diff --git a/go/cdk8s-crd/imports/certmanagerio/CertificateSpecKeystoresJks.go b/go/cdk8s-crd/imports/certmanagerio/CertificateSpecKeystoresJks.go
index b7dc402d..ff518f2e 100644
--- a/go/cdk8s-crd/imports/certmanagerio/CertificateSpecKeystoresJks.go
+++ b/go/cdk8s-crd/imports/certmanagerio/CertificateSpecKeystoresJks.go
@@ -7,18 +7,26 @@ type CertificateSpecKeystoresJks struct {
 	//
 	// If true, a file named `keystore.jks` will be created in the target
 	// Secret resource, encrypted using the password stored in
-	// `passwordSecretRef`.
+	// `passwordSecretRef` or `password`.
 	// The keystore file will be updated immediately.
 	// If the issuer provided a CA certificate, a file named `truststore.jks`
 	// will also be created in the target Secret resource, encrypted using the
 	// password stored in `passwordSecretRef`
 	// containing the issuing Certificate Authority.
 	Create *bool `field:"required" json:"create" yaml:"create"`
-	// PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the JKS keystore.
-	PasswordSecretRef *CertificateSpecKeystoresJksPasswordSecretRef `field:"required" json:"passwordSecretRef" yaml:"passwordSecretRef"`
 	// Alias specifies the alias of the key in the keystore, required by the JKS format.
 	//
 	// If not provided, the default alias `certificate` will be used.
 	Alias *string `field:"optional" json:"alias" yaml:"alias"`
+	// Password provides a literal password used to encrypt the JKS keystore.
+	//
+	// Mutually exclusive with passwordSecretRef.
+	// One of password or passwordSecretRef must provide a password with a non-zero length.
+	Password *string `field:"optional" json:"password" yaml:"password"`
+	// PasswordSecretRef is a reference to a non-empty key in a Secret resource containing the password used to encrypt the JKS keystore.
+	//
+	// Mutually exclusive with password.
+	// One of password or passwordSecretRef must provide a password with a non-zero length.
+	PasswordSecretRef *CertificateSpecKeystoresJksPasswordSecretRef `field:"optional" json:"passwordSecretRef" yaml:"passwordSecretRef"`
 }
 
diff --git a/go/cdk8s-crd/imports/certmanagerio/CertificateSpecKeystoresJksPasswordSecretRef.go b/go/cdk8s-crd/imports/certmanagerio/CertificateSpecKeystoresJksPasswordSecretRef.go
index 7a5fb399..540e8b21 100644
--- a/go/cdk8s-crd/imports/certmanagerio/CertificateSpecKeystoresJksPasswordSecretRef.go
+++ b/go/cdk8s-crd/imports/certmanagerio/CertificateSpecKeystoresJksPasswordSecretRef.go
@@ -1,7 +1,10 @@
 package certmanagerio
 
 
-// PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the JKS keystore.
+// PasswordSecretRef is a reference to a non-empty key in a Secret resource containing the password used to encrypt the JKS keystore.
+//
+// Mutually exclusive with password.
+// One of password or passwordSecretRef must provide a password with a non-zero length.
 type CertificateSpecKeystoresJksPasswordSecretRef struct {
 	// Name of the resource being referred to.
 	//
diff --git a/go/cdk8s-crd/imports/certmanagerio/CertificateSpecKeystoresPkcs12.go b/go/cdk8s-crd/imports/certmanagerio/CertificateSpecKeystoresPkcs12.go
index 71e82b83..8989cb1d 100644
--- a/go/cdk8s-crd/imports/certmanagerio/CertificateSpecKeystoresPkcs12.go
+++ b/go/cdk8s-crd/imports/certmanagerio/CertificateSpecKeystoresPkcs12.go
@@ -7,15 +7,23 @@ type CertificateSpecKeystoresPkcs12 struct {
 	//
 	// If true, a file named `keystore.p12` will be created in the target
 	// Secret resource, encrypted using the password stored in
-	// `passwordSecretRef`.
+	// `passwordSecretRef` or in `password`.
 	// The keystore file will be updated immediately.
 	// If the issuer provided a CA certificate, a file named `truststore.p12` will
 	// also be created in the target Secret resource, encrypted using the
 	// password stored in `passwordSecretRef` containing the issuing Certificate
 	// Authority.
 	Create *bool `field:"required" json:"create" yaml:"create"`
-	// PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the PKCS12 keystore.
-	PasswordSecretRef *CertificateSpecKeystoresPkcs12PasswordSecretRef `field:"required" json:"passwordSecretRef" yaml:"passwordSecretRef"`
+	// Password provides a literal password used to encrypt the PKCS#12 keystore.
+	//
+	// Mutually exclusive with passwordSecretRef.
+	// One of password or passwordSecretRef must provide a password with a non-zero length.
+	Password *string `field:"optional" json:"password" yaml:"password"`
+	// PasswordSecretRef is a reference to a non-empty key in a Secret resource containing the password used to encrypt the PKCS#12 keystore.
+	//
+	// Mutually exclusive with password.
+	// One of password or passwordSecretRef must provide a password with a non-zero length.
+	PasswordSecretRef *CertificateSpecKeystoresPkcs12PasswordSecretRef `field:"optional" json:"passwordSecretRef" yaml:"passwordSecretRef"`
 	// Profile specifies the key and certificate encryption algorithms and the HMAC algorithm used to create the PKCS12 keystore.
 	//
 	// Default value is `LegacyRC2` for backward compatibility.
diff --git a/go/cdk8s-crd/imports/certmanagerio/CertificateSpecKeystoresPkcs12PasswordSecretRef.go b/go/cdk8s-crd/imports/certmanagerio/CertificateSpecKeystoresPkcs12PasswordSecretRef.go
index a4ec0059..b67a2b0a 100644
--- a/go/cdk8s-crd/imports/certmanagerio/CertificateSpecKeystoresPkcs12PasswordSecretRef.go
+++ b/go/cdk8s-crd/imports/certmanagerio/CertificateSpecKeystoresPkcs12PasswordSecretRef.go
@@ -1,7 +1,10 @@
 package certmanagerio
 
