diff --git a/spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java b/spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java
index f5aeb447..0f9495e5 100644
--- a/spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java
+++ b/spring-vault-core/src/main/java/org/springframework/vault/config/EnvironmentVaultConfiguration.java
@@ -105,7 +105,8 @@ import org.springframework.web.client.RestOperations;
  * </li>
  * <li>Authentication method: {@code vault.authentication} (defaults to {@literal TOKEN},
  * supported authentication methods are:
- * {@literal TOKEN, APPID, APPROLE, AZURE, AWS_EC2, CERT, CUBBYHOLE})</li>
+ * {@literal TOKEN, APPID, APPROLE, AWS_EC2, AZURE, CERT, CUBBYHOLE, KUBERNETES}, see
+ * {@link AuthenticationMethod})</li>
  * <li>Token authentication
  * <ul>
  * <li>Vault Token: {@code vault.token}</li>
@@ -121,17 +122,18 @@ import org.springframework.web.client.RestOperations;
  * </ul>
  * <li>AppRole authentication
  * <ul>
- * <li>AppRole path: {@code vault.aws-ec2.aws-ec2-path} (since 2.2.1, defaults to
+ * <li>AppRole path: {@code vault.app-role.app-role-path} (since 2.2.1, defaults to
  * {@link AppRoleAuthenticationOptions#DEFAULT_APPROLE_AUTHENTICATION_PATH})</li>
  * <li>RoleId: {@code vault.app-role.role-id}</li>
  * <li>SecretId: {@code vault.app-role.secret-id} (optional)</li>
  * </ul>
  * <li>AWS EC2 authentication
  * <ul>
- * <li>AWS EC2 path: {@code vault.app-id-path} (since 2.2.1, defaults to
+ * <li>AWS EC2 path: {@code vault.aws-ec2.aws-ec2-path} (since 2.2.1, defaults to
  * {@link AwsEc2AuthenticationOptions#DEFAULT_AWS_AUTHENTICATION_PATH})</li>
  * <li>RoleId: {@code vault.aws-ec2.role-id}</li>
- * <li>Identity Document URL: {@code vault.aws-ec2.identity-document} (optional)</li>
+ * <li>Identity Document URL: {@code vault.aws-ec2.identity-document} (defaults to
+ * {@link AwsEc2AuthenticationOptions#DEFAULT_PKCS7_IDENTITY_DOCUMENT_URI})</li>
  * </ul>
  * <li>Azure MSI authentication
  * <ul>
@@ -425,6 +427,6 @@ public class EnvironmentVaultConfiguration extends AbstractVaultConfiguration
 	}
 
 	enum AuthenticationMethod {
-		TOKEN, APPID, APPROLE, AZURE, AWS_EC2, CERT, CUBBYHOLE, KUBERNETES;
+		TOKEN, APPID, APPROLE, AWS_EC2, AZURE, CERT, CUBBYHOLE, KUBERNETES;
 	}
 }
diff --git a/src/main/asciidoc/reference/imperative-template.adoc b/src/main/asciidoc/reference/imperative-template.adoc
index fa8a4432..e99eda0b 100644
--- a/src/main/asciidoc/reference/imperative-template.adoc
+++ b/src/main/asciidoc/reference/imperative-template.adoc
@@ -170,12 +170,11 @@ vault.token=00000000-0000-0000-0000-000000000000
 
 * Vault URI: `vault.uri`
 * SSL Configuration
- ** Keystore resource: `vault.ssl.key-store` (optional)
- ** Keystore password: `vault.ssl.key-store-password` (optional)
- ** Truststore resource: `vault.ssl.trust-store` (optional)
- ** Truststore password: `vault.ssl.trust-store-password` (optional)
-* Authentication method: `vault.authentication` (defaults to `TOKEN`, supported authentication methods are: `TOKEN`, `APPID`, `APPROLE`, `AWS_EC2`, `CERT`, `CUBBYHOLE`)
-
+** Keystore resource: `vault.ssl.key-store` (optional)
+** Keystore password: `vault.ssl.key-store-password` (optional)
+** Truststore resource: `vault.ssl.trust-store` (optional)
+** Truststore password: `vault.ssl.trust-store-password` (optional)
+* Authentication method: `vault.authentication` (defaults to `TOKEN`, supported authentication methods are: `TOKEN`, `APPID`, `APPROLE`, `AWS_EC2`, `AZURE`, `CERT`, `CUBBYHOLE`, `KUBERNETES`)
 
 **Authentication-specific property keys**
 
@@ -185,18 +184,27 @@ vault.token=00000000-0000-0000-0000-000000000000
 
 **<<vault.authentication.appid>>**
 
+* AppId path: `vault.app-id.app-id-path` (defaults to `app-id`)
 * AppId: `vault.app-id.app-id`
-* UserId: `vault.app-id.user-id`. `MAC_ADDRESS` and `IP_ADDRESS` use `MacAddressUserId`, respective `IpAddressUserId` user id mechanisms. Any other value is used with `StaticUserId`.
+* UserId: `vault.app-id.user-id`. `MAC_ADDRESS` and `IP_ADDRESS` use `MacAddressUserId`, respective `IpAddressUserId` user id mechanisms.
+Any other value is used with `StaticUserId`.
 
 **<<vault.authentication.approle>>**
 
+* AppRole path: `vault.app-role.app-role-path` (defaults to `approle`)
 * RoleId: `vault.app-role.role-id`
 * SecretId: `vault.app-role.secret-id` (optional)
 
 **<<vault.authentication.awsec2>>**
 
+* AWS EC2 path: `vault.aws-ec2.aws-ec2-path` (defaults to `aws-ec2`)
 * RoleId: `vault.aws-ec2.role-id`
-* Identity Document URL: `vault.aws-ec2.identity-document` (optional)
+* Identity Document URL: `vault.aws-ec2.identity-document` (defaults to `http://169.254.169.254/latest/dynamic/instance-identity/pkcs7`)
+
+**<<vault.authentication.azuremsi>>**
+
+* Azure MSI path: `vault.azure-msi.azure-path` (defaults to `azure`)
+* Role: `vault.azure-msi.role`
 
 **<<vault.authentication.clientcert>>**
 
@@ -206,14 +214,18 @@ No configuration options.
 
 * Initial Vault Token: `vault.token`
 
+**<<vault.authentication.kubernetes>>**
+
+* Kubernetes path: `vault.kubernetes.kubernetes-path` (defaults to `kubernetes`)
+* Role: `vault.kubernetes.role`
+* Path to service account token file: `vault.kubernetes.service-account-token-file` (defaults to `/var/run/secrets/kubernetes.io/serviceaccount/token`)
+
 [[vault.core.executioncallback]]
 == Execution callbacks
 
-One common design feature of all Spring template classes is that all functionality
-is routed into one of the templates execute callback methods. This helps ensure
-that exceptions and any resource management that maybe required are performed
-consistency. While this was of much greater need in the case of JDBC and JMS
-than with Vault, it still offers a single spot for access and logging to occur.
+One common design feature of all Spring template classes is that all functionality is routed into one of the templates execute callback methods.
+This helps ensure that exceptions and any resource management that maybe required are performed consistency.
+While this was of much greater need in the case of JDBC and JMS than with Vault, it still offers a single spot for access and logging to occur.
 As such, using the execute callback is the preferred way to access the Vault API
 to perform uncommon operations that we've not exposed as methods on `VaultTemplate`.