resource. Default is 20 minutes.
--- a/go.mod
+++ b/go.mod
@ -11,11 +11,13 @@ require (
 	github.com/hashicorp/go-plugin v1.7.0
 	github.com/hashicorp/go-version v1.7.0
 	github.com/hashicorp/hc-install v0.9.2
-	github.com/hashicorp/hcl/v2 v2.24.0
-	github.com/hashicorp/terraform-exec v0.23.1
-	github.com/hashicorp/terraform-json v0.26.0
-	github.com/hashicorp/terraform-plugin-docs v0.22.0
+	github.com/hashicorp/hcl/v2 v2.23.0
+	github.com/hashicorp/terraform-exec v0.23.0
+	github.com/hashicorp/terraform-json v0.25.0
+	github.com/hashicorp/terraform-plugin-docs v0.16.0
 	github.com/hashicorp/terraform-plugin-framework v1.15.1
+	github.com/hashicorp/terraform-plugin-framework-timeouts v0.5.0
+	github.com/hashicorp/terraform-plugin-framework-validators v0.18.0
 	github.com/hashicorp/terraform-plugin-go v0.28.0
 	github.com/hashicorp/terraform-plugin-log v0.9.0
 	github.com/hashicorp/terraform-plugin-mux v0.20.0
@ -27,9 +29,7 @@ require (
 	github.com/mitchellh/hashstructure v1.1.0
 	github.com/robfig/cron v1.2.0
 	github.com/stretchr/testify v1.10.0
-	github.com/zclconf/go-cty v1.16.4
-	golang.org/x/mod v0.25.0
-	google.golang.org/grpc v1.72.1
+	golang.org/x/mod v0.26.0
 	k8s.io/api v0.33.4
 	k8s.io/apiextensions-apiserver v0.33.4
 	k8s.io/apimachinery v0.33.4
@ -37,68 +37,83 @@ require (
 	k8s.io/kube-aggregator v0.33.4
 	k8s.io/kubectl v0.33.4
 	k8s.io/kubernetes v1.33.4
-	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738
 	sigs.k8s.io/yaml v1.4.0
 )

