diff --git a/gcloud/_version b/gcloud/_version
index e24040d51..08c69dd06 100644
--- a/gcloud/_version
+++ b/gcloud/_version
@@ -1,8 +1,8 @@
-Google Cloud SDK 423.0.0
-alpha 2023.03.17
-beta 2023.03.17
-bq 2.0.88
+Google Cloud SDK 424.0.0
+alpha 2023.03.24
+beta 2023.03.24
+bq 2.0.89
 bundled-python3-unix 3.9.16
-core 2023.03.17
+core 2023.03.24
 gcloud-crc32c 1.0.0
 gsutil 5.21
diff --git a/gcloud/alpha/artifacts/settings/describe b/gcloud/alpha/artifacts/settings/describe
index e927b8b90..9f9a14fc0 100644
--- a/gcloud/alpha/artifacts/settings/describe
+++ b/gcloud/alpha/artifacts/settings/describe
@@ -29,7 +29,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud artifacts settings describe
 
         $ gcloud beta artifacts settings describe
 
diff --git a/gcloud/alpha/artifacts/settings/disable-upgrade-redirection b/gcloud/alpha/artifacts/settings/disable-upgrade-redirection
index f87cb3765..8e71369a7 100644
--- a/gcloud/alpha/artifacts/settings/disable-upgrade-redirection
+++ b/gcloud/alpha/artifacts/settings/disable-upgrade-redirection
@@ -31,7 +31,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud artifacts settings disable-upgrade-redirection
 
         $ gcloud beta artifacts settings disable-upgrade-redirection
 
diff --git a/gcloud/alpha/artifacts/settings/enable-upgrade-redirection b/gcloud/alpha/artifacts/settings/enable-upgrade-redirection
index 435b1970a..d93ccad33 100644
--- a/gcloud/alpha/artifacts/settings/enable-upgrade-redirection
+++ b/gcloud/alpha/artifacts/settings/enable-upgrade-redirection
@@ -35,7 +35,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud artifacts settings enable-upgrade-redirection
 
         $ gcloud beta artifacts settings enable-upgrade-redirection
 
diff --git a/gcloud/alpha/artifacts/settings/help b/gcloud/alpha/artifacts/settings/help
index 9407ebf96..2ea911d4f 100644
--- a/gcloud/alpha/artifacts/settings/help
+++ b/gcloud/alpha/artifacts/settings/help
@@ -30,7 +30,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud artifacts settings
 
         $ gcloud beta artifacts settings
 
diff --git a/gcloud/alpha/builds/enterprise-config/github/create b/gcloud/alpha/builds/enterprise-config/github/create
index 98fefed91..7746f52fa 100644
--- a/gcloud/alpha/builds/enterprise-config/github/create
+++ b/gcloud/alpha/builds/enterprise-config/github/create
@@ -16,7 +16,7 @@ SYNOPSIS
           --private-key-version-name=PRIVATE_KEY_VERSION_NAME
           --webhook-secret-version-name=WEBHOOK_SECRET_VERSION_NAME])
         [--peered-network=PEERED_NETWORK] [--webhook-key=WEBHOOK_KEY]
-        [GCLOUD_WIDE_FLAG ...]
+        [--name=NAME --region=REGION] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) Create a GitHub Enterprise Config for use by Google Cloud Build.
@@ -102,6 +102,15 @@ OPTIONAL FLAGS
 
         If this is not set, Cloud Build will generate one on the user's behalf.
 
+     --name=NAME
+        The name of the GitHub Enterprise config.
+
+     --region=REGION
+        The region of the Cloud Build Service to use. Must be set to a
+        supported region name (e.g. us-central1). If unset, builds/region,
+        which is the default region to use when working with Cloud Build
+        resources, is used. If builds/region is unset, region is set to global.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/alpha/builds/enterprise-config/github/delete b/gcloud/alpha/builds/enterprise-config/github/delete
index 704d7358b..3c800b657 100644
--- a/gcloud/alpha/builds/enterprise-config/github/delete
+++ b/gcloud/alpha/builds/enterprise-config/github/delete
@@ -4,7 +4,7 @@ NAME
 
 SYNOPSIS
     gcloud alpha builds enterprise-config github delete CONFIG
-        [GCLOUD_WIDE_FLAG ...]
+        [--region=REGION] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) Delete a github enterprise config from Google Cloud Build.
@@ -13,6 +13,13 @@ POSITIONAL ARGUMENTS
      CONFIG
         The id of the GitHub Enterprise Config
 
+FLAGS
+     --region=REGION
+        The region of the Cloud Build Service to use. Must be set to a
+        supported region name (e.g. us-central1). If unset, builds/region,
+        which is the default region to use when working with Cloud Build
+        resources, is used. If builds/region is unset, region is set to global.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/alpha/builds/enterprise-config/github/describe b/gcloud/alpha/builds/enterprise-config/github/describe
index ae6bd9385..94e4ec1db 100644
--- a/gcloud/alpha/builds/enterprise-config/github/describe
+++ b/gcloud/alpha/builds/enterprise-config/github/describe
@@ -4,7 +4,7 @@ NAME
 
 SYNOPSIS
     gcloud alpha builds enterprise-config github describe CONFIG
-        [GCLOUD_WIDE_FLAG ...]
+        [--region=REGION] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) Describe a github enterprise config used by Google Cloud Build.
@@ -13,6 +13,13 @@ POSITIONAL ARGUMENTS
      CONFIG
         The id of the GitHub Enterprise Config
 
+FLAGS
+     --region=REGION
+        The region of the Cloud Build Service to use. Must be set to a
+        supported region name (e.g. us-central1). If unset, builds/region,
+        which is the default region to use when working with Cloud Build
+        resources, is used. If builds/region is unset, region is set to global.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/alpha/builds/enterprise-config/github/list b/gcloud/alpha/builds/enterprise-config/github/list
index b43e8b3a2..e88d70e63 100644
--- a/gcloud/alpha/builds/enterprise-config/github/list
+++ b/gcloud/alpha/builds/enterprise-config/github/list
@@ -3,13 +3,20 @@ NAME
         enterprise configs in a Google Cloud project
 
 SYNOPSIS
-    gcloud alpha builds enterprise-config github list [--filter=EXPRESSION]
-        [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
-        [GCLOUD_WIDE_FLAG ...]
+    gcloud alpha builds enterprise-config github list [--region=REGION]
+        [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
+        [--sort-by=[FIELD,...]] [--uri] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) List all github enterprise configs in a Google Cloud project.
 
+FLAGS
+     --region=REGION
+        The region of the Cloud Build Service to use. Must be set to a
+        supported region name (e.g. us-central1). If unset, builds/region,
+        which is the default region to use when working with Cloud Build
+        resources, is used. If builds/region is unset, region is set to global.
+
 LIST COMMAND FLAGS
      --filter=EXPRESSION
         Apply a Boolean filter EXPRESSION to each resource item to be listed.
diff --git a/gcloud/alpha/builds/enterprise-config/github/update b/gcloud/alpha/builds/enterprise-config/github/update
index 0c75a440a..78ff3b821 100644
--- a/gcloud/alpha/builds/enterprise-config/github/update
+++ b/gcloud/alpha/builds/enterprise-config/github/update
@@ -4,7 +4,8 @@ NAME
 
 SYNOPSIS
     gcloud alpha builds enterprise-config github update CONFIG
-        [--app-id=APP_ID] [--host-uri=HOST_URI] [--webhook-key=WEBHOOK_KEY]
+        [--app-id=APP_ID] [--host-uri=HOST_URI] [--region=REGION]
+        [--webhook-key=WEBHOOK_KEY]
         [[--gcs-bucket=GCS_BUCKET --gcs-object=GCS_OBJECT
           : --generation=GENERATION]
           | [--oauth-client-id-name=OAUTH_CLIENT_ID_NAME
@@ -32,6 +33,12 @@ FLAGS
      --host-uri=HOST_URI
         The host uri of the GitHub Enterprise Server.
 
+     --region=REGION
+        The region of the Cloud Build Service to use. Must be set to a
+        supported region name (e.g. us-central1). If unset, builds/region,
+        which is the default region to use when working with Cloud Build
+        resources, is used. If builds/region is unset, region is set to global.
+
      --webhook-key=WEBHOOK_KEY
         The unique identifier that Cloud Build expects to be set as the value
         for the query field webhook_key on incoming webhook requests.
diff --git a/gcloud/alpha/builds/submit b/gcloud/alpha/builds/submit
index 8cda67330..319566f19 100644
--- a/gcloud/alpha/builds/submit
+++ b/gcloud/alpha/builds/submit
@@ -3,6 +3,7 @@ NAME
 
 SYNOPSIS
     gcloud alpha builds submit [[SOURCE] --no-source] [--async] [--no-cache]
+        [--default-buckets-behavior=DEFAULT_BUCKETS_BEHAVIOR]
         [--disk-size=DISK_SIZE] [--gcs-log-dir=GCS_LOG_DIR]
         [--gcs-source-staging-dir=GCS_SOURCE_STAGING_DIR]
         [--ignore-file=IGNORE_FILE] [--machine-type=MACHINE_TYPE]
@@ -70,6 +71,10 @@ FLAGS
         Dockerfile builds are non-deterministic and a non-deterministic result
         should not be cached.
 
+     --default-buckets-behavior=DEFAULT_BUCKETS_BEHAVIOR
+        How default buckets are setup. DEFAULT_BUCKETS_BEHAVIOR must be one of:
+        default-logs-bucket-behavior-unspecified, regional-user-owned-bucket.
+
      --disk-size=DISK_SIZE
         Machine disk size (GB) to run the build.
 
@@ -77,13 +82,18 @@ FLAGS
         A directory in Google Cloud Storage to hold build logs. If this field
         is not set,
         gs://[PROJECT_NUMBER].cloudbuild-logs.googleusercontent.com/ will be
-        created and used.
+        created and used or
+        gs://[PROJECT_NUMBER]-[builds/region]-cloudbuild-logs is used when you
+        set --default-buckets-behavior to REGIONAL_USER_OWNED_BUCKET.
 
      --gcs-source-staging-dir=GCS_SOURCE_STAGING_DIR
         A directory in Google Cloud Storage to copy the source used for staging
         the build. If the specified bucket does not exist, Cloud Build will
         create one. If you don't set this field,
-        gs://[PROJECT_ID]_cloudbuild/source is used.
+        gs://[PROJECT_ID]_cloudbuild/source is used or
+        gs://[PROJECT_ID]_[builds/region]_cloudbuild/source is used when you
+        set --default-buckets-behavior to REGIONAL_USER_OWNED_BUCKET and
+        builds/region is not global.
 
      --ignore-file=IGNORE_FILE
         Override the .gcloudignore file and use the specified file instead.
diff --git a/gcloud/alpha/certificate-manager/certificates/create b/gcloud/alpha/certificate-manager/certificates/create
index aecba4924..e3a62c6e2 100644
--- a/gcloud/alpha/certificate-manager/certificates/create
+++ b/gcloud/alpha/certificate-manager/certificates/create
@@ -6,7 +6,8 @@ SYNOPSIS
         (CERTIFICATE : --location=LOCATION)
         (--certificate-file=CERTIFICATE_FILE
           --private-key-file=PRIVATE_KEY_FILE | [--domains=[DOMAINS,...]
-          : --dns-authorizations=[DNS_AUTHORIZATIONS,...]]) [--async]
+          : --dns-authorizations=[DNS_AUTHORIZATIONS,...]
+          | --issuance-config=ISSUANCE_CONFIG]) [--async]
         [--description=DESCRIPTION] [--labels=[KEY=VALUE,...]]
         [--scope=SCOPE; default="DEFAULT"] [GCLOUD_WIDE_FLAG ...]
 
@@ -105,18 +106,23 @@ REQUIRED FLAGS
             This flag argument must be specified if any of the other arguments
             in this group are specified.
 
