imjasonh/gcloud-help
1
0
Fork 0
mirror of https://github.com/imjasonh/gcloud-help synced 2026-07-21 22:49:22 +00:00
Code Activity

gcloud: Wed Jul 26 10:48:49 UTC 2023

Browse source
This commit is contained in:
Automated 2023-07-26 10:48:49 +00:00
parent 64e67b443c
commit 4558a00e48
204 changed files with 2787 additions and 1591 deletions
Download patch file Download diff file Expand all files Collapse all files

4
gcloud/beta/compute/backend-buckets/create
View file

@ -119,8 +119,8 @@ OPTIONAL FLAGS
AUTOMATIC.
--custom-response-header=CUSTOM_RESPONSE_HEADER
Custom headers that the external HTTP(S) load balancer adds to proxied
responses. For the list of headers, see Creating custom headers
Custom headers that the external Application Load Balancer adds to
proxied responses. For the list of headers, see Creating custom headers
(https://cloud.google.com/load-balancing/docs/custom-headers).
Variables are not case-sensitive.

2
gcloud/beta/compute/backend-buckets/update
View file

@ -182,7 +182,7 @@ FLAGS
At most one of these can be specified:
--custom-response-header=CUSTOM_RESPONSE_HEADER
Custom headers that the external HTTP(S) load balancer adds to
Custom headers that the external Application Load Balancer adds to
proxied responses. For the list of headers, see Creating custom
headers
(https://cloud.google.com/load-balancing/docs/custom-headers).