 require (
 	github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
-	github.com/BurntSushi/toml v1.2.1 // indirect
-	github.com/Kunde21/markdownfmt/v3 v3.1.0 // indirect
 	github.com/MakeNowJust/heredoc v1.0.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/semver/v3 v3.2.0 // indirect
 	github.com/Masterminds/sprig/v3 v3.2.3 // indirect
 	github.com/ProtonMail/go-crypto v1.1.6 // indirect
-	github.com/agext/levenshtein v1.2.2 // indirect
+	github.com/agext/levenshtein v1.2.3 // indirect
 	github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
 	github.com/armon/go-radix v1.0.0 // indirect
 	github.com/bgentry/speakeasy v0.1.0 // indirect
 	github.com/blang/semver/v4 v4.0.0 // indirect
-	github.com/bmatcuk/doublestar/v4 v4.8.1 // indirect
-	github.com/chai2010/gettext-go v1.0.2 // indirect
 	github.com/cloudflare/circl v1.6.1 // indirect
-	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/emicklei/go-restful/v3 v3.11.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
+	github.com/google/gnostic-models v0.6.9 // indirect
+	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
+	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
+	github.com/huandu/xstrings v1.3.3 // indirect
+	github.com/invopop/yaml v0.2.0 // indirect
+	github.com/mitchellh/cli v1.1.5 // indirect
+	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect
+	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
+	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
+	github.com/posener/complete v1.2.3 // indirect
+	github.com/russross/blackfriday/v2 v2.1.0 // indirect
+	github.com/shopspring/decimal v1.3.1 // indirect
+	github.com/spf13/cast v1.5.0 // indirect
+	github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
+	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
+	github.com/x448/float16 v0.8.4 // indirect
+	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
+	golang.org/x/sync v0.16.0 // indirect
+	golang.org/x/tools v0.34.0 // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
+	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
+	k8s.io/component-helpers v0.33.4 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+)
+
+require (
+	github.com/chai2010/gettext-go v1.0.2 // indirect
+	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
 	github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect
 	github.com/fatih/camelcase v1.0.0 // indirect
 	github.com/fatih/color v1.16.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
 	github.com/go-errors/errors v1.4.2 // indirect
-	github.com/go-logr/logr v1.4.2 // indirect
+	github.com/go-logr/logr v1.4.3 // indirect
 	github.com/go-openapi/jsonpointer v0.21.0 // indirect
 	github.com/go-openapi/jsonreference v0.20.2 // indirect
 	github.com/go-openapi/swag v0.23.0 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
 	github.com/google/btree v1.1.3 // indirect
-	github.com/google/gnostic-models v0.6.9 // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/google/uuid v1.6.0 // indirect
-	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
 	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
-	github.com/hashicorp/cli v1.1.7 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-checkpoint v0.5.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/go-retryablehttp v0.7.7 // indirect
 	github.com/hashicorp/go-uuid v1.0.3 // indirect
 	github.com/hashicorp/logutils v1.0.0 // indirect
-	github.com/hashicorp/terraform-registry-address v0.2.5 // indirect
+	github.com/hashicorp/terraform-registry-address v0.3.0 // indirect
 	github.com/hashicorp/terraform-svchost v0.1.1 // indirect
 	github.com/hashicorp/yamux v0.1.2 // indirect
-	github.com/huandu/xstrings v1.3.3 // indirect
 	github.com/imdario/mergo v0.3.15 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
-	github.com/invopop/yaml v0.1.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/json-iterator/go v1.1.12 // indirect
 	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
 	github.com/mailru/easyjson v0.7.7 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/mattn/go-runewidth v0.0.9 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
@ -107,53 +122,36 @@ require (
 	github.com/moby/term v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/modern-go/reflect2 v1.0.2 // indirect
-	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826 // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
-	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
 	github.com/oklog/run v1.1.0 // indirect
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
 	github.com/pkg/errors v0.9.1 // indirect
-	github.com/pmezard/go-difflib v1.0.0 // indirect
-	github.com/posener/complete v1.2.3 // indirect
-	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/shopspring/decimal v1.3.1 // indirect
-	github.com/spf13/cast v1.5.0 // indirect
+	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
+	github.com/russross/blackfriday v1.6.0 // indirect
 	github.com/spf13/cobra v1.8.1 // indirect
 	github.com/spf13/pflag v1.0.5 // indirect
 	github.com/vmihailenco/msgpack v4.0.4+incompatible // indirect
-	github.com/vmihailenco/msgpack/v5 v5.4.1 // indirect
-	github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
-	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
-	github.com/yuin/goldmark v1.7.7 // indirect
-	github.com/yuin/goldmark-meta v1.1.0 // indirect
-	go.abhg.dev/goldmark/frontmatter v0.2.0 // indirect
+	github.com/zclconf/go-cty v1.16.3
 	golang.org/x/crypto v0.39.0 // indirect
-	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56 // indirect
-	golang.org/x/net v0.40.0 // indirect
-	golang.org/x/oauth2 v0.27.0 // indirect
-	golang.org/x/sync v0.15.0 // indirect
-	golang.org/x/sys v0.33.0 // indirect
-	golang.org/x/term v0.32.0 // indirect
-	golang.org/x/text v0.26.0 // indirect
+	golang.org/x/net v0.41.0 // indirect
+	golang.org/x/oauth2 v0.30.0 // indirect
+	golang.org/x/sys v0.35.0 // indirect
+	golang.org/x/term v0.34.0 // indirect
+	golang.org/x/text v0.27.0 // indirect
 	golang.org/x/time v0.9.0 // indirect
-	golang.org/x/tools v0.33.0 // indirect
 	google.golang.org/appengine v1.6.8 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a // indirect
-	google.golang.org/protobuf v1.36.6 // indirect
-	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
+	google.golang.org/grpc v1.72.1
+	google.golang.org/protobuf v1.36.9 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	gopkg.in/yaml.v2 v2.4.0 // indirect
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 	k8s.io/cli-runtime v0.33.4 // indirect
 	k8s.io/component-base v0.33.4 // indirect
-	k8s.io/component-helpers v0.33.4 // indirect
 	k8s.io/klog/v2 v2.130.1 // indirect
 	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff // indirect
+	k8s.io/utils v0.0.0-20241104100929-3ea5e8cea738
 	sigs.k8s.io/json v0.0.0-20241010143419-9aa6b5e7a4b3 // indirect
 	sigs.k8s.io/kustomize/api v0.19.0 // indirect
 	sigs.k8s.io/kustomize/kyaml v0.19.0 // indirect
-	sigs.k8s.io/randfill v1.0.0 // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.6.0 // indirect
 )
--- a/go.sum
+++ b/go.sum
@ -2,29 +2,28 @@ dario.cat/mergo v1.0.0 h1:AGCNq9Evsj31mOgNPcLyXc+4PNABt905YmuqPYYpBWk=
 dario.cat/mergo v1.0.0/go.mod h1:uNxQE+84aUszobStD9th8a29P2fMDhsBdgRYvZOxGmk=
 github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 h1:L/gRVlceqvL25UVaW/CKtUDjefjrs0SPonmDGUVOYP0=
 github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161/go.mod h1:xomTg63KZ2rFqZQzSB4Vz2SUXa1BpHTVz9L5PTmPC4E=
-github.com/BurntSushi/toml v1.2.1 h1:9F2/+DoOYIOksmaJFPw1tGFy1eDnIJXg+UHjuD8lTak=
-github.com/BurntSushi/toml v1.2.1/go.mod h1:CxXYINrC8qIiEnFrOxCa7Jy5BFHlXnUU2pbicEuybxQ=
-github.com/Kunde21/markdownfmt/v3 v3.1.0 h1:KiZu9LKs+wFFBQKhrZJrFZwtLnCCWJahL+S+E/3VnM0=
-github.com/Kunde21/markdownfmt/v3 v3.1.0/go.mod h1:tPXN1RTyOzJwhfHoon9wUr4HGYmWgVxSQN6VBJDkrVc=
 github.com/MakeNowJust/heredoc v1.0.0 h1:cXCdzVdstXyiTqTvfqk9SDHpKNjxuom+DOlyEeQ4pzQ=
 github.com/MakeNowJust/heredoc v1.0.0/go.mod h1:mG5amYoWBHf8vpLOuehzbGGw0EHxpZZ6lCpQ4fNJ8LE=
 github.com/Masterminds/goutils v1.1.1 h1:5nUrii3FMTL5diU80unEVvNevw1nH4+ZV4DSLVJLSYI=
 github.com/Masterminds/goutils v1.1.1/go.mod h1:8cTjp+g8YejhMuvIA5y2vz3BpJxksy863GQaJW2MFNU=
 github.com/Masterminds/semver v1.5.0 h1:H65muMkzWKEuNDnfl9d70GUjFniHKHRbFPGBuZ3QEww=
 github.com/Masterminds/semver v1.5.0/go.mod h1:MB6lktGJrhw8PrUyiEoblNEGEQ+RzHPF078ddwwvV3Y=
+github.com/Masterminds/semver/v3 v3.1.1/go.mod h1:VPu/7SZ7ePZ3QOrcuXROw5FAcLl4a0cBrbBpGY/8hQs=
 github.com/Masterminds/semver/v3 v3.2.0 h1:3MEsd0SM6jqZojhjLWWeBY+Kcjy9i6MQAeY7YgDP83g=
 github.com/Masterminds/semver/v3 v3.2.0/go.mod h1:qvl/7zhW3nngYb5+80sSMF+FG2BjYrf8m9wsX0PNOMQ=
+github.com/Masterminds/sprig/v3 v3.2.1/go.mod h1:UoaO7Yp8KlPnJIYWTFkMaqPUYKTfGFPhxNuwnnxkKlk=
 github.com/Masterminds/sprig/v3 v3.2.3 h1:eL2fZNezLomi0uOLqjQoN6BfsDD+fyLtgbJMAj9n6YA=
 github.com/Masterminds/sprig/v3 v3.2.3/go.mod h1:rXcFaZ2zZbLRJv/xSysmlgIM1u11eBaRMhvYXJNkGuM=
 github.com/Microsoft/go-winio v0.6.2 h1:F2VQgta7ecxGYO8k3ZZz3RS8fVIXVxONVUPlNERoyfY=
 github.com/Microsoft/go-winio v0.6.2/go.mod h1:yd8OoFMLzJbo9gZq8j5qaps8bJ9aShtEA8Ipt1oGCvU=
 github.com/ProtonMail/go-crypto v1.1.6 h1:ZcV+Ropw6Qn0AX9brlQLAUXfqLBc7Bl+f/DmNxpLfdw=
 github.com/ProtonMail/go-crypto v1.1.6/go.mod h1:rA3QumHc/FZ8pAHreoekgiAbzpNsfQAosU5td4SnOrE=
-github.com/agext/levenshtein v1.2.2 h1:0S/Yg6LYmFJ5stwQeRp6EeOcCbj7xiqQSdNelsXvaqE=
-github.com/agext/levenshtein v1.2.2/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
+github.com/agext/levenshtein v1.2.3 h1:YB2fHEn0UJagG8T1rrWknE3ZQzWM06O8AMAatNn7lmo=
+github.com/agext/levenshtein v1.2.3/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
 github.com/apparentlymart/go-textseg/v12 v12.0.0/go.mod h1:S/4uRK2UtaQttw1GenVJEynmyUenKwP++x/+DdGV/Ec=
 github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
 github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
+github.com/armon/go-radix v0.0.0-20180808171621-7fddfc383310/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
 github.com/armon/go-radix v1.0.0/go.mod h1:ufUuZ+zHj4x4TnLV4JWEpy2hxWSpsRywHrMgIH9cCH8=
 github.com/armon/go-socks5 v0.0.0-20160902184237-e75332964ef5 h1:0CwZNZbxp69SHPdPJAN/hZIm0C4OItdklCFmMRWYpio=
@ -33,8 +32,6 @@ github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQ
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/blang/semver/v4 v4.0.0 h1:1PFHFE6yCCTv8C1TeyNNarDzntLi7wMI5i/pzqYIsAM=
 github.com/blang/semver/v4 v4.0.0/go.mod h1:IbckMUScFkM3pff0VJDNKRiT6TG/YpiHIM2yvyW5YoQ=
-github.com/bmatcuk/doublestar/v4 v4.8.1 h1:54Bopc5c2cAvhLRAzqOGCYHYyhcDHsFF4wWIR5wKP38=
-github.com/bmatcuk/doublestar/v4 v4.8.1/go.mod h1:xBQ8jztBU6kakFMg+8WGxn0c6z1fTSPVIjEY1Wr7jzc=
 github.com/bufbuild/protocompile v0.14.1 h1:iA73zAf/fyljNjQKwYzUHD6AD4R8KMasmwa/FBatYVw=
 github.com/bufbuild/protocompile v0.14.1/go.mod h1:ppVdAIhbr2H8asPk6k4pY7t9zB1OU5DoEw9xY/FUi1c=
 github.com/chai2010/gettext-go v1.0.2 h1:1Lwwip6Q2QGsAdl/ZKPCwTe9fe0CjlUbqj5bFNSjIRk=
@ -48,8 +45,9 @@ github.com/creack/pty v1.1.18/go.mod h1:MOBLtS5ELjhRRrroQr9kyvTxUAFNvYEK993ew/Vr
 github.com/cyphar/filepath-securejoin v0.4.1 h1:JyxxyPEaktOD+GAnqIqTf9A8tHyAG22rowi7HkoSU1s=
 github.com/cyphar/filepath-securejoin v0.4.1/go.mod h1:Sdj7gXlvMcPZsbhwhQ33GguGLDGQL7h7bg04C/+u9jI=
 github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c=
 github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
+github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
 github.com/emicklei/go-restful/v3 v3.11.0 h1:rAQeMHw1c7zTmncogyy8VvRZwtkmkZ4FxERmMY4rD+g=
 github.com/emicklei/go-restful/v3 v3.11.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
 github.com/emirpasic/gods v1.18.1 h1:FXtiHYKDGKCW2KzwZKx0iC0PQmdlorYgdFG9jPXJ1Bc=
@ -58,6 +56,7 @@ github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f h1:Wl78ApPPB2
 github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f/go.mod h1:OSYXu++VVOHnXeitef/D8n/6y4QV8uLHSFXX4NeXMGc=
 github.com/fatih/camelcase v1.0.0 h1:hxNvNX/xYBp0ovncs8WyWZrOrpBNub/JfaMvbURyft8=
 github.com/fatih/camelcase v1.0.0/go.mod h1:yN2Sb0lFhZJUdVvtELVWefmrXpuZESvPmqwoZc+/fpc=
+github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4=
 github.com/fatih/color v1.13.0/go.mod h1:kLAiJbzzSOZDVNGyDpeOxJ47H46qBXwg5ILebYFFOfk=
 github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM=
 github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE=
@ -75,8 +74,8 @@ github.com/go-git/go-billy/v5 v5.6.2 h1:6Q86EsPXMa7c3YZ3aLAQsMA0VlWmy43r6FHqa/UN
 github.com/go-git/go-billy/v5 v5.6.2/go.mod h1:rcFC2rAsp/erv7CMz9GczHcuD0D32fWzH+MJAU+jaUU=
 github.com/go-git/go-git/v5 v5.14.0 h1:/MD3lCrGjCen5WfEAzKg00MJJffKhC8gzS80ycmCi60=
 github.com/go-git/go-git/v5 v5.14.0/go.mod h1:Z5Xhoia5PcWA3NF8vRLURn9E5FRhSl7dGj9ItW3Wk5k=
-github.com/go-logr/logr v1.4.2 h1:6pFjapn8bFcIbiKo3XT4j/BhANplGihG6tvd+8rYgrY=
-github.com/go-logr/logr v1.4.2/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
+github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
+github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
 github.com/go-logr/stdr v1.2.2 h1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=
 github.com/go-logr/stdr v1.2.2/go.mod h1:mMo/vtBO5dYbehREoey6XUKy/eSumjCCveDpRre4VKE=
 github.com/go-openapi/jsonpointer v0.19.5/go.mod h1:Pl9vOtqEWErmShwVjC8pYs9cog34VGT37dQOVbmoatg=
@ -117,6 +116,7 @@ github.com/google/pprof v0.0.0-20241029153458-d1b30febd7db/go.mod h1:vavhavw2zAx
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 h1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=
 github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510/go.mod h1:pupxD2MaaD3pAXIBCelhxNneeOaAeabZDe5s4K6zSpQ=
 github.com/google/uuid v1.1.1/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
+github.com/google/uuid v1.1.2/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/gorilla/mux v1.8.0/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=
@ -124,8 +124,6 @@ github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5T
 github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 h1:+ngKgrYPPJrOjhax5N+uePQ0Fh1Z7PheYoUI/0nzkPA=
 github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79/go.mod h1:FecbI9+v66THATjSRHfNgh1IVFe/9kFxbXtjV0ctIMA=
-github.com/hashicorp/cli v1.1.7 h1:/fZJ+hNdwfTSfsxMBa9WWMlfjUZbX8/LnUxgAd7lCVU=
-github.com/hashicorp/cli v1.1.7/go.mod h1:e6Mfpga9OCT1vqzFuoGZiiF/KaG9CbUfO5s3ghU3YgU=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@ -152,18 +150,22 @@ github.com/hashicorp/go-version v1.7.0 h1:5tqGy27NaOTB8yJKUZELlFAS/LTKJkrmONwQKe
 github.com/hashicorp/go-version v1.7.0/go.mod h1:fltr4n8CU8Ke44wwGCBoEymUuxUHl09ZGVZPK5anwXA=
 github.com/hashicorp/hc-install v0.9.2 h1:v80EtNX4fCVHqzL9Lg/2xkp62bbvQMnvPQ0G+OmtO24=
 github.com/hashicorp/hc-install v0.9.2/go.mod h1:XUqBQNnuT4RsxoxiM9ZaUk0NX8hi2h+Lb6/c0OZnC/I=
-github.com/hashicorp/hcl/v2 v2.24.0 h1:2QJdZ454DSsYGoaE6QheQZjtKZSUs9Nh2izTWiwQxvE=
-github.com/hashicorp/hcl/v2 v2.24.0/go.mod h1:oGoO1FIQYfn/AgyOhlg9qLC6/nOJPX3qGbkZpYAcqfM=
+github.com/hashicorp/hcl/v2 v2.23.0 h1:Fphj1/gCylPxHutVSEOf2fBOh1VE4AuLV7+kbJf3qos=
+github.com/hashicorp/hcl/v2 v2.23.0/go.mod h1:62ZYHrXgPoX8xBnzl8QzbWq4dyDsDtfCRgIq1rbJEvA=
 github.com/hashicorp/logutils v1.0.0 h1:dLEQVugN8vlakKOUE3ihGLTZJRB4j+M2cdTm/ORI65Y=
 github.com/hashicorp/logutils v1.0.0/go.mod h1:QIAnNjmIWmVIIkWDTG1z5v++HQmx9WQRO+LraFDTW64=
-github.com/hashicorp/terraform-exec v0.23.1 h1:diK5NSSDXDKqHEOIQefBMu9ny+FhzwlwV0xgUTB7VTo=
-github.com/hashicorp/terraform-exec v0.23.1/go.mod h1:e4ZEg9BJDRaSalGm2z8vvrPONt0XWG0/tXpmzYTf+dM=
-github.com/hashicorp/terraform-json v0.26.0 h1:+BnJavhRH+oyNWPnfzrfQwVWCZBFMvjdiH2Vi38Udz4=
-github.com/hashicorp/terraform-json v0.26.0/go.mod h1:eyWCeC3nrZamyrKLFnrvwpc3LQPIJsx8hWHQ/nu2/v4=
-github.com/hashicorp/terraform-plugin-docs v0.22.0 h1:fwIDStbFel1PPNkM+mDPnpB4efHZBdGoMz/zt5FbTDw=
-github.com/hashicorp/terraform-plugin-docs v0.22.0/go.mod h1:55DJVyZ7BNK4t/lANcQ1YpemRuS6KsvIO1BbGA+xzGE=
+github.com/hashicorp/terraform-exec v0.23.0 h1:MUiBM1s0CNlRFsCLJuM5wXZrzA3MnPYEsiXmzATMW/I=
+github.com/hashicorp/terraform-exec v0.23.0/go.mod h1:mA+qnx1R8eePycfwKkCRk3Wy65mwInvlpAeOwmA7vlY=
+github.com/hashicorp/terraform-json v0.25.0 h1:rmNqc/CIfcWawGiwXmRuiXJKEiJu1ntGoxseG1hLhoQ=
+github.com/hashicorp/terraform-json v0.25.0/go.mod h1:sMKS8fiRDX4rVlR6EJUMudg1WcanxCMoWwTLkgZP/vc=
+github.com/hashicorp/terraform-plugin-docs v0.16.0 h1:UmxFr3AScl6Wged84jndJIfFccGyBZn52KtMNsS12dI=
+github.com/hashicorp/terraform-plugin-docs v0.16.0/go.mod h1:M3ZrlKBJAbPMtNOPwHicGi1c+hZUh7/g0ifT/z7TVfA=