 
-// PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the PKCS12 keystore.
+// PasswordSecretRef is a reference to a non-empty key in a Secret resource containing the password used to encrypt the PKCS#12 keystore.
+//
+// Mutually exclusive with password.
+// One of password or passwordSecretRef must provide a password with a non-zero length.
 type CertificateSpecKeystoresPkcs12PasswordSecretRef struct {
 	// Name of the resource being referred to.
 	//
diff --git a/go/kubernetes-end-to-end-aws/cdk.out/kubernetes-end-to-end-aws.assets.json b/go/kubernetes-end-to-end-aws/cdk.out/kubernetes-end-to-end-aws.assets.json
index 8dce7567..90e9ed61 100644
--- a/go/kubernetes-end-to-end-aws/cdk.out/kubernetes-end-to-end-aws.assets.json
+++ b/go/kubernetes-end-to-end-aws/cdk.out/kubernetes-end-to-end-aws.assets.json
@@ -105,7 +105,7 @@
         }
       }
     },
-    "3d6d954a698964f5fef5b4c3e79ff67b53c746277c03290ca3d6617be8c01874": {
+    "0bdd7852b00076aeabd4467eaa513b4f89c147b1b76a4b8a9844d1fe24484b1c": {
       "source": {
         "path": "kubernetesendtoendawsawscdkawseksClusterResourceProvider5E6E6F1A.nested.template.json",
         "packaging": "file"
@@ -113,12 +113,12 @@
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "3d6d954a698964f5fef5b4c3e79ff67b53c746277c03290ca3d6617be8c01874.json",
+          "objectKey": "0bdd7852b00076aeabd4467eaa513b4f89c147b1b76a4b8a9844d1fe24484b1c.json",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
         }
       }
     },
-    "74d50af048c3d2687024f6a59ece42246a2aebf198ee571d9062e184dcd1d63f": {
+    "8154b6009d8c431ea28dc9e70e934d1510a914f15d1113c421735a8741df57d3": {
       "source": {
         "path": "kubernetesendtoendawsawscdkawseksKubectlProvider1BCE4654.nested.template.json",
         "packaging": "file"
@@ -126,12 +126,12 @@
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "74d50af048c3d2687024f6a59ece42246a2aebf198ee571d9062e184dcd1d63f.json",
+          "objectKey": "8154b6009d8c431ea28dc9e70e934d1510a914f15d1113c421735a8741df57d3.json",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
         }
       }
     },
-    "803ee365d276768ad63caa6b682387eb1913016dcb5f954343e73f10cbb3e257": {
+    "a42482c0007a7571e8580363affad3b4f80d227b13103fe621d37146e814509d": {
       "source": {
         "path": "kubernetes-end-to-end-aws.template.json",
         "packaging": "file"
@@ -139,7 +139,7 @@
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "803ee365d276768ad63caa6b682387eb1913016dcb5f954343e73f10cbb3e257.json",
+          "objectKey": "a42482c0007a7571e8580363affad3b4f80d227b13103fe621d37146e814509d.json",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
         }
       }
diff --git a/go/kubernetes-end-to-end-aws/cdk.out/kubernetes-end-to-end-aws.template.json b/go/kubernetes-end-to-end-aws/cdk.out/kubernetes-end-to-end-aws.template.json
index df255f9f..8225938c 100644
--- a/go/kubernetes-end-to-end-aws/cdk.out/kubernetes-end-to-end-aws.template.json
+++ b/go/kubernetes-end-to-end-aws/cdk.out/kubernetes-end-to-end-aws.template.json
@@ -1212,7 +1212,7 @@
        {
         "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
        },
-       "/3d6d954a698964f5fef5b4c3e79ff67b53c746277c03290ca3d6617be8c01874.json"
+       "/0bdd7852b00076aeabd4467eaa513b4f89c147b1b76a4b8a9844d1fe24484b1c.json"
       ]
      ]
     },
@@ -1252,7 +1252,7 @@
        {
         "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
        },
-       "/74d50af048c3d2687024f6a59ece42246a2aebf198ee571d9062e184dcd1d63f.json"
+       "/8154b6009d8c431ea28dc9e70e934d1510a914f15d1113c421735a8741df57d3.json"
       ]
      ]
     },
@@ -1863,7 +1863,7 @@
   "CDKMetadata": {
    "Type": "AWS::CDK::Metadata",
    "Properties": {
-    "Analytics": "v2:deflate64:H4sIAAAAAAAA/1VSXW/bMAz8LXmXlS5ptz3OFYYu/ViMePBrQct0okamDIlKFhj+74PtZm6feDxQ1JG8ley+fZc3CziHRFfHxJpSdjmDPgo4h9curF8hBOQg0yGIsJb3UR+R7yGgsNCUFUhV0zNc0Bfog3Ek8Bhkp2wMjF6k55BGPoinWKInZAwvQKbGwGLbIm0q5YhQc+bdyVToxW9X4d672ApV05z8QtuoA3j+0GlbvqHmAmxEkdpSOWLvrEUvcvQnozHV2kXiXqBeya5o9dCzyJTIYmmNzmNJyAM3o52LjH+gtDjzM5eG4LQBHsa8Fg/g5yYb5QI/AOMZLiLz5gSMc+MN8Sj7WjApec9SZtCHBolFjjp6w5eH6w4+Eb0w0Mhu5yZ9Y8ycNXpsOKG+F+O1coa9ob3YYXDRaxQqBnbNnNb0EW8jt3HaxmgAVdNjGOb89Or/nVRNL9C2wweqJuWoMsNaenEj14sf74ZaThZJ7OCP5BhL1GyT0+pOPk24WN2N3unF3n2Rq7W8XVpD8e8Smurr7eItGJP4SGwalLsp/gPcu9bctAIAAA=="
+    "Analytics": "v2:deflate64:H4sIAAAAAAAA/1VSwW7bMAz9ltxlpUuWbce5wtBlXRcjLnwtaJlO1MiUIVHJAsP/Pthu5vbExweKeiTfSnZfv8m7BVxCoqtTYk0pu5xBnwRcwksX1i8QAnKQ6RBEWMv7qE/I9xBQWGjKCqSq6Tdc0Rfog3Ek8BRkp2wMjF6kl5BGPorHWKInZAxPQKbGwGLXIm0r5YhQc+bd2VToxR9X4cG72ApV05z8RNuoI3h+12lXvqLmAmxEkdpSOWLvrEUvcvRnozHV2kXiXqBeya5o9dCzyJTIYmmNzmNJyAM3o72LjM9QWpz5mUtDcNoAD2PeigfwY5uNcoEfgPECV5F5cwbGufGWeJR9K5iUvGUpM+hjg8QiRx294evDbQcfiF4YaGS3d5O+MWbOGj02nFDfi/FaOcPB0EHsMbjoNQoVA7tmTmt6j3eR2zhtYzSAqulXGOb88Or/nVRNT9C2wweqJuWoMsNaenEn14vvb4ZaThZJ7OCP5BRL1GyT82ojHydcrDajd3pxcJ/kai03S2so/l1CU335vHgNxiQ+EpsG5X6K/wDq6lT4tAIAAA=="
    },
    "Metadata": {
     "aws:cdk:path": "kubernetes-end-to-end-aws/CDKMetadata/Default"
diff --git a/go/kubernetes-end-to-end-aws/cdk.out/kubernetesendtoendawsawscdkawseksClusterResourceProvider5E6E6F1A.nested.template.json b/go/kubernetes-end-to-end-aws/cdk.out/kubernetesendtoendawsawscdkawseksClusterResourceProvider5E6E6F1A.nested.template.json
index eae028ea..8ed5c0b4 100644
--- a/go/kubernetes-end-to-end-aws/cdk.out/kubernetesendtoendawsawscdkawseksClusterResourceProvider5E6E6F1A.nested.template.json
+++ b/go/kubernetes-end-to-end-aws/cdk.out/kubernetesendtoendawsawscdkawseksClusterResourceProvider5E6E6F1A.nested.template.json
@@ -828,7 +828,7 @@
   "CDKMetadata": {
    "Type": "AWS::CDK::Metadata",
    "Properties": {
-    "Analytics": "v2:deflate64:H4sIAAAAAAAA/zWNwW6DMBBEvyV3x2lD1PaaIPXURohIvVobe0EuZo28dhOE+PfKJJxm3mp2Zi/fP+TLBm681abbOnuV0xk5orlE0J1w0F8NKAcjBkXeoBqCv48KWqQoz95glfmY8SuHBNxYTVwoYMbI8phFcCFPSXcYT8D4LJVT2dDy84OBrSfxmUjHbMqGVj8LC72cau8wnxetvLN6zPhw8yyWmUuE1lIramSfgkahE0ffq/BkllXwf9ZgWKrWVNlQ6cnYdfobhsFSO4vWv8p9IQ87Zyndd9Cbt8Pml63dhkTR9ijrh/4D4qZ4p0YBAAA="
+    "Analytics": "v2:deflate64:H4sIAAAAAAAA/zWNzW6DMBCEnyV347Shf9cEqac2QkTq1drYC3Ixa+S1myDEu1cmyWnmW83O7OT7h3zawIULbfrC2bOcj8gRzSmC7oWD4WxAOZgwKPIG1Rj8dVLQIUV59AbrzPuMXzkk4MJq5lIBM0aW+yyCS3lIusd4AMZ7qZyrltafHwxsPYnPRDpmU7X08IuwMMi58Q7zedXaO6unjDe3LGKdOUXoLHWiQfYpaBQ6cfSDCndmWQf/Zw2GteqRqlqqPBn7mP6GcbTULaLzz3JXytets5SuWxjM28vml60tQqJoB5TNTf8B1Pf6g0YBAAA="
    },
    "Metadata": {
     "aws:cdk:path": "kubernetes-end-to-end-aws/@aws-cdk--aws-eks.ClusterResourceProvider/CDKMetadata/Default"
diff --git a/go/kubernetes-end-to-end-aws/cdk.out/kubernetesendtoendawsawscdkawseksKubectlProvider1BCE4654.nested.template.json b/go/kubernetes-end-to-end-aws/cdk.out/kubernetesendtoendawsawscdkawseksKubectlProvider1BCE4654.nested.template.json
index 727af4ce..9547c238 100644
--- a/go/kubernetes-end-to-end-aws/cdk.out/kubernetesendtoendawsawscdkawseksKubectlProvider1BCE4654.nested.template.json
+++ b/go/kubernetes-end-to-end-aws/cdk.out/kubernetesendtoendawsawscdkawseksKubectlProvider1BCE4654.nested.template.json
@@ -334,7 +334,7 @@
   "CDKMetadata": {
    "Type": "AWS::CDK::Metadata",
    "Properties": {
-    "Analytics": "v2:deflate64:H4sIAAAAAAAA/02PzWrDQAyEnyX3tdLGoe01MfTSHoILvS7yWjWK9wdWu3WD8buXdUzpaUYaGH06wPMLPOxwksr0Y2W5gxkn0TONAm+5I5PsJYZv7ikqi67rEebX7E3i4FXz5f/7d7xR/KQoHPyiGB3MbbBUolUvwbK5lfHuFiW1RhFKAqciSmo4ZzNSOqPQolqSkKMhtaYfCQf2w4ahbbmmcRJjGU6TNJZXgNLfBN/zimWypOB03JoE/r4pVNt2UUN4hEMNx71ln3/26Pqn4+4qzFXMPrEjaO/6CzD3XQgxAQAA"
+    "Analytics": "v2:deflate64:H4sIAAAAAAAA/02PS2vDQAyEf0vua6WN+7omhl7aQ3Ch10Veq0bxPmC1WzcY//eyjik9zUgDo08HeH6Bux1OUpl+rCx3MOMkeqZR4C13ZJI9x/DNPUVl0XU9wvyavUkcvGq+/H//jleKnxSFg18Uo4O5DZZKtOo5WDbXMt7coqTWKEJJ4FhESQ2nbEZKJxRaVEsScjSk1vQj4cB+2DC0Ldc0TmIsw3GSxvIKUPqb4HtesUyWFJyOW5PA3zeFatsuagj3cKjhcW/Z5589uv7pYXcR5ipmn9gRtDf9BQam3ywxAQAA"
    },
    "Metadata": {
     "aws:cdk:path": "kubernetes-end-to-end-aws/@aws-cdk--aws-eks.KubectlProvider/CDKMetadata/Default"
diff --git a/go/kubernetes-end-to-end-aws/cdk.out/manifest.json b/go/kubernetes-end-to-end-aws/cdk.out/manifest.json
index 81307660..6dd68528 100644
--- a/go/kubernetes-end-to-end-aws/cdk.out/manifest.json
+++ b/go/kubernetes-end-to-end-aws/cdk.out/manifest.json
@@ -17,7 +17,7 @@
         "validateOnSynth": false,
         "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
         "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
-        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/803ee365d276768ad63caa6b682387eb1913016dcb5f954343e73f10cbb3e257.json",
+        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/a42482c0007a7571e8580363affad3b4f80d227b13103fe621d37146e814509d.json",
         "requiresBootstrapStackVersion": 6,
         "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
         "additionalDependencies": [
diff --git a/go/kubernetes-end-to-end-aws/cdk.out/tree.json b/go/kubernetes-end-to-end-aws/cdk.out/tree.json
index 7f0c3752..ab4ed11f 100644
--- a/go/kubernetes-end-to-end-aws/cdk.out/tree.json
+++ b/go/kubernetes-end-to-end-aws/cdk.out/tree.json
@@ -2772,7 +2772,7 @@
                           {
                             "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
                           },
-                          "/3d6d954a698964f5fef5b4c3e79ff67b53c746277c03290ca3d6617be8c01874.json"
+                          "/0bdd7852b00076aeabd4467eaa513b4f89c147b1b76a4b8a9844d1fe24484b1c.json"
                         ]
                       ]
                     },
@@ -3462,7 +3462,7 @@
                           {
                             "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
                           },
-                          "/74d50af048c3d2687024f6a59ece42246a2aebf198ee571d9062e184dcd1d63f.json"
+                          "/8154b6009d8c431ea28dc9e70e934d1510a914f15d1113c421735a8741df57d3.json"
                         ]
                       ]
                     },
diff --git a/python/cdk8s-crd/imports/io/cert_manager/__init__.py b/python/cdk8s-crd/imports/io/cert_manager/__init__.py
index 09e4b03b..333208e8 100644
--- a/python/cdk8s-crd/imports/io/cert_manager/__init__.py
+++ b/python/cdk8s-crd/imports/io/cert_manager/__init__.py
@@ -833,8 +833,9 @@ def __repr__(self) -> str:
     jsii_struct_bases=[],
     name_mapping={
         "create": "create",
-        "password_secret_ref": "passwordSecretRef",
         "alias": "alias",
+        "password": "password",
+        "password_secret_ref": "passwordSecretRef",
     },
 )
 class CertificateSpecKeystoresJks:
@@ -842,14 +843,16 @@ def __init__(
         self,
         *,
         create: builtins.bool,
-        password_secret_ref: typing.Union["CertificateSpecKeystoresJksPasswordSecretRef", typing.Dict[builtins.str, typing.Any]],
         alias: typing.Optional[builtins.str] = None,
+        password: typing.Optional[builtins.str] = None,
+        password_secret_ref: typing.Optional[typing.Union["CertificateSpecKeystoresJksPasswordSecretRef", typing.Dict[builtins.str, typing.Any]]] = None,
     ) -> None:
         '''JKS configures options for storing a JKS keystore in the ``spec.secretName`` Secret resource.
 