117
gcloud/beta/compute/backend-services/create
View file

@ -33,6 +33,7 @@ SYNOPSIS
[--network=NETWORK] [--port-name=PORT_NAME] [--protocol=PROTOCOL]
[--[no-]request-coalescing] [--serve-while-stale=SERVE_WHILE_STALE]
[--service-bindings=SERVICE_BINDING,[...]]
[--service-lb-policy=SERVICE_LOAD_BALANCING_POLICY]
[--session-affinity=SESSION_AFFINITY]
[--signed-url-cache-max-age=SIGNED_URL_CACHE_MAX_AGE]
[--subsetting-policy=SUBSETTING_POLICY; default="NONE"]
@ -211,8 +212,8 @@ FLAGS
--custom-request-header "another-header:"
--custom-response-header=CUSTOM_RESPONSE_HEADER
Custom headers that the external HTTP(S) load balancer adds to proxied
responses. For the list of headers, see Creating custom headers
Custom headers that the external Application Load Balancer adds to
proxied responses. For the list of headers, see Creating custom headers
(https://cloud.google.com/load-balancing/docs/custom-headers).
Variables are not case-sensitive.
@ -247,13 +248,13 @@ FLAGS
--drop-traffic-if-unhealthy
Enable dropping of traffic if there are no healthy VMs detected in both
the primary and backup instance groups. Not compatible with the
--global flag. Applicable only for backend service-based network load
balancers and internal TCP/UDP load balancers as part of a connection
--global flag. Applicable only for backend service-based external and
internal passthrough Network Load Balancers as part of a connection
tracking policy. For details, see: Connection persistence on unhealthy
backends for internal TCP/UDP load balancing
backends for internal passthrough Network Load Balancers
(https://cloud.google.com/load-balancing/docs/internal#connection-persistence)
and Connection persistence on unhealthy backends for network load
balancing
and Connection persistence on unhealthy backends for external
passthrough Network Load Balancers
(https://cloud.google.com/load-balancing/docs/network/networklb-backend-service#connection-persistence).
--[no-]enable-cdn
@ -266,9 +267,9 @@ FLAGS
--[no-]enable-logging
The logging options for the load balancer traffic served by this
backend service. If logging is enabled, logs will be exported to Cloud
Logging. Disabled by default. This field cannot be specified for SSL
Proxy and TCP Proxy Load Balancing. Use --enable-logging to enable and
--no-enable-logging to disable.
Logging. Disabled by default. This field cannot be specified for global
external proxy Network Load Balancers. Use --enable-logging to enable
and --no-enable-logging to disable.
--[no-]enable-strong-affinity
Enable or disable strong session affinity. This is only available for
@ -291,9 +292,9 @@ FLAGS
health of the backend service.
Legacy health checks are not recommended for backend services. It is
possible to use a legacy health check on a backend service for a
HTTP(S) load balancer if that backend service uses instance groups. For
more information, refer to this guide:
possible to use a legacy health check on a backend service for an
Application Load Balancer if that backend service uses instance groups.
For more information, refer to this guide:
https://cloud.google.com/load-balancing/docs/health-check-concepts#lb_guide.
--https-health-checks=HTTPS_HEALTH_CHECK,[...]
@ -301,9 +302,9 @@ FLAGS
health of the backend service.
Legacy health checks are not recommended for backend services. It is
possible to use a legacy health check on a backend service for a
HTTP(S) load balancer if that backend service uses instance groups. For
more information, refer to this guide:
possible to use a legacy health check on a backend service for an
Application Load Balancer if that backend service uses instance groups.
For more information, refer to this guide:
https://cloud.google.com/load-balancing/docs/health-check-concepts#lb_guide.
--iap=disabled|enabled,[oauth2-client-id=OAUTH2-CLIENT-ID,oauth2-client-secret=OAUTH2-CLIENT-SECRET]
@ -318,19 +319,20 @@ FLAGS
--idle-timeout-sec=IDLE_TIMEOUT_SEC
Specifies how long to keep a connection tracking table entry while
there is no matching traffic (in seconds). Applicable only for backend
service-based network load balancers and internal TCP/UDP load
balancers as part of a connection tracking policy.
service-based external and internal passthrough Network Load Balancers
as part of a connection tracking policy.
--load-balancing-scheme=LOAD_BALANCING_SCHEME; default="EXTERNAL"
Specifies the load balancer type. Choose EXTERNAL for the classic
HTTP(S) load balancers, the external TCP/UDP network load balancers,
and the external TCP/SSL proxy load balancers. Choose EXTERNAL_MANAGED
for the Envoy-based global and regional external HTTP(S) load
balancers. Choose INTERNAL for internal TCP/UDP load balancers. Choose
INTERNAL_MANAGED for Envoy-based internal load balancers such as the
internal HTTP(S) load balancers and the internal TCP proxy load
balancers. Choose INTERNAL_SELF_MANAGED for Traffic Director. For more
information, refer to this guide:
Application Load Balancers, the external passthrough Network Load
Balancers, and the global external proxy Network Load Balancers. Choose
EXTERNAL_MANAGED for the Envoy-based global and regional external
Application Load Balancers, and the regional external proxy Network
Load Balancers. Choose INTERNAL for the internal passthrough Network
Load Balancers. Choose INTERNAL_MANAGED for Envoy-based internal load
balancers such as the internal Application Load Balancers and the
internal proxy Network Load Balancers. Choose INTERNAL_SELF_MANAGED for
Traffic Director. For more information, refer to this guide:
https://cloud.google.com/load-balancing/docs/choosing-load-balancer.
LOAD_BALANCING_SCHEME must be one of: INTERNAL, EXTERNAL,
INTERNAL_SELF_MANAGED, EXTERNAL_MANAGED, INTERNAL_MANAGED.
@ -345,8 +347,8 @@ FLAGS
This field can only be specified if logging is enabled for the backend
service. Configures whether all, none, or a subset of optional fields
should be added to the reported logs. Default is EXCLUDE_ALL_OPTIONAL.
This field can only be specified for Internal TCP/UDP Load Balancing
and External Network Load Balancing. LOGGING_OPTIONAL must be one of:
This field can only be specified for internal and external passthrough
Network Load Balancers. LOGGING_OPTIONAL must be one of:
EXCLUDE_ALL_OPTIONAL, INCLUDE_ALL_OPTIONAL, CUSTOM.
--logging-optional-fields=[LOGGING_OPTIONAL_FIELDS,...]
@ -355,7 +357,7 @@ FLAGS
comma-separated list of optional fields you want to include in the
logs. For example: serverInstance, serverGkeDetails.cluster,
serverGkeDetails.pod.podNamespace. This can only be specified for
Internal TCP/UDP Load Balancing and External Network Load Balancing.
internal and external passthrough Network Load Balancers.
--logging-sample-rate=LOGGING_SAMPLE_RATE
This field can only be specified if logging is enabled for the backend
@ -448,9 +450,9 @@ FLAGS
load-balancing-scheme is INTERNAL.
--port-name=PORT_NAME
Backend services for external HTTP(S) load balancing, internal HTTP(S)
load balancing, TCP proxy load balancing, and SSL proxy load balancing
must reference exactly one named port if using instance group backends.
Backend services for Application Load Balancers and proxy Network Load
Balancers must reference exactly one named port if using instance group
backends.
Each instance group backend exports one or more named ports, which map
a user-configurable name to a port number. The backend service's named
@ -465,8 +467,8 @@ FLAGS
◆ For any load balancer, if the backends are not instance groups (for
example, GCE_VM_IP_PORT NEGs).
◆ For any type of backend on a backend service for internal TCP/UDP
load balancing or external TCP/UDP network load balancing.
◆ For any type of backend on a backend service for internal or
external passthrough Network Load Balancers.
See also
https://cloud.google.com/load-balancing/docs/backend-service#named_ports.
@ -474,26 +476,26 @@ FLAGS
--protocol=PROTOCOL
Protocol for incoming requests.
If the load-balancing-scheme is INTERNAL (Internal TCP/UDP Load
Balancing), the protocol must be one of: TCP, UDP, UNSPECIFIED.
If the load-balancing-scheme is INTERNAL (Internal passthrough Network
Load Balancer), the protocol must be one of: TCP, UDP, UNSPECIFIED.
If the load-balancing-scheme is INTERNAL_SELF_MANAGED (Traffic
Director), the protocol must be one of: HTTP, HTTPS, HTTP2, GRPC.
If the load-balancing-scheme is INTERNAL_MANAGED (Internal HTTP(S) Load
Balancing), the protocol must be one of: HTTP, HTTPS, HTTP2.
If the load-balancing-scheme is INTERNAL_MANAGED (Internal Application
Load Balancer), the protocol must be one of: HTTP, HTTPS, HTTP2.
If the load-balancing-scheme is EXTERNAL and region is not set
(HTTP(S), SSL Proxy, or TCP Proxy Load Balancing), the protocol must be
one of: HTTP, HTTPS, HTTP2, SSL, TCP.
If the load-balancing-scheme is EXTERNAL and region is not set (Classic
Application Load Balancer and global external proxy Network Load
Balancer), the protocol must be one of: HTTP, HTTPS, HTTP2, SSL, TCP.
If the load-balancing-scheme is EXTERNAL and region is set (External
Network Load Balancing), the protocol must be one of: TCP, UDP,
UNSPECIFIED.
passthrough Network Load Balancer), the protocol must be one of: TCP,
UDP, UNSPECIFIED.
If the load-balancing-scheme is EXTERNAL_MANAGED (Envoy based External
HTTP(S) Load Balancing), the protocol must be one of: HTTP, HTTPS,
HTTP2.
If the load-balancing-scheme is EXTERNAL_MANAGED (Envoy based Global
and regional external Application Load Balancers), the protocol must be
one of: HTTP, HTTPS, HTTP2.
--[no-]request-coalescing
Enables request coalescing to the backend (recommended).
@ -532,6 +534,12 @@ FLAGS
only be set if load balancing scheme is INTERNAL_SELF_MANAGED. If set,
lists of backends and health checks must be both empty.
--service-lb-policy=SERVICE_LOAD_BALANCING_POLICY
Service load balancing policy to be applied to this backend service.
Can only be set if load balancing scheme is EXTERNAL_MANAGED,
INTERNAL_MANAGED, or INTERNAL_SELF_MANAGED. Only available for global
backend services.
--session-affinity=SESSION_AFFINITY
The type of session affinity to use. Supports both TCP and UDP.
SESSION_AFFINITY must be one of:
@ -620,11 +628,11 @@ FLAGS
INTERNAL_MANAGED or INTERNAL_SELF_MANAGED.
--timeout=TIMEOUT; default="30s"
Applicable to all load balancing products except Internal TCP/UDP Load
Balancing and External TCP/UDP Network Load Balancing. For Internal
TCP/UDP Load Balancing (load-balancing-scheme set to INTERNAL) and
External TCP/UDP Network Load Balancing (global not set and
load-balancing-scheme set to EXTERNAL), timeout is ignored.
Applicable to all load balancing products except passthrough Network
Load Balancers. For internal passthrough Network Load Balancers
(load-balancing-scheme set to INTERNAL) and external passthrough
Network Load Balancers (global not set and load-balancing-scheme set to
EXTERNAL), timeout is ignored.
If the protocol is HTTP, HTTPS, or HTTP2, timeout is a request/response
timeout for HTTP(S) traffic, meaning the amount of time that the load
@ -649,11 +657,12 @@ FLAGS
--tracking-mode=TRACKING_MODE
Specifies the connection key used for connection tracking. The default
value is PER_CONNECTION. Applicable only for backend service-based
network load balancers and internal TCP/UDP load balancers as part of a
external and internal passthrough Network Load Balancers as part of a
connection tracking policy. For details, see: Connection tracking mode
for internal TCP/UDP load balancing
for internal passthrough Network Load Balancers balancing
(https://cloud.google.com/load-balancing/docs/internal#tracking-mode)
and Connection tracking mode for network load balancing
and Connection tracking mode for external passthrough Network Load
Balancers
(https://cloud.google.com/load-balancing/docs/network/networklb-backend-service#tracking-mode).
TRACKING_MODE must be one of: PER_CONNECTION, PER_SESSION.