-         --dns-authorizations=[DNS_AUTHORIZATIONS,...]
-            Name(s) of the DNS authorizations for each listed domain.
+         At most one of these can be specified:
 
-            Note that each domain requires a matching authorization, and any
-            domain that fails authorization will prevent issuance and/or
-            renewal of the certificate.
+           --dns-authorizations=[DNS_AUTHORIZATIONS,...]
+              Name(s) of the DNS authorizations for each listed domain.
 
-            To reference multiple DNS authorizations, provide a list of comma
-            separated DNS authorization resource names or URLs. For example:
+              Note that each domain requires a matching authorization, and any
+              domain that fails authorization will prevent issuance and/or
+              renewal of the certificate.
 
-                $ gcloud alpha certificate-manager certificates create \
-                     --dns-authorizations=api-example-com,www-example-com
+              To reference multiple DNS authorizations, provide a list of comma
+              separated DNS authorization resource names or URLs. For example:
+
+                  $ gcloud alpha certificate-manager certificates create \
+                       --dns-authorizations=api-example-com,www-example-com
+
+           --issuance-config=ISSUANCE_CONFIG
+              Name of the Certificate Issuance Config to use for issuance.
 
 OPTIONAL FLAGS
      --async
diff --git a/gcloud/alpha/certificate-manager/issuance-configs/create b/gcloud/alpha/certificate-manager/issuance-configs/create
index 283bfaf72..5cc66d02e 100644
--- a/gcloud/alpha/certificate-manager/issuance-configs/create
+++ b/gcloud/alpha/certificate-manager/issuance-configs/create
@@ -102,7 +102,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud certificate-manager issuance-configs create
 
         $ gcloud beta certificate-manager issuance-configs create
 
diff --git a/gcloud/alpha/certificate-manager/issuance-configs/delete b/gcloud/alpha/certificate-manager/issuance-configs/delete
index eb7fd9ea7..dc77d9943 100644
--- a/gcloud/alpha/certificate-manager/issuance-configs/delete
+++ b/gcloud/alpha/certificate-manager/issuance-configs/delete
@@ -66,7 +66,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud certificate-manager issuance-configs delete
 
         $ gcloud beta certificate-manager issuance-configs delete
 
diff --git a/gcloud/alpha/certificate-manager/issuance-configs/describe b/gcloud/alpha/certificate-manager/issuance-configs/describe
index 65175305c..f4d503281 100644
--- a/gcloud/alpha/certificate-manager/issuance-configs/describe
+++ b/gcloud/alpha/certificate-manager/issuance-configs/describe
@@ -61,7 +61,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud certificate-manager issuance-configs describe
 
         $ gcloud beta certificate-manager issuance-configs describe
 
diff --git a/gcloud/alpha/certificate-manager/issuance-configs/help b/gcloud/alpha/certificate-manager/issuance-configs/help
index 4db44f335..e738417d1 100644
--- a/gcloud/alpha/certificate-manager/issuance-configs/help
+++ b/gcloud/alpha/certificate-manager/issuance-configs/help
@@ -33,7 +33,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud certificate-manager issuance-configs
 
         $ gcloud beta certificate-manager issuance-configs
 
diff --git a/gcloud/alpha/certificate-manager/issuance-configs/list b/gcloud/alpha/certificate-manager/issuance-configs/list
index 42a72cb1a..552e9fa75 100644
--- a/gcloud/alpha/certificate-manager/issuance-configs/list
+++ b/gcloud/alpha/certificate-manager/issuance-configs/list
@@ -81,7 +81,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud certificate-manager issuance-configs list
 
         $ gcloud beta certificate-manager issuance-configs list
 
diff --git a/gcloud/alpha/compute/disks/bulk/create b/gcloud/alpha/compute/disks/bulk/create
index 95d12c6de..1cd80e140 100644
--- a/gcloud/alpha/compute/disks/bulk/create
+++ b/gcloud/alpha/compute/disks/bulk/create
@@ -9,9 +9,8 @@ SYNOPSIS
 
 DESCRIPTION
     (ALPHA) gcloud alpha compute disks bulk create facilitates the creation of
-    multiple Compute Engine disks with a single command. Currently, this
-    includes the ability to consistently clone a set of Async PD secondary
-    disks with the same consistency group policy.
+    multiple Compute Engine disks with a single command. This includes cloning
+    a set of Async PD secondary disks with the same consistency group policy.
 
 EXAMPLES
     To consistently clone secondary disks with the same consistency group
@@ -27,7 +26,7 @@ EXAMPLES
 REQUIRED FLAGS
      --source-consistency-group-policy=SOURCE_CONSISTENCY_GROUP_POLICY
         URL of the source consistency group resource policy. The resource
-        policy is always in the region of the source disks.
+        policy is always the same region as the source disks.
 
      Exactly one of these must be specified:
 
@@ -85,5 +84,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud beta compute disks bulk create
 
diff --git a/gcloud/alpha/compute/disks/bulk/help b/gcloud/alpha/compute/disks/bulk/help
index f031fe254..b87670cb7 100644
--- a/gcloud/alpha/compute/disks/bulk/help
+++ b/gcloud/alpha/compute/disks/bulk/help
@@ -24,5 +24,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud beta compute disks bulk
 
diff --git a/gcloud/alpha/compute/disks/create b/gcloud/alpha/compute/disks/create
index e3217e488..6c6f8964d 100644
--- a/gcloud/alpha/compute/disks/create
+++ b/gcloud/alpha/compute/disks/create
@@ -9,6 +9,7 @@ SYNOPSIS
         [--guest-os-features=[GUEST_OS_FEATURE,...]] [--interface=INTERFACE]
         [--labels=[KEY=VALUE,...]] [--licenses=[LICENSE,...]] [--multi-writer]
         [--physical-block-size=PHYSICAL_BLOCK_SIZE; default="4096"]
+        [--primary-disk-project=PRIMARY_DISK_PROJECT]
         [--provisioned-iops=PROVISIONED_IOPS]
         [--provisioned-throughput=PROVISIONED_THROUGHPUT]
         [--replica-zones=ZONE,ZONE] [--no-require-csek-key-create]
@@ -22,12 +23,11 @@ SYNOPSIS
           | --source-snapshot=SOURCE_SNAPSHOT]
         [--kms-key=KMS_KEY : --kms-keyring=KMS_KEYRING
           --kms-location=KMS_LOCATION --kms-project=KMS_PROJECT]
+        [--primary-disk-region=PRIMARY_DISK_REGION
+          | --primary-disk-zone=PRIMARY_DISK_ZONE]
         [--region=REGION | --zone=ZONE]
         [--source-disk-region=SOURCE_DISK_REGION
-          | --source-disk-zone=SOURCE_DISK_ZONE]
-        [--primary-disk-project=PRIMARY_DISK_PROJECT]
-        [--primary-disk-region=PRIMARY_DISK_REGION
-          | --primary-disk-zone=PRIMARY_DISK_ZONE] [GCLOUD_WIDE_FLAG ...]
+          | --source-disk-zone=SOURCE_DISK_ZONE] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) gcloud alpha compute disks create creates one or more Compute
@@ -125,6 +125,9 @@ FLAGS
         4096(default) and 16384. PHYSICAL_BLOCK_SIZE must be one of: 4096,
         16384.
 
+     --primary-disk-project=PRIMARY_DISK_PROJECT
+        Project of the primary disk for asynchronous replication.
+
      --provisioned-iops=PROVISIONED_IOPS
         Provisioned IOPS of disk to create. Only for use with disks of type
         pd-extreme and hyperdisk-extreme.
@@ -277,6 +280,18 @@ FLAGS
           ▸ provide the argument --kms-project on the command line;
           ▸ set the property core/project.
 
+     At most one of these can be specified:
+
+       --primary-disk-region=PRIMARY_DISK_REGION
+          Region of the primary disk for asynchronous replication. The primary
+          and secondary disks must not be in the same region. Overrides the
+          default compute/region property value for this command invocation.
+
+       --primary-disk-zone=PRIMARY_DISK_ZONE
+          Zone of the primary disk for asynchronous replication. The primary
+          and secondary disks must not be in the same region. Overrides the
+          default compute/zone property value for this command invocation.
+
      At most one of these can be specified:
 
        --region=REGION
@@ -332,22 +347,6 @@ FLAGS
           disk is in the same zone as the source disk. Overrides the default
           compute/zone property value for this command invocation.
 
-ASYNC PD FLAGS
-     --primary-disk-project=PRIMARY_DISK_PROJECT
-        Project of the primary disk for asynchronous replication.
-
-     At most one of these can be specified:
-
-       --primary-disk-region=PRIMARY_DISK_REGION
-          Region of the primary disk for asynchronous replication. The primary
-          and secondary disks must not be in the same region. Overrides the
-          default compute/region property value for this command invocation.
-
-       --primary-disk-zone=PRIMARY_DISK_ZONE
-          Zone of the primary disk for asynchronous replication. The primary
-          and secondary disks must not be in the same region. Overrides the
-          default compute/zone property value for this command invocation.
-
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/alpha/compute/disks/start-async-replication b/gcloud/alpha/compute/disks/start-async-replication
index a07d4416b..5e9e5c8e3 100644
--- a/gcloud/alpha/compute/disks/start-async-replication
+++ b/gcloud/alpha/compute/disks/start-async-replication
@@ -15,9 +15,8 @@ DESCRIPTION
     invoked on the primary disk and --secondary-disk must be provided.
 
 EXAMPLES
-    Replication can only be started from the primary scope. To start
-    replication from the primary disk 'my-disk-1' in zone us-east1-a to the
-    secondary disk 'my-disk-2' in zone us-west1-a:
+    Start replication from the primary disk 'my-disk-1' in zone us-east1-a to
+    the secondary disk 'my-disk-2' in zone us-west1-a:
 
         $ gcloud alpha compute disks start-async-replication my-disk-1 \
             --zone=us-east1-a --secondary-disk=my-disk-2 \
@@ -103,5 +102,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud beta compute disks start-async-replication
 
diff --git a/gcloud/alpha/compute/disks/stop-async-replication b/gcloud/alpha/compute/disks/stop-async-replication
index 769ebfcb8..4fc6d01f9 100644
--- a/gcloud/alpha/compute/disks/stop-async-replication
+++ b/gcloud/alpha/compute/disks/stop-async-replication
@@ -102,5 +102,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud beta compute disks stop-async-replication
 
diff --git a/gcloud/alpha/compute/disks/stop-group-async-replication b/gcloud/alpha/compute/disks/stop-group-async-replication
index 7cd38bfb8..b083a4ade 100644
--- a/gcloud/alpha/compute/disks/stop-group-async-replication
+++ b/gcloud/alpha/compute/disks/stop-group-async-replication
@@ -92,5 +92,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud beta compute disks stop-group-async-replication
 
diff --git a/gcloud/alpha/compute/external-vpn-gateways/create b/gcloud/alpha/compute/external-vpn-gateways/create
index 1a745cac6..54ae0db59 100644
--- a/gcloud/alpha/compute/external-vpn-gateways/create
+++ b/gcloud/alpha/compute/external-vpn-gateways/create
@@ -38,15 +38,20 @@ REQUIRED FLAGS
         For example, to create an external VPN gateway with one interface:
 
             $ gcloud alpha compute external-vpn-gateways create \
-                MY-EXTERNAL-GATEWAY --interfaces 0=8.9.9.9
+                MY-EXTERNAL-GATEWAY --interfaces 0=192.0.2.0
 
         To create an external VPN gateway with two interfaces: $ gcloud alpha
         compute external-vpn-gateways create \ MY-EXTERNAL-GATEWAY --interfaces
-        0=8.9.9.9,1=8.9.9.10
+        0=192.0.2.0,1=192.0.2.1
 
         To create an external VPN gateway with four interfaces: $ gcloud alpha
         compute external-vpn-gateways create \ MY-EXTERNAL-GATEWAY \
-        --interfaces 0=8.9.9.9,1=8.9.9.10,2=8.9.9.11,3=8.9.9.12
+        --interfaces 0=192.0.2.0,1=192.0.2.1,2=192.0.2.3,3=192.0.2.4
+
+        To create an external VPN gateway with IPv6 addresses on four
+        interfaces: $ gcloud alpha compute external-vpn-gateways create \
+        MY-EXTERNAL-GATEWAY \ --interfaces \
+        0=2001:db8::1,1=2001:db8::2,2=2001:db8::3,3=2001:db8::4
 
         Note that the redundancy type of the gateway will be automatically
         inferred based on the number of interfaces provided:
diff --git a/gcloud/alpha/compute/instance-groups/managed/create b/gcloud/alpha/compute/instance-groups/managed/create
index 80e76f3ba..86328442a 100644
--- a/gcloud/alpha/compute/instance-groups/managed/create
+++ b/gcloud/alpha/compute/instance-groups/managed/create
@@ -306,9 +306,7 @@ OPTIONAL FLAGS
        --update-policy-max-surge=MAX_SURGE
           Maximum additional number of VMs that can be created during the
           update process. This can be a fixed number (e.g. 5) or a percentage
-          of size to the managed instance group (e.g. 10%). Defaults to 0 if
-          the managed instance group has stateful configuration, or to the
-          number of zones in which it operates otherwise.
+          of size to the managed instance group (e.g. 10%).
 