-        :param create: Create enables JKS keystore creation for the Certificate. If true, a file named ``keystore.jks`` will be created in the target Secret resource, encrypted using the password stored in ``passwordSecretRef``. The keystore file will be updated immediately. If the issuer provided a CA certificate, a file named ``truststore.jks`` will also be created in the target Secret resource, encrypted using the password stored in ``passwordSecretRef`` containing the issuing Certificate Authority
-        :param password_secret_ref: PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the JKS keystore.
+        :param create: Create enables JKS keystore creation for the Certificate. If true, a file named ``keystore.jks`` will be created in the target Secret resource, encrypted using the password stored in ``passwordSecretRef`` or ``password``. The keystore file will be updated immediately. If the issuer provided a CA certificate, a file named ``truststore.jks`` will also be created in the target Secret resource, encrypted using the password stored in ``passwordSecretRef`` containing the issuing Certificate Authority
         :param alias: Alias specifies the alias of the key in the keystore, required by the JKS format. If not provided, the default alias ``certificate`` will be used.
+        :param password: Password provides a literal password used to encrypt the JKS keystore. Mutually exclusive with passwordSecretRef. One of password or passwordSecretRef must provide a password with a non-zero length.
+        :param password_secret_ref: PasswordSecretRef is a reference to a non-empty key in a Secret resource containing the password used to encrypt the JKS keystore. Mutually exclusive with password. One of password or passwordSecretRef must provide a password with a non-zero length.
 