 github.com/hashicorp/terraform-plugin-framework v1.15.1 h1:2mKDkwb8rlx/tvJTlIcpw0ykcmvdWv+4gY3SIgk8Pq8=
 github.com/hashicorp/terraform-plugin-framework v1.15.1/go.mod h1:hxrNI/GY32KPISpWqlCoTLM9JZsGH3CyYlir09bD/fI=
+github.com/hashicorp/terraform-plugin-framework-timeouts v0.5.0 h1:I/N0g/eLZ1ZkLZXUQ0oRSXa8YG/EF0CEuQP1wXdrzKw=
+github.com/hashicorp/terraform-plugin-framework-timeouts v0.5.0/go.mod h1:t339KhmxnaF4SzdpxmqW8HnQBHVGYazwtfxU0qCs4eE=
+github.com/hashicorp/terraform-plugin-framework-validators v0.18.0 h1:OQnlOt98ua//rCw+QhBbSqfW3QbwtVrcdWeQN5gI3Hw=
+github.com/hashicorp/terraform-plugin-framework-validators v0.18.0/go.mod h1:lZvZvagw5hsJwuY7mAY6KUz45/U6fiDR0CzQAwWD0CA=
 github.com/hashicorp/terraform-plugin-go v0.28.0 h1:zJmu2UDwhVN0J+J20RE5huiF3XXlTYVIleaevHZgKPA=
 github.com/hashicorp/terraform-plugin-go v0.28.0/go.mod h1:FDa2Bb3uumkTGSkTFpWSOwWJDwA7bf3vdP3ltLDTH6o=
 github.com/hashicorp/terraform-plugin-log v0.9.0 h1:i7hOA+vdAItN1/7UrfBqBwvYPQ9TFvymaRGZED3FCV0=
@ -174,12 +176,14 @@ github.com/hashicorp/terraform-plugin-sdk/v2 v2.37.0 h1:NFPMacTrY/IdcIcnUB+7hsor
 github.com/hashicorp/terraform-plugin-sdk/v2 v2.37.0/go.mod h1:QYmYnLfsosrxjCnGY1p9c7Zj6n9thnEE+7RObeYs3fA=
 github.com/hashicorp/terraform-plugin-testing v1.13.3 h1:QLi/khB8Z0a5L54AfPrHukFpnwsGL8cwwswj4RZduCo=
 github.com/hashicorp/terraform-plugin-testing v1.13.3/go.mod h1:WHQ9FDdiLoneey2/QHpGM/6SAYf4A7AZazVg7230pLE=
-github.com/hashicorp/terraform-registry-address v0.2.5 h1:2GTftHqmUhVOeuu9CW3kwDkRe4pcBDq0uuK5VJngU1M=
-github.com/hashicorp/terraform-registry-address v0.2.5/go.mod h1:PpzXWINwB5kuVS5CA7m1+eO2f1jKb5ZDIxrOPfpnGkg=
+github.com/hashicorp/terraform-registry-address v0.3.0 h1:HMpK3nqaGFPS9VmgRXrJL/dzHNdheGVKk5k7VlFxzCo=
+github.com/hashicorp/terraform-registry-address v0.3.0/go.mod h1:jRGCMiLaY9zii3GLC7hqpSnwhfnCN5yzvY0hh4iCGbM=
 github.com/hashicorp/terraform-svchost v0.1.1 h1:EZZimZ1GxdqFRinZ1tpJwVxxt49xc/S52uzrw4x0jKQ=
 github.com/hashicorp/terraform-svchost v0.1.1/go.mod h1:mNsjQfZyf/Jhz35v6/0LWcv26+X7JPS+buii2c9/ctc=
 github.com/hashicorp/yamux v0.1.2 h1:XtB8kyFOyHXYVFnwT5C3+Bdo8gArse7j2AQ0DA0Uey8=
 github.com/hashicorp/yamux v0.1.2/go.mod h1:C+zze2n6e/7wshOZep2A70/aQU6QBRWJO/G6FT1wIns=
+github.com/huandu/xstrings v1.3.1/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
+github.com/huandu/xstrings v1.3.2/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/huandu/xstrings v1.3.3 h1:/Gcsuc1x8JVbJ9/rlye4xZnVAbEkGauT8lbebqcQws4=
 github.com/huandu/xstrings v1.3.3/go.mod h1:y5/lhBue+AyNmUVz9RLU9xbLR0o4KIIExikq4ovT0aE=
 github.com/imdario/mergo v0.3.11/go.mod h1:jmQim1M+e3UYxmgPu/WyfjB3N3VflVyUjjjwH0dnCYA=
@ -187,8 +191,9 @@ github.com/imdario/mergo v0.3.15 h1:M8XP7IuFNsqUx6VPK2P9OSmsYsI/YFaGil0uD21V3dM=
 github.com/imdario/mergo v0.3.15/go.mod h1:WBLT9ZmE3lPoWsEzCh9LPo3TiwVN+ZKEjmz+hD27ysY=
 github.com/inconshreveable/mousetrap v1.1.0 h1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=
 github.com/inconshreveable/mousetrap v1.1.0/go.mod h1:vpF70FUmC8bwa3OWnCshd2FqLfsEA9PFc4w1p2J65bw=
-github.com/invopop/yaml v0.1.0 h1:YW3WGUoJEXYfzWBjn00zIlrw7brGVD0fUKRYDPAPhrc=
 github.com/invopop/yaml v0.1.0/go.mod h1:2XuRLgs/ouIrW3XNzuNj7J3Nvu/Dig5MXvbCEdiBN3Q=
+github.com/invopop/yaml v0.2.0 h1:7zky/qH+O0DwAyoobXUqvVBwgBFRxKoQ/3FjcVpjTMY=
+github.com/invopop/yaml v0.2.0/go.mod h1:2XuRLgs/ouIrW3XNzuNj7J3Nvu/Dig5MXvbCEdiBN3Q=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 h1:BQSFePA1RWJOlocH6Fxy8MmwDt+yVQYULKfN0RoTN8A=
 github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99/go.mod h1:1lJo3i6rXxKeerYnT8Nvf0QmHCRC1n8sfWVwXF2Frvo=
 github.com/jhump/protoreflect v1.17.0 h1:qOEr613fac2lOuTgWN4tPAtLL7fUSbuJL5X5XumQh94=
@ -219,16 +224,18 @@ github.com/mailru/easyjson v0.0.0-20190614124828-94de47d64c63/go.mod h1:C1wdFJiN
 github.com/mailru/easyjson v0.0.0-20190626092158-b2ccc519800e/go.mod h1:C1wdFJiN94OJF2b5HbByQZoLdCWB1Yqtg26g4irojpc=
 github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
 github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
+github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU=
 github.com/mattn/go-colorable v0.1.9/go.mod h1:u6P/XSegPjTcexA+o6vUJrdnUu04hMope9wVRipJSqc=
 github.com/mattn/go-colorable v0.1.12/go.mod h1:u5H1YNBxpqRaxsYJYSkiCWKzEfiAb1Gb520KVy5xxl4=
 github.com/mattn/go-colorable v0.1.14 h1:9A9LHSqF/7dyVVX6g0U9cwm9pG3kP9gSzcuIPHPsaIE=
 github.com/mattn/go-colorable v0.1.14/go.mod h1:6LmQG8QLFO4G5z1gPvYEzlUgJ2wF+stgPZH1UqBm1s8=
+github.com/mattn/go-isatty v0.0.3/go.mod h1:M+lRXTBqGeGNdLjl/ufCoiOlB5xdOkqRJdNxMWT7Zi4=
 github.com/mattn/go-isatty v0.0.12/go.mod h1:cbi8OIDigv2wuxKPP5vlRcQ1OAZbq2CE4Kysco4FUpU=
 github.com/mattn/go-isatty v0.0.14/go.mod h1:7GGIvUiUoEMVVmxf/4nioHXj79iQHKdU27kJ6hsGG94=
 github.com/mattn/go-isatty v0.0.20 h1:xfD0iDuEKnDkl03q4limB+vH+GxLEtL/jb4xVJSWWEY=
 github.com/mattn/go-isatty v0.0.20/go.mod h1:W+V8PltTTMOvKvAeJH7IuucS94S2C6jfK/D7dTCTo3Y=
-github.com/mattn/go-runewidth v0.0.9 h1:Lm995f3rfxdpd6TSmuVCHVb/QhupuXlYr8sCI/QdE+0=
-github.com/mattn/go-runewidth v0.0.9/go.mod h1:H031xJmbD/WCDINGzjvQ9THkh0rPKHF+m2gUSrubnMI=
+github.com/mitchellh/cli v1.1.5 h1:OxRIeJXpAMztws/XHlN2vu6imG5Dpq+j61AzAX5fLng=
+github.com/mitchellh/cli v1.1.5/go.mod h1:v8+iFts2sPIKUV1ltktPXMCC8fumSKFItNcD2cLtRR4=
 github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
 github.com/mitchellh/copystructure v1.2.0 h1:vpKXTN4ewci03Vljg/q9QvCGUDttBOGBIa15WveJJGw=
 github.com/mitchellh/copystructure v1.2.0/go.mod h1:qLl+cE2AmVv+CoeAwDPye/v+N2HKCj9FbZEVFJRxO9s=
@ -274,14 +281,18 @@ github.com/pjbgf/sha1cd v0.3.2 h1:a9wb0bp1oC2TGwStyn0Umc/IGKQnEgF0vVaZ8QF8eo4=
 github.com/pjbgf/sha1cd v0.3.2/go.mod h1:zQWigSxVmsHEZow5qaLtPYxpcKMMQpa09ixqBxuCS6A=
 github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=
 github.com/pkg/errors v0.9.1/go.mod h1:bwawxfHBFNV+L2hUp1rHADufV3IMtnDRdf1r5NINEl0=
-github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
 github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
+github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
+github.com/posener/complete v1.1.1/go.mod h1:em0nMJCgc9GFtwrmVmEMR/ZL6WyhyjMBndrE9hABlRI=
 github.com/posener/complete v1.2.3 h1:NP0eAhjcjImqslEwo/1hq7gpajME0fTLTezBKDqfXqo=
 github.com/posener/complete v1.2.3/go.mod h1:WZIdtGGp+qx0sLrYKtIRAruyNpv6hFCicSgv7Sy7s/s=
 github.com/robfig/cron v1.2.0 h1:ZjScXvvxeQ63Dbyxy76Fj3AT3Ut0aKsyd2/tl3DTMuQ=
 github.com/robfig/cron v1.2.0/go.mod h1:JGuDeoQd7Z6yL4zQhZ3OPEVHB7fL6Ka6skscFHfmt2k=
-github.com/rogpeppe/go-internal v1.14.1 h1:UQB4HGPB6osV0SQTLymcB4TgvyWu6ZyliaW0tI/otEQ=
-github.com/rogpeppe/go-internal v1.14.1/go.mod h1:MaRKkUm5W0goXpeCfT7UZI6fk/L7L7so1lCWt35ZSgc=
+github.com/rogpeppe/go-internal v1.13.1 h1:KvO1DLK/DRN07sQ1LQKScxyZJuNnedQ5/wKSR38lUII=
+github.com/rogpeppe/go-internal v1.13.1/go.mod h1:uMEvuHeurkdAXX61udpOXGD/AzZDWNMNyH2VO9fmH0o=
+github.com/russross/blackfriday v1.6.0 h1:KqfZb0pUVN2lYqZUYRddxF4OR8ZMURnJIG5Y3VRLtww=
+github.com/russross/blackfriday v1.6.0/go.mod h1:ti0ldHuxg49ri4ksnFxlkCfN+hvslNlmVHqNRXXJNAY=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
@ -331,16 +342,10 @@ github.com/xlab/treeprint v1.2.0/go.mod h1:gj5Gd3gPdKtR1ikdDK6fnFLdmIS0X30kTTuNd
 github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
 github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
-github.com/yuin/goldmark v1.7.7 h1:5m9rrB1sW3JUMToKFQfb+FGt1U7r57IHu5GrYrG2nqU=
-github.com/yuin/goldmark v1.7.7/go.mod h1:uzxRWxtg69N339t3louHJ7+O03ezfj6PlliRlaOzY1E=
-github.com/yuin/goldmark-meta v1.1.0 h1:pWw+JLHGZe8Rk0EGsMVssiNb/AaPMHfSRszZeUeiOUc=
-github.com/yuin/goldmark-meta v1.1.0/go.mod h1:U4spWENafuA7Zyg+Lj5RqK/MF+ovMYtBvXi1lBb2VP0=
-github.com/zclconf/go-cty v1.16.4 h1:QGXaag7/7dCzb+odlGrgr+YmYZFaOCMW6DEpS+UD1eE=
-github.com/zclconf/go-cty v1.16.4/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
+github.com/zclconf/go-cty v1.16.3 h1:osr++gw2T61A8KVYHoQiFbFd1Lh3JOCXc/jFLJXKTxk=
+github.com/zclconf/go-cty v1.16.3/go.mod h1:VvMs5i0vgZdhYawQNq5kePSpLAoz8u1xvZgrPIxfnZE=
 github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940 h1:4r45xpDWB6ZMSMNJFMOjqrGHynW3DIBuR2H9j0ug+Mo=
 github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940/go.mod h1:CmBdvvj3nqzfzJ6nTCIwDTPZ56aVGvDrmztiO5g3qrM=
-go.abhg.dev/goldmark/frontmatter v0.2.0 h1:P8kPG0YkL12+aYk2yU3xHv4tcXzeVnN+gU0tJ5JnxRw=
-go.abhg.dev/goldmark/frontmatter v0.2.0/go.mod h1:XqrEkZuM57djk7zrlRUB02x8I5J0px76YjkOzhB4YlU=
 go.opentelemetry.io/auto/sdk v1.1.0 h1:cH53jehLUN6UFLY71z+NDOiNJqDdPRaXzTel0sJySYA=
 go.opentelemetry.io/auto/sdk v1.1.0/go.mod h1:3wSPjt5PWp2RhlCcmmOial7AvC4DQqZb7a7wCow3W8A=
 go.opentelemetry.io/otel v1.34.0 h1:zRLXxLCgL1WyKsPVrgbSdMN4c0FMkDAskSTQP+0hdUY=
@ -357,7 +362,9 @@ go.uber.org/goleak v1.3.0 h1:2K3zAYmnTNqV73imy9J1T3WC+gmCePx2hEGkimedGto=
 go.uber.org/goleak v1.3.0/go.mod h1:CoHD4mav9JJNrW/WLlf7HGZPjdw8EucARQHekz1X6bE=
 golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
 golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
+golang.org/x/crypto v0.0.0-20200414173820-0848c9571904/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
+golang.org/x/crypto v0.0.0-20200820211705-5c72a883971a/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
 golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
 golang.org/x/crypto v0.3.0/go.mod h1:hebNnKkNXi2UzZN1eVRvBB7co0a+JxK6XbPiWVs/3J4=
 golang.org/x/crypto v0.39.0 h1:SHs+kF4LP+f+p14esP5jAoDpHU8Gu/v9lFRK6IT5imM=
@ -367,8 +374,8 @@ golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56/go.mod h1:M4RDyNAINzryxdtnbR
 golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
 golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
-golang.org/x/mod v0.25.0 h1:n7a+ZbQKQA/Ysbyb0/6IbB1H/X41mKgbhfv7AfG/44w=
-golang.org/x/mod v0.25.0/go.mod h1:IXM97Txy2VM4PJ3gI61r1YEk/gAj6zAHN3AdZt6S9Ww=
+golang.org/x/mod v0.26.0 h1:EGMPT//Ezu+ylkCijjPc+f4Aih7sZvaAr+O3EHBxvZg=
+golang.org/x/mod v0.26.0/go.mod h1:/j6NAhSk8iQ723BGAUyoAcn7SlD7s15Dp9Nd/SfeaFQ=
 golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg=
 golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
 golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
@ -376,17 +383,17 @@ golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwY
 golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
 golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
 golang.org/x/net v0.2.0/go.mod h1:KqCZLdyyvdV855qA2rE3GC2aiw5xGR5TEjj8smXukLY=
-golang.org/x/net v0.40.0 h1:79Xs7wF06Gbdcg4kdCCIQArK11Z1hr5POQ6+fIYHNuY=
-golang.org/x/net v0.40.0/go.mod h1:y0hY0exeL2Pku80/zKK7tpntoX23cqL3Oa6njdgRtds=
-golang.org/x/oauth2 v0.27.0 h1:da9Vo7/tDv5RH/7nZDz1eMGS/q1Vv1N/7FCrBhI9I3M=
-golang.org/x/oauth2 v0.27.0/go.mod h1:onh5ek6nERTohokkhCD/y2cV4Do3fxFHFuAejCkRWT8=
+golang.org/x/net v0.41.0 h1:vBTly1HeNPEn3wtREYfy4GZ/NECgw2Cnl+nK6Nz3uvw=
+golang.org/x/net v0.41.0/go.mod h1:B/K4NNqkfmg07DQYrbwvSluqCJOOXwUjeb/5lOisjbA=
+golang.org/x/oauth2 v0.30.0 h1:dnDm7JmhM45NNpd8FDDeLhK6FwqbOf4MLCM9zb1BOHI=
+golang.org/x/oauth2 v0.30.0/go.mod h1:B++QgG3ZKulg6sRPGD/mqlHQs5rB3Ml9erfeDY7xKlU=
 golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
 golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
-golang.org/x/sync v0.15.0 h1:KWH3jNZsfyT6xfAfKiz6MRNmd46ByHDYaZ7KSkCtdW8=
-golang.org/x/sync v0.15.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
+golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw=
+golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA=
 golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=
 golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
 golang.org/x/sys v0.0.0-20200116001909-b77594299b42/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=
@ -402,20 +409,20 @@ golang.org/x/sys v0.0.0-20220520151302-bc2c85ada10a/go.mod h1:oPkhp1MJrh7nUepCBc
 golang.org/x/sys v0.0.0-20220722155257-8c9f86f7a55f/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
-golang.org/x/sys v0.33.0 h1:q3i8TbbEz+JRD9ywIRlyRAQbM0qF7hu24q3teo2hbuw=
-golang.org/x/sys v0.33.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
+golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI=
+golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
 golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
 golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
 golang.org/x/term v0.2.0/go.mod h1:TVmDHMZPmdnySmBfhjOoOdhjzdE1h4u1VwSiw2l1Nuc=
-golang.org/x/term v0.32.0 h1:DR4lr0TjUs3epypdhTOkMmuF5CDFJ/8pOnbzMZPQ7bg=
-golang.org/x/term v0.32.0/go.mod h1:uZG1FhGx848Sqfsq4/DlJr3xGGsYMu/L5GW4abiaEPQ=
+golang.org/x/term v0.34.0 h1:O/2T7POpk0ZZ7MAzMeWFSg6S5IpWd/RXDlM9hgM3DR4=
+golang.org/x/term v0.34.0/go.mod h1:5jC53AEywhIVebHgPVeg0mj8OD3VO9OzclacVrqpaAw=
 golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
 golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
 golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ=
 golang.org/x/text v0.3.8/go.mod h1:E6s5w1FMmriuDzIBO73fBruAKo1PCIq6d2Q6DHfQ8WQ=
 golang.org/x/text v0.4.0/go.mod h1:mrYo+phRRbMaCq/xk9113O4dZlRixOauAjOtrjsXDZ8=
-golang.org/x/text v0.26.0 h1:P42AVeLghgTYr4+xUnTRKDMqpar+PtX7KWuNQL21L8M=
-golang.org/x/text v0.26.0/go.mod h1:QK15LZJUUQVJxhz7wXgxSy/CJaTFjd0G+YLonydOVQA=
+golang.org/x/text v0.27.0 h1:4fGWRpyh641NLlecmyl4LOe6yDdfaYNrGb2zdfo4JV4=
+golang.org/x/text v0.27.0/go.mod h1:1D28KMCvyooCX9hBiosv5Tz/+YLxj0j7XhWjpSUF7CU=
 golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
 golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
 golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=
@ -423,8 +430,8 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn
 golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE=
 golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA=
 golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc=
-golang.org/x/tools v0.33.0 h1:4qz2S3zmRxbGIhDIAgjxvFutSvH5EfnsYrRBj0UI0bc=
-golang.org/x/tools v0.33.0/go.mod h1:CIJMaWEY88juyUfo7UbgPqbC8rU2OqfAV1h2Qp0oMYI=
+golang.org/x/tools v0.34.0 h1:qIpSLOxeCYGg9TrcJokLBG4KFA6d795g0xkBkiESGlo=
+golang.org/x/tools v0.34.0/go.mod h1:pAP9OwEaY1CAW3HOmg3hLZC5Z0CCmzjAF2UQMSqNARg=
 golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
 golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
@ -432,14 +439,14 @@ golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8T
 google.golang.org/appengine v1.1.0/go.mod h1:EbEs0AVv82hx2wNQdGPgUI5lhzA/G0D9YwlJXL52JkM=
 google.golang.org/appengine v1.6.8 h1:IhEN5q69dyKagZPYMSdIjS2HqprW324FRQZJcGqPAsM=
 google.golang.org/appengine v1.6.8/go.mod h1:1jJ3jBArFh5pcgW8gCtRJnepW8FzD1V44FJffLiz/Ds=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a h1:51aaUVRocpvUOSQKM6Q7VuoaktNIaMCLuhZB6DKksq4=
-google.golang.org/genproto/googleapis/rpc v0.0.0-20250218202821-56aae31c358a/go.mod h1:uRxBH1mhmO8PGhU89cMcHaXKZqO+OfakD8QQO0oYwlQ=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 h1:pFyd6EwwL2TqFf8emdthzeX+gZE1ElRq3iM8pui4KBY=
+google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7/go.mod h1:qQ0YXyHHx3XkvlzUtpXDkS29lDSafHMZBAZDc03LQ3A=
 google.golang.org/grpc v1.72.1 h1:HR03wO6eyZ7lknl75XlxABNVLLFc2PAb6mHlYh756mA=
 google.golang.org/grpc v1.72.1/go.mod h1:wH5Aktxcg25y1I3w7H69nHfXdOG3UiadoBtjh3izSDM=
 google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw=
 google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc=
-google.golang.org/protobuf v1.36.6 h1:z1NpPI8ku2WgiWnf+t9wTPsn6eP1L7ksHUlkfLvd9xY=
-google.golang.org/protobuf v1.36.6/go.mod h1:jduwjTPXsFjZGTmRluh+L6NjiWu7pchiJ2/5YcXBHnY=
+google.golang.org/protobuf v1.36.9 h1:w2gp2mA27hUeUzj9Ex9FBjsBm40zfaDtEWow293U7Iw=
+google.golang.org/protobuf v1.36.9/go.mod h1:fuxRtAxBytpl4zzqUh6/eyUujkJdNiuEkXntxiD/uRU=
 gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20180628173108-788fd7840127/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
@ -452,7 +459,6 @@ gopkg.in/warnings.v0 v0.1.2 h1:wFXVbFY8DY5/xOe1ECiWdKCzZlxgshcYVNkBHstARME=
 gopkg.in/warnings.v0 v0.1.2/go.mod h1:jksf8JmL6Qr/oQM2OXTHunEvvTAsrWBLb6OOjuVWRNI=
 gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
-gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 gopkg.in/yaml.v3 v3.0.0/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
--- a/internal/framework/provider/admissionregistrationv1/admissionregistrationv1_test.go
+++ b/internal/framework/provider/admissionregistrationv1/admissionregistrationv1_test.go
@ -0,0 +1,26 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package admissionregistrationv1_test
+
+import (
+	"context"
+
+	"github.com/hashicorp/terraform-plugin-framework/providerserver"