        --update-policy-max-unavailable=MAX_UNAVAILABLE
           Maximum number of VMs that can be unavailable during the update
@@ -367,9 +365,7 @@ OPTIONAL FLAGS
 
        --update-policy-replacement-method=UPDATE_POLICY_REPLACEMENT_METHOD
           Type of replacement method. Specifies what action will be taken to
-          update VMs. Defaults to ``recreate`` if the managed instance group
-          has stateful configuration, or to ``substitute`` otherwise.
-          UPDATE_POLICY_REPLACEMENT_METHOD must be one of:
+          update VMs. UPDATE_POLICY_REPLACEMENT_METHOD must be one of:
 
            recreate
               Recreate VMs and preserve the VM names. The VM IDs and creation
diff --git a/gcloud/alpha/compute/instance-groups/managed/update b/gcloud/alpha/compute/instance-groups/managed/update
index 478f48cd4..1b675ffbf 100644
--- a/gcloud/alpha/compute/instance-groups/managed/update
+++ b/gcloud/alpha/compute/instance-groups/managed/update
@@ -308,9 +308,7 @@ FLAGS
        --update-policy-max-surge=MAX_SURGE
           Maximum additional number of VMs that can be created during the
           update process. This can be a fixed number (e.g. 5) or a percentage
-          of size to the managed instance group (e.g. 10%). Defaults to 0 if
-          the managed instance group has stateful configuration, or to the
-          number of zones in which it operates otherwise.
+          of size to the managed instance group (e.g. 10%).
 
        --update-policy-max-unavailable=MAX_UNAVAILABLE
           Maximum number of VMs that can be unavailable during the update
@@ -369,9 +367,7 @@ FLAGS
 
        --update-policy-replacement-method=UPDATE_POLICY_REPLACEMENT_METHOD
           Type of replacement method. Specifies what action will be taken to
-          update VMs. Defaults to ``recreate`` if the managed instance group
-          has stateful configuration, or to ``substitute`` otherwise.
-          UPDATE_POLICY_REPLACEMENT_METHOD must be one of:
+          update VMs. UPDATE_POLICY_REPLACEMENT_METHOD must be one of:
 
            recreate
               Recreate VMs and preserve the VM names. The VM IDs and creation
diff --git a/gcloud/alpha/compute/instance-templates/list b/gcloud/alpha/compute/instance-templates/list
index b85c72eb6..7316f8ae0 100644
--- a/gcloud/alpha/compute/instance-templates/list
+++ b/gcloud/alpha/compute/instance-templates/list
@@ -4,16 +4,17 @@ NAME
 
 SYNOPSIS
     gcloud alpha compute instance-templates list [NAME ...]
-        [--regexp=REGEXP, -r REGEXP] [--filter=EXPRESSION] [--limit=LIMIT]
-        [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
-        [GCLOUD_WIDE_FLAG ...]
+        [--regexp=REGEXP, -r REGEXP] [--global | --regions=[REGION,...]]
+        [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
+        [--sort-by=[FIELD,...]] [--uri] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) gcloud alpha compute instance-templates list displays all Google
     Compute Engine instance templates in a project.
 
-    By default, instance templates from all zones are listed. The results can
-    be narrowed down using a filter: --filter="zone:( ZONE ... )".
+    By default, global instance templates and instance templates from all
+    regions are listed. The results can be narrowed down by providing the
+    --global or --regions flag.
 
 EXAMPLES
     To list all instance templates in a project in table form, run:
@@ -24,11 +25,15 @@ EXAMPLES
 
         $ gcloud alpha compute instance-templates list --uri
 
-    To list all instance templates in the us-central1-b and europe-west1-d
-    zones, run:
+    To list all global instance templates in a project, run:
+
+        $ gcloud alpha compute instance-templates list --global
+
+    To list all instance templates in the us-central1 and europe-west1 regions,
+    given they are regional resources, run:
 
         $ gcloud alpha compute instance-templates list \
-            --filter="zone:( us-central1-b europe-west1-d )"
+            --filter="region:( europe-west1 us-central1 )"
 
 POSITIONAL ARGUMENTS
      [NAME ...]
@@ -46,6 +51,15 @@ FLAGS
 
         Flag --regexp is deprecated. Use --filter="name~'REGEXP'" instead.
 
+     At most one of these can be specified:
+
+       --global
+          If provided, only global resources are shown.
+
+       --regions=[REGION,...]
+          If provided, only regional resources are shown. If arguments are
+          provided, only resources from the given regions are shown.
+
 LIST COMMAND FLAGS
      --filter=EXPRESSION
         Apply a Boolean filter EXPRESSION to each resource item to be listed.
diff --git a/gcloud/alpha/compute/resource-policies/create/disk-consistency-group b/gcloud/alpha/compute/resource-policies/create/disk-consistency-group
index 8bc794ee5..d7bf066ff 100644
--- a/gcloud/alpha/compute/resource-policies/create/disk-consistency-group
+++ b/gcloud/alpha/compute/resource-policies/create/disk-consistency-group
@@ -7,12 +7,13 @@ SYNOPSIS
         [--description=DESCRIPTION] [--region=REGION] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) Create a Compute Engine Disk Consistency Group Resource Policy.
+    (ALPHA) Create a Compute Engine disk consistency group resource policy.
 
 EXAMPLES
-    To create a Compute Engine Disk Consistency Group policy, run: $ gcloud
-    alpha compute resource-policies create disk-consistency-group
-    my-resource-policy --region=REGION
+    Create a disk consistency group policy:
+
+        $ gcloud alpha compute resource-policies create \
+            disk-consistency-group my-resource-policy --region=REGION
 
 POSITIONAL ARGUMENTS
      NAME
@@ -54,5 +55,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud beta compute resource-policies create disk-consistency-group
 
diff --git a/gcloud/alpha/compute/sole-tenancy/node-groups/create b/gcloud/alpha/compute/sole-tenancy/node-groups/create
index b5bf6f65f..89402b0e1 100644
--- a/gcloud/alpha/compute/sole-tenancy/node-groups/create
+++ b/gcloud/alpha/compute/sole-tenancy/node-groups/create
@@ -5,7 +5,9 @@ NAME
 SYNOPSIS
     gcloud alpha compute sole-tenancy node-groups create NAME
         --node-template=NODE_TEMPLATE --target-size=TARGET_SIZE
-        [--description=DESCRIPTION] [--maintenance-policy=MAINTENANCE_POLICY]
+        [--description=DESCRIPTION]
+        [--maintenance-interval=MAINTENANCE_INTERVAL]
+        [--maintenance-policy=MAINTENANCE_POLICY]
         [--maintenance-window-start-time=START_TIME] [--zone=ZONE]
         [--autoscaler-mode=AUTOSCALER_MODE
           : --max-nodes=MAX_NODES --min-nodes=MIN_NODES]
@@ -36,6 +38,18 @@ OPTIONAL FLAGS
      --description=DESCRIPTION
         An optional description of this resource.
 
+     --maintenance-interval=MAINTENANCE_INTERVAL
+        Specifies the frequency of planned maintenance events.
+        MAINTENANCE_INTERVAL must be one of:
+
+         as-needed
+            VMs are eligible to receive infrastructure and hypervisor updates
+            as they become available.
+         recurrent
+            VMs receive infrastructure and hypervisor updates on a periodic
+            basis, minimizing the number of maintenance operations (live
+            migrations or terminations) on an individual VM.
+
      --maintenance-policy=MAINTENANCE_POLICY
         Determines the maintenance behavior during host maintenance events. For
         more information, see
diff --git a/gcloud/alpha/compute/tpus/queued-resources/create b/gcloud/alpha/compute/tpus/queued-resources/create
index cb0b240dc..c0e751ce5 100644
--- a/gcloud/alpha/compute/tpus/queued-resources/create
+++ b/gcloud/alpha/compute/tpus/queued-resources/create
@@ -7,7 +7,10 @@ SYNOPSIS
         (QUEUED_RESOURCE : --zone=ZONE) --accelerator-type=ACCELERATOR_TYPE
         --runtime-version=RUNTIME_VERSION
         (--node-id=NODE_ID | --node-count=NODE_COUNT --node-prefix=NODE_PREFIX)
-        [--async] [--best-effort] [--guaranteed] [--internal-ips] [--reserved]
+        [--async] [--best-effort] [--guaranteed] [--internal-ips]
+        [--reservation-host-folder=RESERVATION_HOST_FOLDER]
+        [--reservation-host-organization=RESERVATION_HOST_ORGANIZATION]
+        [--reservation-host-project=RESERVATION_HOST_PROJECT] [--reserved]
         [--valid-after-duration=VALID_AFTER_DURATION]
         [--valid-after-time=VALID_AFTER_TIME]
         [--valid-until-duration=VALID_UNTIL_DURATION]
@@ -124,6 +127,18 @@ OPTIONAL FLAGS
         default is that external IP addresses will be associated with the TPU
         workers.
 
+     --reservation-host-folder=RESERVATION_HOST_FOLDER
+        The folder hosting the reservation that the TPU should use. Only one
+        reservation host entity may be specified.
+
+     --reservation-host-organization=RESERVATION_HOST_ORGANIZATION
+        The organization hosting the reservation that the TPU should use. Only
+        one reservation host entity may be specified.
+
+     --reservation-host-project=RESERVATION_HOST_PROJECT
+        The project hosting the reservation that the TPU should use. Only one
+        reservation host entity may be specified.
+
      --reserved
         Specifies the request should be scheduled on reserved capacity.
 
diff --git a/gcloud/alpha/compute/tpus/queued-resources/help b/gcloud/alpha/compute/tpus/queued-resources/help
index ea9a7c74e..d74f73932 100644
--- a/gcloud/alpha/compute/tpus/queued-resources/help
+++ b/gcloud/alpha/compute/tpus/queued-resources/help
@@ -28,6 +28,9 @@ COMMANDS
      list
         (ALPHA) List Queued Resources.
 
