diff --git a/gcloud/_version b/gcloud/_version
index 3c55c3aab..9190352f5 100644
--- a/gcloud/_version
+++ b/gcloud/_version
@@ -1,8 +1,8 @@
-Google Cloud SDK 526.0.1
-alpha 2025.06.10
-beta 2025.06.10
+Google Cloud SDK 527.0.0
+alpha 2025.06.13
+beta 2025.06.13
 bq 2.1.18
 bundled-python3-unix 3.12.9
-core 2025.06.10
+core 2025.06.13
 gcloud-crc32c 1.0.0
 gsutil 5.34
diff --git a/gcloud/ai/endpoints/deploy-model b/gcloud/ai/endpoints/deploy-model
index 33c36f3e1..1fe25a67e 100644
--- a/gcloud/ai/endpoints/deploy-model
+++ b/gcloud/ai/endpoints/deploy-model
@@ -72,9 +72,10 @@ OPTIONAL FLAGS
 
          type
             The type of the accelerator. Choices are 'nvidia-a100-80gb',
-            'nvidia-h100-80gb', 'nvidia-h100-mega-80gb', 'nvidia-l4',
-            'nvidia-tesla-a100', 'nvidia-tesla-k80', 'nvidia-tesla-p100',
-            'nvidia-tesla-p4', 'nvidia-tesla-t4', 'nvidia-tesla-v100'.
+            'nvidia-b200', 'nvidia-h100-80gb', 'nvidia-h100-mega-80gb',
+            'nvidia-h200-141gb', 'nvidia-l4', 'nvidia-tesla-a100',
+            'nvidia-tesla-k80', 'nvidia-tesla-p100', 'nvidia-tesla-p4',
+            'nvidia-tesla-t4', 'nvidia-tesla-v100'.
 
          count
             The number of accelerators to attach to each machine running the
diff --git a/gcloud/alloydb/instances/create b/gcloud/alloydb/instances/create
index 0a49b2a37..22725e3d1 100644
--- a/gcloud/alloydb/instances/create
+++ b/gcloud/alloydb/instances/create
@@ -5,6 +5,7 @@ NAME
 SYNOPSIS
     gcloud alloydb instances create INSTANCE --cluster=CLUSTER
         --instance-type=INSTANCE_TYPE --region=REGION
+        [--allocated-ip-range-override=ALLOCATED_IP_RANGE_OVERRIDE]
         [--allowed-psc-projects=[ALLOWED_PSC_PROJECTS,...]]
         [--assign-inbound-public-ip=ASSIGN_INBOUND_PUBLIC_IP] [--async]
         [--authorized-external-networks=[AUTHORIZED_NETWORK,...]]
@@ -61,6 +62,14 @@ REQUIRED FLAGS
         regions at https://cloud.google.com/sql/docs/instance-locations.
 
 OPTIONAL FLAGS
+     --allocated-ip-range-override=ALLOCATED_IP_RANGE_OVERRIDE
+        Name of the allocated IP range for the private IP AlloyDB instance, for
+        example: "google-managed-services-default". If set, the instance IPs
+        will be created from this allocated range and will override the IP
+        range used by the parent cluster. The range name must comply with RFC
+        1035. Specifically, the name must be 1-63 characters long and match the
+        regular expression [a-z]([-a-z0-9]*[a-z0-9])?.
+
      --allowed-psc-projects=[ALLOWED_PSC_PROJECTS,...]
         Comma-separated list of allowed consumer projects to create endpoints
         for Private Service Connect (PSC) connectivity for the instance. Only
diff --git a/gcloud/alloydb/instances/create-secondary b/gcloud/alloydb/instances/create-secondary
index 00bd0b76a..9adc10bc6 100644
--- a/gcloud/alloydb/instances/create-secondary
+++ b/gcloud/alloydb/instances/create-secondary
@@ -4,7 +4,9 @@ NAME
 
 SYNOPSIS
     gcloud alloydb instances create-secondary INSTANCE --cluster=CLUSTER
-        --region=REGION [--allowed-psc-projects=[ALLOWED_PSC_PROJECTS,...]]
+        --region=REGION
+        [--allocated-ip-range-override=ALLOCATED_IP_RANGE_OVERRIDE]
+        [--allowed-psc-projects=[ALLOWED_PSC_PROJECTS,...]]
         [--assign-inbound-public-ip=ASSIGN_INBOUND_PUBLIC_IP] [--async]
         [--authorized-external-networks=[AUTHORIZED_NETWORK,...]]
         [--availability-type=AVAILABILITY_TYPE]
@@ -37,6 +39,14 @@ REQUIRED FLAGS
         regions at https://cloud.google.com/sql/docs/instance-locations.
 
 OPTIONAL FLAGS
+     --allocated-ip-range-override=ALLOCATED_IP_RANGE_OVERRIDE
+        Name of the allocated IP range for the private IP AlloyDB instance, for
+        example: "google-managed-services-default". If set, the instance IPs
+        will be created from this allocated range and will override the IP
+        range used by the parent cluster. The range name must comply with RFC
+        1035. Specifically, the name must be 1-63 characters long and match the
+        regular expression [a-z]([-a-z0-9]*[a-z0-9])?.
+
      --allowed-psc-projects=[ALLOWED_PSC_PROJECTS,...]
         Comma-separated list of allowed consumer projects to create endpoints
         for Private Service Connect (PSC) connectivity for the instance. Only
diff --git a/gcloud/alpha/ai/endpoints/create b/gcloud/alpha/ai/endpoints/create
index 4e08e5f46..1632cc91c 100644
--- a/gcloud/alpha/ai/endpoints/create
+++ b/gcloud/alpha/ai/endpoints/create
@@ -5,8 +5,9 @@ SYNOPSIS
     gcloud alpha ai endpoints create --display-name=DISPLAY_NAME
         [--description=DESCRIPTION]
         [--encryption-kms-key-name=ENCRYPTION_KMS_KEY_NAME]
-        [--endpoint-id=ENDPOINT_ID] [--gdce-zone=GDCE_ZONE]
-        [--labels=[KEY=VALUE,...]] [--network=NETWORK] [--region=REGION]
+        [--endpoint-id=ENDPOINT_ID] [--gdc-zone=GDC_ZONE]
+        [--gdce-zone=GDCE_ZONE] [--labels=[KEY=VALUE,...]] [--network=NETWORK]
+        [--region=REGION]
         [--request-response-logging-rate=REQUEST_RESPONSE_LOGGING_RATE
           --request-response-logging-table=REQUEST_RESPONSE_LOGGING_TABLE]
         [GCLOUD_WIDE_FLAG ...]
@@ -36,6 +37,9 @@ OPTIONAL FLAGS
      --endpoint-id=ENDPOINT_ID
         User-specified ID of the endpoint.
 
+     --gdc-zone=GDC_ZONE
+        The name of the GDC zone. If set, the endpoint is for GDCc.
+
      --gdce-zone=GDCE_ZONE
         The name of the GDCE zone. If set, the endpoint is in GDCE.
 
diff --git a/gcloud/alpha/alloydb/instances/create b/gcloud/alpha/alloydb/instances/create
index f675e7628..91346bfd1 100644
--- a/gcloud/alpha/alloydb/instances/create
+++ b/gcloud/alpha/alloydb/instances/create
@@ -5,6 +5,7 @@ NAME
 SYNOPSIS
     gcloud alpha alloydb instances create INSTANCE --cluster=CLUSTER
         --instance-type=INSTANCE_TYPE --region=REGION
+        [--allocated-ip-range-override=ALLOCATED_IP_RANGE_OVERRIDE]
         [--allowed-psc-projects=[ALLOWED_PSC_PROJECTS,...]]
         [--assign-inbound-public-ip=ASSIGN_INBOUND_PUBLIC_IP] [--async]
         [--authorized-external-networks=[AUTHORIZED_NETWORK,...]]
@@ -78,6 +79,14 @@ REQUIRED FLAGS
         regions at https://cloud.google.com/sql/docs/instance-locations.
 
 OPTIONAL FLAGS
+     --allocated-ip-range-override=ALLOCATED_IP_RANGE_OVERRIDE
+        Name of the allocated IP range for the private IP AlloyDB instance, for
+        example: "google-managed-services-default". If set, the instance IPs
+        will be created from this allocated range and will override the IP
+        range used by the parent cluster. The range name must comply with RFC
+        1035. Specifically, the name must be 1-63 characters long and match the
+        regular expression [a-z]([-a-z0-9]*[a-z0-9])?.
+
      --allowed-psc-projects=[ALLOWED_PSC_PROJECTS,...]
         Comma-separated list of allowed consumer projects to create endpoints
         for Private Service Connect (PSC) connectivity for the instance. Only
diff --git a/gcloud/alpha/alloydb/instances/create-secondary b/gcloud/alpha/alloydb/instances/create-secondary
index 9e3edf6ab..3c07f3378 100644
--- a/gcloud/alpha/alloydb/instances/create-secondary
+++ b/gcloud/alpha/alloydb/instances/create-secondary
@@ -4,7 +4,9 @@ NAME
 
 SYNOPSIS
     gcloud alpha alloydb instances create-secondary INSTANCE --cluster=CLUSTER
-        --region=REGION [--allowed-psc-projects=[ALLOWED_PSC_PROJECTS,...]]
+        --region=REGION
+        [--allocated-ip-range-override=ALLOCATED_IP_RANGE_OVERRIDE]
+        [--allowed-psc-projects=[ALLOWED_PSC_PROJECTS,...]]
         [--assign-inbound-public-ip=ASSIGN_INBOUND_PUBLIC_IP] [--async]
         [--authorized-external-networks=[AUTHORIZED_NETWORK,...]]
         [--availability-type=AVAILABILITY_TYPE]
@@ -37,6 +39,14 @@ REQUIRED FLAGS
         regions at https://cloud.google.com/sql/docs/instance-locations.
 
 OPTIONAL FLAGS
+     --allocated-ip-range-override=ALLOCATED_IP_RANGE_OVERRIDE
+        Name of the allocated IP range for the private IP AlloyDB instance, for
+        example: "google-managed-services-default". If set, the instance IPs
+        will be created from this allocated range and will override the IP
+        range used by the parent cluster. The range name must comply with RFC
+        1035. Specifically, the name must be 1-63 characters long and match the
+        regular expression [a-z]([-a-z0-9]*[a-z0-9])?.
+
      --allowed-psc-projects=[ALLOWED_PSC_PROJECTS,...]
         Comma-separated list of allowed consumer projects to create endpoints
         for Private Service Connect (PSC) connectivity for the instance. Only
diff --git a/gcloud/alpha/compute/backend-services/create b/gcloud/alpha/compute/backend-services/create
index 597d2b1a5..b909d895e 100644
--- a/gcloud/alpha/compute/backend-services/create
+++ b/gcloud/alpha/compute/backend-services/create
@@ -286,10 +286,11 @@ FLAGS
 
      --[no-]enable-cdn
         Enable or disable Cloud CDN for the backend service. Only available for
-        backend services with --load-balancing-scheme=EXTERNAL that use a
-        --protocol of HTTP, HTTPS, HTTP2 or H2C. Cloud CDN caches HTTP
-        responses at the edge of Google's network. Cloud CDN is disabled by
-        default. Use --enable-cdn to enable and --no-enable-cdn to disable.
+        backend services with --load-balancing-scheme=EXTERNAL or
+        EXTERNAL_MANAGED that use a --protocol of HTTP, HTTPS, HTTP2 or H2C.
+        Cloud CDN caches HTTP responses at the edge of Google's network. Cloud
+        CDN is disabled by default. Use --enable-cdn to enable and
+        --no-enable-cdn to disable.
 
      --[no-]enable-logging
         The logging options for the load balancer traffic served by this
diff --git a/gcloud/alpha/compute/backend-services/update b/gcloud/alpha/compute/backend-services/update
index c99aa950b..e8a8b94f7 100644
--- a/gcloud/alpha/compute/backend-services/update
+++ b/gcloud/alpha/compute/backend-services/update
@@ -203,10 +203,11 @@ FLAGS
 
      --[no-]enable-cdn
         Enable or disable Cloud CDN for the backend service. Only available for
-        backend services with --load-balancing-scheme=EXTERNAL that use a
-        --protocol of HTTP, HTTPS, HTTP2 or H2C. Cloud CDN caches HTTP
-        responses at the edge of Google's network. Cloud CDN is disabled by
-        default. Use --enable-cdn to enable and --no-enable-cdn to disable.
+        backend services with --load-balancing-scheme=EXTERNAL or
+        EXTERNAL_MANAGED that use a --protocol of HTTP, HTTPS, HTTP2 or H2C.
+        Cloud CDN caches HTTP responses at the edge of Google's network. Cloud
+        CDN is disabled by default. Use --enable-cdn to enable and
+        --no-enable-cdn to disable.
 
      --[no-]enable-logging
         The logging options for the load balancer traffic served by this
diff --git a/gcloud/alpha/container/clusters/create b/gcloud/alpha/container/clusters/create
index d34f3494d..e6a6ae73c 100644
--- a/gcloud/alpha/container/clusters/create
+++ b/gcloud/alpha/container/clusters/create
@@ -75,6 +75,7 @@ SYNOPSIS
         [--node-taints=[NODE_TAINT,...]] [--node-version=NODE_VERSION]
         [--notification-config=[pubsub=ENABLED|DISABLED,
           pubsub-topic=TOPIC,...]] [--num-nodes=NUM_NODES; default=3]
+        [--patch-update=[PATCH_UPDATE]]
         [--performance-monitoring-unit=PERFORMANCE_MONITORING_UNIT]
         [--placement-policy=PLACEMENT_POLICY] [--placement-type=PLACEMENT_TYPE]
         [--preemptible] [--private-endpoint-subnetwork=NAME]
@@ -1136,6 +1137,17 @@ FLAGS
      --num-nodes=NUM_NODES; default=3
         The number of nodes to be created in each of the cluster's zones.
 