         :schema: CertificateSpecKeystoresJks
         '''
@@ -858,14 +861,18 @@ def __init__(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__571b4581314dc6da5154732cbc505ea05f780b18877fbcbc24fd2e2fa8274e62)
             check_type(argname="argument create", value=create, expected_type=type_hints["create"])
-            check_type(argname="argument password_secret_ref", value=password_secret_ref, expected_type=type_hints["password_secret_ref"])
             check_type(argname="argument alias", value=alias, expected_type=type_hints["alias"])
+            check_type(argname="argument password", value=password, expected_type=type_hints["password"])
+            check_type(argname="argument password_secret_ref", value=password_secret_ref, expected_type=type_hints["password_secret_ref"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "create": create,
-            "password_secret_ref": password_secret_ref,
         }
         if alias is not None:
             self._values["alias"] = alias
+        if password is not None:
+            self._values["password"] = password
+        if password_secret_ref is not None:
+            self._values["password_secret_ref"] = password_secret_ref
 
     @builtins.property
     def create(self) -> builtins.bool:
@@ -873,7 +880,7 @@ def create(self) -> builtins.bool:
 
         If true, a file named ``keystore.jks`` will be created in the target
         Secret resource, encrypted using the password stored in
-        ``passwordSecretRef``.
+        ``passwordSecretRef`` or ``password``.
         The keystore file will be updated immediately.
         If the issuer provided a CA certificate, a file named ``truststore.jks``
         will also be created in the target Secret resource, encrypted using the
@@ -886,16 +893,6 @@ def create(self) -> builtins.bool:
         assert result is not None, "Required property 'create' is missing"
         return typing.cast(builtins.bool, result)
 
-    @builtins.property
-    def password_secret_ref(self) -> "CertificateSpecKeystoresJksPasswordSecretRef":
-        '''PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the JKS keystore.
-
-        :schema: CertificateSpecKeystoresJks#passwordSecretRef
-        '''
-        result = self._values.get("password_secret_ref")
-        assert result is not None, "Required property 'password_secret_ref' is missing"
-        return typing.cast("CertificateSpecKeystoresJksPasswordSecretRef", result)
-
     @builtins.property
     def alias(self) -> typing.Optional[builtins.str]:
         '''Alias specifies the alias of the key in the keystore, required by the JKS format.
@@ -907,6 +904,32 @@ def alias(self) -> typing.Optional[builtins.str]:
         result = self._values.get("alias")
         return typing.cast(typing.Optional[builtins.str], result)
 
+    @builtins.property
+    def password(self) -> typing.Optional[builtins.str]:
+        '''Password provides a literal password used to encrypt the JKS keystore.
+
+        Mutually exclusive with passwordSecretRef.
+        One of password or passwordSecretRef must provide a password with a non-zero length.
+
+        :schema: CertificateSpecKeystoresJks#password
+        '''
+        result = self._values.get("password")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def password_secret_ref(
+        self,
+    ) -> typing.Optional["CertificateSpecKeystoresJksPasswordSecretRef"]:
+        '''PasswordSecretRef is a reference to a non-empty key in a Secret resource containing the password used to encrypt the JKS keystore.
+
+        Mutually exclusive with password.
+        One of password or passwordSecretRef must provide a password with a non-zero length.
+
+        :schema: CertificateSpecKeystoresJks#passwordSecretRef
+        '''
+        result = self._values.get("password_secret_ref")
+        return typing.cast(typing.Optional["CertificateSpecKeystoresJksPasswordSecretRef"], result)
+
     def __eq__(self, rhs: typing.Any) -> builtins.bool:
         return isinstance(rhs, self.__class__) and rhs._values == self._values
 
@@ -931,7 +954,10 @@ def __init__(
         name: builtins.str,
         key: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the JKS keystore.
+        '''PasswordSecretRef is a reference to a non-empty key in a Secret resource containing the password used to encrypt the JKS keystore.
+
+        Mutually exclusive with password.
+        One of password or passwordSecretRef must provide a password with a non-zero length.
 
         :param name: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
         :param key: The key of the entry in the Secret resource's ``data`` field to be used. Some instances of this field may be defaulted, in others it may be required.
@@ -989,6 +1015,7 @@ def __repr__(self) -> str:
     jsii_struct_bases=[],
     name_mapping={
         "create": "create",
+        "password": "password",
         "password_secret_ref": "passwordSecretRef",
         "profile": "profile",
     },
@@ -998,13 +1025,15 @@ def __init__(
         self,
         *,
         create: builtins.bool,
-        password_secret_ref: typing.Union["CertificateSpecKeystoresPkcs12PasswordSecretRef", typing.Dict[builtins.str, typing.Any]],
+        password: typing.Optional[builtins.str] = None,
+        password_secret_ref: typing.Optional[typing.Union["CertificateSpecKeystoresPkcs12PasswordSecretRef", typing.Dict[builtins.str, typing.Any]]] = None,
         profile: typing.Optional["CertificateSpecKeystoresPkcs12Profile"] = None,
     ) -> None:
         '''PKCS12 configures options for storing a PKCS12 keystore in the ``spec.secretName`` Secret resource.
 
-        :param create: Create enables PKCS12 keystore creation for the Certificate. If true, a file named ``keystore.p12`` will be created in the target Secret resource, encrypted using the password stored in ``passwordSecretRef``. The keystore file will be updated immediately. If the issuer provided a CA certificate, a file named ``truststore.p12`` will also be created in the target Secret resource, encrypted using the password stored in ``passwordSecretRef`` containing the issuing Certificate Authority
-        :param password_secret_ref: PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the PKCS12 keystore.
+        :param create: Create enables PKCS12 keystore creation for the Certificate. If true, a file named ``keystore.p12`` will be created in the target Secret resource, encrypted using the password stored in ``passwordSecretRef`` or in ``password``. The keystore file will be updated immediately. If the issuer provided a CA certificate, a file named ``truststore.p12`` will also be created in the target Secret resource, encrypted using the password stored in ``passwordSecretRef`` containing the issuing Certificate Authority
+        :param password: Password provides a literal password used to encrypt the PKCS#12 keystore. Mutually exclusive with passwordSecretRef. One of password or passwordSecretRef must provide a password with a non-zero length.
+        :param password_secret_ref: PasswordSecretRef is a reference to a non-empty key in a Secret resource containing the password used to encrypt the PKCS#12 keystore. Mutually exclusive with password. One of password or passwordSecretRef must provide a password with a non-zero length.
         :param profile: Profile specifies the key and certificate encryption algorithms and the HMAC algorithm used to create the PKCS12 keystore. Default value is ``LegacyRC2`` for backward compatibility. If provided, allowed values are: ``LegacyRC2``: Deprecated. Not supported by default in OpenSSL 3 or Java 20. ``LegacyDES``: Less secure algorithm. Use this option for maximal compatibility. ``Modern2023``: Secure algorithm. Use this option in case you have to always use secure algorithms (eg. because of company policy). Please note that the security of the algorithm is not that important in reality, because the unencrypted certificate and private key are also stored in the Secret.
 