+     reset
+        (ALPHA) Reset a Queued Resource.
+
 NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
diff --git a/gcloud/alpha/compute/tpus/queued-resources/reset b/gcloud/alpha/compute/tpus/queued-resources/reset
new file mode 100644
index 000000000..d0b744289
--- /dev/null
+++ b/gcloud/alpha/compute/tpus/queued-resources/reset
@@ -0,0 +1,75 @@
+NAME
+    gcloud alpha compute tpus queued-resources reset - reset a Queued Resource
+
+SYNOPSIS
+    gcloud alpha compute tpus queued-resources reset
+        (QUEUED_RESOURCE : --zone=ZONE) [--async] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Reset an existing Queued Resource.
+
+    To get a list of Queued Resources for resetting, run:
+
+        $ gcloud alpha compute tpus queued-resources list
+
+EXAMPLES
+    To reset a Queued Resource in zone us-central1-b and project my-project,
+    run:
+
+        $ gcloud alpha compute tpus queued-resources reset \
+            --zone=us-central1-b --project=my-project
+
+POSITIONAL ARGUMENTS
+     Queued resource resource - The Queued Resource you want to reset. The
+     arguments in this group can be used to specify the attributes of this
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways. To set the project attribute:
+      ◆ provide the argument queued_resource on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       QUEUED_RESOURCE
+          ID of the queued_resource or fully qualified identifier for the
+          queued_resource. To set the queued_resource attribute:
+          ▸ provide the argument queued_resource on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --zone=ZONE
+          The compute/zone of the Cloud TPU.
+
+          If not specified, will use default compute/zone.
+
+          To set the zone attribute:
+          ▸ provide the argument queued_resource on the command line with a
+            fully specified name;
+          ▸ provide the argument --zone on the command line;
+          ▸ set the property compute/zone.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the tpu/v2alpha1 API. The full documentation for this API
+    can be found at: https://cloud.google.com/tpu/
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/config/get b/gcloud/alpha/config/get
index 506090054..82a186b59 100644
--- a/gcloud/alpha/config/get
+++ b/gcloud/alpha/config/get
@@ -394,6 +394,10 @@ AVAILABLE PROPERTIES
             Overrides API endpoint for gcloud iam command group. Defaults to
             https://iam.googleapis.com/
 
+         iamcredentials
+            Overrides API endpoint for gcloud iam command group. Defaults to
+            https://iamcredentials.googleapis.com/
+
          iap
             Overrides API endpoint for gcloud iap command group. Defaults to
             https://iap.googleapis.com/
diff --git a/gcloud/alpha/config/help b/gcloud/alpha/config/help
index 8f98e6d5c..800a43c34 100644
--- a/gcloud/alpha/config/help
+++ b/gcloud/alpha/config/help
@@ -426,6 +426,10 @@ AVAILABLE PROPERTIES
             Overrides API endpoint for gcloud iam command group. Defaults to
             https://iam.googleapis.com/
 
+         iamcredentials
+            Overrides API endpoint for gcloud iam command group. Defaults to
+            https://iamcredentials.googleapis.com/
+
          iap
             Overrides API endpoint for gcloud iap command group. Defaults to
             https://iap.googleapis.com/
diff --git a/gcloud/alpha/config/list b/gcloud/alpha/config/list
index 129f8fb65..b4140b35f 100644
--- a/gcloud/alpha/config/list
+++ b/gcloud/alpha/config/list
@@ -438,6 +438,10 @@ AVAILABLE PROPERTIES
             Overrides API endpoint for gcloud iam command group. Defaults to
             https://iam.googleapis.com/
 
+         iamcredentials
+            Overrides API endpoint for gcloud iam command group. Defaults to
+            https://iamcredentials.googleapis.com/
+
          iap
             Overrides API endpoint for gcloud iap command group. Defaults to
             https://iap.googleapis.com/
diff --git a/gcloud/alpha/config/set b/gcloud/alpha/config/set
index 16107fe2f..6f4e955d4 100644
--- a/gcloud/alpha/config/set
+++ b/gcloud/alpha/config/set
@@ -441,6 +441,10 @@ AVAILABLE PROPERTIES
             Overrides API endpoint for gcloud iam command group. Defaults to
             https://iam.googleapis.com/
 
+         iamcredentials
+            Overrides API endpoint for gcloud iam command group. Defaults to
+            https://iamcredentials.googleapis.com/
+
          iap
             Overrides API endpoint for gcloud iap command group. Defaults to
             https://iap.googleapis.com/
diff --git a/gcloud/alpha/config/unset b/gcloud/alpha/config/unset
index 6288e46ba..e68e0d5c5 100644
--- a/gcloud/alpha/config/unset
+++ b/gcloud/alpha/config/unset
@@ -402,6 +402,10 @@ AVAILABLE PROPERTIES
             Overrides API endpoint for gcloud iam command group. Defaults to
             https://iam.googleapis.com/
 
+         iamcredentials
+            Overrides API endpoint for gcloud iam command group. Defaults to
+            https://iamcredentials.googleapis.com/
+
          iap
             Overrides API endpoint for gcloud iap command group. Defaults to
             https://iap.googleapis.com/
diff --git a/gcloud/alpha/deploy/job-runs/help b/gcloud/alpha/deploy/job-runs/help
index d8cec84be..17c732c5d 100644
--- a/gcloud/alpha/deploy/job-runs/help
+++ b/gcloud/alpha/deploy/job-runs/help
@@ -22,6 +22,9 @@ COMMANDS
      list
         (ALPHA) List the job runs.
 
+     terminate
+        (ALPHA) Terminates a Cloud Deploy job run.
+
 NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
diff --git a/gcloud/alpha/deploy/job-runs/terminate b/gcloud/alpha/deploy/job-runs/terminate
new file mode 100644
index 000000000..6b72cace5
--- /dev/null
+++ b/gcloud/alpha/deploy/job-runs/terminate
@@ -0,0 +1,88 @@
+NAME
+    gcloud alpha deploy job-runs terminate - terminates a Cloud Deploy job run
+
+SYNOPSIS
+    gcloud alpha deploy job-runs terminate
+        (JOB_RUN : --delivery-pipeline=DELIVERY_PIPELINE
+          --region=REGION --release=RELEASE --rollout=ROLLOUT)
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Terminates a Cloud Deploy job run.
+
+EXAMPLES
+    To terminate a job run test-jobrun, for delivery pipeline 'test-pipeline',
+    release 'test-release', rollout 'test-rollout', in region 'us-central1',
+    run:
+
+        $ gcloud alpha deploy job-runs terminate test-jobrun \
+             --delivery-pipeline=test-pipeline --release=test-release \
+             --rollout=test-rollout --region=us-central1
+
+POSITIONAL ARGUMENTS
+     Job run resource - The name of the Job Run. The arguments in this group
+     can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways. To set the project attribute:
+      ◆ provide the argument job_run on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       JOB_RUN
+          ID of the job_run or fully qualified identifier for the job_run. To
+          set the name attribute:
+          ▸ provide the argument job_run on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --delivery-pipeline=DELIVERY_PIPELINE
+          The delivery pipeline associated with the job_run. Alternatively, set
+          the property [deploy/delivery-pipeline]. To set the delivery-pipeline
+          attribute:
+          ▸ provide the argument job_run on the command line with a fully
+            specified name;
+          ▸ provide the argument --delivery-pipeline on the command line;
+          ▸ set the property deploy/delivery_pipeline.
+
+       --region=REGION
+          The Cloud region for the job_run. Alternatively, set the property
+          [deploy/region]. To set the region attribute:
+          ▸ provide the argument job_run on the command line with a fully
+            specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property deploy/region.
+
+       --release=RELEASE
+          The release associated with the job_run. To set the release
+          attribute:
+          ▸ provide the argument job_run on the command line with a fully
+            specified name;
+          ▸ provide the argument --release on the command line.
+
+       --rollout=ROLLOUT
+          The rollout associated with the job_run. To set the rollout
+          attribute:
+          ▸ provide the argument job_run on the command line with a fully
+            specified name;
+          ▸ provide the argument --rollout on the command line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. This variant is also available:
+
+        $ gcloud beta deploy job-runs terminate
+
diff --git a/gcloud/alpha/deploy/releases/create b/gcloud/alpha/deploy/releases/create
index 486c3405e..14896fd08 100644
--- a/gcloud/alpha/deploy/releases/create
+++ b/gcloud/alpha/deploy/releases/create
@@ -12,7 +12,8 @@ SYNOPSIS
         [--build-artifacts=BUILD_ARTIFACTS | --images=[NAME=TAG,...]]
         [--disable-initial-rollout | --enable-initial-rollout
           --initial-rollout-annotations=[KEY=VALUE,...]
-          --initial-rollout-labels=[KEY=VALUE,...]]
+          --initial-rollout-labels=[KEY=VALUE,...]
+          --initial-rollout-phase-id=INITIAL_ROLLOUT_PHASE_ID]
         [--from-k8s-manifest=FROM_K8S_MANIFEST
           | --from-run-manifest=FROM_RUN_MANIFEST
           | --skaffold-file=SKAFFOLD_FILE --source=SOURCE; default="."]
@@ -184,6 +185,18 @@ FLAGS
               $ gcloud alpha deploy releases create \
                   initial-rollout-labels="commit=abc123,author=foo"
 
+       --initial-rollout-phase-id=INITIAL_ROLLOUT_PHASE_ID
+          The phase to start the initial rollout at when creating the release.
+          The phase ID must be a valid phase on the rollout. If not specified,
+          then the rollout will start at the first phase.
+
+          Examples:
+
+          Start rollout at stable phase:
+
+              $ gcloud alpha deploy releases create \
+                  --initial-rollout-phase-id=stable
+
      At most one of these can be specified:
 
        --from-k8s-manifest=FROM_K8S_MANIFEST
diff --git a/gcloud/alpha/deploy/releases/promote b/gcloud/alpha/deploy/releases/promote
index 924872e75..22be7a617 100644
--- a/gcloud/alpha/deploy/releases/promote
+++ b/gcloud/alpha/deploy/releases/promote
@@ -7,8 +7,8 @@ SYNOPSIS
         (--release=RELEASE
           : --delivery-pipeline=DELIVERY_PIPELINE --region=REGION)
         [--annotations=[KEY=VALUE,...]] [--labels=[KEY=VALUE,...]]
-        [--rollout-id=ROLLOUT_ID] [--to-target=TO_TARGET]
-        [GCLOUD_WIDE_FLAG ...]
+        [--rollout-id=ROLLOUT_ID] [--starting-phase-id=STARTING_PHASE_ID]
+        [--to-target=TO_TARGET] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) If to-target is not specified the command promotes the release from
@@ -86,6 +86,13 @@ OPTIONAL FLAGS
      --rollout-id=ROLLOUT_ID
         ID to assign to the generated rollout for promotion.
 