+     --patch-update=[PATCH_UPDATE]
+        The patch update to use for the cluster.
+
+        Setting to 'accelerated' automatically upgrades the cluster to the
+        latest patch available within the cluster's current minor version and
+        release channel. Setting to 'default' automatically upgrades the
+        cluster to the default patch upgrade targetversion available within the
+        cluster's current minor version and release channel.
+
+        PATCH_UPDATE must be one of: accelerated, default.
+
      --performance-monitoring-unit=PERFORMANCE_MONITORING_UNIT
         Sets the Performance Monitoring Unit level. Valid values are
         architectural, standard and enhanced. PERFORMANCE_MONITORING_UNIT must
diff --git a/gcloud/alpha/container/clusters/update b/gcloud/alpha/container/clusters/update
index 657817ce4..7fd1c85ae 100644
--- a/gcloud/alpha/container/clusters/update
+++ b/gcloud/alpha/container/clusters/update
@@ -38,7 +38,7 @@ SYNOPSIS
           | --logging-variant=LOGGING_VARIANT | --maintenance-window=START_TIME
           | --network-performance-configs=[PROPERTY1=VALUE1,...]
           | --notification-config=[pubsub=ENABLED|DISABLED,
-          pubsub-topic=TOPIC,...]
+          pubsub-topic=TOPIC,...] | --patch-update=[PATCH_UPDATE]
           | --private-ipv6-google-access-type=PRIVATE_IPV6_GOOGLE_ACCESS_TYPE
           | --release-channel=[CHANNEL] | --remove-labels=[KEY,...]
           | --remove-workload-policies=REMOVE_WORKLOAD_POLICIES
@@ -620,6 +620,17 @@ REQUIRED FLAGS
           The project of the Pub/Sub topic must be the same one as the cluster.
           It can be either the project ID or the project number.
 
+       --patch-update=[PATCH_UPDATE]
+          The patch update to use for the cluster.
+
+          Setting to 'accelerated' automatically upgrades the cluster to the
+          latest patch available within the cluster's current minor version and
+          release channel. Setting to 'default' automatically upgrades the
+          cluster to the default patch upgrade targetversion available within
+          the cluster's current minor version and release channel.
+
+          PATCH_UPDATE must be one of: accelerated, default.
+
        --private-ipv6-google-access-type=PRIVATE_IPV6_GOOGLE_ACCESS_TYPE
           Sets the type of private access to Google services over IPv6.
 
diff --git a/gcloud/alpha/container/fleet/scopes/add-app-operator-binding b/gcloud/alpha/container/fleet/scopes/add-app-operator-binding
index f1ea0665d..f1e330c77 100644
--- a/gcloud/alpha/container/fleet/scopes/add-app-operator-binding
+++ b/gcloud/alpha/container/fleet/scopes/add-app-operator-binding
@@ -5,12 +5,12 @@ NAME
 
 SYNOPSIS
     gcloud alpha container fleet scopes add-app-operator-binding SCOPE
-        --role=ROLE (--group=GROUP | --user=USER) [--labels=[KEY=VALUE,...]]
-        [GCLOUD_WIDE_FLAG ...]
+        (--custom-role=CUSTOM_ROLE | --role=ROLE) (--group=GROUP | --user=USER)
+        [--labels=[KEY=VALUE,...]] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) One binding consists of an app operator principal (user/group) and
-    a role (view/edit/admin).
+    a role (view/edit/admin or a custom role).
 
     This command sets up the different permissions required for an app
     operator, including usage of fleet scopes, connect gateway, logging, and
@@ -66,6 +66,26 @@ EXAMPLES
       ▪ creates fleet scope RBAC role binding: role admin with a random ID
         for user person@google.com.
 
+    ---
+
+    The following command:
+
+        $ gcloud alpha container fleet scopes add-app-operator-binding \
+            SCOPE --custom-role=my-custom-role --user=person@google.com \
+            --project=PROJECT_ID
+
+      ▪ adds IAM policy binding: roles/gkehub.scopeViewer on SCOPE
+      ▪ adds IAM policy binding: roles/gkehub.scopeEditorProjectLevel on
+        PROJECT_ID
+      ▪ adds IAM policy binding: roles/logging.viewAccessor on PROJECT_ID
+        with condition where bucket corresponds to SCOPE
+      ▪ creates fleet scope RBAC role binding: role my-custom-role with a
+        random ID for user person@google.com.
+
+    For any tailored IAM permissions required when using a custom role, the
+    user or group can separately be granted additional IAM permissions on the
+    project.
+
 POSITIONAL ARGUMENTS
      Scope resource - The group of arguments defining the Fleet Scope. This
      represents a Cloud resource. (NOTE) Some attributes are not given
@@ -91,8 +111,14 @@ POSITIONAL ARGUMENTS
           ▸ provide the argument SCOPE on the command line.
 
 REQUIRED FLAGS
-     --role=ROLE
-        Role to assign. ROLE must be one of: admin, edit, view.
+     Exactly one of these must be specified:
+
+       --custom-role=CUSTOM_ROLE
+          Custom role to assign to principal.
+
+       --role=ROLE
+          Predefined role to assign to principal (admin, edit, view). ROLE must
+          be one of: admin, edit, view.
 
      Exactly one of these must be specified:
 
diff --git a/gcloud/alpha/container/fleet/scopes/list-app-operator-bindings b/gcloud/alpha/container/fleet/scopes/list-app-operator-bindings
index 2308a69c6..648fe9269 100644
--- a/gcloud/alpha/container/fleet/scopes/list-app-operator-bindings
+++ b/gcloud/alpha/container/fleet/scopes/list-app-operator-bindings
@@ -15,7 +15,7 @@ DESCRIPTION
     permissions required for an app operator, including usage of fleet scopes,
     connect gateway, logging, and metrics. The overarching principal role
     (view/edit/admin, or custom) is determined by (1) the fleet scope RBAC role
-    (view, edit, or admin), (2) the fleet scope-level IAM role
+    (view, edit, admin or a custom role), (2) the fleet scope-level IAM role
     (roles/gkehub.scopeViewer, roles/gkehub.scopeEditor, or
     roles/gkehub.scopeAdmin), (3) the project-level IAM role
     (roles/gkehub.scopeViewerProjectLevel, or
diff --git a/gcloud/alpha/container/fleet/scopes/remove-app-operator-binding b/gcloud/alpha/container/fleet/scopes/remove-app-operator-binding
index 906501837..d394f74a2 100644
--- a/gcloud/alpha/container/fleet/scopes/remove-app-operator-binding
+++ b/gcloud/alpha/container/fleet/scopes/remove-app-operator-binding
@@ -61,7 +61,24 @@ EXAMPLES
     The following command:
 
         $ gcloud alpha container fleet scopes remove-app-operator-binding \
-            SCOPE --role=admin --user=person@google.com --project=PROJECT_ID
+            SCOPE --user=person@google.com --project=PROJECT_ID
+
+    assuming the user already has a custom role:
+      ▪ removes IAM policy binding: roles/gkehub.scopeViewer from SCOPE
+      ▪ removes IAM policy binding: roles/gkehub.scopeEditorProjectLevel from
+        PROJECT_ID if the user does not have the edit/admin role for any other
+        scope under the project
+      ▪ removes IAM policy binding: roles/logging.viewAccessor from
+        PROJECT_ID condition where bucket corresponds to SCOPE
+      ▪ deletes existing fleet scope RBAC role binding: role admin for user
+        person@google.com.
+
+    ---
+
+    The following command:
+
+        $ gcloud alpha container fleet scopes remove-app-operator-binding \
+            SCOPE --user=person@google.com --project=PROJECT_ID
 
     assuming the user already has the admin role:
       ▪ removes IAM policy binding: roles/gkehub.scopeAdmin from SCOPE
diff --git a/gcloud/alpha/container/hub/scopes/add-app-operator-binding b/gcloud/alpha/container/hub/scopes/add-app-operator-binding
index 74bc8bcb3..bcd95be48 100644
--- a/gcloud/alpha/container/hub/scopes/add-app-operator-binding
+++ b/gcloud/alpha/container/hub/scopes/add-app-operator-binding
@@ -5,12 +5,12 @@ NAME
 
 SYNOPSIS
     gcloud alpha container hub scopes add-app-operator-binding SCOPE
-        --role=ROLE (--group=GROUP | --user=USER) [--labels=[KEY=VALUE,...]]
-        [GCLOUD_WIDE_FLAG ...]
+        (--custom-role=CUSTOM_ROLE | --role=ROLE) (--group=GROUP | --user=USER)
+        [--labels=[KEY=VALUE,...]] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) One binding consists of an app operator principal (user/group) and
-    a role (view/edit/admin).
+    a role (view/edit/admin or a custom role).
 
     This command sets up the different permissions required for an app
     operator, including usage of fleet scopes, connect gateway, logging, and
@@ -66,6 +66,26 @@ EXAMPLES
       ▪ creates fleet scope RBAC role binding: role admin with a random ID
         for user person@google.com.
 
+    ---
+
+    The following command:
+
+        $ gcloud alpha container hub scopes add-app-operator-binding SCOPE \
+            --custom-role=my-custom-role --user=person@google.com \
+            --project=PROJECT_ID
+
+      ▪ adds IAM policy binding: roles/gkehub.scopeViewer on SCOPE
+      ▪ adds IAM policy binding: roles/gkehub.scopeEditorProjectLevel on
+        PROJECT_ID
+      ▪ adds IAM policy binding: roles/logging.viewAccessor on PROJECT_ID
+        with condition where bucket corresponds to SCOPE
+      ▪ creates fleet scope RBAC role binding: role my-custom-role with a
+        random ID for user person@google.com.
+
+    For any tailored IAM permissions required when using a custom role, the
+    user or group can separately be granted additional IAM permissions on the
+    project.
+
 POSITIONAL ARGUMENTS
      Scope resource - The group of arguments defining the Fleet Scope. This
      represents a Cloud resource. (NOTE) Some attributes are not given
@@ -91,8 +111,14 @@ POSITIONAL ARGUMENTS
           ▸ provide the argument SCOPE on the command line.
 
 REQUIRED FLAGS
-     --role=ROLE
-        Role to assign. ROLE must be one of: admin, edit, view.
+     Exactly one of these must be specified:
+
+       --custom-role=CUSTOM_ROLE
+          Custom role to assign to principal.
+
+       --role=ROLE
+          Predefined role to assign to principal (admin, edit, view). ROLE must
+          be one of: admin, edit, view.
 
      Exactly one of these must be specified:
 
diff --git a/gcloud/alpha/container/hub/scopes/list-app-operator-bindings b/gcloud/alpha/container/hub/scopes/list-app-operator-bindings
index 298f436a1..46071c1aa 100644
--- a/gcloud/alpha/container/hub/scopes/list-app-operator-bindings
+++ b/gcloud/alpha/container/hub/scopes/list-app-operator-bindings
@@ -15,7 +15,7 @@ DESCRIPTION
     permissions required for an app operator, including usage of fleet scopes,
     connect gateway, logging, and metrics. The overarching principal role
     (view/edit/admin, or custom) is determined by (1) the fleet scope RBAC role
-    (view, edit, or admin), (2) the fleet scope-level IAM role
+    (view, edit, admin or a custom role), (2) the fleet scope-level IAM role
     (roles/gkehub.scopeViewer, roles/gkehub.scopeEditor, or
     roles/gkehub.scopeAdmin), (3) the project-level IAM role
     (roles/gkehub.scopeViewerProjectLevel, or
diff --git a/gcloud/alpha/container/hub/scopes/remove-app-operator-binding b/gcloud/alpha/container/hub/scopes/remove-app-operator-binding
index ad1f55c71..55b184ce1 100644
--- a/gcloud/alpha/container/hub/scopes/remove-app-operator-binding
+++ b/gcloud/alpha/container/hub/scopes/remove-app-operator-binding
@@ -61,7 +61,24 @@ EXAMPLES
     The following command:
 
         $ gcloud alpha container hub scopes remove-app-operator-binding \
-            SCOPE --role=admin --user=person@google.com --project=PROJECT_ID
+            SCOPE --user=person@google.com --project=PROJECT_ID
+
+    assuming the user already has a custom role:
+      ▪ removes IAM policy binding: roles/gkehub.scopeViewer from SCOPE
+      ▪ removes IAM policy binding: roles/gkehub.scopeEditorProjectLevel from
+        PROJECT_ID if the user does not have the edit/admin role for any other
+        scope under the project
+      ▪ removes IAM policy binding: roles/logging.viewAccessor from
+        PROJECT_ID condition where bucket corresponds to SCOPE
+      ▪ deletes existing fleet scope RBAC role binding: role admin for user
+        person@google.com.
+
+    ---
+
+    The following command:
+
+        $ gcloud alpha container hub scopes remove-app-operator-binding \
+            SCOPE --user=person@google.com --project=PROJECT_ID
 
     assuming the user already has the admin role:
       ▪ removes IAM policy binding: roles/gkehub.scopeAdmin from SCOPE
diff --git a/gcloud/alpha/dataplex/datascans/create/data-discovery b/gcloud/alpha/dataplex/datascans/create/data-discovery
index f46450062..87a92aaaf 100644
--- a/gcloud/alpha/dataplex/datascans/create/data-discovery
+++ b/gcloud/alpha/dataplex/datascans/create/data-discovery
@@ -9,7 +9,7 @@ SYNOPSIS
         [--display-name=DISPLAY_NAME] [--labels=[KEY=VALUE,...]]
         [--async | --validate-only]
         [--bigquery-publishing-connection=BIGQUERY_PUBLISHING_CONNECTION
-          --bigquery-publishing-dataset-location=BIGQUERY_PUBLISHING_DATASET_LOCATION --bigquery-publishing-table-type=BIGQUERY_PUBLISHING_TABLE_TYPE --storage-exclude-patterns=[PATTERN,
+          --bigquery-publishing-dataset-location=BIGQUERY_PUBLISHING_DATASET_LOCATION --bigquery-publishing-dataset-project=BIGQUERY_PUBLISHING_DATASET_PROJECT --bigquery-publishing-table-type=BIGQUERY_PUBLISHING_TABLE_TYPE --storage-exclude-patterns=[PATTERN,
           ...] --storage-include-patterns=[PATTERN,...]
           --csv-delimiter=CSV_DELIMITER
           --csv-disable-type-inference=CSV_DISABLE_TYPE_INFERENCE
@@ -118,6 +118,12 @@ OPTIONAL FLAGS
             https://cloud.google.com/bigquery/docs/locations#supportedLocations
             for supported locations.
 
+         --bigquery-publishing-dataset-project=BIGQUERY_PUBLISHING_DATASET_PROJECT
+            The project of the BigQuery dataset to publish BigLake external or
+            non-BigLake external tables to. If not specified, the cloud
+            resource bucket project will be used to create the dataset. The
+            format is "projects/{project_id_or_number}.
+
          --bigquery-publishing-table-type=BIGQUERY_PUBLISHING_TABLE_TYPE
             BigQuery table type to discover the cloud resource bucket. Can be
             either EXTERNAL or BIGLAKE. If not specified, the table type will
diff --git a/gcloud/alpha/dataplex/datascans/update/data-discovery b/gcloud/alpha/dataplex/datascans/update/data-discovery
index 73a776e8d..bf6b21d1c 100644
--- a/gcloud/alpha/dataplex/datascans/update/data-discovery
+++ b/gcloud/alpha/dataplex/datascans/update/data-discovery
@@ -8,7 +8,7 @@ SYNOPSIS
         [--display-name=DISPLAY_NAME] [--labels=[KEY=VALUE,...]]
         [--async | --validate-only]
         [--bigquery-publishing-connection=BIGQUERY_PUBLISHING_CONNECTION
-          --bigquery-publishing-dataset-location=BIGQUERY_PUBLISHING_DATASET_LOCATION --bigquery-publishing-table-type=BIGQUERY_PUBLISHING_TABLE_TYPE --storage-exclude-patterns=[PATTERN,
+          --bigquery-publishing-dataset-location=BIGQUERY_PUBLISHING_DATASET_LOCATION --bigquery-publishing-dataset-project=BIGQUERY_PUBLISHING_DATASET_PROJECT --bigquery-publishing-table-type=BIGQUERY_PUBLISHING_TABLE_TYPE --storage-exclude-patterns=[PATTERN,
           ...] --storage-include-patterns=[PATTERN,...]
           --csv-delimiter=CSV_DELIMITER
           --csv-disable-type-inference=CSV_DISABLE_TYPE_INFERENCE
@@ -107,6 +107,12 @@ FLAGS
             https://cloud.google.com/bigquery/docs/locations#supportedLocations
             for supported locations.
 