         :schema: CertificateSpecKeystoresPkcs12
@@ -1014,12 +1043,16 @@ def __init__(
         if __debug__:
             type_hints = typing.get_type_hints(_typecheckingstub__c5382e8480294729cddd333c0c832e9c632efa49695fb65db41f2232ecd5fb79)
             check_type(argname="argument create", value=create, expected_type=type_hints["create"])
+            check_type(argname="argument password", value=password, expected_type=type_hints["password"])
             check_type(argname="argument password_secret_ref", value=password_secret_ref, expected_type=type_hints["password_secret_ref"])
             check_type(argname="argument profile", value=profile, expected_type=type_hints["profile"])
         self._values: typing.Dict[builtins.str, typing.Any] = {
             "create": create,
-            "password_secret_ref": password_secret_ref,
         }
+        if password is not None:
+            self._values["password"] = password
+        if password_secret_ref is not None:
+            self._values["password_secret_ref"] = password_secret_ref
         if profile is not None:
             self._values["profile"] = profile
 
@@ -1029,7 +1062,7 @@ def create(self) -> builtins.bool:
 
         If true, a file named ``keystore.p12`` will be created in the target
         Secret resource, encrypted using the password stored in
-        ``passwordSecretRef``.
+        ``passwordSecretRef`` or in ``password``.
         The keystore file will be updated immediately.
         If the issuer provided a CA certificate, a file named ``truststore.p12`` will
         also be created in the target Secret resource, encrypted using the
@@ -1043,14 +1076,30 @@ def create(self) -> builtins.bool:
         return typing.cast(builtins.bool, result)
 
     @builtins.property
-    def password_secret_ref(self) -> "CertificateSpecKeystoresPkcs12PasswordSecretRef":
-        '''PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the PKCS12 keystore.
+    def password(self) -> typing.Optional[builtins.str]:
+        '''Password provides a literal password used to encrypt the PKCS#12 keystore.
+
+        Mutually exclusive with passwordSecretRef.
+        One of password or passwordSecretRef must provide a password with a non-zero length.
+
+        :schema: CertificateSpecKeystoresPkcs12#password
+        '''
+        result = self._values.get("password")
+        return typing.cast(typing.Optional[builtins.str], result)
+
+    @builtins.property
+    def password_secret_ref(
+        self,
+    ) -> typing.Optional["CertificateSpecKeystoresPkcs12PasswordSecretRef"]:
+        '''PasswordSecretRef is a reference to a non-empty key in a Secret resource containing the password used to encrypt the PKCS#12 keystore.
+
+        Mutually exclusive with password.
+        One of password or passwordSecretRef must provide a password with a non-zero length.
 
         :schema: CertificateSpecKeystoresPkcs12#passwordSecretRef
         '''
         result = self._values.get("password_secret_ref")
-        assert result is not None, "Required property 'password_secret_ref' is missing"
-        return typing.cast("CertificateSpecKeystoresPkcs12PasswordSecretRef", result)
+        return typing.cast(typing.Optional["CertificateSpecKeystoresPkcs12PasswordSecretRef"], result)
 
     @builtins.property
     def profile(self) -> typing.Optional["CertificateSpecKeystoresPkcs12Profile"]:
@@ -1094,7 +1143,10 @@ def __init__(
         name: builtins.str,
         key: typing.Optional[builtins.str] = None,
     ) -> None:
-        '''PasswordSecretRef is a reference to a key in a Secret resource containing the password used to encrypt the PKCS12 keystore.
+        '''PasswordSecretRef is a reference to a non-empty key in a Secret resource containing the password used to encrypt the PKCS#12 keystore.
+
+        Mutually exclusive with password.
+        One of password or passwordSecretRef must provide a password with a non-zero length.
 
         :param name: Name of the resource being referred to. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
         :param key: The key of the entry in the Secret resource's ``data`` field to be used. Some instances of this field may be defaulted, in others it may be required.
@@ -2106,8 +2158,9 @@ def _typecheckingstub__304190a06d3e60433de1a2655ea13ece3d452ac5995f8f0e820230f00
 def _typecheckingstub__571b4581314dc6da5154732cbc505ea05f780b18877fbcbc24fd2e2fa8274e62(
     *,
     create: builtins.bool,
-    password_secret_ref: typing.Union[CertificateSpecKeystoresJksPasswordSecretRef, typing.Dict[builtins.str, typing.Any]],
     alias: typing.Optional[builtins.str] = None,
+    password: typing.Optional[builtins.str] = None,
+    password_secret_ref: typing.Optional[typing.Union[CertificateSpecKeystoresJksPasswordSecretRef, typing.Dict[builtins.str, typing.Any]]] = None,
 ) -> None:
     """Type checking stubs"""
     pass
@@ -2123,7 +2176,8 @@ def _typecheckingstub__4c705b97f1ec6666fe596694a6020ae107ebdb667b49d9a0e8e70230b
 def _typecheckingstub__c5382e8480294729cddd333c0c832e9c632efa49695fb65db41f2232ecd5fb79(
     *,
     create: builtins.bool,
-    password_secret_ref: typing.Union[CertificateSpecKeystoresPkcs12PasswordSecretRef, typing.Dict[builtins.str, typing.Any]],
+    password: typing.Optional[builtins.str] = None,
+    password_secret_ref: typing.Optional[typing.Union[CertificateSpecKeystoresPkcs12PasswordSecretRef, typing.Dict[builtins.str, typing.Any]]] = None,
     profile: typing.Optional[CertificateSpecKeystoresPkcs12Profile] = None,
 ) -> None:
     """Type checking stubs"""
diff --git a/typescript/cdk8s-crd/imports/cert-manager.io.ts b/typescript/cdk8s-crd/imports/cert-manager.io.ts
index 4c8d0b26..09d33e60 100644
--- a/typescript/cdk8s-crd/imports/cert-manager.io.ts
+++ b/typescript/cdk8s-crd/imports/cert-manager.io.ts
@@ -935,7 +935,7 @@ export interface CertificateSpecKeystoresJks {
    * Create enables JKS keystore creation for the Certificate.
    * If true, a file named `keystore.jks` will be created in the target
    * Secret resource, encrypted using the password stored in
-   * `passwordSecretRef`.
+   * `passwordSecretRef` or `password`.
    * The keystore file will be updated immediately.
    * If the issuer provided a CA certificate, a file named `truststore.jks`
    * will also be created in the target Secret resource, encrypted using the
@@ -947,12 +947,23 @@ export interface CertificateSpecKeystoresJks {
   readonly create: boolean;
 
   /**
-   * PasswordSecretRef is a reference to a key in a Secret resource
+   * Password provides a literal password used to encrypt the JKS keystore.
+   * Mutually exclusive with passwordSecretRef.
+   * One of password or passwordSecretRef must provide a password with a non-zero length.
+   *
+   * @schema CertificateSpecKeystoresJks#password
+   */
+  readonly password?: string;
+
+  /**
+   * PasswordSecretRef is a reference to a non-empty key in a Secret resource
    * containing the password used to encrypt the JKS keystore.
+   * Mutually exclusive with password.
+   * One of password or passwordSecretRef must provide a password with a non-zero length.
    *
    * @schema CertificateSpecKeystoresJks#passwordSecretRef
    */
-  readonly passwordSecretRef: CertificateSpecKeystoresJksPasswordSecretRef;
+  readonly passwordSecretRef?: CertificateSpecKeystoresJksPasswordSecretRef;
 