+     --starting-phase-id=STARTING_PHASE_ID
+        If set, starts the created rollout at the specified phase.
+
+        Start rollout at stable phase:
+
+            $ gcloud alpha deploy releases promote --starting-phase-id=stable
+
      --to-target=TO_TARGET
         Destination target to promote into.
 
diff --git a/gcloud/alpha/deploy/rollouts/advance b/gcloud/alpha/deploy/rollouts/advance
new file mode 100644
index 000000000..873160c88
--- /dev/null
+++ b/gcloud/alpha/deploy/rollouts/advance
@@ -0,0 +1,84 @@
+NAME
+    gcloud alpha deploy rollouts advance - advances a rollout
+
+SYNOPSIS
+    gcloud alpha deploy rollouts advance
+        (ROLLOUT : --delivery-pipeline=DELIVERY_PIPELINE
+          --region=REGION --release=RELEASE) [--phase-id=PHASE_ID]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Advances a rollout.
+
+EXAMPLES
+    To advance a rollout test-rollout to phase test-phase for delivery pipeline
+    test-pipeline, release test-release in region us-central1, run:
+
+        $ gcloud alpha deploy rollouts advance test-rollout \
+             --phase-id=test-phase --delivery-pipeline=test-pipeline \
+             --release=test-release --region=us-central1
+
+POSITIONAL ARGUMENTS
+     Rollout resource - The name of the Rollout. The arguments in this group
+     can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways. To set the project attribute:
+      ◆ provide the argument rollout on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       ROLLOUT
+          ID of the rollout or fully qualified identifier for the rollout. To
+          set the rollout attribute:
+          ▸ provide the argument rollout on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --delivery-pipeline=DELIVERY_PIPELINE
+          The delivery pipeline associated with the rollout. Alternatively, set
+          the property [deploy/delivery-pipeline]. To set the delivery-pipeline
+          attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --delivery-pipeline on the command line;
+          ▸ set the property deploy/delivery_pipeline.
+
+       --region=REGION
+          The Cloud region for the rollout. Alternatively, set the property
+          [deploy/region]. To set the region attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property deploy/region.
+
+       --release=RELEASE
+          The release associated with the rollout. To set the release
+          attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --release on the command line.
+
+FLAGS
+     --phase-id=PHASE_ID
+        Phase ID on a rollout resource
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. This variant is also available:
+
+        $ gcloud beta deploy rollouts advance
+
diff --git a/gcloud/alpha/deploy/rollouts/cancel b/gcloud/alpha/deploy/rollouts/cancel
new file mode 100644
index 000000000..1b2da9d2f
--- /dev/null
+++ b/gcloud/alpha/deploy/rollouts/cancel
@@ -0,0 +1,79 @@
+NAME
+    gcloud alpha deploy rollouts cancel - cancel a Rollout
+
+SYNOPSIS
+    gcloud alpha deploy rollouts cancel
+        (ROLLOUT : --delivery-pipeline=DELIVERY_PIPELINE
+          --region=REGION --release=RELEASE) [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Cancel a Rollout.
+
+EXAMPLES
+    To cancel a rollout test-rollout for delivery pipeline test-pipeline,
+    release test-release in region us-central1, run:
+
+        $ gcloud alpha deploy rollouts cancel test-rollout \
+             --delivery-pipeline=test-pipeline --release=test-release \
+             --region=us-central1
+
+POSITIONAL ARGUMENTS
+     Rollout resource - The name of the Rollout. The arguments in this group
+     can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways. To set the project attribute:
+      ◆ provide the argument rollout on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       ROLLOUT
+          ID of the rollout or fully qualified identifier for the rollout. To
+          set the rollout attribute:
+          ▸ provide the argument rollout on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --delivery-pipeline=DELIVERY_PIPELINE
+          The delivery pipeline associated with the rollout. Alternatively, set
+          the property [deploy/delivery-pipeline]. To set the delivery-pipeline
+          attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --delivery-pipeline on the command line;
+          ▸ set the property deploy/delivery_pipeline.
+
+       --region=REGION
+          The Cloud region for the rollout. Alternatively, set the property
+          [deploy/region]. To set the region attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property deploy/region.
+
+       --release=RELEASE
+          The release associated with the rollout. To set the release
+          attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --release on the command line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. This variant is also available:
+
+        $ gcloud beta deploy rollouts cancel
+
diff --git a/gcloud/alpha/deploy/rollouts/help b/gcloud/alpha/deploy/rollouts/help
index 414931745..5415c528b 100644
--- a/gcloud/alpha/deploy/rollouts/help
+++ b/gcloud/alpha/deploy/rollouts/help
@@ -16,12 +16,21 @@ GCLOUD WIDE FLAGS
 COMMANDS
     COMMAND is one of the following:
 
+     advance
+        (ALPHA) Advances a rollout.
+
      approve
         (ALPHA) Approves a rollout having an Approval state of "Required".
 
+     cancel
+        (ALPHA) Cancel a Rollout.
+
      describe
         (ALPHA) Show details for a rollout.
 
+     ignore-job
+        (ALPHA) Ignores a specified job and phase combination on a rollout.
+
      list
         (ALPHA) List the rollouts.
 
diff --git a/gcloud/alpha/deploy/rollouts/ignore-job b/gcloud/alpha/deploy/rollouts/ignore-job
new file mode 100644
index 000000000..3f5e7b538
--- /dev/null
+++ b/gcloud/alpha/deploy/rollouts/ignore-job
@@ -0,0 +1,90 @@
+NAME
+    gcloud alpha deploy rollouts ignore-job - ignores a specified job and phase
+        combination on a rollout
+
+SYNOPSIS
+    gcloud alpha deploy rollouts ignore-job
+        (ROLLOUT : --delivery-pipeline=DELIVERY_PIPELINE
+          --region=REGION --release=RELEASE) --job-id=JOB_ID
+        --phase-id=PHASE_ID [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Ignores a specified job and phase combination on a rollout.
+
+EXAMPLES
+    To ignore a job test-job in phase test-phase on a rollout test-rollout for
+    delivery pipeline test-pipeline, release test-release in region
+    us-central1, run:
+
+        $ gcloud alpha deploy rollouts ignore-job test-rollout \
+             --job-id=test-job --phase-id=test-phase \
+             --delivery-pipeline=test-pipeline --release=test-release \
+             --region=us-central1
+
+POSITIONAL ARGUMENTS
+     Rollout resource - The name of the Rollout. The arguments in this group
+     can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways. To set the project attribute:
+      ◆ provide the argument rollout on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       ROLLOUT
+          ID of the rollout or fully qualified identifier for the rollout. To
+          set the rollout attribute:
+          ▸ provide the argument rollout on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --delivery-pipeline=DELIVERY_PIPELINE
+          The delivery pipeline associated with the rollout. Alternatively, set
+          the property [deploy/delivery-pipeline]. To set the delivery-pipeline
+          attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --delivery-pipeline on the command line;
+          ▸ set the property deploy/delivery_pipeline.
+
+       --region=REGION
+          The Cloud region for the rollout. Alternatively, set the property
+          [deploy/region]. To set the region attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property deploy/region.
+
+       --release=RELEASE
+          The release associated with the rollout. To set the release
+          attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --release on the command line.
+
+REQUIRED FLAGS
+     --job-id=JOB_ID
+        Job ID on a rollout resource
+
+     --phase-id=PHASE_ID
+        Phase ID on a rollout resource
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. This variant is also available:
+
+        $ gcloud beta deploy rollouts ignore-job
+
diff --git a/gcloud/alpha/deploy/targets/redeploy b/gcloud/alpha/deploy/targets/redeploy
index 2b0bb36e9..99d2464d6 100644
--- a/gcloud/alpha/deploy/targets/redeploy
+++ b/gcloud/alpha/deploy/targets/redeploy
@@ -6,7 +6,8 @@ SYNOPSIS
     gcloud alpha deploy targets redeploy (TARGET : --region=REGION)
         --delivery-pipeline=DELIVERY_PIPELINE [--annotations=[KEY=VALUE,...]]
         [--description=DESCRIPTION] [--labels=[KEY=VALUE,...]]
-        [--rollout-id=ROLLOUT_ID] [GCLOUD_WIDE_FLAG ...]
+        [--rollout-id=ROLLOUT_ID] [--starting-phase-id=STARTING_PHASE_ID]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) Redeploy the last rollout that has a state of SUCCESSFUL or FAILED
@@ -81,6 +82,13 @@ OPTIONAL FLAGS
      --rollout-id=ROLLOUT_ID
         ID to assign to the generated rollout for promotion.
 
+     --starting-phase-id=STARTING_PHASE_ID
+        If set, starts the created rollout at the specified phase.
+
+        Start rollout at stable phase:
+
+            $ gcloud alpha deploy targets redeploy --starting-phase-id=stable
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/alpha/deploy/targets/rollback b/gcloud/alpha/deploy/targets/rollback
index e8b0398c2..2e43f8018 100644
--- a/gcloud/alpha/deploy/targets/rollback
+++ b/gcloud/alpha/deploy/targets/rollback
@@ -6,7 +6,8 @@ SYNOPSIS
     gcloud alpha deploy targets rollback (TARGET : --region=REGION)
         --delivery-pipeline=DELIVERY_PIPELINE [--annotations=[KEY=VALUE,...]]
         [--description=DESCRIPTION] [--labels=[KEY=VALUE,...]]
-        [--release=RELEASE] [--rollout-id=ROLLOUT_ID] [GCLOUD_WIDE_FLAG ...]
+        [--release=RELEASE] [--rollout-id=ROLLOUT_ID]
+        [--starting-phase-id=STARTING_PHASE_ID] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) If release is not specified, the command rollbacks the target with
@@ -84,6 +85,13 @@ OPTIONAL FLAGS
      --rollout-id=ROLLOUT_ID
         ID to assign to the generated rollout for promotion.
 
+     --starting-phase-id=STARTING_PHASE_ID
+        If set, starts the created rollout at the specified phase.
+
+        Start rollout at stable phase:
+
+            $ gcloud alpha deploy targets rollback --starting-phase-id=stable
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/alpha/edge-cloud/container/clusters/create b/gcloud/alpha/edge-cloud/container/clusters/create
index 4f3351ccc..7cb2f2e5c 100644
--- a/gcloud/alpha/edge-cloud/container/clusters/create
+++ b/gcloud/alpha/edge-cloud/container/clusters/create
@@ -19,7 +19,7 @@ DESCRIPTION
     (ALPHA) Create an Edge Container cluster.
 
 EXAMPLES
-    To create a cluster called 'my-cluster' in region us-central1, run:
+    To create a cluster called my-cluster in region us-central1, run:
 
         $ gcloud alpha edge-cloud container clusters create my-cluster \
             --location=us-central1
@@ -31,8 +31,8 @@ POSITIONAL ARGUMENTS
      ways. To set the project attribute:
       ◆ provide the argument cluster on the command line with a fully
         specified name;
-      ◆ set the property core/project;
-      ◆ provide the argument --project on the command line.
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
 
      This must be specified.
 
@@ -45,11 +45,10 @@ POSITIONAL ARGUMENTS
           arguments in this group are specified.
 
        --location=LOCATION
-          The global location name. To set the location attribute:
+          Google Cloud location for the cluster. To set the location attribute:
           ▸ provide the argument cluster on the command line with a fully
             specified name;
-          ▸ provide the argument --location on the command line;
-          ▸ set the property edge_container/location.
+          ▸ provide the argument --location on the command line.
 
 FLAGS
      --admin-users=ADMIN_USERS
diff --git a/gcloud/alpha/edge-cloud/container/clusters/get-credentials b/gcloud/alpha/edge-cloud/container/clusters/get-credentials
index 8289fafb9..904925b63 100644
--- a/gcloud/alpha/edge-cloud/container/clusters/get-credentials
+++ b/gcloud/alpha/edge-cloud/container/clusters/get-credentials
@@ -28,7 +28,7 @@ EXAMPLES
             my-cluster --location=us-west1
 
 POSITIONAL ARGUMENTS
-     Cluster resource - edge-cloud container cluster to get credentials. The
+     Cluster resource - Edge Container cluster to get credentials. The
      arguments in this group can be used to specify the attributes of this
      resource. (NOTE) Some attributes are not given arguments in this group but
      can be set in other ways. To set the project attribute:
diff --git a/gcloud/alpha/functions/upgrade b/gcloud/alpha/functions/upgrade
index e46dd9a28..ed79852fb 100644
--- a/gcloud/alpha/functions/upgrade
+++ b/gcloud/alpha/functions/upgrade
@@ -21,18 +21,17 @@ EXAMPLES
 
         $ gcloud alpha functions upgrade foo --redirect-traffic
 
+    If you find you need to do more local testing you can rollback production
+    traffic to the 1st gen function copy:
+
+        $ gcloud alpha functions upgrade foo --rollback-traffic
+
     Once you're ready to finish upgrading and delete the 1st gen function copy,
     run:
 
         $ gcloud alpha functions upgrade foo --commit
 
-    Before committing, if you find you need to do more local testing you can
-    rollback production traffic to the 1st gen function copy:
-
-        $ gcloud alpha functions upgrade foo --rollback-traffic
-
-    With traffic going to the 1st gen function copy, you can abort the
-    generation upgrade process by running:
+    You can abort the generation upgrade process at any time by running:
 
         $ gcloud alpha functions upgrade foo --abort
 
diff --git a/gcloud/alpha/metastore/services/create b/gcloud/alpha/metastore/services/create
index 938dfdb44..721488bf4 100644
--- a/gcloud/alpha/metastore/services/create
+++ b/gcloud/alpha/metastore/services/create
@@ -250,10 +250,10 @@ FLAGS
        --instance-size=INSTANCE_SIZE
           The instance size of the service. INSTANCE_SIZE must be one of:
 
-           extra_large
+           extra-large
               Extra large instance size, maps to a scaling factor of 6.0.
 