+	"github.com/hashicorp/terraform-plugin-go/tfprotov6"
+
+	"github.com/hashicorp/terraform-provider-kubernetes/internal/framework/provider"
+	"github.com/hashicorp/terraform-provider-kubernetes/kubernetes"
+
+	sdkv2 "github.com/hashicorp/terraform-plugin-sdk/v2/terraform"
+)
+
+func sdkv2providerMeta() func() any {
+	p := kubernetes.Provider()
+	p.Configure(context.Background(), sdkv2.NewResourceConfigRaw(nil))
+	return p.Meta
+}
+
+var testAccProtoV6ProviderFactories = map[string]func() (tfprotov6.ProviderServer, error){
+	"kubernetes": providerserver.NewProtocol6WithError(provider.New("test", sdkv2providerMeta())),
+}
--- a/internal/framework/provider/admissionregistrationv1/validating_admission_policy.go
+++ b/internal/framework/provider/admissionregistrationv1/validating_admission_policy.go
@ -0,0 +1,52 @@
+// Copyright (c) HashiCorp, Inc.
+
+package admissionregistrationv1
+
+import (
+	"context"
+
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/identityschema"
+)
+
+var (
+	_ resource.Resource                = (*ValidatingAdmissionPolicy)(nil)
+	_ resource.ResourceWithConfigure   = (*ValidatingAdmissionPolicy)(nil)
+	_ resource.ResourceWithImportState = (*ValidatingAdmissionPolicy)(nil)
+	_ resource.ResourceWithIdentity    = (*ValidatingAdmissionPolicy)(nil)
+)
+
+type ValidatingAdmissionPolicy struct {
+	SDKv2Meta func() any
+}
+
+func NewValidatingAdmissionPolicy() resource.Resource {
+	return &ValidatingAdmissionPolicy{}
+}
+
+func (r *ValidatingAdmissionPolicy) Metadata(_ context.Context, req resource.MetadataRequest, resp *resource.MetadataResponse) {
+	resp.TypeName = req.ProviderTypeName + "_validating_admission_policy_v1"
+}
+
+func (r *ValidatingAdmissionPolicy) Configure(_ context.Context, req resource.ConfigureRequest, resp *resource.ConfigureResponse) {
+	if req.ProviderData == nil {
+		return
+	}
+	r.SDKv2Meta = req.ProviderData.(func() any)
+}
+
+func (r *ValidatingAdmissionPolicy) IdentitySchema(_ context.Context, _ resource.IdentitySchemaRequest, resp *resource.IdentitySchemaResponse) {
+	resp.IdentitySchema = identityschema.Schema{
+		Attributes: map[string]identityschema.Attribute{
+			"api_version": identityschema.StringAttribute{
+				RequiredForImport: true,
+			},
+			"kind": identityschema.StringAttribute{
+				RequiredForImport: true,
+			},
+			"name": identityschema.StringAttribute{
+				RequiredForImport: true,
+			},
+		},
+	}
+}
--- a/internal/framework/provider/admissionregistrationv1/validating_admission_policy_crud.go
+++ b/internal/framework/provider/admissionregistrationv1/validating_admission_policy_crud.go
@ -0,0 +1,287 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package admissionregistrationv1
+
+import (
+	"context"
+	"fmt"
+	"time"
+
+	"github.com/hashicorp/terraform-plugin-framework-timeouts/resource/timeouts"
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+
+	"github.com/hashicorp/terraform-provider-kubernetes/kubernetes"
+
+	arv1 "k8s.io/api/admissionregistration/v1"
+	apierrors "k8s.io/apimachinery/pkg/api/errors"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func (r *ValidatingAdmissionPolicy) Create(ctx context.Context, req resource.CreateRequest, resp *resource.CreateResponse) {
+	var plan ValidatingAdmissionPolicyModel
+	resp.Diagnostics.Append(req.Config.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	defaultTimeout, _ := time.ParseDuration("20m")
+	timeout, d := plan.Timeouts.Create(ctx, defaultTimeout)
+	resp.Diagnostics.Append(d...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	ctx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+
+	conn, err := r.SDKv2Meta().(kubernetes.KubeClientsets).MainClientset()
+	if err != nil {
+		resp.Diagnostics.AddError("kubernetes client error", err.Error())
+		return
+	}
+
+	obj := &arv1.ValidatingAdmissionPolicy{
+		ObjectMeta: metav1.ObjectMeta{
+			Name:        plan.Metadata.Name.ValueString(),
+			Labels:      expandStringMap(plan.Metadata.Labels),
+			Annotations: expandStringMap(plan.Metadata.Annotations),
+		},
+		Spec: expandValidatingAdmissionPolicySpec(plan.Spec),
+	}
+
+	out, err := conn.AdmissionregistrationV1().ValidatingAdmissionPolicies().Create(ctx, obj, metav1.CreateOptions{})
+	if err != nil {
+		resp.Diagnostics.AddError(
+			"error creating ValidatingAdmissionPolicy",
+			fmt.Sprintf("Failed to create policy %q: %s", plan.Metadata.Name.ValueString(), err.Error()),
+		)
+		return
+	}
+
+	plan.ID = types.StringValue(out.Name)
+	plan.Metadata.UID = types.StringValue(string(out.UID))
+	plan.Metadata.ResourceVersion = types.StringValue(out.ResourceVersion)
+	plan.Metadata.Generation = types.Int64Value(out.Generation)
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &plan)...)
+
+	identity := ValidatingAdmissionPolicyIdentityModel{
+		APIVersion: types.StringValue("admissionregistration.k8s.io/v1"),
+		Kind:       types.StringValue("ValidatingAdmissionPolicy"),
+		Name:       types.StringValue(out.Name),
+	}
+	resp.Diagnostics.Append(resp.Identity.Set(ctx, identity)...)
+}
+
+func (r *ValidatingAdmissionPolicy) Read(ctx context.Context, req resource.ReadRequest, resp *resource.ReadResponse) {
+	var state ValidatingAdmissionPolicyModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	defaultTimeout, _ := time.ParseDuration("20m")
+	timeout, d := state.Timeouts.Read(ctx, defaultTimeout)
+	resp.Diagnostics.Append(d...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	ctx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+
+	conn, err := r.SDKv2Meta().(kubernetes.KubeClientsets).MainClientset()
+	if err != nil {
+		resp.Diagnostics.AddError("kubernetes client error", err.Error())
+		return
+	}
+
+	name := state.Metadata.Name.ValueString()
+	out, err := conn.AdmissionregistrationV1().ValidatingAdmissionPolicies().Get(ctx, name, metav1.GetOptions{})
+	if apierrors.IsNotFound(err) {
+		resp.State.RemoveResource(ctx)
+		return
+	}
+	if err != nil {
+		resp.Diagnostics.AddError(
+			"error reading ValidatingAdmissionPolicy",
+			fmt.Sprintf("Failed to read policy %q: %s", name, err.Error()),
+		)
+		return
+	}
+
+	state.Metadata.UID = types.StringValue(string(out.UID))
+	state.Metadata.ResourceVersion = types.StringValue(out.ResourceVersion)
+	state.Metadata.Generation = types.Int64Value(out.Generation)
+
+	if len(out.Labels) > 0 {
+		state.Metadata.Labels = flattenStringMap(out.Labels)
+	}
+	if len(out.Annotations) > 0 {
+		state.Metadata.Annotations = flattenStringMap(out.Annotations)
+	}
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &state)...)
+
+	identity := ValidatingAdmissionPolicyIdentityModel{
+		APIVersion: types.StringValue("admissionregistration.k8s.io/v1"),
+		Kind:       types.StringValue("ValidatingAdmissionPolicy"),
+		Name:       types.StringValue(out.Name),
+	}
+	resp.Diagnostics.Append(resp.Identity.Set(ctx, identity)...)
+}
+
+func (r *ValidatingAdmissionPolicy) Update(ctx context.Context, req resource.UpdateRequest, resp *resource.UpdateResponse) {
+	var plan ValidatingAdmissionPolicyModel
+	resp.Diagnostics.Append(req.Plan.Get(ctx, &plan)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	defaultTimeout, _ := time.ParseDuration("20m")
+	timeout, d := plan.Timeouts.Update(ctx, defaultTimeout)
+	resp.Diagnostics.Append(d...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	ctx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+
+	conn, err := r.SDKv2Meta().(kubernetes.KubeClientsets).MainClientset()
+	if err != nil {
+		resp.Diagnostics.AddError("kubernetes client error", err.Error())
+		return
+	}
+
+	name := plan.Metadata.Name.ValueString()
+	cur, err := conn.AdmissionregistrationV1().ValidatingAdmissionPolicies().Get(ctx, name, metav1.GetOptions{})
+	if err != nil {
+		resp.Diagnostics.AddError(
+			"read before update failed",
+			fmt.Sprintf("Failed to read policy %q before update: %s", name, err.Error()),
+		)
+		return
+	}
+
+	cur.Spec = expandValidatingAdmissionPolicySpec(plan.Spec)
+
+	if cur.ObjectMeta.Labels == nil {
+		cur.ObjectMeta.Labels = make(map[string]string)
+	}
+	if cur.ObjectMeta.Annotations == nil {
+		cur.ObjectMeta.Annotations = make(map[string]string)
+	}
+	cur.ObjectMeta.Labels = expandStringMap(plan.Metadata.Labels)
+	cur.ObjectMeta.Annotations = expandStringMap(plan.Metadata.Annotations)
+
+	out, err := conn.AdmissionregistrationV1().ValidatingAdmissionPolicies().Update(ctx, cur, metav1.UpdateOptions{})
+	if err != nil {
+		resp.Diagnostics.AddError(
+			"error updating ValidatingAdmissionPolicy",
+			fmt.Sprintf("Failed to update policy %q: %s", name, err.Error()),
+		)
+		return
+	}
+
+	plan.ID = types.StringValue(out.Name)
+	plan.Metadata.UID = types.StringValue(string(out.UID))
+	plan.Metadata.ResourceVersion = types.StringValue(out.ResourceVersion)
+	plan.Metadata.Generation = types.Int64Value(out.Generation)
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &plan)...)
+
+	identity := ValidatingAdmissionPolicyIdentityModel{
+		APIVersion: types.StringValue("admissionregistration.k8s.io/v1"),
+		Kind:       types.StringValue("ValidatingAdmissionPolicy"),
+		Name:       types.StringValue(out.Name),
+	}
+	resp.Diagnostics.Append(resp.Identity.Set(ctx, identity)...)
+}
+
+func (r *ValidatingAdmissionPolicy) Delete(ctx context.Context, req resource.DeleteRequest, resp *resource.DeleteResponse) {
+	var state ValidatingAdmissionPolicyModel
+	resp.Diagnostics.Append(req.State.Get(ctx, &state)...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+
+	defaultTimeout, _ := time.ParseDuration("20m")
+	timeout, d := state.Timeouts.Delete(ctx, defaultTimeout)
+	resp.Diagnostics.Append(d...)
+	if resp.Diagnostics.HasError() {
+		return
+	}
+	ctx, cancel := context.WithTimeout(ctx, timeout)
+	defer cancel()
+
+	conn, err := r.SDKv2Meta().(kubernetes.KubeClientsets).MainClientset()
+	if err != nil {
+		resp.Diagnostics.AddError("kubernetes client error", err.Error())
+		return
+	}
+
+	name := state.Metadata.Name.ValueString()
+	err = conn.AdmissionregistrationV1().ValidatingAdmissionPolicies().Delete(ctx, name, metav1.DeleteOptions{})
+	if err != nil && !apierrors.IsNotFound(err) {
+		resp.Diagnostics.AddError(
+			"error deleting ValidatingAdmissionPolicy",
+			fmt.Sprintf("Failed to delete policy %q: %s", name, err.Error()),
+		)
+		return
+	}
+}
+
+func (r *ValidatingAdmissionPolicy) ImportState(ctx context.Context, req resource.ImportStateRequest, resp *resource.ImportStateResponse) {
+	var name string
+
+	if req.ID != "" {
+		name = req.ID
+	} else {
+		var identityData ValidatingAdmissionPolicyIdentityModel
+		resp.Diagnostics.Append(req.Identity.Get(ctx, &identityData)...)
+		if resp.Diagnostics.HasError() {
+			return
+		}
+		name = identityData.Name.ValueString()
+	}
+
+	conn, err := r.SDKv2Meta().(kubernetes.KubeClientsets).MainClientset()
+	if err != nil {
+		resp.Diagnostics.AddError("kubernetes client error", err.Error())
+		return
+	}
+
+	out, err := conn.AdmissionregistrationV1().ValidatingAdmissionPolicies().Get(ctx, name, metav1.GetOptions{})
+	if err != nil {
+		resp.Diagnostics.AddError(
+			"error importing ValidatingAdmissionPolicy",
+			fmt.Sprintf("Failed to import policy %q: %s", name, err.Error()),
+		)
+		return
+	}
+
+	var state ValidatingAdmissionPolicyModel
+	state.ID = types.StringValue(out.Name)
+
+	timeoutsObj := types.ObjectNull(map[string]attr.Type{
+		"create": types.StringType,
+		"delete": types.StringType,
+		"read":   types.StringType,
+		"update": types.StringType,
+	})
+	state.Timeouts = timeouts.Value{
+		Object: timeoutsObj,
+	}
+
+	flattenValidatingAdmissionPolicy(out, &state)
+
+	resp.Diagnostics.Append(resp.State.Set(ctx, &state)...)
+
+	identity := ValidatingAdmissionPolicyIdentityModel{
+		APIVersion: types.StringValue("admissionregistration.k8s.io/v1"),
+		Kind:       types.StringValue("ValidatingAdmissionPolicy"),
+		Name:       types.StringValue(out.Name),
+	}
+	resp.Diagnostics.Append(resp.Identity.Set(ctx, identity)...)
+}
--- a/internal/framework/provider/admissionregistrationv1/validating_admission_policy_helpers.go
+++ b/internal/framework/provider/admissionregistrationv1/validating_admission_policy_helpers.go
@ -0,0 +1,390 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package admissionregistrationv1
+
+import (
+	"context"
+
+	"github.com/hashicorp/terraform-plugin-framework/attr"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+	arv1 "k8s.io/api/admissionregistration/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+)
+
+func expandStringMap(m map[string]types.String) map[string]string {
+	if m == nil {
+		return nil
+	}
+	result := make(map[string]string, len(m))
+	for k, v := range m {
+		if !v.IsNull() && !v.IsUnknown() {
+			result[k] = v.ValueString()
+		}
+	}
+	return result
+}
+
+func flattenStringMap(m map[string]string) map[string]types.String {
+	if m == nil {
+		return nil
+	}
+	result := make(map[string]types.String, len(m))
+	for k, v := range m {
+		result[k] = types.StringValue(v)
+	}
+	return result
+}
+
+func expandStringSlice(s []types.String) []string {
+	if s == nil {
+		return nil
+	}
+	result := make([]string, 0, len(s))
+	for _, v := range s {
+		if !v.IsNull() && !v.IsUnknown() {
+			result = append(result, v.ValueString())
+		}
+	}
+	return result
+}
+
+func flattenStringSlice(s []string) []types.String {
+	if s == nil {
+		return nil
+	}
+	result := make([]types.String, len(s))
+	for i, v := range s {
+		result[i] = types.StringValue(v)
+	}
+	return result
+}
+
+func expandValidatingAdmissionPolicySpec(spec ValidatingAdmissionPolicySpecModel) arv1.ValidatingAdmissionPolicySpec {
+	result := arv1.ValidatingAdmissionPolicySpec{}
+
+	if len(spec.AuditAnnotations) > 0 {
+		result.AuditAnnotations = make([]arv1.AuditAnnotation, len(spec.AuditAnnotations))
+		for i, aa := range spec.AuditAnnotations {
+			result.AuditAnnotations[i] = arv1.AuditAnnotation{
+				Key:             aa.Key.ValueString(),
+				ValueExpression: aa.ValueExpression.ValueString(),
+			}
+		}
+	}
+
+	if !spec.FailurePolicy.IsNull() && !spec.FailurePolicy.IsUnknown() {
+		fp := arv1.FailurePolicyType(spec.FailurePolicy.ValueString())
+		result.FailurePolicy = &fp
+	}
+
+	if len(spec.MatchConditions) > 0 {
+		result.MatchConditions = make([]arv1.MatchCondition, len(spec.MatchConditions))
+		for i, mc := range spec.MatchConditions {
+			result.MatchConditions[i] = arv1.MatchCondition{
+				Name:       mc.Name.ValueString(),
+				Expression: mc.Expression.ValueString(),
+			}
+		}
+	}
+
+	result.MatchConstraints = expandMatchConstraints(spec.MatchConstraints)
+
+	if spec.ParamKind != nil {
+		result.ParamKind = &arv1.ParamKind{
+			APIVersion: spec.ParamKind.APIVersion.ValueString(),
+			Kind:       spec.ParamKind.Kind.ValueString(),
+		}
+	}
+
+	if len(spec.Validations) > 0 {
+		result.Validations = make([]arv1.Validation, len(spec.Validations))
+		for i, v := range spec.Validations {
+			validation := arv1.Validation{
+				Expression: v.Expression.ValueString(),
+			}
+			if !v.Message.IsNull() && !v.Message.IsUnknown() {
+				validation.Message = v.Message.ValueString()
+			}
+			if !v.MessageExpression.IsNull() && !v.MessageExpression.IsUnknown() {
+				validation.MessageExpression = v.MessageExpression.ValueString()
+			}
+			// v1beta1 doesn't have Reason field
+			result.Validations[i] = validation
+		}
+	}
+
+	if len(spec.Variables) > 0 {
+		result.Variables = make([]arv1.Variable, len(spec.Variables))
+		for i, v := range spec.Variables {
+			result.Variables[i] = arv1.Variable{
+				Name:       v.Name.ValueString(),
+				Expression: v.Expression.ValueString(),
+			}
+		}
+	}
+
+	return result
+}
+
+func expandMatchConstraints(mc MatchConstraintsModel) *arv1.MatchResources {
+	result := &arv1.MatchResources{}
+
+	if len(mc.ExcludeResourceRules) > 0 {
+		result.ExcludeResourceRules = make([]arv1.NamedRuleWithOperations, len(mc.ExcludeResourceRules))
+		for i, rule := range mc.ExcludeResourceRules {
+			result.ExcludeResourceRules[i] = expandNamedRuleWithOperations(rule)
+		}
+	}
+
+	if !mc.MatchPolicy.IsNull() && !mc.MatchPolicy.IsUnknown() {
+		mp := arv1.MatchPolicyType(mc.MatchPolicy.ValueString())
+		result.MatchPolicy = &mp
+	}
+
+	if mc.NamespaceSelector != nil {
+		result.NamespaceSelector = expandLabelSelector(*mc.NamespaceSelector)
+	}
+
+	if mc.ObjectSelector != nil {
+		result.ObjectSelector = expandLabelSelector(mc.ObjectSelector.LabelSelector)
+	}
+
+	if len(mc.ResourceRules) > 0 {
+		result.ResourceRules = make([]arv1.NamedRuleWithOperations, len(mc.ResourceRules))
