tx! I meant if any like

datastore_uri

to be set only in secrets, but from here https://github.com/authzed/spicedb-operator/blob/8e8c355032118c0044a8f17c0452aa5bb4896535/pkg/config/config.go#L269-L283, it seems not 🤔 then will probably need to manually ref it as you proposed:

datastoreReadReplicaConnUri:
      valueFrom:
        secretKeyRef:
          name: vault-kv2-spicedb
          key: datastore_read_replica_uri #this will be added to vault