-           extra_small
+           extra-small
               Extra small instance size, maps to a scaling factor of 0.1.
 
            large
diff --git a/gcloud/alpha/metastore/services/update b/gcloud/alpha/metastore/services/update
index d171d1d67..d466b7343 100644
--- a/gcloud/alpha/metastore/services/update
+++ b/gcloud/alpha/metastore/services/update
@@ -127,10 +127,10 @@ FLAGS
        --instance-size=INSTANCE_SIZE
           The instance size of the service. INSTANCE_SIZE must be one of:
 
-           extra_large
+           extra-large
               Extra large instance size, maps to a scaling factor of 6.0.
 
-           extra_small
+           extra-small
               Extra small instance size, maps to a scaling factor of 0.1.
 
            large
diff --git a/gcloud/alpha/monitoring/snoozes/cancel b/gcloud/alpha/monitoring/snoozes/cancel
index 3d721e39f..47200eee2 100644
--- a/gcloud/alpha/monitoring/snoozes/cancel
+++ b/gcloud/alpha/monitoring/snoozes/cancel
@@ -5,15 +5,14 @@ SYNOPSIS
     gcloud alpha monitoring snoozes cancel SNOOZE [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) Cancels a snooze.
+    (ALPHA) Cancel a snooze.
 
-    If the snooze is upcoming, i.e. the start time is in the future, then this
-    command is equivalent to:
+    If the start time is in the future, then this command is equivalent to:
 
       ▪ update --start-time="+PT1S" --end-time="+PT1S
 
-    Otherwise, if the snooze is active, i.e. the start time is past and the
-    ending time is in the future, then this command is equivalent to:
+    Otherwise, if the start time is past and the ending time is in the future,
+    then this command is equivalent to:
 
       ▪ update --end-time="+PT1S
 
diff --git a/gcloud/alpha/monitoring/snoozes/list b/gcloud/alpha/monitoring/snoozes/list
index 38db39ab8..596d3ea39 100644
--- a/gcloud/alpha/monitoring/snoozes/list
+++ b/gcloud/alpha/monitoring/snoozes/list
@@ -21,7 +21,7 @@ EXAMPLES
 
         $ gcloud alpha monitoring snoozes list --sort-by="~display_name"
 
-    To return results with past, i.e. historical, snoozes only:
+    To return results with expired snoozes only:
 
         $ gcloud alpha monitoring snoozes list \
             --filter="interval.end_time<+PT1S"
diff --git a/gcloud/alpha/monitoring/snoozes/update b/gcloud/alpha/monitoring/snoozes/update
index e8dd08c56..79d708382 100644
--- a/gcloud/alpha/monitoring/snoozes/update
+++ b/gcloud/alpha/monitoring/snoozes/update
@@ -8,15 +8,16 @@ SYNOPSIS
           --end-time=END_TIME --start-time=START_TIME] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) Updates a snooze.
+    (ALPHA) Update a snooze.
 
-        If `--snooze-from-file` is specified:
+    If --snooze-from-file is specified, then the update rules depend on the
+    value of the (optional) --fields flag:
 
-          * If `--fields` is specified, then only the specified fields will be
-            updated.
-          * Else, the snooze will be replaced with the provided snooze. The
-            snooze can be modified further using the flags from the Snooze
-            Settings group below.
+      ▪ If --fields is specified, then only the specified fields of the
+        snooze are updated.
+      ▪ Else, all fields of the snooze are replaced. The updated snooze can
+        be modified further using the flags from the Snooze Settings group
+        below.
 
     Otherwise, the snooze will be updated with the values specified in the
     flags from the Snooze Settings group.
diff --git a/gcloud/alpha/netapp/volumes/snapshots/create b/gcloud/alpha/netapp/volumes/snapshots/create
index 18a1ef751..5f082f901 100644
--- a/gcloud/alpha/netapp/volumes/snapshots/create
+++ b/gcloud/alpha/netapp/volumes/snapshots/create
@@ -4,9 +4,8 @@ NAME
 
 SYNOPSIS
     gcloud alpha netapp volumes snapshots create
-        (SNAPSHOT : --location=LOCATION --snapshot-volume=SNAPSHOT_VOLUME)
-        [--async] [--description=DESCRIPTION] [--labels=[KEY=VALUE,...]]
-        [--volume=VOLUME] [GCLOUD_WIDE_FLAG ...]
+        (SNAPSHOT : --location=LOCATION) [--async] [--description=DESCRIPTION]
+        [--labels=[KEY=VALUE,...]] [--volume=VOLUME] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) Creates a Cloud NetApp Volume Snapshot.
@@ -19,7 +18,10 @@ POSITIONAL ARGUMENTS
       ◆ provide the argument snapshot on the command line with a fully
         specified name;
       ◆ provide the argument --project on the command line;
-      ◆ set the property core/project.
+      ◆ set the property core/project. To set the volume attribute:
+      ◆ provide the argument snapshot on the command line with a fully
+        specified name;
+      ◆ provide the argument --volume on the command line.
 
      This must be specified.
 
@@ -39,13 +41,6 @@ POSITIONAL ARGUMENTS
           ▸ set the property netapp/location;
           ▸ set the property netapp/region.
 
-       --snapshot-volume=SNAPSHOT_VOLUME
-          The volume of the snapshot To set the volume attribute:
-          ▸ provide the argument snapshot on the command line with a fully
-            specified name;
-          ▸ provide the argument --snapshot-volume on the command line;
-          ▸ provide the argument --volume on the command line.
-
 FLAGS
      --async
         Return immediately, without waiting for the operation in progress to
@@ -67,14 +62,10 @@ FLAGS
      group but can be set in other ways. To set the project attribute:
       ◆ provide the argument --volume on the command line with a fully
         specified name;
-      ◆ provide the argument --snapshot-volume on the command line with a
-        fully specified name;
       ◆ provide the argument --project on the command line;
       ◆ set the property core/project. To set the location attribute:
       ◆ provide the argument --volume on the command line with a fully
         specified name;
-      ◆ provide the argument --snapshot-volume on the command line with a
-        fully specified name;
       ◆ provide the argument --location on the command line;
       ◆ set the property netapp/location;
       ◆ set the property netapp/region.
@@ -82,8 +73,7 @@ FLAGS
        --volume=VOLUME
           ID of the volume or fully qualified identifier for the volume. To set
           the volume attribute:
-          ▸ provide the argument --volume on the command line;
-          ▸ provide the argument --snapshot-volume on the command line.
+          ▸ provide the argument --volume on the command line.
 
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
diff --git a/gcloud/alpha/netapp/volumes/snapshots/delete b/gcloud/alpha/netapp/volumes/snapshots/delete
index 8fbeb475c..b39e4a644 100644
--- a/gcloud/alpha/netapp/volumes/snapshots/delete
+++ b/gcloud/alpha/netapp/volumes/snapshots/delete
@@ -4,9 +4,8 @@ NAME
 
 SYNOPSIS
     gcloud alpha netapp volumes snapshots delete
-        (SNAPSHOT : --location=LOCATION --snapshot-volume=SNAPSHOT_VOLUME)
-        [--async] [--description=DESCRIPTION] [--volume=VOLUME]
-        [GCLOUD_WIDE_FLAG ...]
+        (SNAPSHOT : --location=LOCATION) [--async] [--description=DESCRIPTION]
+        [--volume=VOLUME] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) Deletes a Cloud NetApp Volume Snapshot.
@@ -19,7 +18,10 @@ POSITIONAL ARGUMENTS
       ◆ provide the argument snapshot on the command line with a fully
         specified name;
       ◆ provide the argument --project on the command line;
-      ◆ set the property core/project.
+      ◆ set the property core/project. To set the volume attribute:
+      ◆ provide the argument snapshot on the command line with a fully
+        specified name;
+      ◆ provide the argument --volume on the command line.
 
      This must be specified.
 
@@ -39,13 +41,6 @@ POSITIONAL ARGUMENTS
           ▸ set the property netapp/location;
           ▸ set the property netapp/region.
 
-       --snapshot-volume=SNAPSHOT_VOLUME
-          The volume of the snapshot To set the volume attribute:
-          ▸ provide the argument snapshot on the command line with a fully
-            specified name;
-          ▸ provide the argument --snapshot-volume on the command line;
-          ▸ provide the argument --volume on the command line.
-
 FLAGS
      --async
         Return immediately, without waiting for the operation in progress to
@@ -59,14 +54,10 @@ FLAGS
      group but can be set in other ways. To set the project attribute:
       ◆ provide the argument --volume on the command line with a fully
         specified name;
-      ◆ provide the argument --snapshot-volume on the command line with a
-        fully specified name;
       ◆ provide the argument --project on the command line;
       ◆ set the property core/project. To set the location attribute:
       ◆ provide the argument --volume on the command line with a fully
         specified name;
-      ◆ provide the argument --snapshot-volume on the command line with a
-        fully specified name;
       ◆ provide the argument --location on the command line;
       ◆ set the property netapp/location;
       ◆ set the property netapp/region.
@@ -74,8 +65,7 @@ FLAGS
        --volume=VOLUME
           ID of the volume or fully qualified identifier for the volume. To set
           the volume attribute:
-          ▸ provide the argument --volume on the command line;
-          ▸ provide the argument --snapshot-volume on the command line.
+          ▸ provide the argument --volume on the command line.
 
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
diff --git a/gcloud/alpha/netapp/volumes/snapshots/describe b/gcloud/alpha/netapp/volumes/snapshots/describe
index a9e8ac5b2..f2c240225 100644
--- a/gcloud/alpha/netapp/volumes/snapshots/describe
+++ b/gcloud/alpha/netapp/volumes/snapshots/describe
@@ -4,8 +4,8 @@ NAME
 
 SYNOPSIS
     gcloud alpha netapp volumes snapshots describe
-        (SNAPSHOT : --location=LOCATION --snapshot-volume=SNAPSHOT_VOLUME)
-        [--volume=VOLUME] [GCLOUD_WIDE_FLAG ...]
+        (SNAPSHOT : --location=LOCATION) [--volume=VOLUME]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) Describes a Cloud NetApp Volume Snapshot.
@@ -18,7 +18,10 @@ POSITIONAL ARGUMENTS
       ◆ provide the argument snapshot on the command line with a fully
         specified name;
       ◆ provide the argument --project on the command line;
-      ◆ set the property core/project.
+      ◆ set the property core/project. To set the volume attribute:
+      ◆ provide the argument snapshot on the command line with a fully
+        specified name;
+      ◆ provide the argument --volume on the command line.
 
      This must be specified.
 
@@ -38,27 +41,16 @@ POSITIONAL ARGUMENTS
           ▸ set the property netapp/location;
           ▸ set the property netapp/region.
 