+         --bigquery-publishing-dataset-project=BIGQUERY_PUBLISHING_DATASET_PROJECT
+            The project of the BigQuery dataset to publish BigLake external or
+            non-BigLake external tables to. If not specified, the cloud
+            resource bucket project will be used to create the dataset. The
+            format is "projects/{project_id_or_number}.
+
          --bigquery-publishing-table-type=BIGQUERY_PUBLISHING_TABLE_TYPE
             BigQuery table type to discover the cloud resource bucket. Can be
             either EXTERNAL or BIGLAKE. If not specified, the table type will
diff --git a/gcloud/alpha/managed-kafka/clusters/describe b/gcloud/alpha/managed-kafka/clusters/describe
index 94abd0977..0cd3f1a92 100644
--- a/gcloud/alpha/managed-kafka/clusters/describe
+++ b/gcloud/alpha/managed-kafka/clusters/describe
@@ -4,7 +4,7 @@ NAME
 
 SYNOPSIS
     gcloud alpha managed-kafka clusters describe
-        (CLUSTER : --location=LOCATION) [GCLOUD_WIDE_FLAG ...]
+        (CLUSTER : --location=LOCATION) [--full-view] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) Describe a Managed Service for Apache Kafka cluster.
@@ -50,6 +50,13 @@ POSITIONAL ARGUMENTS
             specified name;
           ▸ provide the argument --location on the command line.
 
+FLAGS
+     --full-view
+        Whether full cluster view is returned. If provided, the cluster view
+        will include everything, including data fetched from the Kafka cluster
+        source of truth. If not provided, the API will default to the basic
+        view that only includes the basic metadata of the cluster.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/alpha/redis/instances/upgrade b/gcloud/alpha/redis/instances/upgrade
index 8a6176c39..65c53a5fc 100644
--- a/gcloud/alpha/redis/instances/upgrade
+++ b/gcloud/alpha/redis/instances/upgrade
@@ -52,10 +52,7 @@ POSITIONAL ARGUMENTS
 
 REQUIRED FLAGS
      --redis-version=VERSION
-        Target version of Redis software. You can only upgrade to the next
-        highest version. For example, you must upgrade an instance from
-        redis_3_2 to redis_4_0 before you can upgrade the instance to
-        redis_5_0. VERSION must be one of:
+        Target version of Redis software. VERSION must be one of:
 
          redis_4_0
             Redis 4.0 compatibility
diff --git a/gcloud/alpha/run/compose/help b/gcloud/alpha/run/compose/help
new file mode 100644
index 000000000..60b3ace4a
--- /dev/null
+++ b/gcloud/alpha/run/compose/help
@@ -0,0 +1,26 @@
+NAME
+    gcloud alpha run compose - support Docker Compose workflows on Cloud Run
+
+SYNOPSIS
+    gcloud alpha run compose COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) This command group provides tools for Docker Compose developers to
+    deploy services to Cloud Run using compose.yaml as the input source.
+
+EXAMPLES
+    To bring up a Docker Compose service on Cloud Run, run:
+
+        $ gcloud alpha run compose up compose.yaml
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/run/help b/gcloud/alpha/run/help
index dd09775ba..5d17bc79c 100644
--- a/gcloud/alpha/run/help
+++ b/gcloud/alpha/run/help
@@ -23,6 +23,9 @@ GCLOUD WIDE FLAGS
 GROUPS
     GROUP is one of the following:
 
+     compose
+        (ALPHA) Support Docker Compose workflows on Cloud Run.
+
      domain-mappings
         (ALPHA) View and manage your Cloud Run domain mappings.
 
diff --git a/gcloud/alpha/run/worker-pools/delete b/gcloud/alpha/run/worker-pools/delete
index ca6b88a4f..d21197e62 100644
--- a/gcloud/alpha/run/worker-pools/delete
+++ b/gcloud/alpha/run/worker-pools/delete
@@ -45,7 +45,8 @@ POSITIONAL ARGUMENTS
           ▸ provide the argument WORKER_POOL on the command line with a fully
             specified name;
           ▸ provide the argument --region on the command line;
-          ▸ set the property run/region.
+          ▸ set the property run/region;
+          ▸ specify the region from an interactive prompt.
 
 FLAGS
      --async
diff --git a/gcloud/alpha/run/worker-pools/deploy b/gcloud/alpha/run/worker-pools/deploy
index 956a61ba7..934850e78 100644
--- a/gcloud/alpha/run/worker-pools/deploy
+++ b/gcloud/alpha/run/worker-pools/deploy
@@ -84,7 +84,8 @@ POSITIONAL ARGUMENTS
           ▸ specify the workerpool name from an interactive prompt with a
             fully specified name;
           ▸ provide the argument --region on the command line;
-          ▸ set the property run/region.
+          ▸ set the property run/region;
+          ▸ specify the region from an interactive prompt.
 
 FLAGS
      --async
diff --git a/gcloud/alpha/run/worker-pools/list b/gcloud/alpha/run/worker-pools/list
index 26a5d4300..4ec136730 100644
--- a/gcloud/alpha/run/worker-pools/list
+++ b/gcloud/alpha/run/worker-pools/list
@@ -2,7 +2,9 @@ NAME
     gcloud alpha run worker-pools list - list available worker-pools
 
 SYNOPSIS
-    gcloud alpha run worker-pools list [--region=REGION] [GCLOUD_WIDE_FLAG ...]
+    gcloud alpha run worker-pools list [--region=REGION] [--filter=EXPRESSION]
+        [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) List available worker-pools.
@@ -13,23 +15,41 @@ EXAMPLES
         $ gcloud alpha run worker-pools list
 
 FLAGS
-     Region resource - Region to list worker-pools in. This represents a Cloud
-     resource. (NOTE) Some attributes are not given arguments in this group but
-     can be set in other ways.
+     --region=REGION
+        Region in which the resource can be found. Alternatively, set the
+        property [run/region].
 
-     To set the project attribute:
-      ◆ provide the argument --region on the command line with a fully
-        specified name;
-      ◆ set the property run/region with a fully specified name;
-      ◆ provide the argument --project on the command line;
-      ◆ set the property core/project.
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
 
-       --region=REGION
-          ID of the Region or fully qualified identifier for the Region.
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
 
-          To set the region attribute:
-          ▸ provide the argument --region on the command line;
-          ▸ set the property run/region.
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
 
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
diff --git a/gcloud/alpha/run/worker-pools/revisions/delete b/gcloud/alpha/run/worker-pools/revisions/delete
index 7d9d73d2c..749a95eaa 100644
--- a/gcloud/alpha/run/worker-pools/revisions/delete
+++ b/gcloud/alpha/run/worker-pools/revisions/delete
@@ -48,7 +48,8 @@ POSITIONAL ARGUMENTS
           ▸ provide the argument WORKER_POOL_REVISION on the command line
             with a fully specified name;
           ▸ provide the argument --region on the command line;
-          ▸ set the property run/region.
+          ▸ set the property run/region;
+          ▸ specify the region from an interactive prompt.
 
        --worker-pool=WORKER_POOL
           WorkerPool for the WorkerPoolRevision.
@@ -56,7 +57,8 @@ POSITIONAL ARGUMENTS
           To set the worker-pool attribute:
           ▸ provide the argument WORKER_POOL_REVISION on the command line
             with a fully specified name;
-          ▸ provide the argument --worker-pool on the command line.
+          ▸ provide the argument --worker-pool on the command line;
+          ▸ specify the workerpool name from an interactive prompt.
 
 FLAGS
      --async
diff --git a/gcloud/alpha/run/worker-pools/update b/gcloud/alpha/run/worker-pools/update
index 67574c95b..3cfb3854c 100644
--- a/gcloud/alpha/run/worker-pools/update
+++ b/gcloud/alpha/run/worker-pools/update
@@ -79,7 +79,8 @@ POSITIONAL ARGUMENTS
           ▸ specify the workerpool name from an interactive prompt with a
             fully specified name;
           ▸ provide the argument --region on the command line;
-          ▸ set the property run/region.
+          ▸ set the property run/region;
+          ▸ specify the region from an interactive prompt.
 
 FLAGS
      --async
diff --git a/gcloud/alpha/run/worker-pools/update-instance-split b/gcloud/alpha/run/worker-pools/update-instance-split
index 80ac6709c..a865b859e 100644
--- a/gcloud/alpha/run/worker-pools/update-instance-split
+++ b/gcloud/alpha/run/worker-pools/update-instance-split
@@ -74,7 +74,8 @@ POSITIONAL ARGUMENTS
           ▸ specify the workerpool name from an interactive prompt with a
             fully specified name;
           ▸ provide the argument --region on the command line;
-          ▸ set the property run/region.
+          ▸ set the property run/region;
+          ▸ specify the region from an interactive prompt.
 
 FLAGS
      --async
diff --git a/gcloud/alpha/scc/postures/help b/gcloud/alpha/scc/postures/help
index 88a6c5f7d..29c7d01bc 100644
--- a/gcloud/alpha/scc/postures/help
+++ b/gcloud/alpha/scc/postures/help
@@ -29,8 +29,8 @@ COMMANDS
         workload.
 
      list
-        (ALPHA) Lists all the Cloud Security Command Center (SCC) postures for
-        an organization.
+        (ALPHA) Lists all the Cloud Security Command Center postures for an
+        organization.
 
      list-revisions
         (ALPHA) List the revisions of a Cloud Security Command Center (SCC)
diff --git a/gcloud/alpha/scc/postures/list b/gcloud/alpha/scc/postures/list
index 9733566d5..40d41e2ce 100644
--- a/gcloud/alpha/scc/postures/list
+++ b/gcloud/alpha/scc/postures/list
@@ -3,23 +3,44 @@ NAME
         Center postures for an organization
 
 SYNOPSIS
-    gcloud alpha scc postures list PARENT [--filter=EXPRESSION] [--limit=LIMIT]
-        [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
+    gcloud alpha scc postures list
+        ([PARENT] --location=LOCATION --organization=ORGANIZATION)
+        [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
+        [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) Lists all Cloud Security Command Center (SCC) postures for an
-    organization. For a posture with multiple revisions, only the latest
-    updated revision of the posture is returned in the output.
+    (ALPHA) Lists all the Cloud Security Command Center postures for an
+    organization.
 
 EXAMPLES
-    List all postures in organization 123, location global.
+    To list all the Cloud Security Command Center postures for an organization
+    123 and in the global location, run:
 
         $ gcloud alpha scc postures list organizations/123/locations/global
 
+        $ gcloud alpha scc postures list --organization=123 --location=global
+
 POSITIONAL ARGUMENTS
-     PARENT
-        Resource name of the parent, like organizations/<organizationID> or
-        organizations/<organizationID>/locations/<location>.
+     Exactly one of these must be specified:
+
+       [PARENT]
+          Parent the Cloud Security Command Center postures belongs to.
+          Formatted as organizations/<organizationID>/locations/<location>.
+
+       Specify organization and location using flags.
+
+         --location=LOCATION
+            When data residency controls are enabled, this attribute specifies
+            the location in which the resource is located and applicable.
+
+            This flag argument must be specified if any of the other arguments
+            in this group are specified.
+
+         --organization=ORGANIZATION
+            The organization ID (e.g., 123) that contains the resource.
+
+            This flag argument must be specified if any of the other arguments
+            in this group are specified.
 
 LIST COMMAND FLAGS
      --filter=EXPRESSION
diff --git a/gcloud/alpha/source-manager/instances/create b/gcloud/alpha/source-manager/instances/create
index c8a55e245..3b7185939 100644
--- a/gcloud/alpha/source-manager/instances/create
+++ b/gcloud/alpha/source-manager/instances/create
@@ -4,8 +4,8 @@ NAME
 
 SYNOPSIS
     gcloud alpha source-manager instances create (INSTANCE : --region=REGION)
-        [--async] [--ca-pool=CA_POOL] [--enable-workforce-identity-federation]
-        [--is-private] [--kms-key=KMS_KEY] [--max-wait=MAX_WAIT; default="60m"]
+        [--async] [--enable-workforce-identity-federation] [--kms-key=KMS_KEY]
+        [--max-wait=MAX_WAIT; default="60m"] [--is-private : --ca-pool=CA_POOL]
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
@@ -62,15 +62,9 @@ FLAGS
         complete. The default is True. Enabled by default, use --no-async to
         disable.
 
-     --ca-pool=CA_POOL
-        CA Pool path for private instance.
-
      --enable-workforce-identity-federation
         Bool indicator for workforce identity federation instance.
 
-     --is-private
-        Bool indicator for private instance.
-
      --kms-key=KMS_KEY
         KMS key used to encrypt instance optionally.
 
@@ -80,6 +74,17 @@ FLAGS
         specified. See $ gcloud topic datetimes for information on time
         formats.
 
+     Private instance configuration.
+
+       --is-private
+          Bool indicator for private instance.
+
+          This flag argument must be specified if any of the other arguments in
+          this group are specified.
+
+       --ca-pool=CA_POOL
+          CA Pool path for private instance.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/alpha/storage/insights/dataset-configs/create b/gcloud/alpha/storage/insights/dataset-configs/create
index a70710359..279633f3a 100644
--- a/gcloud/alpha/storage/insights/dataset-configs/create
+++ b/gcloud/alpha/storage/insights/dataset-configs/create
@@ -51,16 +51,20 @@ REQUIRED FLAGS
      --retention-period-days=RETENTION_DAYS
         Provide retention period for the config.
 
-     List of source project numbers or the file containing list of project
-     numbers.
+     List of source options currently supported are source projects.
 
      Exactly one of these must be specified:
 
-       --source-projects=[SOURCE_PROJECT_NUMBERS,...]
-          List of source project numbers.
+       List of source project numbers or the file containing list of project
+       numbers.
 
