code: func (v *VaultProvider) GenerateRoot() error {
  	if !v.isRoot {
  		return fmt.Errorf("provider is not the root certificate authority")
  	}
  
  	// Set up the root PKI backend if necessary.
  	_, err := v.ActiveRoot()
  	switch err {
  	case ErrBackendNotMounted:
  		err := v.client.Sys().Mount(v.config.RootPKIPath, &vaultapi.MountInput{
  			Type:        "pki",
  			Description: "root CA backend for Consul Connect",
  			Config: vaultapi.MountConfigInput{
  				MaxLeaseTTL: "8760h",
  			},
  		})
  
  		if err != nil {
  			return err
  		}
  
  		fallthrough
  	case ErrBackendNotInitialized:
  		spiffeID := connect.SpiffeIDSigning{ClusterID: v.clusterId, Domain: "consul"}
  		uuid, err := uuid.GenerateUUID()
  		if err != nil {
  			return err
  		}
  		_, err = v.client.Logical().Write(v.config.RootPKIPath+"root/generate/internal", map[string]interface{}{
  			"common_name": fmt.Sprintf("Vault CA Root Authority %s", uuid),
  			"uri_sans":    spiffeID.URI().String(),
  		})
  		if err != nil {
  			return err
  		}
  	default:
  		if err != nil {
  			return err
  		}
  	}
  
  	return nil
  }
docs: // GenerateRoot mounts and initializes a new root PKI backend if needed.