 }
 
@@ -965,6 +976,7 @@ export function toJson_CertificateSpecKeystoresJks(obj: CertificateSpecKeystores
   const result = {
     'alias': obj.alias,
     'create': obj.create,
+    'password': obj.password,
     'passwordSecretRef': toJson_CertificateSpecKeystoresJksPasswordSecretRef(obj.passwordSecretRef),
   };
   // filter undefined values
@@ -983,7 +995,7 @@ export interface CertificateSpecKeystoresPkcs12 {
    * Create enables PKCS12 keystore creation for the Certificate.
    * If true, a file named `keystore.p12` will be created in the target
    * Secret resource, encrypted using the password stored in
-   * `passwordSecretRef`.
+   * `passwordSecretRef` or in `password`.
    * The keystore file will be updated immediately.
    * If the issuer provided a CA certificate, a file named `truststore.p12` will
    * also be created in the target Secret resource, encrypted using the
@@ -995,12 +1007,23 @@ export interface CertificateSpecKeystoresPkcs12 {
   readonly create: boolean;
 
   /**
-   * PasswordSecretRef is a reference to a key in a Secret resource
-   * containing the password used to encrypt the PKCS12 keystore.
+   * Password provides a literal password used to encrypt the PKCS#12 keystore.
+   * Mutually exclusive with passwordSecretRef.
+   * One of password or passwordSecretRef must provide a password with a non-zero length.
+   *
+   * @schema CertificateSpecKeystoresPkcs12#password
+   */
+  readonly password?: string;
+
+  /**
+   * PasswordSecretRef is a reference to a non-empty key in a Secret resource
+   * containing the password used to encrypt the PKCS#12 keystore.
+   * Mutually exclusive with password.
+   * One of password or passwordSecretRef must provide a password with a non-zero length.
    *
    * @schema CertificateSpecKeystoresPkcs12#passwordSecretRef
    */
-  readonly passwordSecretRef: CertificateSpecKeystoresPkcs12PasswordSecretRef;
+  readonly passwordSecretRef?: CertificateSpecKeystoresPkcs12PasswordSecretRef;
 
   /**
    * Profile specifies the key and certificate encryption algorithms and the HMAC algorithm
@@ -1027,6 +1050,7 @@ export function toJson_CertificateSpecKeystoresPkcs12(obj: CertificateSpecKeysto
   if (obj === undefined) { return undefined; }
   const result = {
     'create': obj.create,
+    'password': obj.password,
     'passwordSecretRef': toJson_CertificateSpecKeystoresPkcs12PasswordSecretRef(obj.passwordSecretRef),
     'profile': obj.profile,
   };
@@ -1207,8 +1231,10 @@ export enum CertificateSpecPrivateKeyRotationPolicy {
 }
 
 /**
- * PasswordSecretRef is a reference to a key in a Secret resource
+ * PasswordSecretRef is a reference to a non-empty key in a Secret resource
  * containing the password used to encrypt the JKS keystore.
+ * Mutually exclusive with password.
+ * One of password or passwordSecretRef must provide a password with a non-zero length.
  *
  * @schema CertificateSpecKeystoresJksPasswordSecretRef
  */
@@ -1248,8 +1274,10 @@ export function toJson_CertificateSpecKeystoresJksPasswordSecretRef(obj: Certifi
 /* eslint-enable max-len, quote-props */
 