106
gcloud/beta/compute/backend-services/update
View file

@ -48,7 +48,8 @@ SYNOPSIS
| --negative-caching-policy=[[CODE=TTL],...]]
[--serve-while-stale=SERVE_WHILE_STALE | --no-serve-while-stale]
[--service-bindings=SERVICE_BINDING,[...] | --no-service-bindings]
[GCLOUD_WIDE_FLAG ...]
[--service-lb-policy=SERVICE_LOAD_BALANCING_POLICY
| --no-service-lb-policy] [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) gcloud beta compute backend-services update is used to update
@ -155,13 +156,13 @@ FLAGS
--drop-traffic-if-unhealthy
Enable dropping of traffic if there are no healthy VMs detected in both
the primary and backup instance groups. Not compatible with the
--global flag. Applicable only for backend service-based network load
balancers and internal TCP/UDP load balancers as part of a connection
--global flag. Applicable only for backend service-based external and
internal passthrough Network Load Balancers as part of a connection
tracking policy. For details, see: Connection persistence on unhealthy
backends for internal TCP/UDP load balancing
backends for internal passthrough Network Load Balancers
(https://cloud.google.com/load-balancing/docs/internal#connection-persistence)
and Connection persistence on unhealthy backends for network load
balancing
and Connection persistence on unhealthy backends for external
passthrough Network Load Balancers
(https://cloud.google.com/load-balancing/docs/network/networklb-backend-service#connection-persistence).
--edge-security-policy=EDGE_SECURITY_POLICY
@ -179,9 +180,9 @@ FLAGS
--[no-]enable-logging
The logging options for the load balancer traffic served by this
backend service. If logging is enabled, logs will be exported to Cloud
Logging. Disabled by default. This field cannot be specified for SSL
Proxy and TCP Proxy Load Balancing. Use --enable-logging to enable and
--no-enable-logging to disable.
Logging. Disabled by default. This field cannot be specified for global
external proxy Network Load Balancers. Use --enable-logging to enable
and --no-enable-logging to disable.
--[no-]enable-strong-affinity
Enable or disable strong session affinity. This is only available for
@ -208,9 +209,9 @@ FLAGS
health of the backend service.
Legacy health checks are not recommended for backend services. It is
possible to use a legacy health check on a backend service for a
HTTP(S) load balancer if that backend service uses instance groups. For
more information, refer to this guide:
possible to use a legacy health check on a backend service for an
Application Load Balancer if that backend service uses instance groups.
For more information, refer to this guide:
https://cloud.google.com/load-balancing/docs/health-check-concepts#lb_guide.
--https-health-checks=HTTPS_HEALTH_CHECK,[...]
@ -218,9 +219,9 @@ FLAGS
health of the backend service.
Legacy health checks are not recommended for backend services. It is
possible to use a legacy health check on a backend service for a
HTTP(S) load balancer if that backend service uses instance groups. For
more information, refer to this guide:
possible to use a legacy health check on a backend service for an
Application Load Balancer if that backend service uses instance groups.
For more information, refer to this guide:
https://cloud.google.com/load-balancing/docs/health-check-concepts#lb_guide.
--iap=disabled|enabled,[oauth2-client-id=OAUTH2-CLIENT-ID,oauth2-client-secret=OAUTH2-CLIENT-SECRET]
@ -237,8 +238,8 @@ FLAGS
--idle-timeout-sec=IDLE_TIMEOUT_SEC
Specifies how long to keep a connection tracking table entry while
there is no matching traffic (in seconds). Applicable only for backend
service-based network load balancers and internal TCP/UDP load
balancers as part of a connection tracking policy.
service-based external and internal passthrough Network Load Balancers
as part of a connection tracking policy.
--locality-lb-policy=LOCALITY_LB_POLICY
The load balancing algorithm used within the scope of the locality.
@ -250,8 +251,8 @@ FLAGS
This field can only be specified if logging is enabled for the backend
service. Configures whether all, none, or a subset of optional fields
should be added to the reported logs. Default is EXCLUDE_ALL_OPTIONAL.
This field can only be specified for Internal TCP/UDP Load Balancing
and External Network Load Balancing. LOGGING_OPTIONAL must be one of:
This field can only be specified for internal and external passthrough
Network Load Balancers. LOGGING_OPTIONAL must be one of:
EXCLUDE_ALL_OPTIONAL, INCLUDE_ALL_OPTIONAL, CUSTOM.
--logging-optional-fields=[LOGGING_OPTIONAL_FIELDS,...]
@ -260,7 +261,7 @@ FLAGS
comma-separated list of optional fields you want to include in the
logs. For example: serverInstance, serverGkeDetails.cluster,
serverGkeDetails.pod.podNamespace. This can only be specified for
Internal TCP/UDP Load Balancing and External Network Load Balancing.
internal and external passthrough Network Load Balancers.
--logging-sample-rate=LOGGING_SAMPLE_RATE
This field can only be specified if logging is enabled for the backend
@ -271,9 +272,9 @@ FLAGS
enabled and 0.0 otherwise.
--port-name=PORT_NAME
Backend services for external HTTP(S) load balancing, internal HTTP(S)
load balancing, TCP proxy load balancing, and SSL proxy load balancing
must reference exactly one named port if using instance group backends.
Backend services for Application Load Balancers and proxy Network Load
Balancers must reference exactly one named port if using instance group
backends.
Each instance group backend exports one or more named ports, which map
a user-configurable name to a port number. The backend service's named
@ -288,8 +289,8 @@ FLAGS
◆ For any load balancer, if the backends are not instance groups (for
example, GCE_VM_IP_PORT NEGs).
◆ For any type of backend on a backend service for internal TCP/UDP
load balancing or external TCP/UDP network load balancing.
◆ For any type of backend on a backend service for internal or
external passthrough Network Load Balancers.
See also
https://cloud.google.com/load-balancing/docs/backend-service#named_ports.
@ -297,26 +298,26 @@ FLAGS
--protocol=PROTOCOL
Protocol for incoming requests.
If the load-balancing-scheme is INTERNAL (Internal TCP/UDP Load
Balancing), the protocol must be one of: TCP, UDP, UNSPECIFIED.
If the load-balancing-scheme is INTERNAL (Internal passthrough Network
Load Balancer), the protocol must be one of: TCP, UDP, UNSPECIFIED.
If the load-balancing-scheme is INTERNAL_SELF_MANAGED (Traffic
Director), the protocol must be one of: HTTP, HTTPS, HTTP2, GRPC.
If the load-balancing-scheme is INTERNAL_MANAGED (Internal HTTP(S) Load
Balancing), the protocol must be one of: HTTP, HTTPS, HTTP2.
If the load-balancing-scheme is INTERNAL_MANAGED (Internal Application
Load Balancer), the protocol must be one of: HTTP, HTTPS, HTTP2.
If the load-balancing-scheme is EXTERNAL and region is not set
(HTTP(S), SSL Proxy, or TCP Proxy Load Balancing), the protocol must be
one of: HTTP, HTTPS, HTTP2, SSL, TCP.
If the load-balancing-scheme is EXTERNAL and region is not set (Classic
Application Load Balancer and global external proxy Network Load
Balancer), the protocol must be one of: HTTP, HTTPS, HTTP2, SSL, TCP.
If the load-balancing-scheme is EXTERNAL and region is set (External
Network Load Balancing), the protocol must be one of: TCP, UDP,
UNSPECIFIED.
passthrough Network Load Balancer), the protocol must be one of: TCP,
UDP, UNSPECIFIED.
If the load-balancing-scheme is EXTERNAL_MANAGED (Envoy based External
HTTP(S) Load Balancing), the protocol must be one of: HTTP, HTTPS,
HTTP2.
If the load-balancing-scheme is EXTERNAL_MANAGED (Envoy based Global
and regional external Application Load Balancers), the protocol must be
one of: HTTP, HTTPS, HTTP2.
--[no-]request-coalescing
Enables request coalescing to the backend (recommended).
@ -423,11 +424,11 @@ FLAGS
INTERNAL_MANAGED or INTERNAL_SELF_MANAGED.
--timeout=TIMEOUT
Applicable to all load balancing products except Internal TCP/UDP Load
Balancing and External TCP/UDP Network Load Balancing. For Internal
TCP/UDP Load Balancing (load-balancing-scheme set to INTERNAL) and
External TCP/UDP Network Load Balancing (global not set and
load-balancing-scheme set to EXTERNAL), timeout is ignored.
Applicable to all load balancing products except passthrough Network
Load Balancers. For internal passthrough Network Load Balancers
(load-balancing-scheme set to INTERNAL) and external passthrough
Network Load Balancers (global not set and load-balancing-scheme set to
EXTERNAL), timeout is ignored.
If the protocol is HTTP, HTTPS, or HTTP2, timeout is a request/response
timeout for HTTP(S) traffic, meaning the amount of time that the load
@ -452,11 +453,12 @@ FLAGS
--tracking-mode=TRACKING_MODE
Specifies the connection key used for connection tracking. The default
value is PER_CONNECTION. Applicable only for backend service-based
network load balancers and internal TCP/UDP load balancers as part of a
external and internal passthrough Network Load Balancers as part of a
connection tracking policy. For details, see: Connection tracking mode
for internal TCP/UDP load balancing
for internal passthrough Network Load Balancers balancing
(https://cloud.google.com/load-balancing/docs/internal#tracking-mode)
and Connection tracking mode for network load balancing
and Connection tracking mode for external passthrough Network Load
Balancers
(https://cloud.google.com/load-balancing/docs/network/networklb-backend-service#tracking-mode).
TRACKING_MODE must be one of: PER_CONNECTION, PER_SESSION.
@ -555,7 +557,7 @@ FLAGS
At most one of these can be specified:
--custom-response-header=CUSTOM_RESPONSE_HEADER
Custom headers that the external HTTP(S) load balancer adds to
Custom headers that the external Application Load Balancer adds to
proxied responses. For the list of headers, see Creating custom
headers
(https://cloud.google.com/load-balancing/docs/custom-headers).
@ -762,6 +764,18 @@ FLAGS
--no-service-bindings
No service bindings should be attached to the backend service.
At most one of these can be specified:
--service-lb-policy=SERVICE_LOAD_BALANCING_POLICY
Service load balancing policy to be applied to this backend service.
Can only be set if load balancing scheme is EXTERNAL_MANAGED,
INTERNAL_MANAGED, or INTERNAL_SELF_MANAGED. Only available for global
backend services.
--no-service-lb-policy
No service load balancing policies should be attached to the backend
service.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,