-       --source-projects-file=SOURCE_PROJECT_NUMBERS_IN_FILE
-          CSV formatted file containing source project numbers, one per line.
+       At most one of these can be specified:
+
+         --source-projects=[SOURCE_PROJECT_NUMBERS,...]
+            List of source project numbers.
+
+         --source-projects-file=SOURCE_PROJECT_NUMBERS_IN_FILE
+            CSV formatted file containing source project numbers, one per line.
 
 OPTIONAL FLAGS
      --auto-add-new-buckets
@@ -103,7 +107,8 @@ OPTIONAL FLAGS
             google/re2 on GitHub.
 
      Specify the list of locations for source projects to be included or
-     excluded.
+     excluded from available locations
+     (https://cloud.google.com/storage/docs/locations#available-locations).
 
      At most one of these can be specified:
 
diff --git a/gcloud/beta/ai/endpoints/create b/gcloud/beta/ai/endpoints/create
index e36e70762..5b6f4f08f 100644
--- a/gcloud/beta/ai/endpoints/create
+++ b/gcloud/beta/ai/endpoints/create
@@ -5,8 +5,9 @@ SYNOPSIS
     gcloud beta ai endpoints create --display-name=DISPLAY_NAME
         [--description=DESCRIPTION]
         [--encryption-kms-key-name=ENCRYPTION_KMS_KEY_NAME]
-        [--endpoint-id=ENDPOINT_ID] [--gdce-zone=GDCE_ZONE]
-        [--labels=[KEY=VALUE,...]] [--network=NETWORK] [--region=REGION]
+        [--endpoint-id=ENDPOINT_ID] [--gdc-zone=GDC_ZONE]
+        [--gdce-zone=GDCE_ZONE] [--labels=[KEY=VALUE,...]] [--network=NETWORK]
+        [--region=REGION]
         [--request-response-logging-rate=REQUEST_RESPONSE_LOGGING_RATE
           --request-response-logging-table=REQUEST_RESPONSE_LOGGING_TABLE]
         [GCLOUD_WIDE_FLAG ...]
@@ -36,6 +37,9 @@ OPTIONAL FLAGS
      --endpoint-id=ENDPOINT_ID
         User-specified ID of the endpoint.
 
+     --gdc-zone=GDC_ZONE
+        The name of the GDC zone. If set, the endpoint is for GDCc.
+
      --gdce-zone=GDCE_ZONE
         The name of the GDCE zone. If set, the endpoint is in GDCE.
 
diff --git a/gcloud/beta/alloydb/instances/create b/gcloud/beta/alloydb/instances/create
index b67f95a62..508407a01 100644
--- a/gcloud/beta/alloydb/instances/create
+++ b/gcloud/beta/alloydb/instances/create
@@ -5,6 +5,7 @@ NAME
 SYNOPSIS
     gcloud beta alloydb instances create INSTANCE --cluster=CLUSTER
         --instance-type=INSTANCE_TYPE --region=REGION
+        [--allocated-ip-range-override=ALLOCATED_IP_RANGE_OVERRIDE]
         [--allowed-psc-projects=[ALLOWED_PSC_PROJECTS,...]]
         [--assign-inbound-public-ip=ASSIGN_INBOUND_PUBLIC_IP] [--async]
         [--authorized-external-networks=[AUTHORIZED_NETWORK,...]]
@@ -68,6 +69,14 @@ REQUIRED FLAGS
         regions at https://cloud.google.com/sql/docs/instance-locations.
 
 OPTIONAL FLAGS
+     --allocated-ip-range-override=ALLOCATED_IP_RANGE_OVERRIDE
+        Name of the allocated IP range for the private IP AlloyDB instance, for
+        example: "google-managed-services-default". If set, the instance IPs
+        will be created from this allocated range and will override the IP
+        range used by the parent cluster. The range name must comply with RFC
+        1035. Specifically, the name must be 1-63 characters long and match the
+        regular expression [a-z]([-a-z0-9]*[a-z0-9])?.
+
      --allowed-psc-projects=[ALLOWED_PSC_PROJECTS,...]
         Comma-separated list of allowed consumer projects to create endpoints
         for Private Service Connect (PSC) connectivity for the instance. Only
diff --git a/gcloud/beta/alloydb/instances/create-secondary b/gcloud/beta/alloydb/instances/create-secondary
index f075e0a47..eaf80bb90 100644
--- a/gcloud/beta/alloydb/instances/create-secondary
+++ b/gcloud/beta/alloydb/instances/create-secondary
@@ -4,7 +4,9 @@ NAME
 
 SYNOPSIS
     gcloud beta alloydb instances create-secondary INSTANCE --cluster=CLUSTER
-        --region=REGION [--allowed-psc-projects=[ALLOWED_PSC_PROJECTS,...]]
+        --region=REGION
+        [--allocated-ip-range-override=ALLOCATED_IP_RANGE_OVERRIDE]
+        [--allowed-psc-projects=[ALLOWED_PSC_PROJECTS,...]]
         [--assign-inbound-public-ip=ASSIGN_INBOUND_PUBLIC_IP] [--async]
         [--authorized-external-networks=[AUTHORIZED_NETWORK,...]]
         [--availability-type=AVAILABILITY_TYPE]
@@ -37,6 +39,14 @@ REQUIRED FLAGS
         regions at https://cloud.google.com/sql/docs/instance-locations.
 
 OPTIONAL FLAGS
+     --allocated-ip-range-override=ALLOCATED_IP_RANGE_OVERRIDE
+        Name of the allocated IP range for the private IP AlloyDB instance, for
+        example: "google-managed-services-default". If set, the instance IPs
+        will be created from this allocated range and will override the IP
+        range used by the parent cluster. The range name must comply with RFC
+        1035. Specifically, the name must be 1-63 characters long and match the
+        regular expression [a-z]([-a-z0-9]*[a-z0-9])?.
+
      --allowed-psc-projects=[ALLOWED_PSC_PROJECTS,...]
         Comma-separated list of allowed consumer projects to create endpoints
         for Private Service Connect (PSC) connectivity for the instance. Only
diff --git a/gcloud/beta/compute/backend-services/create b/gcloud/beta/compute/backend-services/create
index 924deb167..0ab6e502f 100644
--- a/gcloud/beta/compute/backend-services/create
+++ b/gcloud/beta/compute/backend-services/create
@@ -286,10 +286,11 @@ FLAGS
 
      --[no-]enable-cdn
         Enable or disable Cloud CDN for the backend service. Only available for
-        backend services with --load-balancing-scheme=EXTERNAL that use a
-        --protocol of HTTP, HTTPS, HTTP2 or H2C. Cloud CDN caches HTTP
-        responses at the edge of Google's network. Cloud CDN is disabled by
-        default. Use --enable-cdn to enable and --no-enable-cdn to disable.
+        backend services with --load-balancing-scheme=EXTERNAL or
+        EXTERNAL_MANAGED that use a --protocol of HTTP, HTTPS, HTTP2 or H2C.
+        Cloud CDN caches HTTP responses at the edge of Google's network. Cloud
+        CDN is disabled by default. Use --enable-cdn to enable and
+        --no-enable-cdn to disable.
 
      --[no-]enable-logging
         The logging options for the load balancer traffic served by this
diff --git a/gcloud/beta/compute/backend-services/update b/gcloud/beta/compute/backend-services/update
index f437c4d43..359000999 100644
--- a/gcloud/beta/compute/backend-services/update
+++ b/gcloud/beta/compute/backend-services/update
@@ -203,10 +203,11 @@ FLAGS
 
      --[no-]enable-cdn
         Enable or disable Cloud CDN for the backend service. Only available for
-        backend services with --load-balancing-scheme=EXTERNAL that use a
-        --protocol of HTTP, HTTPS, HTTP2 or H2C. Cloud CDN caches HTTP
-        responses at the edge of Google's network. Cloud CDN is disabled by
-        default. Use --enable-cdn to enable and --no-enable-cdn to disable.
+        backend services with --load-balancing-scheme=EXTERNAL or
+        EXTERNAL_MANAGED that use a --protocol of HTTP, HTTPS, HTTP2 or H2C.
+        Cloud CDN caches HTTP responses at the edge of Google's network. Cloud
+        CDN is disabled by default. Use --enable-cdn to enable and
+        --no-enable-cdn to disable.
 
      --[no-]enable-logging
         The logging options for the load balancer traffic served by this
diff --git a/gcloud/beta/compute/instances/bulk/create b/gcloud/beta/compute/instances/bulk/create
index e540f7a5d..a03dec04f 100644
--- a/gcloud/beta/compute/instances/bulk/create
+++ b/gcloud/beta/compute/instances/bulk/create
@@ -671,6 +671,12 @@ OPTIONAL FLAGS
             be one of: IPV4_ONLY, IPV4_IPV6, IPV6_ONLY. The default value is
             IPV4_ONLY.
 
+         igmp-query
+            Determines if the Compute Engine Instance can receive and respond
+            to IGMP query packets on the specified network interface.
+            IGMP_QUERY must be one of: IGMP_QUERY_V2, IGMP_QUERY_DISABLED. It
+            is disabled by default.
+
      --network-performance-configs=[PROPERTY=VALUE,...]
         Configures network performance settings for the instance. If this flag
         is not specified, the instance will be created with its default network
diff --git a/gcloud/beta/compute/instances/create b/gcloud/beta/compute/instances/create
index 4d1d4b8bf..0357df49c 100644
--- a/gcloud/beta/compute/instances/create
+++ b/gcloud/beta/compute/instances/create
@@ -844,6 +844,12 @@ FLAGS
             VLAN tag of a dynamic network interface, must be an integer in the
             range from 2 to 255 inclusively.
 
+         igmp-query
+            Determines if the Compute Engine Instance can receive and respond
+            to IGMP query packets on the specified network interface.
+            IGMP_QUERY must be one of: IGMP_QUERY_V2, IGMP_QUERY_DISABLED. It
+            is disabled by default.
+
      --network-performance-configs=[PROPERTY=VALUE,...]
         Configures network performance settings for the instance. If this flag
         is not specified, the instance will be created with its default network
diff --git a/gcloud/beta/compute/instances/network-interfaces/update b/gcloud/beta/compute/instances/network-interfaces/update
index 15e2e00f9..51e52199e 100644
--- a/gcloud/beta/compute/instances/network-interfaces/update
+++ b/gcloud/beta/compute/instances/network-interfaces/update
@@ -6,6 +6,7 @@ SYNOPSIS
     gcloud beta compute instances network-interfaces update INSTANCE_NAME
         [--aliases=ALIASES] [--external-ipv6-address=EXTERNAL_IPV6_ADDRESS]
         [--external-ipv6-prefix-length=EXTERNAL_IPV6_PREFIX_LENGTH]
+        [--igmp-query=IGMP_QUERY]
         [--internal-ipv6-address=INTERNAL_IPV6_ADDRESS]
         [--internal-ipv6-prefix-length=INTERNAL_IPV6_PREFIX_LENGTH]
         [--ipv6-network-tier=IPV6_NETWORK_TIER] [--network=NETWORK]
@@ -58,6 +59,16 @@ FLAGS
         be used together with --external-ipv6-address. Currently only /96 is
         supported and the default value is 96.
 
+     --igmp-query=IGMP_QUERY
+        Determines if the Compute Engine instance can receive and respond to
+        IGMP query packets on the specified network interface. IGMP_QUERY must
+        be one of:
+
+         IGMP_QUERY_DISABLED
+            IGMP Query on the network interface is disabled.
+         IGMP_QUERY_V2
+            IGMP Query V2 on the network interface is enabled.
+
      --internal-ipv6-address=INTERNAL_IPV6_ADDRESS
         Assigns the given internal IPv6 address or range to an instance. The
         address must be the first IP address in the range or a /96 IP address
diff --git a/gcloud/beta/container/clusters/create b/gcloud/beta/container/clusters/create
index 7b8c017d5..89a919855 100644
--- a/gcloud/beta/container/clusters/create
+++ b/gcloud/beta/container/clusters/create
@@ -74,6 +74,7 @@ SYNOPSIS
         [--node-version=NODE_VERSION]
         [--notification-config=[pubsub=ENABLED|DISABLED,
           pubsub-topic=TOPIC,...]] [--num-nodes=NUM_NODES; default=3]
+        [--patch-update=[PATCH_UPDATE]]
         [--performance-monitoring-unit=PERFORMANCE_MONITORING_UNIT]
         [--placement-policy=PLACEMENT_POLICY] [--placement-type=PLACEMENT_TYPE]
         [--preemptible] [--private-endpoint-subnetwork=NAME]
@@ -1102,6 +1103,17 @@ FLAGS
      --num-nodes=NUM_NODES; default=3
         The number of nodes to be created in each of the cluster's zones.
 
+     --patch-update=[PATCH_UPDATE]
+        The patch update to use for the cluster.
+
+        Setting to 'accelerated' automatically upgrades the cluster to the
+        latest patch available within the cluster's current minor version and
+        release channel. Setting to 'default' automatically upgrades the
+        cluster to the default patch upgrade targetversion available within the
+        cluster's current minor version and release channel.
+
+        PATCH_UPDATE must be one of: accelerated, default.
+
      --performance-monitoring-unit=PERFORMANCE_MONITORING_UNIT
         Sets the Performance Monitoring Unit level. Valid values are
         architectural, standard and enhanced. PERFORMANCE_MONITORING_UNIT must
diff --git a/gcloud/beta/container/clusters/update b/gcloud/beta/container/clusters/update
index f3cee105b..e38309c37 100644
--- a/gcloud/beta/container/clusters/update
+++ b/gcloud/beta/container/clusters/update
@@ -38,7 +38,7 @@ SYNOPSIS
           | --logging-variant=LOGGING_VARIANT | --maintenance-window=START_TIME
           | --network-performance-configs=[PROPERTY1=VALUE1,...]
           | --notification-config=[pubsub=ENABLED|DISABLED,
-          pubsub-topic=TOPIC,...]
+          pubsub-topic=TOPIC,...] | --patch-update=[PATCH_UPDATE]
           | --private-ipv6-google-access-type=PRIVATE_IPV6_GOOGLE_ACCESS_TYPE
           | --release-channel=[CHANNEL] | --remove-labels=[KEY,...]
           | --remove-workload-policies=REMOVE_WORKLOAD_POLICIES
@@ -618,6 +618,17 @@ REQUIRED FLAGS
           The project of the Pub/Sub topic must be the same one as the cluster.
           It can be either the project ID or the project number.
 