-       --snapshot-volume=SNAPSHOT_VOLUME
-          The volume of the snapshot To set the volume attribute:
-          ▸ provide the argument snapshot on the command line with a fully
-            specified name;
-          ▸ provide the argument --snapshot-volume on the command line;
-          ▸ provide the argument --volume on the command line.
-
 FLAGS
      Volume resource - The Volume to take a Snapshot of. This represents a
      Cloud resource. (NOTE) Some attributes are not given arguments in this
      group but can be set in other ways. To set the project attribute:
       ◆ provide the argument --volume on the command line with a fully
         specified name;
-      ◆ provide the argument --snapshot-volume on the command line with a
-        fully specified name;
       ◆ provide the argument --project on the command line;
       ◆ set the property core/project. To set the location attribute:
       ◆ provide the argument --volume on the command line with a fully
         specified name;
-      ◆ provide the argument --snapshot-volume on the command line with a
-        fully specified name;
       ◆ provide the argument --location on the command line;
       ◆ set the property netapp/location;
       ◆ set the property netapp/region.
@@ -66,8 +58,7 @@ FLAGS
        --volume=VOLUME
           ID of the volume or fully qualified identifier for the volume. To set
           the volume attribute:
-          ▸ provide the argument --volume on the command line;
-          ▸ provide the argument --snapshot-volume on the command line.
+          ▸ provide the argument --volume on the command line.
 
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
diff --git a/gcloud/alpha/netapp/volumes/snapshots/list b/gcloud/alpha/netapp/volumes/snapshots/list
index f630845c4..f18d0facc 100644
--- a/gcloud/alpha/netapp/volumes/snapshots/list
+++ b/gcloud/alpha/netapp/volumes/snapshots/list
@@ -37,14 +37,10 @@ FLAGS
      group but can be set in other ways. To set the project attribute:
       ◆ provide the argument --volume on the command line with a fully
         specified name;
-      ◆ provide the argument --snapshot-volume on the command line with a
-        fully specified name;
       ◆ provide the argument --project on the command line;
       ◆ set the property core/project. To set the location attribute:
       ◆ provide the argument --volume on the command line with a fully
         specified name;
-      ◆ provide the argument --snapshot-volume on the command line with a
-        fully specified name;
       ◆ provide the argument --location on the command line;
       ◆ set the property netapp/location;
       ◆ set the property netapp/region.
@@ -52,8 +48,7 @@ FLAGS
        --volume=VOLUME
           ID of the volume or fully qualified identifier for the volume. To set
           the volume attribute:
-          ▸ provide the argument --volume on the command line;
-          ▸ provide the argument --snapshot-volume on the command line.
+          ▸ provide the argument --volume on the command line.
 
 LIST COMMAND FLAGS
      --filter=EXPRESSION
diff --git a/gcloud/alpha/netapp/volumes/snapshots/update b/gcloud/alpha/netapp/volumes/snapshots/update
index a685c32b6..21ca5ebae 100644
--- a/gcloud/alpha/netapp/volumes/snapshots/update
+++ b/gcloud/alpha/netapp/volumes/snapshots/update
@@ -4,10 +4,9 @@ NAME
 
 SYNOPSIS
     gcloud alpha netapp volumes snapshots update
-        (SNAPSHOT : --location=LOCATION --snapshot-volume=SNAPSHOT_VOLUME)
-        [--async] [--description=DESCRIPTION] [--update-labels=[KEY=VALUE,...]]
-        [--volume=VOLUME] [--clear-labels | --remove-labels=[KEY,...]]
-        [GCLOUD_WIDE_FLAG ...]
+        (SNAPSHOT : --location=LOCATION) [--async] [--description=DESCRIPTION]
+        [--update-labels=[KEY=VALUE,...]] [--volume=VOLUME]
+        [--clear-labels | --remove-labels=[KEY,...]] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) Creates a Cloud NetApp Volume Snapshot.
@@ -20,7 +19,10 @@ POSITIONAL ARGUMENTS
       ◆ provide the argument snapshot on the command line with a fully
         specified name;
       ◆ provide the argument --project on the command line;
-      ◆ set the property core/project.
+      ◆ set the property core/project. To set the volume attribute:
+      ◆ provide the argument snapshot on the command line with a fully
+        specified name;
+      ◆ provide the argument --volume on the command line.
 
      This must be specified.
 
@@ -40,13 +42,6 @@ POSITIONAL ARGUMENTS
           ▸ set the property netapp/location;
           ▸ set the property netapp/region.
 
-       --snapshot-volume=SNAPSHOT_VOLUME
-          The volume of the snapshot To set the volume attribute:
-          ▸ provide the argument snapshot on the command line with a fully
-            specified name;
-          ▸ provide the argument --snapshot-volume on the command line;
-          ▸ provide the argument --volume on the command line.
-
 FLAGS
      --async
         Return immediately, without waiting for the operation in progress to
@@ -69,14 +64,10 @@ FLAGS
      group but can be set in other ways. To set the project attribute:
       ◆ provide the argument --volume on the command line with a fully
         specified name;
-      ◆ provide the argument --snapshot-volume on the command line with a
-        fully specified name;
       ◆ provide the argument --project on the command line;
       ◆ set the property core/project. To set the location attribute:
       ◆ provide the argument --volume on the command line with a fully
         specified name;
-      ◆ provide the argument --snapshot-volume on the command line with a
-        fully specified name;
       ◆ provide the argument --location on the command line;
       ◆ set the property netapp/location;
       ◆ set the property netapp/region.
@@ -84,8 +75,7 @@ FLAGS
        --volume=VOLUME
           ID of the volume or fully qualified identifier for the volume. To set
           the volume attribute:
-          ▸ provide the argument --volume on the command line;
-          ▸ provide the argument --snapshot-volume on the command line.
+          ▸ provide the argument --volume on the command line.
 
      At most one of these can be specified:
 
diff --git a/gcloud/alpha/network-security/gateway-security-policies/delete b/gcloud/alpha/network-security/gateway-security-policies/delete
index 7c3c1895c..e917d98c5 100644
--- a/gcloud/alpha/network-security/gateway-security-policies/delete
+++ b/gcloud/alpha/network-security/gateway-security-policies/delete
@@ -1,6 +1,6 @@
 NAME
     gcloud alpha network-security gateway-security-policies delete - delete
-        GatewaySecurityPolicy
+        Gateway Security Policy
 
 SYNOPSIS
     gcloud alpha network-security gateway-security-policies delete
@@ -8,16 +8,17 @@ SYNOPSIS
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) Delete the specified GatewaySecurityPolicy.
+    (ALPHA) Delete the specified Gateway Security Policy.
 
 EXAMPLES
-    To delete a GatewaySecurityPolicy called 'my-gateway-security-policy', run:
+    To delete a Gateway Security Policy called 'my-gateway-security-policy',
+    run:
 
         $ gcloud alpha network-security gateway-security-policies delete \
             my-gateway-security-policy --location=global
 
 POSITIONAL ARGUMENTS
-     Gateway security policy resource - Name of the GatewaySecurityPolicy you
+     Gateway security policy resource - Name of the Gateway Security Policy you
      want to delete. The arguments in this group can be used to specify the
      attributes of this resource. (NOTE) Some attributes are not given
      arguments in this group but can be set in other ways. To set the project
@@ -67,5 +68,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud beta network-security gateway-security-policies delete
 
diff --git a/gcloud/alpha/network-security/gateway-security-policies/export b/gcloud/alpha/network-security/gateway-security-policies/export
index 2f7eb3391..ce63d84db 100644
--- a/gcloud/alpha/network-security/gateway-security-policies/export
+++ b/gcloud/alpha/network-security/gateway-security-policies/export
@@ -1,6 +1,6 @@
 NAME
     gcloud alpha network-security gateway-security-policies export - export
-        GatewaySecurityPolicy
+        Gateway Security Policy
 
 SYNOPSIS
     gcloud alpha network-security gateway-security-policies export
@@ -8,10 +8,10 @@ SYNOPSIS
         [--destination=DESTINATION] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) Export a GatewaySecurityPolicy.
+    (ALPHA) Export a Gateway Security Policy.
 
 EXAMPLES
-    To export a GatewaySecurityPolicy, run:
+    To export a Gateway Security Policy, run:
 
         $ gcloud alpha network-security gateway-security-policies export \
             my-gateway-security-policy \
@@ -19,7 +19,7 @@ EXAMPLES
             --location=global
 
 POSITIONAL ARGUMENTS
-     Gateway security policy resource - Name of the GatewaySecurityPolicy to
+     Gateway security policy resource - Name of the Gateway Security Policy to
      export. The arguments in this group can be used to specify the attributes
      of this resource. (NOTE) Some attributes are not given arguments in this
      group but can be set in other ways. To set the project attribute:
@@ -71,5 +71,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud beta network-security gateway-security-policies export
 
diff --git a/gcloud/alpha/network-security/gateway-security-policies/help b/gcloud/alpha/network-security/gateway-security-policies/help
index fee292583..cabfb60df 100644
--- a/gcloud/alpha/network-security/gateway-security-policies/help
+++ b/gcloud/alpha/network-security/gateway-security-policies/help
@@ -1,13 +1,13 @@
 NAME
     gcloud alpha network-security gateway-security-policies - manage Network
-        Security GatewaySecurityPolicies
+        Security Gateway Security Policies
 
 SYNOPSIS
     gcloud alpha network-security gateway-security-policies GROUP | COMMAND
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) Manage Network Security GatewaySecurityPolicies.
+    (ALPHA) Manage Network Security Gateway Security Policies.
 
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --help.
@@ -24,20 +24,22 @@ COMMANDS
     COMMAND is one of the following:
 
      delete
-        (ALPHA) Delete GatewaySecurityPolicy.
+        (ALPHA) Delete Gateway Security Policy.
 
      export
-        (ALPHA) Export GatewaySecurityPolicy.
+        (ALPHA) Export Gateway Security Policy.
 
      import
-        (ALPHA) Import GatewaySecurityPolicy.
+        (ALPHA) Import Gateway Security Policy.
 
      list
-        (ALPHA) List GatewaySecurityPolicies.
+        (ALPHA) List Gateway Security Policies.
 
 NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud beta network-security gateway-security-policies
 
diff --git a/gcloud/alpha/network-security/gateway-security-policies/import b/gcloud/alpha/network-security/gateway-security-policies/import
index 8fd6c0c93..800afe710 100644
--- a/gcloud/alpha/network-security/gateway-security-policies/import
+++ b/gcloud/alpha/network-security/gateway-security-policies/import
@@ -1,6 +1,6 @@
 NAME
     gcloud alpha network-security gateway-security-policies import - import
-        GatewaySecurityPolicy
+        Gateway Security Policy
 
 SYNOPSIS
     gcloud alpha network-security gateway-security-policies import
@@ -8,17 +8,17 @@ SYNOPSIS
         [--source=SOURCE] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) Import a GatewaySecurityPolicy.
+    (ALPHA) Import a Gateway Security Policy.
 
 EXAMPLES
-    To import a GatewaySecurityPolicy from a YAML file, run:
+    To import a Gateway Security Policy from a YAML file, run:
 
         $ gcloud alpha network-security gateway-security-policies import \
             my-gateway-security-policy \
             --source=my-gateway-security-policy-list.yaml --location=global
 
 POSITIONAL ARGUMENTS
-     Gateway security policy resource - Name of the GatewaySecurityPolicy to
+     Gateway security policy resource - Name of the Gateway Security Policy to
      import. The arguments in this group can be used to specify the attributes
      of this resource. (NOTE) Some attributes are not given arguments in this
      group but can be set in other ways. To set the project attribute:
@@ -77,5 +77,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud beta network-security gateway-security-policies import
 
diff --git a/gcloud/alpha/network-security/gateway-security-policies/list b/gcloud/alpha/network-security/gateway-security-policies/list
index 06a088da3..fbe0ed622 100644
--- a/gcloud/alpha/network-security/gateway-security-policies/list
+++ b/gcloud/alpha/network-security/gateway-security-policies/list
@@ -1,6 +1,6 @@
 NAME
-    gcloud alpha network-security gateway-security-policies list - list
-        GatewaySecurityPolicies
+    gcloud alpha network-security gateway-security-policies list - list Gateway
+        Security Policies
 
 SYNOPSIS
     gcloud alpha network-security gateway-security-policies list
@@ -9,20 +9,20 @@ SYNOPSIS
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) List all GatewaySecurityPolicies in the specified location of the
+    (ALPHA) List all Gateway Security Policies in the specified location of the
     current project.
 