9
gcloud/beta/compute/disks/create
View file

@ -3,8 +3,9 @@ NAME
SYNOPSIS
gcloud beta compute disks create DISK_NAME [DISK_NAME ...]
[--architecture=ARCHITECTURE] [--csek-key-file=FILE]
[--description=DESCRIPTION] [--erase-windows-vss-signature]
[--architecture=ARCHITECTURE] [--confidential-compute]
[--csek-key-file=FILE] [--description=DESCRIPTION]
[--erase-windows-vss-signature]
[--guest-os-features=[GUEST_OS_FEATURE,...]] [--interface=INTERFACE]
[--labels=[KEY=VALUE,...]] [--licenses=[LICENSE,...]] [--multi-writer]
[--physical-block-size=PHYSICAL_BLOCK_SIZE; default="4096"]
@ -65,6 +66,10 @@ FLAGS
https://cloud.google.com/compute/docs/cpu-platforms. ARCHITECTURE must
be one of: ARM64, X86_64.
--confidential-compute
Create the disk in confidential compute mode, CMEK layer is required
and only applicable to HyperDisk series.
--csek-key-file=FILE
Path to a Customer-Supplied Encryption Key (CSEK) key file that maps
Compute Engine resources to user managed keys to be used when creating,

23
gcloud/beta/compute/firewall-policies/rules/create
View file

@ -11,13 +11,14 @@ SYNOPSIS
[--dest-threat-intelligence=[DEST_THREAT_INTELLIGENCE_LISTS,...]]
[--direction=DIRECTION] [--[no-]disabled] [--[no-]enable-logging]
[--layer4-configs=[LAYER4_CONFIG,...]] [--organization=ORGANIZATION]
[--security-profile-group=SECURITY_PROFILE_GROUP]
[--src-address-groups=[SOURCE_ADDRESS_GROUPS,...]]
[--src-fqdns=[SOURCE_FQDNS,...]] [--src-ip-ranges=[SRC_IP_RANGE,...]]
[--src-region-codes=[SOURCE_REGION_CODES,...]]
[--src-threat-intelligence=[SOURCE_THREAT_INTELLIGENCE_LISTS,...]]
[--target-resources=[TARGET_RESOURCES,...]]
[--target-service-accounts=[TARGET_SERVICE_ACCOUNTS,...]]
[GCLOUD_WIDE_FLAG ...]
[--[no-]tls-inspect] [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) gcloud beta compute firewall-policies rules create is used to create
@ -38,7 +39,7 @@ POSITIONAL ARGUMENTS
REQUIRED FLAGS
--action=ACTION
Action to take if the request matches the match condition. ACTION must
be one of: allow, deny, goto_next.
be one of: allow, deny, goto_next, apply_security_profile_group.
--firewall-policy=FIREWALL_POLICY
Short name of the firewall policy into which the rule should be
@ -90,6 +91,18 @@ OPTIONAL FLAGS
Organization which the organization firewall policy belongs to. Must be
set if FIREWALL_POLICY is short name.
--security-profile-group=SECURITY_PROFILE_GROUP
An org-based security profile group to be used with
apply_security_profile_group action. Allowed formats are: a)
http(s)://<namespace>/<api>/organizations/<org_id>/locations/global/securityProfileGroups/<profile>
b)
(//)<namespace>/organizations/<org_id>/locations/global/securityProfileGroups/<profile>
c) <profile>. In case "c" gCloud CLI will create a reference matching
format "a", but to make it work
CLOUDSDK_API_ENDPOINT_OVERRIDES_NETWORKSECURITY property must be set.
In order to set this property, please run the command gcloud config set
api_endpoint_overrides/networksecurity https://<namespace>/.
--src-address-groups=[SOURCE_ADDRESS_GROUPS,...]
Source address groups to match for this rule. Can only be specified if
DIRECTION is ingress.
@ -117,6 +130,12 @@ OPTIONAL FLAGS
--target-service-accounts=[TARGET_SERVICE_ACCOUNTS,...]
List of target service accounts for the rule.
--[no-]tls-inspect
Use this flag to indicate whether TLS traffic should be inspected using
the TLS inspection policy when the security profile group is applied.
Default: no TLS inspection. Use --tls-inspect to enable and
--no-tls-inspect to disable.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,