+		for i, rule := range mc.ResourceRules {
+			result.ResourceRules[i] = expandNamedRuleWithOperations(rule)
+		}
+	}
+
+	return result
+}
+
+func expandNamedRuleWithOperations(rule RuleWithOperationsModel) arv1.NamedRuleWithOperations {
+	result := arv1.NamedRuleWithOperations{
+		ResourceNames: expandStringSlice(rule.ResourceNames),
+		RuleWithOperations: arv1.RuleWithOperations{
+			Operations: expandOperations(rule.Operations),
+			Rule: arv1.Rule{
+				APIGroups:   expandStringSlice(rule.APIGroups),
+				APIVersions: expandStringSlice(rule.APIVersions),
+				Resources:   expandStringSlice(rule.Resources),
+			},
+		},
+	}
+
+	if !rule.Scope.IsNull() && !rule.Scope.IsUnknown() {
+		scope := arv1.ScopeType(rule.Scope.ValueString())
+		result.RuleWithOperations.Rule.Scope = &scope
+	}
+
+	return result
+}
+
+func expandOperations(ops []types.String) []arv1.OperationType {
+	if ops == nil {
+		return nil
+	}
+	result := make([]arv1.OperationType, 0, len(ops))
+	for _, op := range ops {
+		if !op.IsNull() && !op.IsUnknown() {
+			result = append(result, arv1.OperationType(op.ValueString()))
+		}
+	}
+	return result
+}
+
+func expandLabelSelector(ls LabelSelectorModel) *metav1.LabelSelector {
+	result := &metav1.LabelSelector{}
+
+	if !ls.MatchLabels.IsNull() && !ls.MatchLabels.IsUnknown() {
+		matchLabels := make(map[string]string)
+		ls.MatchLabels.ElementsAs(context.Background(), &matchLabels, false)
+		result.MatchLabels = matchLabels
+	}
+
+	if len(ls.MatchExpressions) > 0 {
+		result.MatchExpressions = make([]metav1.LabelSelectorRequirement, len(ls.MatchExpressions))
+		for i, expr := range ls.MatchExpressions {
+			result.MatchExpressions[i] = metav1.LabelSelectorRequirement{
+				Key:      expr.Key.ValueString(),
+				Operator: metav1.LabelSelectorOperator(expr.Operator.ValueString()),
+				Values:   expandStringSlice(expr.Values),
+			}
+		}
+	}
+
+	return result
+}
+
+func flattenValidatingAdmissionPolicy(obj *arv1.ValidatingAdmissionPolicy, model *ValidatingAdmissionPolicyModel) {
+	model.Metadata.Name = types.StringValue(obj.Name)
+
+	if obj.GenerateName != "" {
+		model.Metadata.GenerateName = types.StringValue(obj.GenerateName)
+	}
+	if obj.Namespace != "" {
+		model.Metadata.Namespace = types.StringValue(obj.Namespace)
+	}
+
+	model.Metadata.UID = types.StringValue(string(obj.UID))
+	model.Metadata.ResourceVersion = types.StringValue(obj.ResourceVersion)
+	model.Metadata.Generation = types.Int64Value(obj.Generation)
+
+	if len(obj.Labels) > 0 {
+		model.Metadata.Labels = flattenStringMap(obj.Labels)
+	}
+	if len(obj.Annotations) > 0 {
+		model.Metadata.Annotations = flattenStringMap(obj.Annotations)
+	}
+
+	flattenValidatingAdmissionPolicySpec(&obj.Spec, &model.Spec)
+}
+
+func flattenValidatingAdmissionPolicySpec(spec *arv1.ValidatingAdmissionPolicySpec, model *ValidatingAdmissionPolicySpecModel) {
+	if len(spec.AuditAnnotations) > 0 {
+		model.AuditAnnotations = make([]AuditAnnotationModel, len(spec.AuditAnnotations))
+		for i, aa := range spec.AuditAnnotations {
+			model.AuditAnnotations[i] = AuditAnnotationModel{
+				Key:             types.StringValue(aa.Key),
+				ValueExpression: types.StringValue(aa.ValueExpression),
+			}
+		}
+	}
+
+	if spec.FailurePolicy != nil {
+		model.FailurePolicy = types.StringValue(string(*spec.FailurePolicy))
+	}
+
+	if len(spec.MatchConditions) > 0 {
+		model.MatchConditions = make([]MatchConditionModel, len(spec.MatchConditions))
+		for i, mc := range spec.MatchConditions {
+			model.MatchConditions[i] = MatchConditionModel{
+				Name:       types.StringValue(mc.Name),
+				Expression: types.StringValue(mc.Expression),
+			}
+		}
+	}
+
+	if spec.MatchConstraints != nil {
+		flattenMatchConstraints(spec.MatchConstraints, &model.MatchConstraints)
+	}
+
+	if spec.ParamKind != nil {
+		model.ParamKind = &ParamKindModel{
+			APIVersion: types.StringValue(spec.ParamKind.APIVersion),
+			Kind:       types.StringValue(spec.ParamKind.Kind),
+		}
+	}
+
+	if len(spec.Validations) > 0 {
+		model.Validations = make([]ValidationModel, len(spec.Validations))
+		for i, v := range spec.Validations {
+			validation := ValidationModel{
+				Expression: types.StringValue(v.Expression),
+				Message:    types.StringValue(v.Message),
+			}
+			if v.MessageExpression != "" {
+				validation.MessageExpression = types.StringValue(v.MessageExpression)
+			}
+			// v1beta1 doesn't have Reason field
+			model.Validations[i] = validation
+		}
+	}
+
+	if len(spec.Variables) > 0 {
+		model.Variables = make([]VariableModel, len(spec.Variables))
+		for i, v := range spec.Variables {
+			model.Variables[i] = VariableModel{
+				Name:       types.StringValue(v.Name),
+				Expression: types.StringValue(v.Expression),
+			}
+		}
+	}
+}
+
+func flattenMatchConstraints(mc *arv1.MatchResources, model *MatchConstraintsModel) {
+	if len(mc.ExcludeResourceRules) > 0 {
+		model.ExcludeResourceRules = make([]RuleWithOperationsModel, len(mc.ExcludeResourceRules))
+		for i, rule := range mc.ExcludeResourceRules {
+			model.ExcludeResourceRules[i] = flattenNamedRuleWithOperations(rule)
+		}
+	}
+
+	if mc.MatchPolicy != nil {
+		model.MatchPolicy = types.StringValue(string(*mc.MatchPolicy))
+	}
+
+	if mc.NamespaceSelector != nil && (len(mc.NamespaceSelector.MatchLabels) > 0 || len(mc.NamespaceSelector.MatchExpressions) > 0) {
+		selector := flattenLabelSelector(mc.NamespaceSelector)
+		model.NamespaceSelector = &selector
+	}
+
+	if mc.ObjectSelector != nil && (len(mc.ObjectSelector.MatchLabels) > 0 || len(mc.ObjectSelector.MatchExpressions) > 0) {
+		selector := flattenLabelSelector(mc.ObjectSelector)
+		model.ObjectSelector = &ObjectSelectorModel{
+			LabelSelector: selector,
+		}
+	}
+
+	if len(mc.ResourceRules) > 0 {
+		model.ResourceRules = make([]RuleWithOperationsModel, len(mc.ResourceRules))
+		for i, rule := range mc.ResourceRules {
+			model.ResourceRules[i] = flattenNamedRuleWithOperations(rule)
+		}
+	}
+}
+
+func flattenNamedRuleWithOperations(rule arv1.NamedRuleWithOperations) RuleWithOperationsModel {
+	result := RuleWithOperationsModel{
+		APIGroups:     flattenStringSlice(rule.RuleWithOperations.Rule.APIGroups),
+		APIVersions:   flattenStringSlice(rule.RuleWithOperations.Rule.APIVersions),
+		Resources:     flattenStringSlice(rule.RuleWithOperations.Rule.Resources),
+		ResourceNames: flattenStringSlice(rule.ResourceNames),
+		Operations:    flattenOperations(rule.RuleWithOperations.Operations),
+	}
+
+	if rule.RuleWithOperations.Rule.Scope != nil && string(*rule.RuleWithOperations.Rule.Scope) != "*" {
+		result.Scope = types.StringValue(string(*rule.RuleWithOperations.Rule.Scope))
+	}
+
+	return result
+}
+
+func flattenOperations(ops []arv1.OperationType) []types.String {
+	if ops == nil {
+		return nil
+	}
+	result := make([]types.String, len(ops))
+	for i, op := range ops {
+		result[i] = types.StringValue(string(op))
+	}
+	return result
+}
+
+func flattenLabelSelector(ls *metav1.LabelSelector) LabelSelectorModel {
+	result := LabelSelectorModel{}
+
+	if len(ls.MatchLabels) > 0 {
+		matchLabels := make(map[string]attr.Value, len(ls.MatchLabels))
+		for k, v := range ls.MatchLabels {
+			matchLabels[k] = types.StringValue(v)
+		}
+		result.MatchLabels, _ = types.MapValue(types.StringType, matchLabels)
+	} else {
+		result.MatchLabels = types.MapNull(types.StringType)
+	}
+
+	if len(ls.MatchExpressions) > 0 {
+		result.MatchExpressions = make([]LabelSelectorRequirementModel, len(ls.MatchExpressions))
+		for i, expr := range ls.MatchExpressions {
+			result.MatchExpressions[i] = LabelSelectorRequirementModel{
+				Key:      types.StringValue(expr.Key),
+				Operator: types.StringValue(string(expr.Operator)),
+				Values:   flattenStringSlice(expr.Values),
+			}
+		}
+	}
+
+	return result
+}
--- a/internal/framework/provider/admissionregistrationv1/validating_admission_policy_model.go
+++ b/internal/framework/provider/admissionregistrationv1/validating_admission_policy_model.go
@ -0,0 +1,102 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package admissionregistrationv1
+
+import (
+	"github.com/hashicorp/terraform-plugin-framework-timeouts/resource/timeouts"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+)
+
+type ValidatingAdmissionPolicyModel struct {
+	Timeouts timeouts.Value                     `tfsdk:"timeouts"`
+	ID       types.String                       `tfsdk:"id"`
+	Metadata MetadataModel                      `tfsdk:"metadata"`
+	Spec     ValidatingAdmissionPolicySpecModel `tfsdk:"spec"`
+}
+
+type MetadataModel struct {
+	Annotations     map[string]types.String `tfsdk:"annotations"`
+	GenerateName    types.String            `tfsdk:"generate_name"`
+	Generation      types.Int64             `tfsdk:"generation"`
+	Labels          map[string]types.String `tfsdk:"labels"`
+	Name            types.String            `tfsdk:"name"`
+	Namespace       types.String            `tfsdk:"namespace"`
+	ResourceVersion types.String            `tfsdk:"resource_version"`
+	UID             types.String            `tfsdk:"uid"`
+}
+
+type ValidatingAdmissionPolicySpecModel struct {
+	AuditAnnotations []AuditAnnotationModel `tfsdk:"audit_annotations"`
+	FailurePolicy    types.String           `tfsdk:"failure_policy"`
+	MatchConditions  []MatchConditionModel  `tfsdk:"match_conditions"`
+	MatchConstraints MatchConstraintsModel  `tfsdk:"match_constraints"`
+	ParamKind        *ParamKindModel        `tfsdk:"param_kind"`
+	Validations      []ValidationModel      `tfsdk:"validations"`
+	Variables        []VariableModel        `tfsdk:"variables"`
+}
+
+type AuditAnnotationModel struct {
+	Key             types.String `tfsdk:"key"`
+	ValueExpression types.String `tfsdk:"value_expression"`
+}
+
+type MatchConditionModel struct {
+	Expression types.String `tfsdk:"expression"`
+	Name       types.String `tfsdk:"name"`
+}
+
+type MatchConstraintsModel struct {
+	ExcludeResourceRules []RuleWithOperationsModel `tfsdk:"exclude_resource_rules"`
+	MatchPolicy          types.String              `tfsdk:"match_policy"`
+	NamespaceSelector    *LabelSelectorModel       `tfsdk:"namespace_selector"`
+	ObjectSelector       *ObjectSelectorModel      `tfsdk:"object_selector"`
+	ResourceRules        []RuleWithOperationsModel `tfsdk:"resource_rules"`
+}
+
+type RuleWithOperationsModel struct {
+	APIGroups     []types.String `tfsdk:"api_groups"`
+	APIVersions   []types.String `tfsdk:"api_versions"`
+	Operations    []types.String `tfsdk:"operations"`
+	ResourceNames []types.String `tfsdk:"resource_names"`
+	Resources     []types.String `tfsdk:"resources"`
+	Scope         types.String   `tfsdk:"scope"`
+}
+
+type LabelSelectorModel struct {
+	MatchLabels      types.Map                       `tfsdk:"match_labels"`
+	MatchExpressions []LabelSelectorRequirementModel `tfsdk:"match_expressions"`
+}
+
+type LabelSelectorRequirementModel struct {
+	Key      types.String   `tfsdk:"key"`
+	Operator types.String   `tfsdk:"operator"`
+	Values   []types.String `tfsdk:"values"`
+}
+
+type ObjectSelectorModel struct {
+	LabelSelector LabelSelectorModel `tfsdk:"label_selector"`
+}
+
+type ParamKindModel struct {
+	APIVersion types.String `tfsdk:"api_version"`
+	Kind       types.String `tfsdk:"kind"`
+}
+
+type ValidationModel struct {
+	Expression        types.String `tfsdk:"expression"`
+	Message           types.String `tfsdk:"message"`
+	MessageExpression types.String `tfsdk:"message_expression"`
+	Reason            types.String `tfsdk:"reason"`
+}
+
+type VariableModel struct {
+	Expression types.String `tfsdk:"expression"`
+	Name       types.String `tfsdk:"name"`
+}
+
+type ValidatingAdmissionPolicyIdentityModel struct {
+	APIVersion types.String `tfsdk:"api_version"`
+	Kind       types.String `tfsdk:"kind"`
+	Name       types.String `tfsdk:"name"`
+}
--- a/internal/framework/provider/admissionregistrationv1/validating_admission_policy_schema.go
+++ b/internal/framework/provider/admissionregistrationv1/validating_admission_policy_schema.go
@ -0,0 +1,309 @@
+// Copyright (c) HashiCorp, Inc.
+package admissionregistrationv1
+
+import (
+	"context"
+
+	"github.com/hashicorp/terraform-plugin-framework-timeouts/resource/timeouts"
+	"github.com/hashicorp/terraform-plugin-framework-validators/stringvalidator"
+	"github.com/hashicorp/terraform-plugin-framework/resource"
+	"github.com/hashicorp/terraform-plugin-framework/resource/schema"
+	"github.com/hashicorp/terraform-plugin-framework/schema/validator"
+	"github.com/hashicorp/terraform-plugin-framework/types"
+)
+
+func (r *ValidatingAdmissionPolicy) Schema(ctx context.Context, req resource.SchemaRequest, resp *resource.SchemaResponse) {
+	resp.Schema = schema.Schema{
+		MarkdownDescription: `Validating Admission Policy Resource`,
+		Blocks: map[string]schema.Block{
+			"timeouts": timeouts.BlockAll(ctx),
+		},
+		Attributes: map[string]schema.Attribute{
+			"id": schema.StringAttribute{
+				MarkdownDescription: `The unique ID for this terraform resource`,
+				Optional:            true,
+				Computed:            true,
+			},
+			"metadata": schema.SingleNestedAttribute{
+				MarkdownDescription: `Standard object's metadata. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#metadata`,
+				Optional:            true,
+				Attributes: map[string]schema.Attribute{
+					"annotations": schema.MapAttribute{
+						MarkdownDescription: `Annotations is an unstructured key value map stored with a resource that may be set by external tools to store and retrieve arbitrary metadata. They are not queryable and should be preserved when modifying objects. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations`,
+						ElementType:         types.StringType,
+						Optional:            true,
+					},
+					"generate_name": schema.StringAttribute{
+						MarkdownDescription: `GenerateName is an optional prefix, used by the server, to generate a unique name ONLY IF the Name field has not been provided. If this field is used, the name returned to the client will be different than the name passed. This value will also be combined with a unique suffix. The provided value has the same validation rules as the Name field, and may be truncated by the length of the suffix required to make the value unique on the server.
+If this field is specified and the generated name exists, the server will return a 409.
+Applied only if Name is not specified. More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#idempotency`,
+						Optional: true,
+					},
+					"generation": schema.Int64Attribute{
+						MarkdownDescription: `A sequence number representing a specific generation of the desired state. Populated by the system. Read-only.`,
+						Optional:            true,
+						Computed:            true,
+					},
+					"labels": schema.MapAttribute{
+						MarkdownDescription: `Map of string keys and values that can be used to organize and categorize (scope and select) objects. May match selectors of replication controllers and services. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels`,
+						ElementType:         types.StringType,
+						Optional:            true,
+					},
+					"name": schema.StringAttribute{
+						MarkdownDescription: `Name must be unique within a namespace. Is required when creating resources, although some resources may allow a client to request the generation of an appropriate name automatically. Name is primarily intended for creation idempotence and configuration definition. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#names`,
+						Optional:            true,
+						Computed:            true,
+					},
+					"namespace": schema.StringAttribute{
+						MarkdownDescription: `Namespace defines the space within which each name must be unique. An empty namespace is equivalent to the "default" namespace, but "default" is the canonical representation. Not all objects are required to be scoped to a namespace - the value of this field for those objects will be empty.
+Must be a DNS_LABEL. Cannot be updated. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces`,
+						Optional: true,
+					},
+					"resource_version": schema.StringAttribute{
+						MarkdownDescription: `An opaque value that represents the internal version of this object that can be used by clients to determine when objects have changed. May be used for optimistic concurrency, change detection, and the watch operation on a resource or set of resources. Clients must treat these values as opaque and passed unmodified back to the server. They may only be valid for a particular resource or set of resources.
