gcloud: Wed Jun 8 09:13:38 UTC 2022

gcloud/composer/environments/create

@@ -22,8 +22,11 @@ SYNOPSIS
           --web-server-ipv4-cidr=WEB_SERVER_IPV4_CIDR]
         [--cluster-ipv4-cidr=CLUSTER_IPV4_CIDR
           --cluster-secondary-range-name=CLUSTER_SECONDARY_RANGE_NAME
-          --enable-ip-alias --services-ipv4-cidr=SERVICES_IPV4_CIDR
+          --enable-ip-alias --enable-ip-masq-agent
+          --services-ipv4-cidr=SERVICES_IPV4_CIDR
           --services-secondary-range-name=SERVICES_SECONDARY_RANGE_NAME]
+        [--enable-master-authorized-networks
+          --master-authorized-networks=[NETWORK,...]]
         [--kms-key=KMS_KEY : --kms-keyring=KMS_KEYRING
           --kms-location=KMS_LOCATION --kms-project=KMS_PROJECT]
         [--maintenance-window-end=MAINTENANCE_WINDOW_END
@@ -286,6 +289,16 @@ FLAGS
           will require at least two secondary ranges in the subnetwork, one for
           the pod IPs and another to reserve space for the services range.
 
+       --enable-ip-masq-agent
+          When enabled, the IP Masquarade Agent
+          (https://cloud.google.com/composer/docs/enable-ip-masquerade-agent)
+          is deployed to your environment's cluster. It performs many-to-one IP
+          address translations to hide a pod's IP address behind the cluster
+          node's IP address. This is done when sending traffic to destinations
+          outside the cluster's pod CIDR range.
+
+          Cannot be specified unless --enable-ip-alias is also specified.
+
        --services-ipv4-cidr=SERVICES_IPV4_CIDR
           IP range for the services IPs.
 
@@ -304,6 +317,20 @@ FLAGS
 
           Cannot be specified unless --enable-ip-alias is also specified.
 
+     Master Authorized Networks configuration
+
+       --enable-master-authorized-networks
+          Enable Master Authorized Networks feature
+          (https://cloud.google.com/kubernetes-engine/docs/how-to/authorized-networks/)
+          in the Composer Environment's GKE cluster.
+
+       --master-authorized-networks=[NETWORK,...]
+          Comma separated Master Authorized Networks specified in CIDR
+          notation.
+
+          Cannot be specified unless --enable-master-authorized-networks is
+          also specified.
+
      Key resource - The Cloud KMS (Key Management Service) cryptokey that will
      be used to protect the environment. The 'Cloud Composer Service Agent'
      service account must hold permission 'Cloud KMS CryptoKey

gcloud/composer/environments/update

@@ -7,6 +7,9 @@ SYNOPSIS
         (--cloud-sql-machine-type=CLOUD_SQL_MACHINE_TYPE
           | --environment-size=ENVIRONMENT_SIZE | --node-count=NODE_COUNT
           | --web-server-machine-type=WEB_SERVER_MACHINE_TYPE
+          | --disable-master-authorized-networks
+          --enable-master-authorized-networks
+          --master-authorized-networks=[NETWORK,...]
           | --max-workers=MAX_WORKERS --min-workers=MIN_WORKERS
           --scheduler-count=SCHEDULER_COUNT --scheduler-cpu=SCHEDULER_CPU
           --scheduler-memory=SCHEDULER_MEMORY
@@ -86,6 +89,25 @@ REQUIRED FLAGS
           machine types is available here:
           https://cloud.google.com/composer/pricing.
 
+       Group of arguments for setting master authorized networks configuration.
+
+         --disable-master-authorized-networks
+            Disable Master Authorized Networks feature
+            (https://cloud.google.com/kubernetes-engine/docs/how-to/authorized-networks/)
+            in the Composer Environment's GKE cluster.
+
+         --enable-master-authorized-networks
+            Enable Master Authorized Networks feature
+            (https://cloud.google.com/kubernetes-engine/docs/how-to/authorized-networks/)
+            in the Composer Environment's GKE cluster.
+
+         --master-authorized-networks=[NETWORK,...]
+            Comma separated Master Authorized Networks specified in CIDR
+            notation.
+
+            Cannot be specified unless --enable-master-authorized-networks is
+            also specified.
+
        Group of arguments for setting workloads configuration in Composer 2.X
        or greater (--scheduler-count flag is available for Composer 1.X as
        well).