23
gcloud/beta/compute/firewall-policies/rules/update
View file

@ -13,13 +13,14 @@ SYNOPSIS
[--direction=DIRECTION] [--[no-]disabled] [--[no-]enable-logging]
[--layer4-configs=[LAYER4_CONFIG,...]] [--new-priority=NEW_PRIORITY]
[--organization=ORGANIZATION]
[--security-profile-group=SECURITY_PROFILE_GROUP]
[--src-address-groups=[SOURCE_ADDRESS_GROUPS,...]]
[--src-fqdns=[SOURCE_FQDNS,...]] [--src-ip-ranges=[SRC_IP_RANGE,...]]
[--src-region-codes=[SOURCE_REGION_CODES,...]]
[--src-threat-intelligence=[SOURCE_THREAT_INTELLIGENCE_LISTS,...]]
[--target-resources=[TARGET_RESOURCES,...]]
[--target-service-accounts=[TARGET_SERVICE_ACCOUNTS,...]]
[GCLOUD_WIDE_FLAG ...]
[--[no-]tls-inspect] [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) gcloud beta compute firewall-policies rules update is used to update
@ -46,7 +47,7 @@ REQUIRED FLAGS
OPTIONAL FLAGS
--action=ACTION
Action to take if the request matches the match condition. ACTION must
be one of: allow, deny, goto_next.
be one of: allow, deny, goto_next, apply_security_profile_group.
--description=DESCRIPTION
An optional, textual description for the rule.
@ -96,6 +97,18 @@ OPTIONAL FLAGS
Organization which the organization firewall policy belongs to. Must be
set if FIREWALL_POLICY is short name.
--security-profile-group=SECURITY_PROFILE_GROUP
An org-based security profile group to be used with
apply_security_profile_group action. Allowed formats are: a)
http(s)://<namespace>/<api>/organizations/<org_id>/locations/global/securityProfileGroups/<profile>
b)
(//)<namespace>/organizations/<org_id>/locations/global/securityProfileGroups/<profile>
c) <profile>. In case "c" gCloud CLI will create a reference matching
format "a", but to make it work
CLOUDSDK_API_ENDPOINT_OVERRIDES_NETWORKSECURITY property must be set.
In order to set this property, please run the command gcloud config set
api_endpoint_overrides/networksecurity https://<namespace>/.
--src-address-groups=[SOURCE_ADDRESS_GROUPS,...]
Source address groups to match for this rule. Can only be specified if
DIRECTION is ingress.
@ -123,6 +136,12 @@ OPTIONAL FLAGS
--target-service-accounts=[TARGET_SERVICE_ACCOUNTS,...]
List of target service accounts for the rule.
--[no-]tls-inspect
Use this flag to indicate whether TLS traffic should be inspected using
the TLS inspection policy when the security profile group is applied.
Default: no TLS inspection. Use --tls-inspect to enable and
--no-tls-inspect to disable.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,

27
gcloud/beta/compute/forwarding-rules/create
View file

@ -241,22 +241,25 @@ OPTIONAL FLAGS
forwarding rules. LOAD_BALANCING_SCHEME must be one of:
EXTERNAL
External load balancing or forwarding, used with one of
--target-http-proxy, --target-https-proxy, --target-tcp-proxy,
--target-ssl-proxy, --target-pool, --target-vpn-gateway,
--target-instance.
Classic Application Load Balancers, global external proxy Network
Load Balancers, external passthrough Network Load Balancers or
protocol forwarding, used with one of --target-http-proxy,
--target-https-proxy, --target-tcp-proxy, --target-ssl-proxy,
--target-pool, --target-vpn-gateway, --target-instance.
EXTERNAL_MANAGED
Envoy based External HTTP(S) Load Balancing, used with
--target-http-proxy, --target-https-proxy.
Global and regional external Application Load Balancers, and
regional external proxy Network Load Balancers, used with
--target-http-proxy, --target-https-proxy, --target-tcp-proxy.
INTERNAL
Internal load balancing or forwarding, used with --backend-service.
Internal passthrough Network Load Balancers or protocol forwarding,
used with --backend-service.
INTERNAL_MANAGED
Internal load balancing, used with --target-http-proxy,
--target-https-proxy, --target-tcp-proxy.
INTERNAL_SELF_MANAGED
Traffic Director load balancing or forwarding, used with
--target-http-proxy, --target-https-proxy, --target-grpc-proxy,
Internal Application Load Balancers and internal proxy Network Load
Balancers, used with --target-http-proxy, --target-https-proxy,
--target-tcp-proxy.
INTERNAL_SELF_MANAGED
Traffic Director, used with --target-http-proxy,
--target-https-proxy, --target-grpc-proxy, --target-tcp-proxy.
--network=NETWORK
(Only for --load-balancing-scheme=INTERNAL or

27
gcloud/beta/compute/forwarding-rules/set-target
View file

@ -138,22 +138,25 @@ OPTIONAL FLAGS
of:
EXTERNAL
External load balancing or forwarding, used with one of
--target-http-proxy, --target-https-proxy, --target-tcp-proxy,
--target-ssl-proxy, --target-pool, --target-vpn-gateway,
--target-instance.
Classic Application Load Balancers, global external proxy Network
Load Balancers, external passthrough Network Load Balancers or
protocol forwarding, used with one of --target-http-proxy,
--target-https-proxy, --target-tcp-proxy, --target-ssl-proxy,
--target-pool, --target-vpn-gateway, --target-instance.
EXTERNAL_MANAGED
Envoy based External HTTP(S) Load Balancing, used with
--target-http-proxy, --target-https-proxy.
Global and regional external Application Load Balancers, and
regional external proxy Network Load Balancers, used with
--target-http-proxy, --target-https-proxy, --target-tcp-proxy.
INTERNAL
Internal load balancing or forwarding, used with --backend-service.
Internal passthrough Network Load Balancers or protocol forwarding,
used with --backend-service.
INTERNAL_MANAGED
Internal load balancing, used with --target-http-proxy,
--target-https-proxy, --target-tcp-proxy.
INTERNAL_SELF_MANAGED
Traffic Director load balancing or forwarding, used with
--target-http-proxy, --target-https-proxy, --target-grpc-proxy,
Internal Application Load Balancers and internal proxy Network Load
Balancers, used with --target-http-proxy, --target-https-proxy,
--target-tcp-proxy.
INTERNAL_SELF_MANAGED
Traffic Director, used with --target-http-proxy,
--target-https-proxy, --target-grpc-proxy, --target-tcp-proxy.
--network=NETWORK
(DEPRECATED) Only for --load-balancing-scheme=INTERNAL or

10
gcloud/beta/compute/http-health-checks/create
View file

@ -14,11 +14,11 @@ SYNOPSIS
DESCRIPTION
(BETA) Legacy HTTP health checks are required if you want to implement
health checking of a target pool for a Network TCP/UDP Load Balancer.
Though you can use legacy HTTP health checks in certain other Google Cloud
Platform load balancing configurations and for managed instance group
autohealing, you should consider a non-legacy HTTP health check created
with health-checks create http instead.
health checking for a target pool backend of an external passthrough
Network Load Balancer. Though you can use legacy HTTP health checks in
certain other Google Cloud Platform load balancing configurations and for
managed instance group autohealing, you should consider a non-legacy HTTP
health check created with health-checks create http instead.
For more information about the differences between legacy and non-legacy
health checks see:

4
gcloud/beta/compute/instance-groups/get-named-ports
View file

@ -12,8 +12,8 @@ DESCRIPTION
(BETA) Named ports are key:value pairs metadata representing the service
name and the port that it's running on. Named ports can be assigned to an
instance group, which indicates that the service is available on all
instances in the group. This information is used by the HTTP Load Balancing
service.
instances in the group. This information is used by Application Load
Balancers and proxy Network Load Balancers.
gcloud beta compute instance-groups get-named-ports lists the named ports
(name and port tuples) for an instance group.

4
gcloud/beta/compute/instance-groups/managed/get-named-ports
View file

@ -12,8 +12,8 @@ DESCRIPTION
(BETA) Named ports are key:value pairs metadata representing the service
name and the port that it's running on. Named ports can be assigned to an
instance group, which indicates that the service is available on all
instances in the group. This information is used by the HTTP Load Balancing
service.
instances in the group. This information is used by Application Load
Balancers and proxy Network Load Balancers.
gcloud beta compute instance-groups managed get-named-ports lists the named
ports (name and port tuples) for an instance group.