+Populated by the system. Read-only. Value must be treated as opaque by clients and . More info: https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#concurrency-control-and-consistency`,
+						Optional: true,
+						Computed: true,
+					},
+					"uid": schema.StringAttribute{
+						MarkdownDescription: `UID is the unique in time and space value for this object. It is typically generated by the server on successful creation of a resource and is not allowed to change on PUT operations.
+Populated by the system. Read-only. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names#uids`,
+						Optional: true,
+						Computed: true,
+					},
+				},
+			},
+			"spec": schema.SingleNestedAttribute{
+				MarkdownDescription: "Rule defining a set of permissions for the role",
+				Required:            true,
+				Attributes: map[string]schema.Attribute{
+					"audit_annotations": schema.ListNestedAttribute{
+						MarkdownDescription: "auditAnnotations contains CEL expressions which are used to produce audit annotations for the audit event of the API request.",
+						Required:            true,
+						NestedObject: schema.NestedAttributeObject{
+							Attributes: auditAnnotationsFields(),
+						},
+					},
+					"failure_policy": schema.StringAttribute{
+						MarkdownDescription: "failurePolicy defines how to handle failures for the admission policy.",
+						Required:            true,
+						Validators: []validator.String{
+							stringvalidator.OneOf("Fail", "Ignore"),
+						},
+					},
+					"match_conditions": schema.ListNestedAttribute{
+						MarkdownDescription: "MatchConditions is a list of conditions that must be met for a request to be validated.",
+						Optional:            true,
+						NestedObject: schema.NestedAttributeObject{
+							Attributes: matchConditionsFields(),
+						},
+					},
+					"match_constraints": schema.SingleNestedAttribute{
+						MarkdownDescription: "MatchConstraints specifies what resources this policy is designed to validate.",
+						Required:            true,
+						Attributes:          matchConstraintsFields(),
+					},
+					"param_kind": schema.SingleNestedAttribute{
+						MarkdownDescription: "ParamKind specifies the kind of resources used to parameterize this policy",
+						Optional:            true,
+						Attributes:          paramKindFields(),
+					},
+					"validations": schema.ListNestedAttribute{
+						MarkdownDescription: "Validations contain CEL expressions which is used to apply the validation.",
+						Optional:            true,
+						NestedObject: schema.NestedAttributeObject{
+							Attributes: validationFields(),
+						},
+					},
+					"variables": schema.ListNestedAttribute{
+						MarkdownDescription: "Variables contain definitions of variables that can be used in composition of other expressions.",
+						Optional:            true,
+						NestedObject: schema.NestedAttributeObject{
+							Attributes: variableFields(),
+						},
+					},
+				},
+			},
+		},
+	}
+}
+
+func auditAnnotationsFields() map[string]schema.Attribute {
+	return map[string]schema.Attribute{
+		"key": schema.StringAttribute{
+			Description: "key specifies the audit annotation key.",
+			Required:    true,
+		},
+		"value_expression": schema.StringAttribute{
+			Description: "valueExpression represents the expression which is evaluated by CEL to produce an audit annotation value.",
+			Required:    true,
+		},
+	}
+}
+
+func matchConditionsFields() map[string]schema.Attribute {
+	return map[string]schema.Attribute{
+		"expression": schema.StringAttribute{
+			Description: "Expression represents the expression which will be evaluated by CEL.",
+			Required:    true,
+		},
+		"name": schema.StringAttribute{
+			Description: "Name is an identifier for this match condition, used for strategic merging of MatchConditions, as well as providing an identifier for logging purposes.",
+			Required:    true,
+		},
+	}
+}
+
+func matchConstraintsFields() map[string]schema.Attribute {
+	return map[string]schema.Attribute{
+		"exclude_resource_rules": schema.ListNestedAttribute{
+			Description: "ExcludeResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy should not care about.",
+			Optional:    true,
+			NestedObject: schema.NestedAttributeObject{
+				Attributes: namedRuleWithOperationsFields(),
+			},
+		},
+		"match_policy": schema.StringAttribute{
+			Optional:    true,
+			Description: "matchPolicy defines how the MatchResources list is used to match incoming requests. Allowed values are Exact or Equivalent.",
+			Validators: []validator.String{
+				stringvalidator.OneOf("Exact", "Equivalent"),
+			},
+		},
+		"namespace_selector": schema.SingleNestedAttribute{
+			Description: "NamespaceSelector decides whether to run the admission control policy on an object based on whether the namespace for that object matches the selector.",
+			Optional:    true,
+			Attributes:  labelSelectorFields(),
+		},
+		"object_selector": schema.SingleNestedAttribute{
+			Description: "ObjectSelector decides whether to run the validation based on if the object has matching labels.",
+			Optional:    true,
+			Attributes: map[string]schema.Attribute{
+				"label_selector": schema.SingleNestedAttribute{
+					MarkdownDescription: `A label query over a set of resources`,
+					Optional:            true,
+					Attributes:          labelSelectorFields(),
+				},
+			},
+		},
+		"resource_rules": schema.ListNestedAttribute{
+			Description: "ResourceRules describes what operations on what resources/subresources the ValidatingAdmissionPolicy matches.",
+			Optional:    true,
+			NestedObject: schema.NestedAttributeObject{
+				Attributes: namedRuleWithOperationsFields(),
+			},
+		},
+	}
+}
+
+func paramKindFields() map[string]schema.Attribute {
+	return map[string]schema.Attribute{
+		"api_version": schema.StringAttribute{
+			Description: "APIVersion is the API group version the resources belong to. In format of \"group/version\"",
+			Required:    true,
+		},
+		"kind": schema.StringAttribute{
+			Description: "Kind is the API kind the resources belong to.",
+			Required:    true,
+		},
+	}
+}
+
+func validationFields() map[string]schema.Attribute {
+	return map[string]schema.Attribute{
+		"expression": schema.StringAttribute{
+			Description: "Expression represents the expression which will be evaluated by CEL.",
+			Required:    true,
+		},
+		"message": schema.StringAttribute{
+			Description: "Message represents the message displayed when validation fails.",
+			Required:    true,
+		},
+		"message_expression": schema.StringAttribute{
+			Description: "Message Expression declares a CEL expression that evaluates to the validation failure message that is returned when this rule fails.",
+			Optional:    true,
+		},
+		"reason": schema.StringAttribute{
+			Description: "Reason represents a machine-readable description of why this validation failed.",
+			Optional:    true,
+		},
+	}
+}
+
+func variableFields() map[string]schema.Attribute {
+	return map[string]schema.Attribute{
+		"expression": schema.StringAttribute{
+			Description: "Expression is the expression that will be evaluated as the value of the variable.",
+			Optional:    true,
+		},
+		"name": schema.StringAttribute{
+			Description: "Name is the name of the variable.",
+			Optional:    true,
+		},
+	}
+}
+
+func namedRuleWithOperationsFields() map[string]schema.Attribute {
+	return map[string]schema.Attribute{
+		"api_groups": schema.ListAttribute{
+			Description: "APIGroups is the API groups the resources belong to. '\\*' is all groups. If '\\*' is present, the length of the slice must be one.",
+			Required:    true,
+			ElementType: types.StringType,
+		},
+		"api_versions": schema.ListAttribute{
+			Description: "APIVersions is the API versions the resources belong to. '\\*' is all versions. If '\\*' is present, the length of the slice must be one. Required.",
+			Required:    true,
+			ElementType: types.StringType,
+		},
+		"operations": schema.ListAttribute{
+			Description: "Operations is the operations the admission hook cares about - CREATE, UPDATE, DELETE, CONNECT or * for all of those operations and any future admission operations that are added.",
+			Required:    true,
+			ElementType: types.StringType,
+		},
+		"resource_names": schema.ListAttribute{
+			Description: "ResourceNames is an optional white list of names that the rule applies to. An empty set means that everything is allowed.",
+			Optional:    true,
+			ElementType: types.StringType,
+		},
+		"resources": schema.ListAttribute{
+			Description: "Resources is a list of resources this rule applies to.",
+			Required:    true,
+			ElementType: types.StringType,
+		},
+		"scope": schema.StringAttribute{
+			Description: "scope specifies the scope of this rule.",
+			Optional:    true,
+		},
+	}
+}
+
+func labelSelectorFields() map[string]schema.Attribute {
+	return map[string]schema.Attribute{
+		"match_expressions": schema.ListNestedAttribute{
+			MarkdownDescription: `matchExpressions is a list of label selector requirements. The requirements are ANDed.`,
+			Optional:            true,
+			NestedObject: schema.NestedAttributeObject{
+				Attributes: map[string]schema.Attribute{
+					"key": schema.StringAttribute{
+						MarkdownDescription: `key is the label key that the selector applies to.`,
+						Optional:            true,
+					},
+					"operator": schema.StringAttribute{
+						MarkdownDescription: `operator represents a key's relationship to a set of values. Valid operators are In, NotIn, Exists and DoesNotExist.`,
+						Optional:            true,
+					},
+					"values": schema.ListAttribute{
+						MarkdownDescription: `values is an array of string values. If the operator is In or NotIn, the values array must be non-empty. If the operator is Exists or DoesNotExist, the values array must be empty. This array is replaced during a strategic merge patch.`,
+						ElementType:         types.StringType,
+						Optional:            true,
+					},
+				},
+			},
+		},
+		"match_labels": schema.MapAttribute{
+			MarkdownDescription: `matchLabels is a map of {key,value} pairs. A single {key,value} in the matchLabels map is equivalent to an element of matchExpressions, whose key field is "key", the operator is "In", and the values array contains only "value". The requirements are ANDed.`,
+			ElementType:         types.StringType,
+			Optional:            true,
+		},
+	}
+}
--- a/internal/framework/provider/admissionregistrationv1/validating_admission_policy_test.go
+++ b/internal/framework/provider/admissionregistrationv1/validating_admission_policy_test.go
@ -0,0 +1,177 @@
+// Copyright (c) HashiCorp, Inc.
+
+package admissionregistrationv1_test
+
+import (
+	"fmt"
+	"testing"
+
+	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
+)
+
+func TestAccValidatingAdmissionPolicy_basic(t *testing.T) {
+	name := "test-policy"
+
+	resource.ParallelTest(t, resource.TestCase{
+		ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testValidatingAdmissionPolicyConfig_basic(name),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr("kubernetes_validating_admission_policy_v1.test", "metadata.name", name),
+					resource.TestCheckResourceAttr("kubernetes_validating_admission_policy_v1.test", "spec.validations.0.expression", "object.spec.replicas <= 5"),
+					resource.TestCheckResourceAttr("kubernetes_validating_admission_policy_v1.test", "spec.validations.0.message", "Replica count must not exceed 5"),
+				),
+			},
+			{
+				ResourceName:      "kubernetes_validating_admission_policy_v1.test",
+				ImportState:       true,
+				ImportStateVerify: true,
+				ImportStateVerifyIgnore: []string{
+					"timeouts",
+					"metadata.resource_version",
+					"spec.match_constraints.match_policy",
+				},
+			},
+		},
+	})
+}
+
+func TestAccValidatingAdmissionPolicy_withMatchConstraints(t *testing.T) {
+	name := "test-policy-constraints"
+
+	resource.ParallelTest(t, resource.TestCase{
+		ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testValidatingAdmissionPolicyConfig_withMatchConstraints(name),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr("kubernetes_validating_admission_policy_v1.test", "metadata.name", name),
+					resource.TestCheckResourceAttr("kubernetes_validating_admission_policy_v1.test", "spec.match_constraints.resource_rules.0.api_groups.0", "apps"),
+					resource.TestCheckResourceAttr("kubernetes_validating_admission_policy_v1.test", "spec.match_constraints.resource_rules.0.resources.0", "deployments"),
+				),
+			},
+		},
+	})
+}
+
+func TestAccValidatingAdmissionPolicy_update(t *testing.T) {
+	name := "test-policy-update"
+
+	resource.ParallelTest(t, resource.TestCase{
+		ProtoV6ProviderFactories: testAccProtoV6ProviderFactories,
+		Steps: []resource.TestStep{
+			{
+				Config: testValidatingAdmissionPolicyConfig_basic(name),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr("kubernetes_validating_admission_policy_v1.test", "spec.validations.0.message", "Replica count must not exceed 5"),
+				),
+			},
+			{
+				Config: testValidatingAdmissionPolicyConfig_updated(name),
+				Check: resource.ComposeAggregateTestCheckFunc(
+					resource.TestCheckResourceAttr("kubernetes_validating_admission_policy_v1.test", "spec.validations.0.message", "Replica count must not exceed 10"),
+				),
+			},
+		},
+	})
+}
+
+func testValidatingAdmissionPolicyConfig_basic(name string) string {
+	return fmt.Sprintf(`
+resource "kubernetes_validating_admission_policy_v1" "test" {
+  metadata = {
+    name = %q
+  }
+
+  spec = {
+    failure_policy = "Fail"
+
+    match_constraints = {
+      resource_rules = [{
+        api_groups   = ["apps"]
+        api_versions = ["v1"]
+        operations   = ["CREATE", "UPDATE"]
+        resources    = ["deployments"]
+      }]
+    }
+
+    audit_annotations = [{
+      key              = "example"
+      value_expression = "'ok'"
+    }]
+
+    validations = [{
+      expression = "object.spec.replicas <= 5"
+      message    = "Replica count must not exceed 5"
+    }]
+  }
+}
+`, name)
+}
+
+func testValidatingAdmissionPolicyConfig_withMatchConstraints(name string) string {
+	return fmt.Sprintf(`
+resource "kubernetes_validating_admission_policy_v1" "test" {
+  metadata = {
+    name = %q
+  }
+
+  spec = {
+    failure_policy = "Fail"
+
+    match_constraints = {
+      resource_rules = [{
+        api_groups   = ["apps"]
+        api_versions = ["v1"]
+        operations   = ["CREATE", "UPDATE"]
+        resources    = ["deployments"]
+      }]
+    }
+
+    audit_annotations = [{
+      key              = "example"
+      value_expression = "'ok'"
+    }]
+
+    validations = [{
+      expression = "object.spec.replicas <= 5"
+      message    = "Replica count must not exceed 5"
+    }]
+  }
+}
+`, name)
+}
+
+func testValidatingAdmissionPolicyConfig_updated(name string) string {
+	return fmt.Sprintf(`
+resource "kubernetes_validating_admission_policy_v1" "test" {
+  metadata = {
+    name = %q
+  }
+
+  spec = {
+    failure_policy = "Fail"
+
+    match_constraints = {
+      resource_rules = [{
+        api_groups   = ["apps"]
+        api_versions = ["v1"]
+        operations   = ["CREATE", "UPDATE"]
+        resources    = ["deployments"]
+      }]
+    }
+
+    audit_annotations = [{
+      key              = "example"
+      value_expression = "'ok'"
+    }]
+
+    validations = [{
+      expression = "object.spec.replicas <= 10"
+      message    = "Replica count must not exceed 10"
+    }]
+  }
+}
+`, name)
+}
--- a/internal/framework/provider/provider.go
+++ b/internal/framework/provider/provider.go
@ -13,6 +13,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-framework/provider/schema"
 	"github.com/hashicorp/terraform-plugin-framework/resource"
 	"github.com/hashicorp/terraform-plugin-framework/types"
+	"github.com/hashicorp/terraform-provider-kubernetes/internal/framework/provider/admissionregistrationv1"
 	"github.com/hashicorp/terraform-provider-kubernetes/internal/framework/provider/authenticationv1"
 	"github.com/hashicorp/terraform-provider-kubernetes/internal/framework/provider/certificatesv1"
 	pfunctions "github.com/hashicorp/terraform-provider-kubernetes/internal/framework/provider/functions"
@ -192,7 +193,9 @@ func (p *KubernetesProvider) Schema(ctx context.Context, req provider.SchemaRequ
 }