+       --patch-update=[PATCH_UPDATE]
+          The patch update to use for the cluster.
+
+          Setting to 'accelerated' automatically upgrades the cluster to the
+          latest patch available within the cluster's current minor version and
+          release channel. Setting to 'default' automatically upgrades the
+          cluster to the default patch upgrade targetversion available within
+          the cluster's current minor version and release channel.
+
+          PATCH_UPDATE must be one of: accelerated, default.
+
        --private-ipv6-google-access-type=PRIVATE_IPV6_GOOGLE_ACCESS_TYPE
           Sets the type of private access to Google services over IPv6.
 
diff --git a/gcloud/beta/container/fleet/scopes/add-app-operator-binding b/gcloud/beta/container/fleet/scopes/add-app-operator-binding
index ecbe45ab7..703ca1e25 100644
--- a/gcloud/beta/container/fleet/scopes/add-app-operator-binding
+++ b/gcloud/beta/container/fleet/scopes/add-app-operator-binding
@@ -5,12 +5,12 @@ NAME
 
 SYNOPSIS
     gcloud beta container fleet scopes add-app-operator-binding SCOPE
-        --role=ROLE (--group=GROUP | --user=USER) [--labels=[KEY=VALUE,...]]
-        [GCLOUD_WIDE_FLAG ...]
+        (--custom-role=CUSTOM_ROLE | --role=ROLE) (--group=GROUP | --user=USER)
+        [--labels=[KEY=VALUE,...]] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (BETA) One binding consists of an app operator principal (user/group) and a
-    role (view/edit/admin).
+    role (view/edit/admin or a custom role).
 
     This command sets up the different permissions required for an app
     operator, including usage of fleet scopes, connect gateway, logging, and
@@ -66,6 +66,26 @@ EXAMPLES
       ▪ creates fleet scope RBAC role binding: role admin with a random ID
         for user person@google.com.
 
+    ---
+
+    The following command:
+
+        $ gcloud beta container fleet scopes add-app-operator-binding \
+            SCOPE --custom-role=my-custom-role --user=person@google.com \
+            --project=PROJECT_ID
+
+      ▪ adds IAM policy binding: roles/gkehub.scopeViewer on SCOPE
+      ▪ adds IAM policy binding: roles/gkehub.scopeEditorProjectLevel on
+        PROJECT_ID
+      ▪ adds IAM policy binding: roles/logging.viewAccessor on PROJECT_ID
+        with condition where bucket corresponds to SCOPE
+      ▪ creates fleet scope RBAC role binding: role my-custom-role with a
+        random ID for user person@google.com.
+
+    For any tailored IAM permissions required when using a custom role, the
+    user or group can separately be granted additional IAM permissions on the
+    project.
+
 POSITIONAL ARGUMENTS
      Scope resource - The group of arguments defining the Fleet Scope. This
      represents a Cloud resource. (NOTE) Some attributes are not given
@@ -91,8 +111,14 @@ POSITIONAL ARGUMENTS
           ▸ provide the argument SCOPE on the command line.
 
 REQUIRED FLAGS
-     --role=ROLE
-        Role to assign. ROLE must be one of: admin, edit, view.
+     Exactly one of these must be specified:
+
+       --custom-role=CUSTOM_ROLE
+          Custom role to assign to principal.
+
+       --role=ROLE
+          Predefined role to assign to principal (admin, edit, view). ROLE must
+          be one of: admin, edit, view.
 
      Exactly one of these must be specified:
 
diff --git a/gcloud/beta/container/fleet/scopes/list-app-operator-bindings b/gcloud/beta/container/fleet/scopes/list-app-operator-bindings
index 176d9a8bd..fc7ddc0b0 100644
--- a/gcloud/beta/container/fleet/scopes/list-app-operator-bindings
+++ b/gcloud/beta/container/fleet/scopes/list-app-operator-bindings
@@ -15,7 +15,7 @@ DESCRIPTION
     permissions required for an app operator, including usage of fleet scopes,
     connect gateway, logging, and metrics. The overarching principal role
     (view/edit/admin, or custom) is determined by (1) the fleet scope RBAC role
-    (view, edit, or admin), (2) the fleet scope-level IAM role
+    (view, edit, admin or a custom role), (2) the fleet scope-level IAM role
     (roles/gkehub.scopeViewer, roles/gkehub.scopeEditor, or
     roles/gkehub.scopeAdmin), (3) the project-level IAM role
     (roles/gkehub.scopeViewerProjectLevel, or
diff --git a/gcloud/beta/container/fleet/scopes/remove-app-operator-binding b/gcloud/beta/container/fleet/scopes/remove-app-operator-binding
index 67f105a44..ad8bd15fe 100644
--- a/gcloud/beta/container/fleet/scopes/remove-app-operator-binding
+++ b/gcloud/beta/container/fleet/scopes/remove-app-operator-binding
@@ -61,7 +61,24 @@ EXAMPLES
     The following command:
 
         $ gcloud beta container fleet scopes remove-app-operator-binding \
-            SCOPE --role=admin --user=person@google.com --project=PROJECT_ID
+            SCOPE --user=person@google.com --project=PROJECT_ID
+
+    assuming the user already has a custom role:
+      ▪ removes IAM policy binding: roles/gkehub.scopeViewer from SCOPE
+      ▪ removes IAM policy binding: roles/gkehub.scopeEditorProjectLevel from
+        PROJECT_ID if the user does not have the edit/admin role for any other
+        scope under the project
+      ▪ removes IAM policy binding: roles/logging.viewAccessor from
+        PROJECT_ID condition where bucket corresponds to SCOPE
+      ▪ deletes existing fleet scope RBAC role binding: role admin for user
+        person@google.com.
+
+    ---
+
+    The following command:
+
+        $ gcloud beta container fleet scopes remove-app-operator-binding \
+            SCOPE --user=person@google.com --project=PROJECT_ID
 
     assuming the user already has the admin role:
       ▪ removes IAM policy binding: roles/gkehub.scopeAdmin from SCOPE
diff --git a/gcloud/beta/container/hub/scopes/add-app-operator-binding b/gcloud/beta/container/hub/scopes/add-app-operator-binding
index 6f1f71066..c99bcf2c4 100644
--- a/gcloud/beta/container/hub/scopes/add-app-operator-binding
+++ b/gcloud/beta/container/hub/scopes/add-app-operator-binding
@@ -4,13 +4,13 @@ NAME
         scope RBAC role binding for an app operator principal
 
 SYNOPSIS
-    gcloud beta container hub scopes add-app-operator-binding SCOPE --role=ROLE
-        (--group=GROUP | --user=USER) [--labels=[KEY=VALUE,...]]
-        [GCLOUD_WIDE_FLAG ...]
+    gcloud beta container hub scopes add-app-operator-binding SCOPE
+        (--custom-role=CUSTOM_ROLE | --role=ROLE) (--group=GROUP | --user=USER)
+        [--labels=[KEY=VALUE,...]] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (BETA) One binding consists of an app operator principal (user/group) and a
-    role (view/edit/admin).
+    role (view/edit/admin or a custom role).
 
     This command sets up the different permissions required for an app
     operator, including usage of fleet scopes, connect gateway, logging, and
@@ -66,6 +66,26 @@ EXAMPLES
       ▪ creates fleet scope RBAC role binding: role admin with a random ID
         for user person@google.com.
 
+    ---
+
+    The following command:
+
+        $ gcloud beta container hub scopes add-app-operator-binding SCOPE \
+            --custom-role=my-custom-role --user=person@google.com \
+            --project=PROJECT_ID
+
+      ▪ adds IAM policy binding: roles/gkehub.scopeViewer on SCOPE
+      ▪ adds IAM policy binding: roles/gkehub.scopeEditorProjectLevel on
+        PROJECT_ID
+      ▪ adds IAM policy binding: roles/logging.viewAccessor on PROJECT_ID
+        with condition where bucket corresponds to SCOPE
+      ▪ creates fleet scope RBAC role binding: role my-custom-role with a
+        random ID for user person@google.com.
+
+    For any tailored IAM permissions required when using a custom role, the
+    user or group can separately be granted additional IAM permissions on the
+    project.
+
 POSITIONAL ARGUMENTS
      Scope resource - The group of arguments defining the Fleet Scope. This
      represents a Cloud resource. (NOTE) Some attributes are not given
@@ -91,8 +111,14 @@ POSITIONAL ARGUMENTS
           ▸ provide the argument SCOPE on the command line.
 
 REQUIRED FLAGS
-     --role=ROLE
-        Role to assign. ROLE must be one of: admin, edit, view.
+     Exactly one of these must be specified:
+
+       --custom-role=CUSTOM_ROLE
+          Custom role to assign to principal.
+
+       --role=ROLE
+          Predefined role to assign to principal (admin, edit, view). ROLE must
+          be one of: admin, edit, view.
 
      Exactly one of these must be specified:
 
diff --git a/gcloud/beta/container/hub/scopes/list-app-operator-bindings b/gcloud/beta/container/hub/scopes/list-app-operator-bindings
index 545c3543c..06df3c95f 100644
--- a/gcloud/beta/container/hub/scopes/list-app-operator-bindings
+++ b/gcloud/beta/container/hub/scopes/list-app-operator-bindings
@@ -15,7 +15,7 @@ DESCRIPTION
     permissions required for an app operator, including usage of fleet scopes,
     connect gateway, logging, and metrics. The overarching principal role
     (view/edit/admin, or custom) is determined by (1) the fleet scope RBAC role
-    (view, edit, or admin), (2) the fleet scope-level IAM role
+    (view, edit, admin or a custom role), (2) the fleet scope-level IAM role
     (roles/gkehub.scopeViewer, roles/gkehub.scopeEditor, or
     roles/gkehub.scopeAdmin), (3) the project-level IAM role
     (roles/gkehub.scopeViewerProjectLevel, or
diff --git a/gcloud/beta/container/hub/scopes/remove-app-operator-binding b/gcloud/beta/container/hub/scopes/remove-app-operator-binding
index 18c7db0ac..4479918aa 100644
--- a/gcloud/beta/container/hub/scopes/remove-app-operator-binding
+++ b/gcloud/beta/container/hub/scopes/remove-app-operator-binding
@@ -61,7 +61,24 @@ EXAMPLES
     The following command:
 
         $ gcloud beta container hub scopes remove-app-operator-binding \
-            SCOPE --role=admin --user=person@google.com --project=PROJECT_ID
+            SCOPE --user=person@google.com --project=PROJECT_ID
+
+    assuming the user already has a custom role:
+      ▪ removes IAM policy binding: roles/gkehub.scopeViewer from SCOPE
+      ▪ removes IAM policy binding: roles/gkehub.scopeEditorProjectLevel from
+        PROJECT_ID if the user does not have the edit/admin role for any other
+        scope under the project
+      ▪ removes IAM policy binding: roles/logging.viewAccessor from
+        PROJECT_ID condition where bucket corresponds to SCOPE
+      ▪ deletes existing fleet scope RBAC role binding: role admin for user
+        person@google.com.
+
+    ---
+
+    The following command:
+
+        $ gcloud beta container hub scopes remove-app-operator-binding \
+            SCOPE --user=person@google.com --project=PROJECT_ID
 
     assuming the user already has the admin role:
       ▪ removes IAM policy binding: roles/gkehub.scopeAdmin from SCOPE
diff --git a/gcloud/beta/data-fusion/instances/create b/gcloud/beta/data-fusion/instances/create
index 926e2d1e5..b30dee468 100644
--- a/gcloud/beta/data-fusion/instances/create
+++ b/gcloud/beta/data-fusion/instances/create
@@ -7,7 +7,8 @@ SYNOPSIS
         [--async] [--edition=EDITION; default="basic"] [--enable_rbac]
         [--enable_stackdriver_logging] [--enable_stackdriver_monitoring]
         [--labels=[KEY=VALUE,...]] [--options=[KEY=VALUE,...]]
-        [--patch_revision=PATCH_REVISION] [--version=VERSION] [--zone=ZONE]
+        [--patch_revision=PATCH_REVISION] [--tags=[KEY=VALUE,...]]
+        [--version=VERSION] [--zone=ZONE]
         [--maintenance-window-end=MAINTENANCE_WINDOW_END
           --maintenance-window-recurrence=MAINTENANCE_WINDOW_RECURRENCE
           --maintenance-window-start=MAINTENANCE_WINDOW_START]
@@ -94,6 +95,13 @@ FLAGS
         Patch revision version of Cloud Data Fusion to use when creating the
         instance.For example: --patch_revision=6.9.2.1.
 
+     --tags=[KEY=VALUE,...]
+        List of tags KEY=VALUE pairs to bind. Each item must be specified in
+        either ID <tag_Key_id>=<tag_value_id> or Namespaced format
+        <tag-key-namespaced-name>=<tag-value-short-name>.
+
+        Example: 123/environment=production,123/costCenter=marketing
+
      --version=VERSION
         The version of Cloud Data Fusion to use when creating the instance. For
         example: --version=6.9.2.
diff --git a/gcloud/beta/datastream/connection-profiles/create b/gcloud/beta/datastream/connection-profiles/create
index 192588a4d..707aa97a7 100644
--- a/gcloud/beta/datastream/connection-profiles/create
+++ b/gcloud/beta/datastream/connection-profiles/create
@@ -93,7 +93,8 @@ REQUIRED FLAGS
         Friendly name for the connection profile.
 
      --type=TYPE
-        Type can be MYSQL, ORACLE, POSTGRESQL, GOOGLE-CLOUD-STORAGE or BIGQUERY
+        Type can be MYSQL, ORACLE, POSTGRESQL, SQLSERVER, SALESFORCE,
+        GOOGLE-CLOUD-STORAGE or BIGQUERY
 
 OPTIONAL FLAGS
      --labels=[KEY=VALUE,...]
diff --git a/gcloud/beta/datastream/connection-profiles/update b/gcloud/beta/datastream/connection-profiles/update
index b14be55cd..a6f5bd04f 100644
--- a/gcloud/beta/datastream/connection-profiles/update
+++ b/gcloud/beta/datastream/connection-profiles/update
@@ -92,7 +92,8 @@ POSITIONAL ARGUMENTS
 
 REQUIRED FLAGS
      --type=TYPE
-        Type can be MYSQL, ORACLE, POSTGRESQL, GOOGLE-CLOUD-STORAGE or BIGQUERY
+        Type can be MYSQL, ORACLE, POSTGRESQL, SQLSERVER, SALESFORCE,
+        GOOGLE-CLOUD-STORAGE or BIGQUERY
 
 OPTIONAL FLAGS
      --display-name=DISPLAY_NAME
diff --git a/gcloud/beta/network-connectivity/hubs/update b/gcloud/beta/network-connectivity/hubs/update
index e9a1b7073..39be645d8 100644
--- a/gcloud/beta/network-connectivity/hubs/update
+++ b/gcloud/beta/network-connectivity/hubs/update
@@ -44,8 +44,8 @@ FLAGS
         New description of the hub.
 