4
gcloud/beta/compute/instance-groups/managed/set-named-ports
View file

@ -11,8 +11,8 @@ DESCRIPTION
(BETA) Named ports are key:value pairs metadata representing the service
name and the port that it's running on. Named ports can be assigned to an
instance group, which indicates that the service is available on all
instances in the group. This information is used by the HTTP Load Balancing
service.
instances in the group. This information is used by Application Load
Balancers and proxy Network Load Balancers.
gcloud beta compute instance-groups managed set-named-ports sets the list
of named ports for all instances in an instance group.

4
gcloud/beta/compute/instance-groups/set-named-ports
View file

@ -11,8 +11,8 @@ DESCRIPTION
(BETA) Named ports are key:value pairs metadata representing the service
name and the port that it's running on. Named ports can be assigned to an
instance group, which indicates that the service is available on all
instances in the group. This information is used by the HTTP Load Balancing
service.
instances in the group. This information is used by Application Load
Balancers and proxy Network Load Balancers.
gcloud beta compute instance-groups set-named-ports sets the list of named
ports for all instances in an instance group.

4
gcloud/beta/compute/instance-groups/unmanaged/get-named-ports
View file

@ -12,8 +12,8 @@ DESCRIPTION
(BETA) Named ports are key:value pairs metadata representing the service
name and the port that it's running on. Named ports can be assigned to an
instance group, which indicates that the service is available on all
instances in the group. This information is used by the HTTP Load Balancing
service.
instances in the group. This information is used by Application Load
Balancers and proxy Network Load Balancers.
gcloud beta compute instance-groups unmanaged get-named-ports lists the
named ports (name and port tuples) for an instance group.

4
gcloud/beta/compute/instance-groups/unmanaged/set-named-ports
View file

@ -10,8 +10,8 @@ DESCRIPTION
(BETA) Named ports are key:value pairs metadata representing the service
name and the port that it's running on. Named ports can be assigned to an
instance group, which indicates that the service is available on all
instances in the group. This information is used by the HTTP Load Balancing
service.
instances in the group. This information is used by Application Load
Balancers and proxy Network Load Balancers.
gcloud beta compute instance-groups unmanaged set-named-ports sets the list
of named ports for all instances in an instance group.

4
gcloud/beta/compute/instances/create
View file

@ -350,6 +350,10 @@ FLAGS
among other restrictions. For more information, see
https://cloud.google.com/compute/docs/disks/sharing-disks-between-vms.
confidential-compute
If yes, the disk is created in confidential mode. The default value
is no.
replica-zones
Required for each regional disk associated with the instance.
Specify the URLs of the zones where the disk should be replicated

14
gcloud/beta/compute/network-firewall-policies/rules/create
View file

@ -12,6 +12,7 @@ SYNOPSIS
[--dest-threat-intelligence=[DEST_THREAT_INTELLIGENCE_LISTS,...]]
[--direction=DIRECTION] [--[no-]disabled] [--[no-]enable-logging]
[--layer4-configs=[LAYER4_CONFIG,...]]
[--security-profile-group=SECURITY_PROFILE_GROUP]
[--src-address-groups=[SOURCE_ADDRESS_GROUPS,...]]
[--src-fqdns=[SOURCE_FQDNS,...]] [--src-ip-ranges=[SRC_IP_RANGE,...]]
[--src-region-codes=[SOURCE_REGION_CODES,...]]
@ -19,6 +20,7 @@ SYNOPSIS
[--src-threat-intelligence=[SOURCE_THREAT_INTELLIGENCE_LISTS,...]]
[--target-secure-tags=[TARGET_SECURE_TAGS,...]]
[--target-service-accounts=[TARGET_SERVICE_ACCOUNTS,...]]
[--[no-]tls-inspect]
[--firewall-policy-region=FIREWALL_POLICY_REGION
| --global-firewall-policy] [GCLOUD_WIDE_FLAG ...]
@ -49,7 +51,7 @@ POSITIONAL ARGUMENTS
REQUIRED FLAGS
--action=ACTION
Action to take if the request matches the match condition. ACTION must
be one of: allow, deny, goto_next.
be one of: allow, deny, goto_next, apply_security_profile_group.
--firewall-policy=FIREWALL_POLICY
Firewall policy ID with which to create rule.
@ -96,6 +98,10 @@ OPTIONAL FLAGS
A list of destination protocols and ports to which the firewall rule
will apply.
--security-profile-group=SECURITY_PROFILE_GROUP
A security profile group to be used with apply_security_profile_group
action.
--src-address-groups=[SOURCE_ADDRESS_GROUPS,...]
Source address groups to match for this rule. Can only be specified if
DIRECTION is ingress.
@ -143,6 +149,12 @@ OPTIONAL FLAGS
--target-service-accounts=[TARGET_SERVICE_ACCOUNTS,...]
List of target service accounts for the rule.
--[no-]tls-inspect
Use this flag to indicate whether TLS traffic should be inspected using
the TLS inspection policy when the security profile group is applied.
Default: no TLS inspection. Use --tls-inspect to enable and
--no-tls-inspect to disable.
At most one of these can be specified:
--firewall-policy-region=FIREWALL_POLICY_REGION

14
gcloud/beta/compute/network-firewall-policies/rules/update
View file

@ -12,6 +12,7 @@ SYNOPSIS
[--dest-threat-intelligence=[DEST_THREAT_INTELLIGENCE_LISTS,...]]
[--direction=DIRECTION] [--[no-]disabled] [--[no-]enable-logging]
[--layer4-configs=[LAYER4_CONFIG,...]] [--new-priority=NEW_PRIORITY]
[--security-profile-group=SECURITY_PROFILE_GROUP]
[--src-address-groups=[SOURCE_ADDRESS_GROUPS,...]]
[--src-fqdns=[SOURCE_FQDNS,...]] [--src-ip-ranges=[SRC_IP_RANGE,...]]
[--src-region-codes=[SOURCE_REGION_CODES,...]]
@ -19,6 +20,7 @@ SYNOPSIS
[--src-threat-intelligence=[SOURCE_THREAT_INTELLIGENCE_LISTS,...]]
[--target-secure-tags=[TARGET_SECURE_TAGS,...]]
[--target-service-accounts=[TARGET_SERVICE_ACCOUNTS,...]]
[--[no-]tls-inspect]
[--firewall-policy-region=FIREWALL_POLICY_REGION
| --global-firewall-policy] [GCLOUD_WIDE_FLAG ...]
@ -46,7 +48,7 @@ REQUIRED FLAGS
OPTIONAL FLAGS
--action=ACTION
Action to take if the request matches the match condition. ACTION must
be one of: allow, deny, goto_next.
be one of: allow, deny, goto_next, apply_security_profile_group.
--description=DESCRIPTION
An optional, textual description for the rule.
@ -92,6 +94,10 @@ OPTIONAL FLAGS
--new-priority=NEW_PRIORITY
New priority for the rule to update. Valid in [0, 65535].
--security-profile-group=SECURITY_PROFILE_GROUP
A security profile group to be used with apply_security_profile_group
action.
--src-address-groups=[SOURCE_ADDRESS_GROUPS,...]
Source address groups to match for this rule. Can only be specified if
DIRECTION is ingress.
@ -139,6 +145,12 @@ OPTIONAL FLAGS
--target-service-accounts=[TARGET_SERVICE_ACCOUNTS,...]
List of target service accounts for the rule.
--[no-]tls-inspect
Use this flag to indicate whether TLS traffic should be inspected using
the TLS inspection policy when the security profile group is applied.
Default: no TLS inspection. Use --tls-inspect to enable and
--no-tls-inspect to disable.
At most one of these can be specified:
--firewall-policy-region=FIREWALL_POLICY_REGION