 func (p *KubernetesProvider) Resources(ctx context.Context) []func() resource.Resource {
-	return []func() resource.Resource{}
+	return []func() resource.Resource{
+		admissionregistrationv1.NewValidatingAdmissionPolicy,
+	}
 }

 func (p *KubernetesProvider) DataSources(ctx context.Context) []func() datasource.DataSource {
--- a/internal/mux/mux.go
+++ b/internal/mux/mux.go
@ -7,21 +7,38 @@ import (
 	"context"

 	"github.com/hashicorp/terraform-plugin-framework/providerserver"
-	"github.com/hashicorp/terraform-plugin-go/tfprotov5"
-	"github.com/hashicorp/terraform-plugin-mux/tf5muxserver"
+	"github.com/hashicorp/terraform-plugin-go/tfprotov6"
+	"github.com/hashicorp/terraform-plugin-mux/tf5to6server"
+	"github.com/hashicorp/terraform-plugin-mux/tf6muxserver"
 	framework "github.com/hashicorp/terraform-provider-kubernetes/internal/framework/provider"
 	"github.com/hashicorp/terraform-provider-kubernetes/kubernetes"
 	manifest "github.com/hashicorp/terraform-provider-kubernetes/manifest/provider"
 )

-func MuxServer(ctx context.Context, v string) (tfprotov5.ProviderServer, error) {
+func MuxServer(ctx context.Context, v string) (tfprotov6.ProviderServer, error) {
 	kubernetesProvider := kubernetes.Provider()