      --[no-]export-psc
-        Whether Private Service Connect transitivity is enabled for the hub.
-        Use --export-psc to enable and --no-export-psc to disable.
+        Whether Private Service Connect propagation is enabled for the hub. Use
+        --export-psc to enable and --no-export-psc to disable.
 
      --update-labels=[KEY=VALUE,...]
         List of label KEY=VALUE pairs to update. If a label exists, its value
diff --git a/gcloud/beta/network-management/vpc-flow-logs-configs/create b/gcloud/beta/network-management/vpc-flow-logs-configs/create
index b029ca03f..fee248920 100644
--- a/gcloud/beta/network-management/vpc-flow-logs-configs/create
+++ b/gcloud/beta/network-management/vpc-flow-logs-configs/create
@@ -1,6 +1,6 @@
 NAME
     gcloud beta network-management vpc-flow-logs-configs create - creates a new
-        VPC Flow Logs configuration in the specified organization
+        VPC Flow Logs configuration
 
 SYNOPSIS
     gcloud beta network-management vpc-flow-logs-configs create
@@ -16,8 +16,15 @@ SYNOPSIS
           | --subnet=SUBNET | --vpn-tunnel=VPN_TUNNEL] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (BETA) Creates a new VPC Flow Logs configuration in the specified
-    organization.
+    (BETA) Creates a new VPC Flow Logs configuration.
+
+    Project-level configuration: Specify a target resource, either: --subnet,
+    --network, --interconnect-attachment, or --vpn-tunnel
+
+    Organization-level configuration: Specify the --organization flag without a
+    target resource to apply the configuration across an entire organization.
+
+    The --location=global flag is always required.
 
 EXAMPLES
     To create a new VPC Flow Logs configuration my-config in organization
@@ -26,6 +33,37 @@ EXAMPLES
         $ gcloud beta network-management vpc-flow-logs-configs create \
             my-config --location=global --organization=<my-org-number>
 
+    To create a new VPC Flow Logs configuration my-config in project my-project
+    for a VLAN attachment for Cloud Interconnect, run:
+
+        $ gcloud beta network-management vpc-flow-logs-configs create \
+            my-config --location=global \
+            --interconnect-attachment="projects/{project_id}/regions/{region\
+        }/interconnectAttachments/{interconnect_attachment_id}"
+
+    To create a new VPC Flow Logs configuration my-config in project my-project
+    for a Cloud VPN tunnel, run:
+
+        $ gcloud beta network-management vpc-flow-logs-configs create \
+            my-config --location=global \
+            --subnet="projects/{project_id}/regions/{region}/vpnTunnels/{vpn\
+        _tunnel_id}"
+
+    To create a new VPC Flow Logs configuration my-config in project my-project
+    for a subnet, run:
+
+        $ gcloud beta network-management vpc-flow-logs-configs create \
+            my-config --location=global \
+            --subnet="projects/{project_id}/regions/{region}/subnets/{subnet\
+        _id}"
+
+    To create a new VPC Flow Logs configuration my-config in project my-project
+    for a VPC network, run:
+
+        $ gcloud beta network-management vpc-flow-logs-configs create \
+            my-config --location=global \
+            --network="projects/{project_id}/global/networks/{network_id}"
+
 POSITIONAL ARGUMENTS
      VpcFlowLogsConfig resource - Identifier. Unique name of the configuration
      using one of the forms:
diff --git a/gcloud/beta/network-management/vpc-flow-logs-configs/delete b/gcloud/beta/network-management/vpc-flow-logs-configs/delete
index a53ef75cb..60c3aa033 100644
--- a/gcloud/beta/network-management/vpc-flow-logs-configs/delete
+++ b/gcloud/beta/network-management/vpc-flow-logs-configs/delete
@@ -18,6 +18,11 @@ EXAMPLES
         $ gcloud beta network-management vpc-flow-logs-configs delete \
             my-config --location=global --organization=<my-org-number>
 
+    To delete a VPC Flow Logs configuration my-config, run:
+
+        $ gcloud beta network-management vpc-flow-logs-configs delete \
+            my-config --location=global
+
 POSITIONAL ARGUMENTS
      VpcFlowLogsConfig resource - VpcFlowLogsConfig resource name using one of
      the form:
diff --git a/gcloud/beta/network-management/vpc-flow-logs-configs/describe b/gcloud/beta/network-management/vpc-flow-logs-configs/describe
index 6f63a7ff8..c27138ce2 100644
--- a/gcloud/beta/network-management/vpc-flow-logs-configs/describe
+++ b/gcloud/beta/network-management/vpc-flow-logs-configs/describe
@@ -1,6 +1,6 @@
 NAME
     gcloud beta network-management vpc-flow-logs-configs describe - describe
-        the details of a specific VPC Flow Logs configuration for organization
+        the details of a specific VPC Flow Logs configuration
 
 SYNOPSIS
     gcloud beta network-management vpc-flow-logs-configs describe
@@ -9,8 +9,7 @@ SYNOPSIS
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (BETA) Describes the details of a specific VPC Flow Logs configuration for
-    organization.
+    (BETA) Describes the details of a specific VPC Flow Logs configuration.
 
 EXAMPLES
     To get the details of a VPC Flow Logs configuration my-config, within the
@@ -19,6 +18,11 @@ EXAMPLES
         $ gcloud beta network-management vpc-flow-logs-configs describe \
             my-config --location=global --organization=<my-org-number>
 
+    To get the details of a VPC Flow Logs configuration my-config, run:
+
+        $ gcloud beta network-management vpc-flow-logs-configs describe \
+            my-config --location=global
+
 POSITIONAL ARGUMENTS
      VpcFlowLogsConfig resource - VpcFlowLogsConfig resource name using the
      form:
diff --git a/gcloud/beta/network-management/vpc-flow-logs-configs/help b/gcloud/beta/network-management/vpc-flow-logs-configs/help
index 5bc3d3aee..1fcff52ad 100644
--- a/gcloud/beta/network-management/vpc-flow-logs-configs/help
+++ b/gcloud/beta/network-management/vpc-flow-logs-configs/help
@@ -9,6 +9,9 @@ SYNOPSIS
 DESCRIPTION
     (BETA) The flag --location=global is required for all the commands.
 
+    You can either specify resources for project-level configurations, or use
+    the --organization flag to apply organization-level configurations.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --help.
 
@@ -18,18 +21,16 @@ COMMANDS
     COMMAND is one of the following:
 
      create
-        (BETA) Creates a new VPC Flow Logs configuration in the specified
-        organization.
+        (BETA) Creates a new VPC Flow Logs configuration.
 
      delete
         (BETA) Deletes the specified VPC Flow Logs configuration.
 
      describe
-        (BETA) Describe the details of a specific VPC Flow Logs configuration
-        for organization.
+        (BETA) Describe the details of a specific VPC Flow Logs configuration.
 
      list
-        (BETA) List all VPC Flow Logs configurations in the organization.
+        (BETA) List all VPC Flow Logs configurations.
 
      query-org-vpc-flow-logs-configs
         (BETA) Fetch all organization-level VPC Flow Logs configurations
diff --git a/gcloud/beta/network-management/vpc-flow-logs-configs/list b/gcloud/beta/network-management/vpc-flow-logs-configs/list
index 638032438..79b6028f7 100644
--- a/gcloud/beta/network-management/vpc-flow-logs-configs/list
+++ b/gcloud/beta/network-management/vpc-flow-logs-configs/list
@@ -1,6 +1,6 @@
 NAME
     gcloud beta network-management vpc-flow-logs-configs list - list all VPC
-        Flow Logs configurations in the organization
+        Flow Logs configurations
 
 SYNOPSIS
     gcloud beta network-management vpc-flow-logs-configs list
@@ -9,20 +9,20 @@ SYNOPSIS
         [--sort-by=[FIELD,...]] [--uri] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (BETA) Lists all VPC Flow Logs configurations in the organization.
+    (BETA) By default, lists all project-level VPC Flow Logs configurations.
+    Use the --organization flag to list all organization-level configurations.
 
 EXAMPLES
-    To list all the VPC Flow Logs configurations within the organization, run:
+    To list all the VPC Flow Logs configurations within the project, run:
 
         $ gcloud beta network-management vpc-flow-logs-configs list \
-            --location=global --organization=<my-org-number>
+            --location=global
 
-    To list all the VPC Flow Logs configurations within the organization with
-    state 'ENABLED', run:
+    To list all the VPC Flow Logs configurations within the project with state
+    'ENABLED', run:
 
         $ gcloud beta network-management vpc-flow-logs-configs list \
-            --location=global --organization=<my-org-number> \
-            --filter="state:ENABLED"
+            --location=global --filter="state:ENABLED"
 
 REQUIRED FLAGS
      Location resource - The parent resource of the VpcFlowLogsConfig:
diff --git a/gcloud/beta/network-management/vpc-flow-logs-configs/update b/gcloud/beta/network-management/vpc-flow-logs-configs/update
index cdc1ab279..bbac98790 100644
--- a/gcloud/beta/network-management/vpc-flow-logs-configs/update
+++ b/gcloud/beta/network-management/vpc-flow-logs-configs/update
@@ -33,6 +33,12 @@ EXAMPLES
             my-config --location=global --organization=<my-org-number> \
             --state=DISABLED
 
+    To update the state field to be 'DISABLED' in the VPC Flow Logs
+    configuration my-config, run:
+
+        $ gcloud beta network-management vpc-flow-logs-configs update \
+            my-config --location=global --state=DISABLED
+
 POSITIONAL ARGUMENTS
      VpcFlowLogsConfig resource - Identifier. Unique name of the configuration
      using one of the forms:
diff --git a/gcloud/beta/redis/instances/upgrade b/gcloud/beta/redis/instances/upgrade
index 651ad0ed0..1b623ed98 100644
--- a/gcloud/beta/redis/instances/upgrade
+++ b/gcloud/beta/redis/instances/upgrade
@@ -52,10 +52,7 @@ POSITIONAL ARGUMENTS
 
 REQUIRED FLAGS
      --redis-version=VERSION
-        Target version of Redis software. You can only upgrade to the next
-        highest version. For example, you must upgrade an instance from
-        redis_3_2 to redis_4_0 before you can upgrade the instance to
-        redis_5_0. VERSION must be one of:
+        Target version of Redis software. VERSION must be one of:
 
          redis_4_0
             Redis 4.0 compatibility
diff --git a/gcloud/beta/source-manager/instances/create b/gcloud/beta/source-manager/instances/create
index 4fdcad492..bf03a0ef6 100644
--- a/gcloud/beta/source-manager/instances/create
+++ b/gcloud/beta/source-manager/instances/create
@@ -4,8 +4,8 @@ NAME
 
 SYNOPSIS
     gcloud beta source-manager instances create (INSTANCE : --region=REGION)
-        [--async] [--ca-pool=CA_POOL] [--enable-workforce-identity-federation]
-        [--is-private] [--kms-key=KMS_KEY] [--max-wait=MAX_WAIT; default="60m"]
+        [--async] [--enable-workforce-identity-federation] [--kms-key=KMS_KEY]
+        [--max-wait=MAX_WAIT; default="60m"] [--is-private : --ca-pool=CA_POOL]
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
@@ -62,15 +62,9 @@ FLAGS
         complete. The default is True. Enabled by default, use --no-async to
         disable.
 
-     --ca-pool=CA_POOL
-        CA Pool path for private instance.
-
      --enable-workforce-identity-federation
         Bool indicator for workforce identity federation instance.
 
-     --is-private
-        Bool indicator for private instance.
-
      --kms-key=KMS_KEY
         KMS key used to encrypt instance optionally.
 
@@ -80,6 +74,17 @@ FLAGS
         specified. See $ gcloud topic datetimes for information on time
         formats.
 
+     Private instance configuration.
+
+       --is-private
+          Bool indicator for private instance.
+
+          This flag argument must be specified if any of the other arguments in
+          this group are specified.
+
+       --ca-pool=CA_POOL
+          CA Pool path for private instance.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/compute/backend-services/create b/gcloud/compute/backend-services/create
index f1b2d76ec..9cfa545ad 100644
--- a/gcloud/compute/backend-services/create
+++ b/gcloud/compute/backend-services/create
@@ -277,10 +277,11 @@ FLAGS
 
      --[no-]enable-cdn
         Enable or disable Cloud CDN for the backend service. Only available for
-        backend services with --load-balancing-scheme=EXTERNAL that use a
-        --protocol of HTTP, HTTPS, HTTP2 or H2C. Cloud CDN caches HTTP
-        responses at the edge of Google's network. Cloud CDN is disabled by
-        default. Use --enable-cdn to enable and --no-enable-cdn to disable.
+        backend services with --load-balancing-scheme=EXTERNAL or
+        EXTERNAL_MANAGED that use a --protocol of HTTP, HTTPS, HTTP2 or H2C.
+        Cloud CDN caches HTTP responses at the edge of Google's network. Cloud
+        CDN is disabled by default. Use --enable-cdn to enable and
+        --no-enable-cdn to disable.
 
      --[no-]enable-logging
         The logging options for the load balancer traffic served by this
diff --git a/gcloud/compute/backend-services/update b/gcloud/compute/backend-services/update
index ea2f11d06..e5810196e 100644
--- a/gcloud/compute/backend-services/update
+++ b/gcloud/compute/backend-services/update
@@ -196,10 +196,11 @@ FLAGS
 
      --[no-]enable-cdn
         Enable or disable Cloud CDN for the backend service. Only available for
-        backend services with --load-balancing-scheme=EXTERNAL that use a
-        --protocol of HTTP, HTTPS, HTTP2 or H2C. Cloud CDN caches HTTP
-        responses at the edge of Google's network. Cloud CDN is disabled by
-        default. Use --enable-cdn to enable and --no-enable-cdn to disable.
+        backend services with --load-balancing-scheme=EXTERNAL or
+        EXTERNAL_MANAGED that use a --protocol of HTTP, HTTPS, HTTP2 or H2C.
+        Cloud CDN caches HTTP responses at the edge of Google's network. Cloud
+        CDN is disabled by default. Use --enable-cdn to enable and
+        --no-enable-cdn to disable.
 
      --[no-]enable-logging
         The logging options for the load balancer traffic served by this
diff --git a/gcloud/compute/firewall-rules/create b/gcloud/compute/firewall-rules/create
index 5d5270c00..18083d2b6 100644
--- a/gcloud/compute/firewall-rules/create
+++ b/gcloud/compute/firewall-rules/create
@@ -10,6 +10,7 @@ SYNOPSIS
         [--direction=DIRECTION] [--disabled] [--[no-]enable-logging]
         [--logging-metadata=LOGGING_METADATA]
         [--network=NETWORK; default="default"] [--priority=PRIORITY]
+        [--resource-manager-tags=[KEY=VALUE,...]]
         [--rules=PROTOCOL[:PORT[-PORT]],[...]]
         [--source-ranges=CIDR_RANGE,[CIDR_RANGE,...]]
         [--source-service-accounts=EMAIL,[EMAIL,...]]
@@ -148,6 +149,10 @@ OPTIONAL FLAGS
         precedence. DENY rules take precedence over ALLOW rules having equal
         priority.
 