2
gcloud/beta/compute/networks/subnets/create
View file

@ -105,6 +105,8 @@ OPTIONAL FLAGS
Reserved for Internal HTTP(S) Load Balancing.
PRIVATE
Regular user created or automatically created subnet.
PRIVATE_NAT
Reserved for use as source range for Private NAT.
PRIVATE_SERVICE_CONNECT
Reserved for Private Service Connect Internal Load Balancing.
REGIONAL_MANAGED_PROXY

6
gcloud/beta/compute/resource-policies/update/help
View file

@ -20,8 +20,10 @@ COMMANDS
(BETA) Update a Compute Engine Snapshot Schedule Resource Policy.
NOTES
This command is currently in beta and might change without notice. This
variant is also available:
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud compute resource-policies update
$ gcloud alpha compute resource-policies update

25
gcloud/beta/compute/resource-policies/update/snapshot-schedule
View file

@ -4,7 +4,8 @@ NAME
SYNOPSIS
gcloud beta compute resource-policies update snapshot-schedule NAME
[--description=DESCRIPTION] [--region=REGION]
[--description=DESCRIPTION] [--max-retention-days=MAX_RETENTION_DAYS]
[--on-source-disk-delete=ON_SOURCE_DISK_DELETE] [--region=REGION]
[--snapshot-labels=[KEY=VALUE,...]]
[--weekly-schedule-from-file=WEEKLY_CYCLE_FROM_FILE
| --start-time=START_TIME (--daily-schedule | --hourly-schedule=HOURS
@ -15,7 +16,7 @@ DESCRIPTION
EXAMPLES
The following command updates a Compute Engine Snapshot Schedule Resource
Policy to take a daily snapshot taken at 13:00 UTC
Policy to take a daily snapshot at 13:00 UTC
$ gcloud beta compute resource-policies update snapshot-schedule \
my-resource-policy --region=REGION --start-time=13:00 \
@ -29,6 +30,20 @@ FLAGS
--description=DESCRIPTION
An optional, textual description for the backend.
--max-retention-days=MAX_RETENTION_DAYS
Maximum number of days snapshot can be retained.
--on-source-disk-delete=ON_SOURCE_DISK_DELETE
Retention behavior of automatic snapshots in the event of source disk
deletion. ON_SOURCE_DISK_DELETE must be one of:
apply-retention-policy
Continue to apply the retention window to automatically-created
snapshots when the source disk is deleted.
keep-auto-snapshots
Keep automatically-created snapshots when the source disk is
deleted. This is the default behavior.
--region=REGION
Region of the resource policy to operate on. If not specified, you
might be prompted to select a region (interactive mode only).
@ -107,8 +122,10 @@ GCLOUD WIDE FLAGS
Run $ gcloud help for details.
NOTES
This command is currently in beta and might change without notice. This
variant is also available:
This command is currently in beta and might change without notice. These
variants are also available:
$ gcloud compute resource-policies update snapshot-schedule
$ gcloud alpha compute resource-policies update snapshot-schedule

40
gcloud/beta/compute/routers/nats/create
View file

@ -4,10 +4,8 @@ NAME
SYNOPSIS
gcloud beta compute routers nats create NAME --router=ROUTER
(--auto-allocate-nat-external-ips
| --nat-external-ip-pool=IP_ADDRESS,[IP_ADDRESS,...])
(--nat-all-subnet-ip-ranges
| --nat-custom-subnet-ip-ranges=SUBNETWORK[:RANGE_NAME],[...]
| --nat-custom-subnet-ip-ranges=SUBNETWORK[:RANGE_NAME|:ALL],[...]
| --nat-primary-subnet-ip-ranges) [--async]
[--auto-network-tier=AUTO_NETWORK_TIER]
[--[no-]enable-dynamic-port-allocation]
@ -19,7 +17,10 @@ SYNOPSIS
[--tcp-established-idle-timeout=TCP_ESTABLISHED_IDLE_TIMEOUT]
[--tcp-time-wait-timeout=TCP_TIME_WAIT_TIMEOUT]
[--tcp-transitory-idle-timeout=TCP_TRANSITORY_IDLE_TIMEOUT]
[--udp-idle-timeout=UDP_IDLE_TIMEOUT] [GCLOUD_WIDE_FLAG ...]
[--type=TYPE] [--udp-idle-timeout=UDP_IDLE_TIMEOUT]
[--auto-allocate-nat-external-ips
| --nat-external-ip-pool=IP_ADDRESS,[IP_ADDRESS,...]]
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) gcloud beta compute routers nats create is used to create a NAT on a
@ -56,24 +57,18 @@ REQUIRED FLAGS
--router=ROUTER
The Router to use for NAT.
Exactly one of these must be specified:
--auto-allocate-nat-external-ips
Automatically allocate external IP addresses for Cloud NAT
--nat-external-ip-pool=IP_ADDRESS,[IP_ADDRESS,...]
External IP Addresses to use for Cloud NAT
Exactly one of these must be specified:
--nat-all-subnet-ip-ranges
Allow all IP ranges of all subnetworks in the region, including
primary and secondary ranges, to use NAT.
--nat-custom-subnet-ip-ranges=SUBNETWORK[:RANGE_NAME],[...]
--nat-custom-subnet-ip-ranges=SUBNETWORK[:RANGE_NAME|:ALL],[...]
List of subnetwork primary and secondary IP ranges to be allowed to
use NAT.
▸ SUBNETWORK:ALL - specifying a subnetwork name with ALL includes
the primary range and all secondary ranges of the subnet.
▸ SUBNETWORK - including a subnetwork name includes only the
primary subnet range of the subnetwork.
▸ SUBNETWORK:RANGE_NAME - specifying a subnetwork and secondary
@ -219,11 +214,30 @@ OPTIONAL FLAGS
https://cloud.google.com/sdk/gcloud/reference/topic/datetimes for
information on duration formats.
--type=TYPE
Type of the NAT Gateway. Defaults to PUBLIC if not specified. TYPE must
be one of:
PRIVATE
Used for private-to-private NAT translations. Allows communication
between VPC Networks.
PUBLIC
Used for private-to-public NAT translations. Allows VMs to
communicate with the Internet.
--udp-idle-timeout=UDP_IDLE_TIMEOUT
Timeout for UDP connections. See
https://cloud.google.com/sdk/gcloud/reference/topic/datetimes for
information on duration formats.
At most one of these can be specified:
--auto-allocate-nat-external-ips
Automatically allocate external IP addresses for Cloud NAT
--nat-external-ip-pool=IP_ADDRESS,[IP_ADDRESS,...]
External IP Addresses to use for Cloud NAT
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,