-	providers := []func() tfprotov5.ProviderServer{
+	upgradedSdkProvider, err := tf5to6server.UpgradeServer(
+		ctx,
 		kubernetesProvider.GRPCProvider,
-		manifest.Provider(),
-		providerserver.NewProtocol5(framework.New(v, kubernetesProvider.Meta)),
+	)
+	if err != nil {
+		return nil, err
 	}

-	return tf5muxserver.NewMuxServer(ctx, providers...)
+	upgradedManifestProvider, err := tf5to6server.UpgradeServer(
+		ctx,
+		manifest.Provider(),
+	)
+	if err != nil {
+		return nil, err
+	}
+
+	providers := []func() tfprotov6.ProviderServer{
+		func() tfprotov6.ProviderServer { return upgradedSdkProvider },
+		func() tfprotov6.ProviderServer { return upgradedManifestProvider },
+		providerserver.NewProtocol6(framework.New(v, kubernetesProvider.Meta)),
+	}
+
+	return tf6muxserver.NewMuxServer(ctx, providers...)
 }
--- a/kubernetes/resource_kubernetes_mutating_webhook_configuration.go
+++ b/kubernetes/resource_kubernetes_mutating_webhook_configuration.go
@ -12,7 +12,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
-	admissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
+	admissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
@ -167,7 +167,7 @@ func resourceKubernetesMutatingWebhookConfigurationCreate(ctx context.Context, d
 		requestv1beta1 := &admissionregistrationv1beta1.MutatingWebhookConfiguration{}
 		responsev1beta1 := &admissionregistrationv1beta1.MutatingWebhookConfiguration{}
 		copier.Copy(requestv1beta1, cfg)
-		responsev1beta1, err = conn.AdmissionregistrationV1beta1().MutatingWebhookConfigurations().Create(ctx, requestv1beta1, metav1.CreateOptions{})
+		responsev1beta1, err = conn.AdmissionregistrationV1().MutatingWebhookConfigurations().Create(ctx, requestv1beta1, metav1.CreateOptions{})
 		copier.Copy(res, responsev1beta1)
 	} else {
 		res, err = conn.AdmissionregistrationV1().MutatingWebhookConfigurations().Create(ctx, &cfg, metav1.CreateOptions{})
@ -209,7 +209,7 @@ func resourceKubernetesMutatingWebhookConfigurationRead(ctx context.Context, d *
 	}
 	if useadmissionregistrationv1beta1 {
 		cfgv1beta1 := &admissionregistrationv1beta1.MutatingWebhookConfiguration{}
-		cfgv1beta1, err = conn.AdmissionregistrationV1beta1().MutatingWebhookConfigurations().Get(ctx, name, metav1.GetOptions{})
+		cfgv1beta1, err = conn.AdmissionregistrationV1().MutatingWebhookConfigurations().Get(ctx, name, metav1.GetOptions{})
 		copier.Copy(cfg, cfgv1beta1)
 	} else {
 		cfg, err = conn.AdmissionregistrationV1().MutatingWebhookConfigurations().Get(ctx, name, metav1.GetOptions{})
@ -279,7 +279,7 @@ func resourceKubernetesMutatingWebhookConfigurationUpdate(ctx context.Context, d
 	}
 	if useadmissionregistrationv1beta1 {
 		responsev1beta1 := &admissionregistrationv1beta1.MutatingWebhookConfiguration{}
-		responsev1beta1, err = conn.AdmissionregistrationV1beta1().MutatingWebhookConfigurations().Patch(ctx, name, types.JSONPatchType, data, metav1.PatchOptions{})
+		responsev1beta1, err = conn.AdmissionregistrationV1().MutatingWebhookConfigurations().Patch(ctx, name, types.JSONPatchType, data, metav1.PatchOptions{})
 		copier.Copy(res, responsev1beta1)
 	} else {
 		res, err = conn.AdmissionregistrationV1().MutatingWebhookConfigurations().Patch(ctx, name, types.JSONPatchType, data, metav1.PatchOptions{})
--- a/kubernetes/resource_kubernetes_validating_webhook_configuration_v1.go
+++ b/kubernetes/resource_kubernetes_validating_webhook_configuration_v1.go
@ -12,7 +12,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
-	admissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
+	admissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
@ -157,7 +157,7 @@ func resourceKubernetesValidatingWebhookConfigurationV1Create(ctx context.Contex
 		requestv1beta1 := &admissionregistrationv1beta1.ValidatingWebhookConfiguration{}
 		responsev1beta1 := &admissionregistrationv1beta1.ValidatingWebhookConfiguration{}
 		copier.Copy(requestv1beta1, cfg)
-		responsev1beta1, err = conn.AdmissionregistrationV1beta1().ValidatingWebhookConfigurations().Create(ctx, requestv1beta1, metav1.CreateOptions{})
+		responsev1beta1, err = conn.AdmissionregistrationV1().ValidatingWebhookConfigurations().Create(ctx, requestv1beta1, metav1.CreateOptions{})
 		copier.Copy(res, responsev1beta1)
 	} else {
 		res, err = conn.AdmissionregistrationV1().ValidatingWebhookConfigurations().Create(ctx, &cfg, metav1.CreateOptions{})
@ -199,7 +199,7 @@ func resourceKubernetesValidatingWebhookConfigurationV1Read(ctx context.Context,
 	}
 	if useadmissionregistrationv1beta1 {
 		cfgv1beta1 := &admissionregistrationv1beta1.ValidatingWebhookConfiguration{}
-		cfgv1beta1, err = conn.AdmissionregistrationV1beta1().ValidatingWebhookConfigurations().Get(ctx, name, metav1.GetOptions{})
+		cfgv1beta1, err = conn.AdmissionregistrationV1().ValidatingWebhookConfigurations().Get(ctx, name, metav1.GetOptions{})
 		copier.Copy(cfg, cfgv1beta1)
 	} else {
 		cfg, err = conn.AdmissionregistrationV1().ValidatingWebhookConfigurations().Get(ctx, name, metav1.GetOptions{})
@ -274,7 +274,7 @@ func resourceKubernetesValidatingWebhookConfigurationV1Update(ctx context.Contex
 	}
 	if useadmissionregistrationv1beta1 {
 		responsev1beta1 := &admissionregistrationv1beta1.ValidatingWebhookConfiguration{}
-		responsev1beta1, err = conn.AdmissionregistrationV1beta1().ValidatingWebhookConfigurations().Patch(ctx, name, types.JSONPatchType, data, metav1.PatchOptions{})
+		responsev1beta1, err = conn.AdmissionregistrationV1().ValidatingWebhookConfigurations().Patch(ctx, name, types.JSONPatchType, data, metav1.PatchOptions{})
 		copier.Copy(res, responsev1beta1)
 	} else {
 		res, err = conn.AdmissionregistrationV1().ValidatingWebhookConfigurations().Patch(ctx, name, types.JSONPatchType, data, metav1.PatchOptions{})
--- a/kubernetes/resource_kubernetes_validating_webhook_configuration_v1beta1.go
+++ b/kubernetes/resource_kubernetes_validating_webhook_configuration_v1beta1.go
@ -12,7 +12,7 @@ import (
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/schema"
 	"github.com/hashicorp/terraform-plugin-sdk/v2/helper/validation"
 	admissionregistrationv1 "k8s.io/api/admissionregistration/v1"
-	admissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1beta1"
+	admissionregistrationv1beta1 "k8s.io/api/admissionregistration/v1"
 	"k8s.io/apimachinery/pkg/api/errors"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	types "k8s.io/apimachinery/pkg/types"
@ -156,7 +156,7 @@ func resourceKubernetesValidatingWebhookConfigurationV1Beta1Create(ctx context.C
 		requestv1beta1 := &admissionregistrationv1beta1.ValidatingWebhookConfiguration{}
 		responsev1beta1 := &admissionregistrationv1beta1.ValidatingWebhookConfiguration{}
 		copier.Copy(requestv1beta1, cfg)
-		responsev1beta1, err = conn.AdmissionregistrationV1beta1().ValidatingWebhookConfigurations().Create(ctx, requestv1beta1, metav1.CreateOptions{})
+		responsev1beta1, err = conn.AdmissionregistrationV1().ValidatingWebhookConfigurations().Create(ctx, requestv1beta1, metav1.CreateOptions{})
 		copier.Copy(res, responsev1beta1)
 	} else {
 		res, err = conn.AdmissionregistrationV1().ValidatingWebhookConfigurations().Create(ctx, &cfg, metav1.CreateOptions{})
@ -198,7 +198,7 @@ func resourceKubernetesValidatingWebhookConfigurationV1Beta1Read(ctx context.Con
 	}
 	if useadmissionregistrationv1beta1 {
 		cfgv1beta1 := &admissionregistrationv1beta1.ValidatingWebhookConfiguration{}
-		cfgv1beta1, err = conn.AdmissionregistrationV1beta1().ValidatingWebhookConfigurations().Get(ctx, name, metav1.GetOptions{})
+		cfgv1beta1, err = conn.AdmissionregistrationV1().ValidatingWebhookConfigurations().Get(ctx, name, metav1.GetOptions{})
 		copier.Copy(cfg, cfgv1beta1)
 	} else {
 		cfg, err = conn.AdmissionregistrationV1().ValidatingWebhookConfigurations().Get(ctx, name, metav1.GetOptions{})
@ -268,7 +268,7 @@ func resourceKubernetesValidatingWebhookConfigurationV1Beta1Update(ctx context.C
 	}
 	if useadmissionregistrationv1beta1 {
 		responsev1beta1 := &admissionregistrationv1beta1.ValidatingWebhookConfiguration{}
-		responsev1beta1, err = conn.AdmissionregistrationV1beta1().ValidatingWebhookConfigurations().Patch(ctx, name, types.JSONPatchType, data, metav1.PatchOptions{})
+		responsev1beta1, err = conn.AdmissionregistrationV1().ValidatingWebhookConfigurations().Patch(ctx, name, types.JSONPatchType, data, metav1.PatchOptions{})
 		copier.Copy(res, responsev1beta1)
 	} else {
 		res, err = conn.AdmissionregistrationV1().ValidatingWebhookConfigurations().Patch(ctx, name, types.JSONPatchType, data, metav1.PatchOptions{})
--- a/kubernetes/test-dfa/deferred_actions_test.go
+++ b/kubernetes/test-dfa/deferred_actions_test.go
@ -7,7 +7,7 @@ import (
 	"context"
 	"testing"

-	"github.com/hashicorp/terraform-plugin-go/tfprotov5"
+	"github.com/hashicorp/terraform-plugin-go/tfprotov6"
 	"github.com/hashicorp/terraform-plugin-testing/config"
 	"github.com/hashicorp/terraform-plugin-testing/helper/resource"
 	"github.com/hashicorp/terraform-plugin-testing/knownvalue"
@ -18,8 +18,8 @@ import (
 	"github.com/hashicorp/terraform-provider-kubernetes/internal/mux"
 )

-var muxFactory = map[string]func() (tfprotov5.ProviderServer, error){
-	"kubernetes": func() (tfprotov5.ProviderServer, error) {
+var muxFactory = map[string]func() (tfprotov6.ProviderServer, error){
+	"kubernetes": func() (tfprotov6.ProviderServer, error) {
 		return mux.MuxServer(context.Background(), "Test")
 	},
 }
@ -35,7 +35,7 @@ func TestAccKubernetesDeferredActions_2_step(t *testing.T) {
 		},
 		Steps: []resource.TestStep{
 			{
-				ProtoV5ProviderFactories: muxFactory,
+				ProtoV6ProviderFactories: muxFactory,
 				ConfigDirectory: func(tscr config.TestStepConfigRequest) string {
 					return "./config-basic"
 				},
@ -60,7 +60,7 @@ func TestAccKubernetesDeferredActions_2_step(t *testing.T) {
 				},
 			},
 			{
-				ProtoV5ProviderFactories: muxFactory,
+				ProtoV6ProviderFactories: muxFactory,
 				ConfigDirectory: func(tscr config.TestStepConfigRequest) string {
 					return "./config-basic"
 				},
@ -85,7 +85,7 @@ func TestAccKubernetesDeferredActions_2_step(t *testing.T) {
 				},
 			},
 			{
-				ProtoV5ProviderFactories: muxFactory,
+				ProtoV6ProviderFactories: muxFactory,
 				ConfigDirectory: func(tscr config.TestStepConfigRequest) string {
 					return "./config-basic"
 				},
--- a/main.go
+++ b/main.go
@ -14,8 +14,8 @@ import (

 	"github.com/hashicorp/go-plugin"
 	"github.com/hashicorp/terraform-exec/tfexec"
-	"github.com/hashicorp/terraform-plugin-go/tfprotov5"
-	tf5server "github.com/hashicorp/terraform-plugin-go/tfprotov5/tf5server"
+	"github.com/hashicorp/terraform-plugin-go/tfprotov6"
+	"github.com/hashicorp/terraform-plugin-go/tfprotov6/tf6server"
 	"github.com/hashicorp/terraform-provider-kubernetes/internal/mux"
 )

@ -33,14 +33,13 @@ func main() {
 	flag.Parse()

 	ctx := context.Background()
-
 	muxer, err := mux.MuxServer(ctx, Version)
 	if err != nil {
 		log.Println(err.Error())
 		os.Exit(1)
 	}

-	opts := []tf5server.ServeOpt{}
+	opts := []tf6server.ServeOpt{}
 	if *debugFlag {
 		reattachConfigCh := make(chan *plugin.ReattachConfig)
 		go func() {
@ -51,10 +50,10 @@ func main() {
 			}
 			printReattachConfig(reattachConfig)
 		}()
-		opts = append(opts, tf5server.WithDebug(ctx, reattachConfigCh, nil))
+		opts = append(opts, tf6server.WithDebug(ctx, reattachConfigCh, nil))
 	}

-	tf5server.Serve(providerName, func() tfprotov5.ProviderServer { return muxer }, opts...)
+	tf6server.Serve(providerName, func() tfprotov6.ProviderServer { return muxer }, opts...)
 }

 // convertReattachConfig converts plugin.ReattachConfig to tfexec.ReattachConfig