+     --resource-manager-tags=[KEY=VALUE,...]
+        A comma-separated list of Resource Manager tags to apply to the
+        firewall.
+
      --rules=PROTOCOL[:PORT[-PORT]],[...]
         A list of protocols and ports to which the firewall rule will apply.
 
diff --git a/gcloud/compute/routes/create b/gcloud/compute/routes/create
index 8204d4bef..76ec8a6d3 100644
--- a/gcloud/compute/routes/create
+++ b/gcloud/compute/routes/create
@@ -11,7 +11,8 @@ SYNOPSIS
         [--next-hop-ilb-region=NEXT_HOP_ILB_REGION]
         [--next-hop-instance-zone=NEXT_HOP_INSTANCE_ZONE]
         [--next-hop-vpn-tunnel-region=NEXT_HOP_VPN_TUNNEL_REGION]
-        [--priority=PRIORITY; default=1000] [--tags=TAG,[TAG,...]]
+        [--priority=PRIORITY; default=1000]
+        [--resource-manager-tags=[KEY=VALUE,...]] [--tags=TAG,[TAG,...]]
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
@@ -158,6 +159,9 @@ OPTIONAL FLAGS
         Specifies the priority of this route relative to other routes with the
         same specificity. The lower the value, the higher the priority.
 
+     --resource-manager-tags=[KEY=VALUE,...]
+        A comma-separated list of Resource Manager tags to apply to the route.
+
      --tags=TAG,[TAG,...]
         Identifies the set of instances that this route will apply to. If no
         tags are provided, the route will apply to all instances in the
diff --git a/gcloud/container/clusters/create b/gcloud/container/clusters/create
index e413c3b6a..cb8da1cab 100644
--- a/gcloud/container/clusters/create
+++ b/gcloud/container/clusters/create
@@ -70,6 +70,7 @@ SYNOPSIS
         [--node-taints=[NODE_TAINT,...]] [--node-version=NODE_VERSION]
         [--notification-config=[pubsub=ENABLED|DISABLED,
           pubsub-topic=TOPIC,...]] [--num-nodes=NUM_NODES; default=3]
+        [--patch-update=[PATCH_UPDATE]]
         [--performance-monitoring-unit=PERFORMANCE_MONITORING_UNIT]
         [--placement-policy=PLACEMENT_POLICY] [--placement-type=PLACEMENT_TYPE]
         [--preemptible] [--private-endpoint-subnetwork=NAME]
@@ -1065,6 +1066,17 @@ FLAGS
      --num-nodes=NUM_NODES; default=3
         The number of nodes to be created in each of the cluster's zones.
 
+     --patch-update=[PATCH_UPDATE]
+        The patch update to use for the cluster.
+
+        Setting to 'accelerated' automatically upgrades the cluster to the
+        latest patch available within the cluster's current minor version and
+        release channel. Setting to 'default' automatically upgrades the
+        cluster to the default patch upgrade targetversion available within the
+        cluster's current minor version and release channel.
+
+        PATCH_UPDATE must be one of: accelerated, default.
+
      --performance-monitoring-unit=PERFORMANCE_MONITORING_UNIT
         Sets the Performance Monitoring Unit level. Valid values are
         architectural, standard and enhanced. PERFORMANCE_MONITORING_UNIT must
diff --git a/gcloud/container/clusters/update b/gcloud/container/clusters/update
index b1e3a84bb..b9208deea 100644
--- a/gcloud/container/clusters/update
+++ b/gcloud/container/clusters/update
@@ -36,7 +36,7 @@ SYNOPSIS
           | --network-performance-configs=[PROPERTY1=VALUE1,...]
           | --node-locations=ZONE,[ZONE,...]
           | --notification-config=[pubsub=ENABLED|DISABLED,
-          pubsub-topic=TOPIC,...]
+          pubsub-topic=TOPIC,...] | --patch-update=[PATCH_UPDATE]
           | --private-ipv6-google-access-type=PRIVATE_IPV6_GOOGLE_ACCESS_TYPE
           | --release-channel=[CHANNEL] | --remove-labels=[KEY,...]
           | --remove-workload-policies=REMOVE_WORKLOAD_POLICIES
@@ -606,6 +606,17 @@ REQUIRED FLAGS
           The project of the Pub/Sub topic must be the same one as the cluster.
           It can be either the project ID or the project number.
 
+       --patch-update=[PATCH_UPDATE]
+          The patch update to use for the cluster.
+
+          Setting to 'accelerated' automatically upgrades the cluster to the
+          latest patch available within the cluster's current minor version and
+          release channel. Setting to 'default' automatically upgrades the
+          cluster to the default patch upgrade targetversion available within
+          the cluster's current minor version and release channel.
+
+          PATCH_UPDATE must be one of: accelerated, default.
+
        --private-ipv6-google-access-type=PRIVATE_IPV6_GOOGLE_ACCESS_TYPE
           Sets the type of private access to Google services over IPv6.
 
diff --git a/gcloud/dataplex/datascans/create/data-discovery b/gcloud/dataplex/datascans/create/data-discovery
index 2fbf658f9..9bbb85e25 100644
--- a/gcloud/dataplex/datascans/create/data-discovery
+++ b/gcloud/dataplex/datascans/create/data-discovery
@@ -9,7 +9,7 @@ SYNOPSIS
         [--display-name=DISPLAY_NAME] [--labels=[KEY=VALUE,...]]
         [--async | --validate-only]
         [--bigquery-publishing-connection=BIGQUERY_PUBLISHING_CONNECTION
-          --bigquery-publishing-dataset-location=BIGQUERY_PUBLISHING_DATASET_LOCATION --bigquery-publishing-table-type=BIGQUERY_PUBLISHING_TABLE_TYPE --storage-exclude-patterns=[PATTERN,
+          --bigquery-publishing-dataset-location=BIGQUERY_PUBLISHING_DATASET_LOCATION --bigquery-publishing-dataset-project=BIGQUERY_PUBLISHING_DATASET_PROJECT --bigquery-publishing-table-type=BIGQUERY_PUBLISHING_TABLE_TYPE --storage-exclude-patterns=[PATTERN,
           ...] --storage-include-patterns=[PATTERN,...]
           --csv-delimiter=CSV_DELIMITER
           --csv-disable-type-inference=CSV_DISABLE_TYPE_INFERENCE
@@ -118,6 +118,12 @@ OPTIONAL FLAGS
             https://cloud.google.com/bigquery/docs/locations#supportedLocations
             for supported locations.
 
+         --bigquery-publishing-dataset-project=BIGQUERY_PUBLISHING_DATASET_PROJECT
+            The project of the BigQuery dataset to publish BigLake external or
+            non-BigLake external tables to. If not specified, the cloud
+            resource bucket project will be used to create the dataset. The
+            format is "projects/{project_id_or_number}.
+
          --bigquery-publishing-table-type=BIGQUERY_PUBLISHING_TABLE_TYPE
             BigQuery table type to discover the cloud resource bucket. Can be
             either EXTERNAL or BIGLAKE. If not specified, the table type will
diff --git a/gcloud/dataplex/datascans/update/data-discovery b/gcloud/dataplex/datascans/update/data-discovery
index f515c37a7..37303ebe6 100644
--- a/gcloud/dataplex/datascans/update/data-discovery
+++ b/gcloud/dataplex/datascans/update/data-discovery
@@ -8,7 +8,7 @@ SYNOPSIS
         [--display-name=DISPLAY_NAME] [--labels=[KEY=VALUE,...]]
         [--async | --validate-only]
         [--bigquery-publishing-connection=BIGQUERY_PUBLISHING_CONNECTION
-          --bigquery-publishing-dataset-location=BIGQUERY_PUBLISHING_DATASET_LOCATION --bigquery-publishing-table-type=BIGQUERY_PUBLISHING_TABLE_TYPE --storage-exclude-patterns=[PATTERN,
+          --bigquery-publishing-dataset-location=BIGQUERY_PUBLISHING_DATASET_LOCATION --bigquery-publishing-dataset-project=BIGQUERY_PUBLISHING_DATASET_PROJECT --bigquery-publishing-table-type=BIGQUERY_PUBLISHING_TABLE_TYPE --storage-exclude-patterns=[PATTERN,
           ...] --storage-include-patterns=[PATTERN,...]
           --csv-delimiter=CSV_DELIMITER
           --csv-disable-type-inference=CSV_DISABLE_TYPE_INFERENCE
@@ -107,6 +107,12 @@ FLAGS
             https://cloud.google.com/bigquery/docs/locations#supportedLocations
             for supported locations.
 
+         --bigquery-publishing-dataset-project=BIGQUERY_PUBLISHING_DATASET_PROJECT
+            The project of the BigQuery dataset to publish BigLake external or
+            non-BigLake external tables to. If not specified, the cloud
+            resource bucket project will be used to create the dataset. The
+            format is "projects/{project_id_or_number}.
+
          --bigquery-publishing-table-type=BIGQUERY_PUBLISHING_TABLE_TYPE
             BigQuery table type to discover the cloud resource bucket. Can be
             either EXTERNAL or BIGLAKE. If not specified, the table type will
diff --git a/gcloud/datastream/connection-profiles/create b/gcloud/datastream/connection-profiles/create
index 588eada7f..7e2167698 100644
--- a/gcloud/datastream/connection-profiles/create
+++ b/gcloud/datastream/connection-profiles/create
@@ -141,7 +141,8 @@ REQUIRED FLAGS
         Friendly name for the connection profile.
 
      --type=TYPE
-        Type can be MYSQL, ORACLE, POSTGRESQL, GOOGLE-CLOUD-STORAGE or BIGQUERY
+        Type can be MYSQL, ORACLE, POSTGRESQL, SQLSERVER, SALESFORCE,
+        GOOGLE-CLOUD-STORAGE or BIGQUERY
 
 OPTIONAL FLAGS
      --force
diff --git a/gcloud/datastream/connection-profiles/update b/gcloud/datastream/connection-profiles/update
index b7a50c723..a61d9a9e8 100644
--- a/gcloud/datastream/connection-profiles/update
+++ b/gcloud/datastream/connection-profiles/update
@@ -129,7 +129,8 @@ POSITIONAL ARGUMENTS
 
 REQUIRED FLAGS
      --type=TYPE
-        Type can be MYSQL, ORACLE, POSTGRESQL, GOOGLE-CLOUD-STORAGE or BIGQUERY
+        Type can be MYSQL, ORACLE, POSTGRESQL, SQLSERVER, SALESFORCE,
+        GOOGLE-CLOUD-STORAGE or BIGQUERY
 
 OPTIONAL FLAGS
      --display-name=DISPLAY_NAME
diff --git a/gcloud/dns/managed-zones/create b/gcloud/dns/managed-zones/create
index 4e1848788..173547081 100644
--- a/gcloud/dns/managed-zones/create
+++ b/gcloud/dns/managed-zones/create
@@ -65,9 +65,10 @@ OPTIONAL FLAGS
             Enable DNSSEC and allow transferring a signed zone in or out.
 
      --forwarding-targets=[IP_ADDRESSES,...]
-        List of IPv4 addresses that the zone will forward queries to. Ignored
-        for public visibility. Non-RFC1918 addresses will forward to the target
-        through the Internet. RFC1918 addresses will forward through the VPC.
+        List of IPv4/IPv6 addresses or one domain name of the target name
+        server that the zone will forward queries to. Ignored for public
+        visibility. Non-RFC1918 addresses will forward to the target through
+        the Internet. RFC1918 addresses will forward through the VPC.
 
      --gkeclusters=[GKECLUSTERS,...]
         List of GKE clusters that the zone should be visible in if the zone
@@ -107,9 +108,10 @@ OPTIONAL FLAGS
         visibility is [private].
 
      --private-forwarding-targets=[IP_ADDRESSES,...]
-        List of IPv4 addresses that the zone will forward queries to. Ignored
-        for public visibility. All addresses specified for this parameter will
-        be reached through the VPC.
+        List of IPv4/IPv6 addresses or one domain name of the target name
+        server that the zone will forward queries to. Ignored for public
+        visibility. All addresses specified for this parameter will be reached
+        through the VPC.
 
      --service-directory-namespace=SERVICE_DIRECTORY_NAMESPACE
         The fully qualified URL of the service directory namespace that should
diff --git a/gcloud/dns/managed-zones/update b/gcloud/dns/managed-zones/update
index 66b3775a5..9f104be49 100644
--- a/gcloud/dns/managed-zones/update
+++ b/gcloud/dns/managed-zones/update
@@ -72,9 +72,10 @@ FLAGS
             Enable DNSSEC and allow transferring a signed zone in or out.
 
      --forwarding-targets=[IP_ADDRESSES,...]
-        List of IPv4 addresses that the zone will forward queries to. Ignored
-        for public visibility. Non-RFC1918 addresses will forward to the target
-        through the Internet. RFC1918 addresses will forward through the VPC.
+        List of IPv4/IPv6 addresses or one domain name of the target name
+        server that the zone will forward queries to. Ignored for public
+        visibility. Non-RFC1918 addresses will forward to the target through
+        the Internet. RFC1918 addresses will forward through the VPC.
 
      --gkeclusters=[GKECLUSTERS,...]
         List of GKE clusters that the zone should be visible in if the zone
@@ -106,9 +107,10 @@ FLAGS
         visibility is [private].
 
      --private-forwarding-targets=[IP_ADDRESSES,...]
-        List of IPv4 addresses that the zone will forward queries to. Ignored
-        for public visibility. All addresses specified for this parameter will
-        be reached through the VPC.
+        List of IPv4/IPv6 addresses or one domain name of the target name
+        server that the zone will forward queries to. Ignored for public
+        visibility. All addresses specified for this parameter will be reached
+        through the VPC.
 
      --update-labels=[KEY=VALUE,...]
         List of label KEY=VALUE pairs to update. If a label exists, its value
diff --git a/gcloud/gemini/data-sharing-with-google-settings/create b/gcloud/gemini/data-sharing-with-google-settings/create
index b351e39a4..7bac559a4 100644
--- a/gcloud/gemini/data-sharing-with-google-settings/create
+++ b/gcloud/gemini/data-sharing-with-google-settings/create
@@ -5,8 +5,9 @@ NAME
 SYNOPSIS
     gcloud gemini data-sharing-with-google-settings create
         (DATA_SHARING_WITH_GOOGLE_SETTING : --location=LOCATION)
-        [--enable-preview-data-sharing] [--labels=[LABELS,...]]
-        [--request-id=REQUEST_ID] [GCLOUD_WIDE_FLAG ...]
+        [--enable-data-sharing] [--enable-preview-data-sharing]
+        [--labels=[LABELS,...]] [--request-id=REQUEST_ID]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     Create a dataSharingWithGoogleSetting
@@ -51,8 +52,11 @@ POSITIONAL ARGUMENTS
           ▸ provide the argument --location on the command line.
 
