code: func (v *VaultProvider) Cleanup() error {
  	return v.client.Sys().Unmount(v.config.IntermediatePKIPath)
  }
docs: // Cleanup unmounts the configured intermediate PKI backend. It's fine to tear
  // this down and recreate it on small config changes because the intermediate
  // certs get bundled with the leaf certs, so there's no cost to the CA changing.