how to config fulcio using openbao,not enough paramter?

[13567436138]

Question

  args:
    port: 5555
    grpcPort: 5554
    # Valid values: googleca, pkcs11ca, aws-hsm-root-ca-path, fileca, kmsca
    certificateAuthority: fileca
    # kms_resource: gcpkms://....
    # kms_cert_chain: |-
    #   << your PEM encoded cert chain here. Order from active intermedate first to root last >>
    hsm_caroot_id:
    aws_hsm_root_ca_path:
    gcp_private_ca_parent: projects/test/locations/us-east1/caPools/test
    ct_log_url: ""
    disable_ct_log: false

[13567436138]

server:
  args:
    certificateAuthority: pkcs11ca
    hsm_caroot_id: "fulcio-token;object=fulcio-key"
    port: 5555
    grpcPort: 5554
  extraEnv:
    - name: PKCS11_MODULE_PATH
      value: /usr/local/vault/lib/libpkcs11-vault.so
  extraVolumes:
    - name: vault-pkcs11-lib
      configMap:
        name: vault-pkcs11-library 
  extraVolumeMounts:
    - name: vault-pkcs11-lib
      mountPath: /usr/local/vault/lib 
      readOnly: true

is this config right?

vault secrets enable pkcs11


vault write pkcs11/keys/fulcio-root-key \
    generate_key=true \
    key_label="fulcio-key" \
    token_label="fulcio-token" \
    key_type="ec" \
    key_bits="256"