 FLAGS
+     --enable-data-sharing
+        Whether data sharing should be enabled in GA products.
+
      --enable-preview-data-sharing
-        Whether preview data sharing should be enabled.
+        Whether data sharing should be enabled in Preview products.
 
      --labels=[LABELS,...]
         Labels as key value pairs.
diff --git a/gcloud/gemini/data-sharing-with-google-settings/update b/gcloud/gemini/data-sharing-with-google-settings/update
index 5db72df00..eab9dede8 100644
--- a/gcloud/gemini/data-sharing-with-google-settings/update
+++ b/gcloud/gemini/data-sharing-with-google-settings/update
@@ -5,7 +5,8 @@ NAME
 SYNOPSIS
     gcloud gemini data-sharing-with-google-settings update
         (DATA_SHARING_WITH_GOOGLE_SETTING : --location=LOCATION)
-        [--[no-]enable-preview-data-sharing] [--request-id=REQUEST_ID]
+        [--[no-]enable-data-sharing] [--[no-]enable-preview-data-sharing]
+        [--request-id=REQUEST_ID]
         [--labels=[LABELS,...]
           | --update-labels=[UPDATE_LABELS,...] --clear-labels
           | --remove-labels=REMOVE_LABELS] [GCLOUD_WIDE_FLAG ...]
@@ -53,8 +54,13 @@ POSITIONAL ARGUMENTS
           ▸ provide the argument --location on the command line.
 
 FLAGS
+     --[no-]enable-data-sharing
+        Whether data sharing should be enabled in GA products. Use
+        --enable-data-sharing to enable and --no-enable-data-sharing to
+        disable.
+
      --[no-]enable-preview-data-sharing
-        Whether preview data sharing should be enabled. Use
+        Whether data sharing should be enabled in Preview products. Use
         --enable-preview-data-sharing to enable and
         --no-enable-preview-data-sharing to disable.
 
diff --git a/gcloud/lustre/instances/create b/gcloud/lustre/instances/create
index 9eafd38fb..25e2182fd 100644
--- a/gcloud/lustre/instances/create
+++ b/gcloud/lustre/instances/create
@@ -4,22 +4,22 @@ NAME
 SYNOPSIS
     gcloud lustre instances create (INSTANCE : --location=LOCATION)
         --capacity-gib=CAPACITY_GIB --filesystem=FILESYSTEM --network=NETWORK
-        [--async] [--description=DESCRIPTION] [--gke-support-enabled]
-        [--labels=[LABELS,...]]
-        [--per-unit-storage-throughput=PER_UNIT_STORAGE_THROUGHPUT]
-        [--request-id=REQUEST_ID] [GCLOUD_WIDE_FLAG ...]
+        --per-unit-storage-throughput=PER_UNIT_STORAGE_THROUGHPUT [--async]
+        [--description=DESCRIPTION] [--gke-support-enabled]
+        [--labels=[LABELS,...]] [--request-id=REQUEST_ID]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     Creates a Managed Lustre instance.
 
 EXAMPLES
-    To create an instance my-instance in location us-central1-a with 2048 Gib
+    To create an instance my-instance in location us-central1-a with 18000 Gib
     capacity run:
 
-        $ gcloud lustre instances create my-instance --capacity-gib=2048 \
+        $ gcloud lustre instances create my-instance --capacity-gib=18000 \
             --location=us-central1-a \
             --network=projects/my-project/global/networks/default \
-            --filesystem=lustrefs
+            --filesystem=lustrefs --per-unit-storage-throughput=1000
 
 POSITIONAL ARGUMENTS
      Instance resource - Identifier. The name of the instance. The arguments in
@@ -55,7 +55,7 @@ POSITIONAL ARGUMENTS
 REQUIRED FLAGS
      --capacity-gib=CAPACITY_GIB
         The storage capacity of the instance in gibibytes (GiB). Allowed values
-        are from 18000 to 936000, in increments of 9000.
+        are from 18000 to 954000, in increments of 9000.
 
      --filesystem=FILESYSTEM
         The filesystem name for this instance. This name is used by client-side
@@ -82,6 +82,10 @@ REQUIRED FLAGS
           To set the network attribute:
           ▸ provide the argument --network on the command line.
 
+     --per-unit-storage-throughput=PER_UNIT_STORAGE_THROUGHPUT
+        The throughput of the instance in MB/s/TiB. Valid values are 125, 250,
+        500, 1000.
+
 OPTIONAL FLAGS
      --async
         Return immediately, without waiting for the operation in progress to
@@ -117,10 +121,6 @@ OPTIONAL FLAGS
 
             --labels=path_to_file.(yaml|json)
 
-     --per-unit-storage-throughput=PER_UNIT_STORAGE_THROUGHPUT
-        The throughput of the instance in MB/s/TiB. Valid values are 250, 500,
-        1000. Default value is 1000.
-
      --request-id=REQUEST_ID
         An optional request ID to identify requests. Specify a unique request
         ID so that if you must retry your request, the server will know to
diff --git a/gcloud/lustre/instances/export-data b/gcloud/lustre/instances/export-data
index 138a17fe5..2446db08f 100644
--- a/gcloud/lustre/instances/export-data
+++ b/gcloud/lustre/instances/export-data
@@ -19,10 +19,11 @@ EXAMPLES
             --lustre-path='/path/to/lustre/dir'
 
 POSITIONAL ARGUMENTS
-     Instance resource - The name of the Managed Lustre instance. The arguments
-     in this group can be used to specify the attributes of this resource.
-     (NOTE) Some attributes are not given arguments in this group but can be
-     set in other ways.
+     Instance resource - The name of the Managed Lustre instance in the format
+     projects/{project}/locations/{location}/instances/{instance}. The
+     arguments in this group can be used to specify the attributes of this
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways.
 
      To set the project attribute:
       ◆ provide the argument instance on the command line with a fully
diff --git a/gcloud/lustre/instances/import-data b/gcloud/lustre/instances/import-data
index 3c0ad7434..ffc1087bb 100644
--- a/gcloud/lustre/instances/import-data
+++ b/gcloud/lustre/instances/import-data
@@ -19,9 +19,11 @@ EXAMPLES
             --lustre-path='/path/to/lustre/dir'
 
 POSITIONAL ARGUMENTS
-     Instance resource - Name of the resource. The arguments in this group can
-     be used to specify the attributes of this resource. (NOTE) Some attributes
-     are not given arguments in this group but can be set in other ways.
+     Instance resource - The name of the Managed Lustre instance in the format
+     projects/{project}/locations/{location}/instances/{instance}. The
+     arguments in this group can be used to specify the attributes of this
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways.
 
      To set the project attribute:
       ◆ provide the argument instance on the command line with a fully
diff --git a/gcloud/lustre/instances/update b/gcloud/lustre/instances/update
index 05042d49f..5496d2fb5 100644
--- a/gcloud/lustre/instances/update
+++ b/gcloud/lustre/instances/update
@@ -60,7 +60,7 @@ FLAGS
 
      --capacity-gib=CAPACITY_GIB
         The storage capacity of the instance in gibibytes (GiB). Allowed values
-        are from 18000 to 936000, in increments of 9000.
+        are from 18000 to 954000, in increments of 9000.
 
      --description=DESCRIPTION
         A user-readable description of the instance.
@@ -71,8 +71,8 @@ FLAGS
         enable and --no-gke-support-enabled to disable.
 
      --per-unit-storage-throughput=PER_UNIT_STORAGE_THROUGHPUT
-        The throughput of the instance in MB/s/TiB. Valid values are 250, 500,
-        1000. Default value is 1000.
+        The throughput of the instance in MB/s/TiB. Valid values are 125, 250,
+        500, 1000.
 
      --request-id=REQUEST_ID
         An optional request ID to identify requests. Specify a unique request
diff --git a/gcloud/redis/instances/upgrade b/gcloud/redis/instances/upgrade
index d7fc10243..da4ad4929 100644
--- a/gcloud/redis/instances/upgrade
+++ b/gcloud/redis/instances/upgrade
@@ -51,10 +51,7 @@ POSITIONAL ARGUMENTS
 
 REQUIRED FLAGS
      --redis-version=VERSION
-        Target version of Redis software. You can only upgrade to the next
-        highest version. For example, you must upgrade an instance from
-        redis_3_2 to redis_4_0 before you can upgrade the instance to
-        redis_5_0. VERSION must be one of:
+        Target version of Redis software. VERSION must be one of:
 
          redis_4_0
             Redis 4.0 compatibility
diff --git a/gcloud/scc/postures/help b/gcloud/scc/postures/help
index d8181ca3e..e600fecc4 100644
--- a/gcloud/scc/postures/help
+++ b/gcloud/scc/postures/help
@@ -28,7 +28,7 @@ COMMANDS
         Extract a Cloud Security Command Center (SCC) posture from a workload.
 
      list
-        Lists all the Cloud Security Command Center (SCC) postures for an
+        Lists all the Cloud Security Command Center postures for an
         organization.
 
      list-revisions
diff --git a/gcloud/scc/postures/list b/gcloud/scc/postures/list
index 4ad72ff24..8d505e277 100644
--- a/gcloud/scc/postures/list
+++ b/gcloud/scc/postures/list
@@ -3,23 +3,43 @@ NAME
         postures for an organization
 
 SYNOPSIS
-    gcloud scc postures list PARENT [--filter=EXPRESSION] [--limit=LIMIT]
-        [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
+    gcloud scc postures list
+        ([PARENT] --location=LOCATION --organization=ORGANIZATION)
+        [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
+        [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    Lists all Cloud Security Command Center (SCC) postures for an organization.
-    For a posture with multiple revisions, only the latest updated revision of
-    the posture is returned in the output.
+    Lists all the Cloud Security Command Center postures for an organization.
 
 EXAMPLES
-    List all postures in organization 123, location global.
+    To list all the Cloud Security Command Center postures for an organization
+    123 and in the global location, run:
 
         $ gcloud scc postures list organizations/123/locations/global
 
+        $ gcloud scc postures list --organization=123 --location=global
+
 POSITIONAL ARGUMENTS
-     PARENT
-        Resource name of the parent, like organizations/<organizationID> or
-        organizations/<organizationID>/locations/<location>.
+     Exactly one of these must be specified:
+
+       [PARENT]
+          Parent the Cloud Security Command Center postures belongs to.
+          Formatted as organizations/<organizationID>/locations/<location>.
+
+       Specify organization and location using flags.
+
+         --location=LOCATION
+            When data residency controls are enabled, this attribute specifies
+            the location in which the resource is located and applicable.
+
+            This flag argument must be specified if any of the other arguments
+            in this group are specified.
+
+         --organization=ORGANIZATION
+            The organization ID (e.g., 123) that contains the resource.
+
+            This flag argument must be specified if any of the other arguments
+            in this group are specified.
 
 LIST COMMAND FLAGS
      --filter=EXPRESSION
diff --git a/gcloud/workflows/deploy b/gcloud/workflows/deploy
index 64327b7de..f88f25198 100644
--- a/gcloud/workflows/deploy
+++ b/gcloud/workflows/deploy
@@ -7,7 +7,10 @@ SYNOPSIS
         [--description=DESCRIPTION]
         [--execution-history-level=EXECUTION_HISTORY_LEVEL; default="none"]
         [--labels=[KEY=VALUE,...]] [--service-account=SERVICE_ACCOUNT]
-        [--source=SOURCE] [--tags=[KEY=VALUE,...]] [GCLOUD_WIDE_FLAG ...]
+        [--source=SOURCE] [--tags=[KEY=VALUE,...]]
+        [--clear-env-vars | --env-vars-file=FILE_PATH
+          | --remove-env-vars=[KEY,...] | --set-env-vars=[KEY=VALUE,...]
+          | --update-env-vars=[KEY=VALUE,...]] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     Create or update a workflow.
@@ -119,6 +122,72 @@ FLAGS
 
         Example: 123/environment=production,123/costCenter=marketing
 
+     Flags to configure user-defined environment variables for a workflow.
+
+         Keys can't be empty strings and can't start with `GOOGLE`
+         or `WORKFLOWS`. We recommend that environment variable keys consist
+         solely of uppercase letters, digits, and underscores (`_`), and that
+         they don't begin with a digit. Consider prefixing your user-defined
+         environment variables with a unique key to avoid conflicts with other
+         variables.
+
+         If your value contains commas, prefix the mapping with a different
+         delimiter character enclosed between `^` (example 1). Use special
+         characters in your shell with caution as they might not work as
+         intended or need escaping (example 2 escapes a `$` in Bash).
+
+         Example 1: --set-env-vars ^@^KEY1=ONE,VALUE,WITH,COMMAS@KEY2=VALUE2
+
+         Example 2: --set-env-vars ^$^KEY1=VALUE1\$KEY2=VALUE,WITH,COMMAS,TOO
+
+         A maximum of 20 user-defined environment variables can be defined.
+         Each definition string (`KEY=value`) is limited to 4 KiB.
+         All keys and values are converted to strings.
+
+     At most one of these can be specified:
+
+       --clear-env-vars
+          Clears all user-defined environment variables previously set for the
+          workflow.
+
+          Example: gcloud workflows deploy ${workflow_name} --clear-env-vars
+
+       --env-vars-file=FILE_PATH
+          Sets environment variables for the workflow to those stored in a
+          local YAML file at the given path. All existing environment variables
+          are removed before the new environment variables are added.
+
+          Example: gcloud workflows deploy ${workflow_name}
+          --env-vars-file=/path/to/env_vars.yaml
+
+          Inside env_vars.yaml:
+
+          policy: global
+
+          retry_count: 5 # Service converts this to string "5"
+
+       --remove-env-vars=[KEY,...]
+          Removes user-defined environment variables from a workflow based on a
+          list of environment variable keys to be removed.
+
+          Example: gcloud workflows deploy ${workflow_name} --remove-env-vars
+          policy,retry_count...
+
+       --set-env-vars=[KEY=VALUE,...]
+          Sets environment variables for the workflow based on a
+          comma-separated list of key-value pairs. Will overwrite a workflow's
+          existing environment variables.
+
+          Example: gcloud workflows deploy ${workflow_name} --set-env-vars
+          policy=global,retry_count=5
+
+       --update-env-vars=[KEY=VALUE,...]
+          Updates existing or adds new user-defined environment variables based
+          on a comma-separated list of key-value pairs.
+
+          Example: gcloud workflows deploy ${workflow_name} --update-env-vars
+          policy=regional,retry_count=2
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,