 /**
- * PasswordSecretRef is a reference to a key in a Secret resource
- * containing the password used to encrypt the PKCS12 keystore.
+ * PasswordSecretRef is a reference to a non-empty key in a Secret resource
+ * containing the password used to encrypt the PKCS#12 keystore.
+ * Mutually exclusive with password.
+ * One of password or passwordSecretRef must provide a password with a non-zero length.
  *
  * @schema CertificateSpecKeystoresPkcs12PasswordSecretRef
  */
diff --git a/typescript/kubernetes-end-to-end-aws/cdk.out/kubernetes-end-to-end.assets.json b/typescript/kubernetes-end-to-end-aws/cdk.out/kubernetes-end-to-end.assets.json
index 6fd88d00..4b247335 100644
--- a/typescript/kubernetes-end-to-end-aws/cdk.out/kubernetes-end-to-end.assets.json
+++ b/typescript/kubernetes-end-to-end-aws/cdk.out/kubernetes-end-to-end.assets.json
@@ -105,7 +105,7 @@
         }
       }
     },
-    "dedcdb0538331f5afd964b7bebb448484546f6194a84f35d2684e8493fa13a61": {
+    "94210fca3f199ba9fb96aef06570597976be8e143946972493b31b88b57dfc3c": {
       "source": {
         "path": "kubernetesendtoendawscdkawseksClusterResourceProviderCD7C6152.nested.template.json",
         "packaging": "file"
@@ -113,12 +113,12 @@
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "dedcdb0538331f5afd964b7bebb448484546f6194a84f35d2684e8493fa13a61.json",
+          "objectKey": "94210fca3f199ba9fb96aef06570597976be8e143946972493b31b88b57dfc3c.json",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
         }
       }
     },
-    "70f7f43bc28eb633b2facc11ea06d2a4dafcad6a9cfbfe95afb6c5858553d204": {
+    "66ea933da1c068f03fc847f4c116f5bbd16db17ae43e7807e29f3ff93ef08f65": {
       "source": {
         "path": "kubernetesendtoendawscdkawseksKubectlProviderC63F8B74.nested.template.json",
         "packaging": "file"
@@ -126,12 +126,12 @@
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "70f7f43bc28eb633b2facc11ea06d2a4dafcad6a9cfbfe95afb6c5858553d204.json",
+          "objectKey": "66ea933da1c068f03fc847f4c116f5bbd16db17ae43e7807e29f3ff93ef08f65.json",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
         }
       }
     },
-    "ef782e537325c9047b5114eb9368097c3a02273043468bbff192023ad3e1a0e5": {
+    "6fc17c9207c32ef10ed731b4810bd99d05484377caa0c48746f5be857b5d2309": {
       "source": {
         "path": "kubernetes-end-to-end.template.json",
         "packaging": "file"
@@ -139,7 +139,7 @@
       "destinations": {
         "current_account-current_region": {
           "bucketName": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}",
-          "objectKey": "ef782e537325c9047b5114eb9368097c3a02273043468bbff192023ad3e1a0e5.json",
+          "objectKey": "6fc17c9207c32ef10ed731b4810bd99d05484377caa0c48746f5be857b5d2309.json",
           "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-file-publishing-role-${AWS::AccountId}-${AWS::Region}"
         }
       }
diff --git a/typescript/kubernetes-end-to-end-aws/cdk.out/kubernetes-end-to-end.template.json b/typescript/kubernetes-end-to-end-aws/cdk.out/kubernetes-end-to-end.template.json
index 457b1555..06dc2783 100644
--- a/typescript/kubernetes-end-to-end-aws/cdk.out/kubernetes-end-to-end.template.json
+++ b/typescript/kubernetes-end-to-end-aws/cdk.out/kubernetes-end-to-end.template.json
@@ -1297,7 +1297,7 @@
        {
         "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
        },
-       "/dedcdb0538331f5afd964b7bebb448484546f6194a84f35d2684e8493fa13a61.json"
+       "/94210fca3f199ba9fb96aef06570597976be8e143946972493b31b88b57dfc3c.json"
       ]
      ]
     }
@@ -1352,7 +1352,7 @@
        {
         "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
        },
-       "/70f7f43bc28eb633b2facc11ea06d2a4dafcad6a9cfbfe95afb6c5858553d204.json"
+       "/66ea933da1c068f03fc847f4c116f5bbd16db17ae43e7807e29f3ff93ef08f65.json"
       ]
      ]
     }
@@ -1936,7 +1936,7 @@
   "CDKMetadata": {
    "Type": "AWS::CDK::Metadata",
    "Properties": {
-    "Analytics": "v2:deflate64:H4sIAAAAAAAA/1VSwW7bMAz9ltxpNXNWYLvNFYYu67YYyeBrIct0oliWApFyEBj+98F2M7cnPj6QxCP5UtF/+SrWK3WlRFdNYk0p+gMr3YC60mtPm1dFhEwiGwPQRjxF3SA/KUKwqi0rJWTtfqkbhgIDGe8AGxK9tJEYA+wu6LaV9M6h5jz4zlQYILtSFvkEL7HE4JCRfitnaiSGP77CY/DxArJ2S/IDbStPKvC7nl15Rs2FshEhs6X0joO3FgMcMHRGY6a1j44HQJ2KvrjocWaRS8hjaY0+xNIhj9yC9j4y/lWlxYVfuIzIa6N4XPNePILv23ySq/hZMV7VDfJgOsW4DN46nmTfC2Ylb1nGrPSpRcdwQB2D4dvz/QYfiAGMakW/97O+KebeGj0NnNEwwPStA6ujcUfYI/kYNIKMxL5d0tq9x9K7ytw3mz0ga/eTRuJD4/8vytrtIl8iD7AWn1ff3lz0MPsisaMpkiaWqNkmXfooXmZcpI+TYQZwvkJxpocuTcWnjVivzmRMEqJj06LYz/EfMMi8taUCAAA="
+    "Analytics": "v2:deflate64:H4sIAAAAAAAA/1VSwW7bMAz9ltxptXVWYLvNFYYu67YY8ZBrIct0oliWApFyEBj+98F2U7cnPj6QxCP5UtF//SbuV+pCia6axJpS9AUr3YC60GtP61dFhEwiGwPQWjxF3SA/KUKwqi0rJWTtfqsrhj0GMt4BNiR6aSMxBtie0W0q6Z1DzXnwnakwQHahLPIRXmKJwSEj/VHO1EgMf32Fh+DjGWTtluQn2lYeVeAPPdvyhJr3ykaEzJbSOw7eWgxQYOiMxkxrHx0PgDoV/f6sx5n7XEIeS2t0EUuHPHIL2vnI+E+VFhd+4TIir43icc1b8Qh+bPJJruJnxXhRV8iD6RTjMnjjeJJ9K5iVvGUZs9LHFh1DgToGw9fn2w0+EQMY1Yp+52d9U8y9NXoaOKNhgOlbBauDcQfYIfkYNIKMxL5d0tp9xNK7ytw2mz0ga/eLRuJT4/sXZe22kc+RB7gXX1bf31x0N/sisaMpkiaWqNkmXfooXma8Tx8nwwzgfIXiRHddmoqHtXhYnciYJETHpkWxm+N/8KyUoqUCAAA="
    },
    "Metadata": {
     "aws:cdk:path": "kubernetes-end-to-end/CDKMetadata/Default"
diff --git a/typescript/kubernetes-end-to-end-aws/cdk.out/kubernetesendtoendawscdkawseksClusterResourceProviderCD7C6152.nested.template.json b/typescript/kubernetes-end-to-end-aws/cdk.out/kubernetesendtoendawscdkawseksClusterResourceProviderCD7C6152.nested.template.json
index d3b50224..10bfb765 100644
--- a/typescript/kubernetes-end-to-end-aws/cdk.out/kubernetesendtoendawscdkawseksClusterResourceProviderCD7C6152.nested.template.json
+++ b/typescript/kubernetes-end-to-end-aws/cdk.out/kubernetesendtoendawscdkawseksClusterResourceProviderCD7C6152.nested.template.json
@@ -774,7 +774,7 @@
   "CDKMetadata": {
    "Type": "AWS::CDK::Metadata",
    "Properties": {
-    "Analytics": "v2:deflate64:H4sIAAAAAAAA/zWPQW+DMAyFf0vvqdfBZTu2SDttFaLSrpGbGOQCCYpDO4T471NoOb33Wc9+cgYfn3DY4UP2xrb7jq8wn0ki2UtE06oO+6tF3eFEQTtvSQ/B/00aG3IRzt5SmfiY8DuFFD5Ez5JrFKEocEyiJIfTaFqKJxR6HYW5qN2680tB2Dv1NToTkylqt/lFMfYwV76jNF619B2bKeHTLYtaay4RG3aNqkj8GAwpM0r0vQ4vFiiDv7OlsJ7aUkXtCu8sb9U/OAzsmkWlf+Emb/csg/ccDrubMO/D6CL3BNVT/wGpau+dQgEAAA=="
+    "Analytics": "v2:deflate64:H4sIAAAAAAAA/zWPQW+DMAyFf0vvqbfCZTu2SDttFaLSrpGbGOQCCYpDO4T471NoOb33Wc9+cgYfn/C+w4fsjW33HV9hPpNEspeIplUd9leLusOJgnbekh6C/5s0NuQinL2lMvEx4XcKKXyIniXXKEJR4JhESQ6n0bQUTyj0OgpzUbt155eCsHfqa3QmJlPUbvOLYuxhrnxHabxq6Ts2U8KnWxa11lwiNuwaVZH4MRhSZpToex1eLFAGf2dLYT21pYraFd5Z3qp/cBjYNYtK/8JN3u5ZBoccDrubMO/D6CL3BNVT/wFpDseKQgEAAA=="
    },
    "Metadata": {
     "aws:cdk:path": "kubernetes-end-to-end/@aws-cdk--aws-eks.ClusterResourceProvider/CDKMetadata/Default"
diff --git a/typescript/kubernetes-end-to-end-aws/cdk.out/kubernetesendtoendawscdkawseksKubectlProviderC63F8B74.nested.template.json b/typescript/kubernetes-end-to-end-aws/cdk.out/kubernetesendtoendawscdkawseksKubectlProviderC63F8B74.nested.template.json
index e4f63776..fb51aa0a 100644
--- a/typescript/kubernetes-end-to-end-aws/cdk.out/kubernetesendtoendawscdkawseksKubectlProviderC63F8B74.nested.template.json
+++ b/typescript/kubernetes-end-to-end-aws/cdk.out/kubernetesendtoendawscdkawseksKubectlProviderC63F8B74.nested.template.json
@@ -216,7 +216,7 @@
   "CDKMetadata": {
    "Type": "AWS::CDK::Metadata",
    "Properties": {
-    "Analytics": "v2:deflate64:H4sIAAAAAAAA/02PwWrDMBBEvyV3eZval/SYGHpJD8GFXMVa2oSNZQm0Ukww/vciJy09zQzs8HZq2H3AdoOTVMYOleMeZpxEzzQIHHNPJrlTDHe2FJXDsbcI82f2JnHwqr34//4LHxTPFIWDX5Q0GkUoCeyLKGngkM1A6YBCinGEuQuOSnHVU3BsHiU+3bKotfid8Mr++qJrVyAaJzGOYT9J63jlqo4k5GhImSwpjDq+ssDfgIL6vWovvg3eclqf9cES3OTtXtfw3sB2cxPmKmafeCTonvoDmQ3jMy0BAAA="
+    "Analytics": "v2:deflate64:H4sIAAAAAAAA/02PwWrDMBBEvyV3edvYl/SYGHpJD8GFXMVa2oSNZQm0Ukww/vciJy09zQzs8HZq2H3A+wYnqYwdKsc9zDiJnmkQOOaeTHKnGO5sKSqHY28R5s/sTeLgVXvx//0XPiieKQoHvyhpNIpQEtgXUdLAIZuB0gGFFOMIcxccleKqp+DYPEp8umVRa/E74ZX99UXXrkA0TmIcw36S1vHKVR1JyNGQMllSGHV8ZYG/AQX1e9VefBu85bQ+64MluMnbva5h28B2cxPmKmafeCTonvoDWWnLJC0BAAA="
    },
    "Metadata": {
     "aws:cdk:path": "kubernetes-end-to-end/@aws-cdk--aws-eks.KubectlProvider/CDKMetadata/Default"
diff --git a/typescript/kubernetes-end-to-end-aws/cdk.out/manifest.json b/typescript/kubernetes-end-to-end-aws/cdk.out/manifest.json
index 87ad3e48..62241527 100644
--- a/typescript/kubernetes-end-to-end-aws/cdk.out/manifest.json
+++ b/typescript/kubernetes-end-to-end-aws/cdk.out/manifest.json
@@ -17,7 +17,7 @@
         "validateOnSynth": false,
         "assumeRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-deploy-role-${AWS::AccountId}-${AWS::Region}",
         "cloudFormationExecutionRoleArn": "arn:${AWS::Partition}:iam::${AWS::AccountId}:role/cdk-hnb659fds-cfn-exec-role-${AWS::AccountId}-${AWS::Region}",
-        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/ef782e537325c9047b5114eb9368097c3a02273043468bbff192023ad3e1a0e5.json",
+        "stackTemplateAssetObjectUrl": "s3://cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}/6fc17c9207c32ef10ed731b4810bd99d05484377caa0c48746f5be857b5d2309.json",
         "requiresBootstrapStackVersion": 6,
         "bootstrapStackVersionSsmParameter": "/cdk-bootstrap/hnb659fds/version",
         "additionalDependencies": [
diff --git a/typescript/kubernetes-end-to-end-aws/cdk.out/tree.json b/typescript/kubernetes-end-to-end-aws/cdk.out/tree.json
index f063ae17..e5051095 100644
--- a/typescript/kubernetes-end-to-end-aws/cdk.out/tree.json
+++ b/typescript/kubernetes-end-to-end-aws/cdk.out/tree.json
@@ -2801,7 +2801,7 @@
                           {
                             "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
                           },
-                          "/dedcdb0538331f5afd964b7bebb448484546f6194a84f35d2684e8493fa13a61.json"
+                          "/94210fca3f199ba9fb96aef06570597976be8e143946972493b31b88b57dfc3c.json"
                         ]
                       ]
                     }
@@ -3338,7 +3338,7 @@
                           {
                             "Fn::Sub": "cdk-hnb659fds-assets-${AWS::AccountId}-${AWS::Region}"
                           },
-                          "/70f7f43bc28eb633b2facc11ea06d2a4dafcad6a9cfbfe95afb6c5858553d204.json"
+                          "/66ea933da1c068f03fc847f4c116f5bbd16db17ae43e7807e29f3ff93ef08f65.json"
                         ]
                       ]
                     }
diff --git a/yarn.lock b/yarn.lock
index 557f32d8..2d57582d 100644
--- a/yarn.lock
+++ b/yarn.lock
@@ -2140,9 +2140,9 @@ fast-json-patch@^3.1.1:
   integrity sha512-vf6IHUX2SBcA+5/+4883dsIjpBTqmfBjmYiWK1savxQmFk4JfBMLa7ynTYOs1Rolp/T1betJxHiGD3g1Mn8lUQ==
 