40
gcloud/beta/compute/routers/nats/rules/create
View file

@ -4,9 +4,10 @@ NAME
SYNOPSIS
gcloud beta compute routers nats rules create RULE_NUMBER --match=MATCH
--nat=NAT --router=ROUTER
--source-nat-active-ips=IP_ADDRESS,[IP_ADDRESS,...] [--async]
[--region=REGION] [GCLOUD_WIDE_FLAG ...]
--nat=NAT --router=ROUTER [--async] [--region=REGION]
[--source-nat-active-ips=IP_ADDRESS,[IP_ADDRESS,...]]
[--source-nat-active-ranges=SUBNETWORK,[SUBNETWORK,...]]
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
(BETA) gcloud beta compute routers nats rules create is used to create a
@ -28,27 +29,29 @@ POSITIONAL ARGUMENTS
REQUIRED FLAGS
--match=MATCH
CEL Expression used to identify traffic to which this rule applies.
◆ Supported attributes: destination.ip
◆ Supported operators: ||, ==
◆ Supported methods: inIpRange
Examples of allowed Match expressions:
◆ Supported attributes (Public NAT): destination.ip
◆ Supported attributes (Private NAT): nexthop.hub
◆ Supported methods (Public Nat): inIpRange
◆ Supported operators (Public NAT): ||, ==
◆ Supported operators (Private NAT): ==
Examples of allowed Match expressions (Public NAT):
◆ 'inIpRange(destination.ip, "203.0.113.0/24")''
◆ 'destination.ip == "203.0.113.7"'
◆ 'destination.ip == "203.0.113.7" || inIpRange(destination.ip,
"203.0.113.16/25")'
Example of allowed Match expression (Private NAT):
◆ nexthop.hub ==
"//networkconnectivity.googleapis.com/projects/p1/locations/global/hubs/h1"
--nat=NAT
Name of the NAT that contains the Rule
--router=ROUTER
The Router to use for NAT.
--source-nat-active-ips=IP_ADDRESS,[IP_ADDRESS,...]
External IP Addresses to use for connections matching this rule.
These must be valid reserved external IPs in the same region.
OPTIONAL FLAGS
--async
Return immediately, without waiting for the operation in progress to
@ -74,6 +77,19 @@ OPTIONAL FLAGS
Alternatively, the region can be stored in the environment variable
CLOUDSDK_COMPUTE_REGION.
--source-nat-active-ips=IP_ADDRESS,[IP_ADDRESS,...]
External IP Addresses to use for connections matching this rule.
These must be valid reserved external IPs in the same region.
--source-nat-active-ranges=SUBNETWORK,[SUBNETWORK,...]
Subnetworks from which addresses are used for connections matching this
rule. This is only supported for Private NAT, and is required when
creating a Private NAT gateway.
These must be Subnetwork resources in the same region, with purpose set
to PRIVATE_NAT.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,

37
gcloud/beta/compute/routers/nats/rules/update
View file

@ -6,8 +6,11 @@ SYNOPSIS
gcloud beta compute routers nats rules update RULE_NUMBER --nat=NAT
--router=ROUTER [--async] [--match=MATCH] [--region=REGION]
[--source-nat-active-ips=IP_ADDRESS,[IP_ADDRESS,...]]
[--source-nat-active-ranges=SUBNETWORK,[SUBNETWORK,...]]
[--clear-source-nat-drain-ips
| --source-nat-drain-ips=IP_ADDRESS,[IP_ADDRESS,...]]
[--clear-source-nat-drain-ranges
| --source-nat-drain-ranges=SUBNETWORK,[SUBNETWORK,...]]
[GCLOUD_WIDE_FLAG ...]
DESCRIPTION
@ -41,16 +44,23 @@ OPTIONAL FLAGS
--match=MATCH
CEL Expression used to identify traffic to which this rule applies.
◆ Supported attributes: destination.ip
◆ Supported operators: ||, ==
◆ Supported methods: inIpRange
Examples of allowed Match expressions:
◆ Supported attributes (Public NAT): destination.ip
◆ Supported attributes (Private NAT): nexthop.hub
◆ Supported methods (Public Nat): inIpRange
◆ Supported operators (Public NAT): ||, ==
◆ Supported operators (Private NAT): ==
Examples of allowed Match expressions (Public NAT):
◆ 'inIpRange(destination.ip, "203.0.113.0/24")''
◆ 'destination.ip == "203.0.113.7"'
◆ 'destination.ip == "203.0.113.7" || inIpRange(destination.ip,
"203.0.113.16/25")'
Example of allowed Match expression (Private NAT):
◆ nexthop.hub ==
"//networkconnectivity.googleapis.com/projects/p1/locations/global/hubs/h1"
--region=REGION
Region of the NAT containing the Rule to update. If not specified, you
might be prompted to select a region (interactive mode only).
@ -76,6 +86,14 @@ OPTIONAL FLAGS
These must be valid reserved external IPs in the same region.
--source-nat-active-ranges=SUBNETWORK,[SUBNETWORK,...]
Subnetworks from which addresses are used for connections matching this
rule. This is only supported for Private NAT, and is required when
creating a Private NAT gateway.
These must be Subnetwork resources in the same region, with purpose set
to PRIVATE_NAT.
At most one of these can be specified:
--clear-source-nat-drain-ips
@ -87,6 +105,17 @@ OPTIONAL FLAGS
These must be external IPs previously used as active IPs on this
rule. No new connections will be established using these IPs.
At most one of these can be specified:
--clear-source-nat-drain-ranges
Clear drained ranges from the Rule
--source-nat-drain-ranges=SUBNETWORK,[SUBNETWORK,...]
Subnetwork ranges to drain connections on.
These must be subnetworks previously used as active ranges on this
rule. No new connections will be established using these ranges.
GCLOUD WIDE FLAGS
These flags are available to all commands: --access-token-file, --account,
--billing-project, --configuration, --flags-file, --flatten, --format,

6
gcloud/beta/compute/routers/nats/update
View file

@ -23,7 +23,7 @@ SYNOPSIS
| --tcp-transitory-idle-timeout=TCP_TRANSITORY_IDLE_TIMEOUT]
[--clear-udp-idle-timeout | --udp-idle-timeout=UDP_IDLE_TIMEOUT]
[--nat-all-subnet-ip-ranges
| --nat-custom-subnet-ip-ranges=SUBNETWORK[:RANGE_NAME],[...]
| --nat-custom-subnet-ip-ranges=SUBNETWORK[:RANGE_NAME|:ALL],[...]
| --nat-primary-subnet-ip-ranges] [GCLOUD_WIDE_FLAG ...]
DESCRIPTION
@ -252,10 +252,12 @@ OPTIONAL FLAGS
Allow all IP ranges of all subnetworks in the region, including
primary and secondary ranges, to use NAT.
--nat-custom-subnet-ip-ranges=SUBNETWORK[:RANGE_NAME],[...]
--nat-custom-subnet-ip-ranges=SUBNETWORK[:RANGE_NAME|:ALL],[...]
List of subnetwork primary and secondary IP ranges to be allowed to
use NAT.
▸ SUBNETWORK:ALL - specifying a subnetwork name with ALL includes
the primary range and all secondary ranges of the subnet.
▸ SUBNETWORK - including a subnetwork name includes only the
primary subnet range of the subnetwork.
▸ SUBNETWORK:RANGE_NAME - specifying a subnetwork and secondary

4
gcloud/beta/compute/ssl-certificates/help
View file

@ -7,8 +7,8 @@ SYNOPSIS
DESCRIPTION
(BETA) Read and manipulate SSL certificates that encrypt traffic between
clients and a load balancer. The relevant load balancer types are SSL
Proxy, external HTTPS, and internal HTTPS.
clients and a load balancer. The relevant load balancer types are
Application Load Balancers and proxy Network Load Balancers.
For more information about SSL certificates, see the SSL certificates
documentation