 fastq@^1.6.0:
-  version "1.18.0"
-  resolved "https://registry.yarnpkg.com/fastq/-/fastq-1.18.0.tgz#d631d7e25faffea81887fe5ea8c9010e1b36fee0"
-  integrity sha512-QKHXPW0hD8g4UET03SdOdunzSouc9N4AuHdsX8XNcTsuz+yYFILVNIX4l9yHABMhiEI9Db0JTTIpu0wB+Y1QQw==
+  version "1.19.0"
+  resolved "https://registry.yarnpkg.com/fastq/-/fastq-1.19.0.tgz#a82c6b7c2bb4e44766d865f07997785fecfdcb89"
+  integrity sha512-7SFSRCNjBQIZH/xZR3iy5iQYR8aGBE0h3VG6/cwlbrpdciNYBMotQav8c1XI3HjHH+NikUpP53nPdlZSdWmFzA==
   dependencies:
     reusify "^1.0.4"
 
@@ -4813,10 +4813,10 @@ semver@^6.0.0:
   resolved "https://registry.yarnpkg.com/semver/-/semver-6.3.1.tgz#556d2ef8689146e46dcea4bfdd095f3434dffcb4"
   integrity sha512-BR7VvDCVHO+q2xBEWskxS6DJE1qRnb7DxzUrogb71CWoSficBxYsiAGd+Kl0mmq/MprG9yArRkyrQxTO6XjMzA==
 
-semver@^7.0.0, semver@^7.1.1, semver@^7.3.4, semver@^7.3.5, semver@^7.3.7, semver@^7.3.8, semver@^7.6.3:
-  version "7.6.3"
-  resolved "https://registry.yarnpkg.com/semver/-/semver-7.6.3.tgz#980f7b5550bc175fb4dc09403085627f9eb33143"
-  integrity sha512-oVekP1cKtI+CTDvHWYFUcMtsK/00wmAEfyqKfNdARm8u1wNVhSgaX7A8d4UuIlUI5e84iEwOhs7ZPYRmzU9U6A==
+semver@^7.0.0, semver@^7.1.1, semver@^7.3.4, semver@^7.3.5, semver@^7.3.7, semver@^7.3.8:
+  version "7.7.0"
+  resolved "https://registry.yarnpkg.com/semver/-/semver-7.7.0.tgz#9c6fe61d0c6f9fa9e26575162ee5a9180361b09c"
+  integrity sha512-DrfFnPzblFmNrIZzg5RzHegbiRWg7KMR7btwi2yjHwx06zsUbO5g613sVwEV7FTwmzJu+Io0lJe2GJ3LxqpvBQ==
 
 semver@^7.5.4:
   version "7.6.0"
@@ -4825,6 +4825,11 @@ semver@^7.5.4:
   dependencies:
     lru-cache "^6.0.0"
 
+semver@^7.6.3:
+  version "7.6.3"
+  resolved "https://registry.yarnpkg.com/semver/-/semver-7.6.3.tgz#980f7b5550bc175fb4dc09403085627f9eb33143"
+  integrity sha512-oVekP1cKtI+CTDvHWYFUcMtsK/00wmAEfyqKfNdARm8u1wNVhSgaX7A8d4UuIlUI5e84iEwOhs7ZPYRmzU9U6A==
+
 set-blocking@^2.0.0:
   version "2.0.0"
   resolved "https://registry.yarnpkg.com/set-blocking/-/set-blocking-2.0.0.tgz#045f9782d011ae9a6803ddd382b24392b3d890f7"