 EXAMPLES
-    To list GatewaySecurityPolicies in the current project, run:
+    To list Gateway Security Policies in the current project, run:
 
         $ gcloud alpha network-security gateway-security-policies list \
             --location=global
 
 REQUIRED FLAGS
-     Location resource - The project of the GatewaySecurityPolicies to display.
-     This represents a Cloud resource. (NOTE) Some attributes are not given
-     arguments in this group but can be set in other ways. To set the project
-     attribute:
+     Location resource - The project of the Gateway Security Policies to
+     display. This represents a Cloud resource. (NOTE) Some attributes are not
+     given arguments in this group but can be set in other ways. To set the
+     project attribute:
       ◆ provide the argument --location on the command line with a fully
         specified name;
       ◆ set the property core/project;
@@ -83,5 +83,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud beta network-security gateway-security-policies list
 
diff --git a/gcloud/alpha/network-security/gateway-security-policies/rules/delete b/gcloud/alpha/network-security/gateway-security-policies/rules/delete
index ba89549d2..98e75acf7 100644
--- a/gcloud/alpha/network-security/gateway-security-policies/rules/delete
+++ b/gcloud/alpha/network-security/gateway-security-policies/rules/delete
@@ -78,5 +78,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud beta network-security gateway-security-policies rules delete
 
diff --git a/gcloud/alpha/network-security/gateway-security-policies/rules/export b/gcloud/alpha/network-security/gateway-security-policies/rules/export
index 047bc50f7..a61083871 100644
--- a/gcloud/alpha/network-security/gateway-security-policies/rules/export
+++ b/gcloud/alpha/network-security/gateway-security-policies/rules/export
@@ -82,5 +82,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud beta network-security gateway-security-policies rules export
 
diff --git a/gcloud/alpha/network-security/gateway-security-policies/rules/help b/gcloud/alpha/network-security/gateway-security-policies/rules/help
index 4af602be1..9163a4796 100644
--- a/gcloud/alpha/network-security/gateway-security-policies/rules/help
+++ b/gcloud/alpha/network-security/gateway-security-policies/rules/help
@@ -33,5 +33,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud beta network-security gateway-security-policies rules
 
diff --git a/gcloud/alpha/network-security/gateway-security-policies/rules/import b/gcloud/alpha/network-security/gateway-security-policies/rules/import
index 6ae8ee7f9..3237d6663 100644
--- a/gcloud/alpha/network-security/gateway-security-policies/rules/import
+++ b/gcloud/alpha/network-security/gateway-security-policies/rules/import
@@ -89,5 +89,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud beta network-security gateway-security-policies rules import
 
diff --git a/gcloud/alpha/network-security/gateway-security-policies/rules/list b/gcloud/alpha/network-security/gateway-security-policies/rules/list
index 6c36bb585..ce6f3820e 100644
--- a/gcloud/alpha/network-security/gateway-security-policies/rules/list
+++ b/gcloud/alpha/network-security/gateway-security-policies/rules/list
@@ -98,5 +98,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud beta network-security gateway-security-policies rules list
 
diff --git a/gcloud/alpha/network-security/help b/gcloud/alpha/network-security/help
index 7efe43a16..e5550de90 100644
--- a/gcloud/alpha/network-security/help
+++ b/gcloud/alpha/network-security/help
@@ -22,7 +22,7 @@ GROUPS
         (ALPHA) Manage Network Security ClientTlsPolicies.
 
      gateway-security-policies
-        (ALPHA) Manage Network Security GatewaySecurityPolicies.
+        (ALPHA) Manage Network Security Gateway Security Policies.
 
      server-tls-policies
         (ALPHA) Manage Network Security ServerTlsPolicies.
diff --git a/gcloud/alpha/network-security/url-lists/delete b/gcloud/alpha/network-security/url-lists/delete
index babf11c0f..62d1348b7 100644
--- a/gcloud/alpha/network-security/url-lists/delete
+++ b/gcloud/alpha/network-security/url-lists/delete
@@ -63,5 +63,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud beta network-security url-lists delete
 
diff --git a/gcloud/alpha/network-security/url-lists/export b/gcloud/alpha/network-security/url-lists/export
index 9215299bb..ef08b608c 100644
--- a/gcloud/alpha/network-security/url-lists/export
+++ b/gcloud/alpha/network-security/url-lists/export
@@ -67,5 +67,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud beta network-security url-lists export
 
diff --git a/gcloud/alpha/network-security/url-lists/help b/gcloud/alpha/network-security/url-lists/help
index f6e5527a1..6587916fd 100644
--- a/gcloud/alpha/network-security/url-lists/help
+++ b/gcloud/alpha/network-security/url-lists/help
@@ -31,5 +31,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud beta network-security url-lists
 
diff --git a/gcloud/alpha/network-security/url-lists/import b/gcloud/alpha/network-security/url-lists/import
index 8738da055..70a608bbc 100644
--- a/gcloud/alpha/network-security/url-lists/import
+++ b/gcloud/alpha/network-security/url-lists/import
@@ -74,5 +74,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud beta network-security url-lists import
 
diff --git a/gcloud/alpha/network-security/url-lists/list b/gcloud/alpha/network-security/url-lists/list
index be9406a04..45b68f22b 100644
--- a/gcloud/alpha/network-security/url-lists/list
+++ b/gcloud/alpha/network-security/url-lists/list
@@ -79,5 +79,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud beta network-security url-lists list
 
diff --git a/gcloud/alpha/recaptcha/firewall-policies/create b/gcloud/alpha/recaptcha/firewall-policies/create
new file mode 100644
index 000000000..736dcef89
--- /dev/null
+++ b/gcloud/alpha/recaptcha/firewall-policies/create
@@ -0,0 +1,76 @@
+NAME
+    gcloud alpha recaptcha firewall-policies create - create a Firewall Policy
+
+SYNOPSIS
+    gcloud alpha recaptcha firewall-policies create [--actions=ACTIONS]
+        [--condition=CONDITION] [--description=DESCRIPTION] [--path=PATH]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Create a reCAPTCHA Firewall Policy.
+
+EXAMPLES
+    To create a new reCAPTCHA firewall policy covering the path "/login/" for
+    all requests with a reCAPTCHA Lite score of >= 0.5 to allow the requests
+    and set the header 'foo' to the value 'bar':
+
+        $ gcloud alpha recaptcha firewall-policies create \
+            --path='/login/*' \
+            --condition='recaptcha.assessment_type == AssessmentType.LITE
+        && recaptcha.score >= 0.5' --actions=allow,set_header=foo=bar
+
+FLAGS
+     --actions=ACTIONS
+        The actions that the caller should take regarding the user. There
+        should be at most 1 terminal action. A terminal action is any action
+        that forces a response, such as Allow, Block or Substitute. If it makes
+        sense for it to happen multple times, such as SetHeader, the action is
+        non-terminal.
+
+        Examples:
+        ◆ Block and set the header with key foo to value bar
+          ▸ --actions=block,set_header=foo=bar
+        ◆ Substitute with path google.com and set two headers, one with key
+          key1 to value value1 and one with key key2 to value value2
+          ▸ --actions=substitute=google.com,set_header=key1=value1,set_header=key2=value2
+
+     --condition=CONDITION
+        A CEL (Common Expression Language) conditional expression that
+        specifies if this policy applies to an incoming user request. If this
+        condition evaluates to true and the requested path matched the path
+        pattern, the associated actions should be executed by the caller. The
+        condition string is checked for CEL syntax correctness on creation. For
+        more information, see the CEL spec: https://github.com/google/cel-spec
+        and its language definition:
+        https://github.com/google/cel-spec/blob/master/doc/langdef.md
+
+     --description=DESCRIPTION
+        A description of what this policy aims to achieve, for convenience
+        purposes. The description can at most include 256 UTF-8 characters.
+
+     --path=PATH
+        The path for which this policy applies, specified as a glob pattern.
+        For more information on glob, see the manual page:
+        https://man7.org/linux/man-pages/man7/glob.7.html.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the recaptchaenterprise/v1 API. The full documentation
+    for this API can be found at:
+    https://cloud.google.com/recaptcha-enterprise/
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. This variant is also available:
+
+        $ gcloud recaptcha firewall-policies create
+
diff --git a/gcloud/alpha/recaptcha/firewall-policies/delete b/gcloud/alpha/recaptcha/firewall-policies/delete
new file mode 100644
index 000000000..03c856c7a
--- /dev/null
+++ b/gcloud/alpha/recaptcha/firewall-policies/delete
@@ -0,0 +1,55 @@
+NAME
+    gcloud alpha recaptcha firewall-policies delete - delete one or more
+        reCAPTCHA Firewall Policies
+
+SYNOPSIS
+    gcloud alpha recaptcha firewall-policies delete FIREWALL_POLICY
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Delete one or more reCAPTCHA Firewall Policies from a given cloud
+    project.
+
+EXAMPLES
+    To delete a reCAPTCHA firewall policies, run:
+
+        $ gcloud alpha recaptcha firewall-policies delete policy-id
+
+POSITIONAL ARGUMENTS
+     Firewall policy resource - The reCAPTCHA firewall policy to delete. This
+     represents a Cloud resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways. To set the project
+     attribute:
+      ◆ provide the argument firewall_policy on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       FIREWALL_POLICY
+          ID of the firewall_policy or fully qualified identifier for the
+          firewall_policy. To set the firewall_policy attribute:
+          ▸ provide the argument firewall_policy on the command line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the recaptchaenterprise/v1 API. The full documentation
+    for this API can be found at:
+    https://cloud.google.com/recaptcha-enterprise/
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. This variant is also available:
+
+        $ gcloud recaptcha firewall-policies delete
+
diff --git a/gcloud/alpha/recaptcha/firewall-policies/describe b/gcloud/alpha/recaptcha/firewall-policies/describe
new file mode 100644
index 000000000..33fb2d6d1
--- /dev/null
+++ b/gcloud/alpha/recaptcha/firewall-policies/describe
@@ -0,0 +1,54 @@
+NAME
+    gcloud alpha recaptcha firewall-policies describe - describe reCAPTCHA
+        Firewall Policy
+
+SYNOPSIS
+    gcloud alpha recaptcha firewall-policies describe FIREWALL_POLICY
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Get the details of a reCAPTCHA Firewall Policy.
+
+EXAMPLES
+    To get details on a reCAPTCHA firewall policy, run:
+
+        $ gcloud alpha recaptcha firewall-policies describe policy-id
+
+POSITIONAL ARGUMENTS
+     Firewall policy resource - The reCAPTCHA firewall policy to describe. This
+     represents a Cloud resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways. To set the project
+     attribute:
+      ◆ provide the argument firewall_policy on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       FIREWALL_POLICY
+          ID of the firewall_policy or fully qualified identifier for the
+          firewall_policy. To set the firewall_policy attribute:
+          ▸ provide the argument firewall_policy on the command line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the recaptchaenterprise/v1 API. The full documentation
+    for this API can be found at:
+    https://cloud.google.com/recaptcha-enterprise/
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. This variant is also available:
+
+        $ gcloud recaptcha firewall-policies describe
+
diff --git a/gcloud/alpha/recaptcha/firewall-policies/help b/gcloud/alpha/recaptcha/firewall-policies/help
new file mode 100644
index 000000000..f27a679c3
--- /dev/null
+++ b/gcloud/alpha/recaptcha/firewall-policies/help
@@ -0,0 +1,41 @@
+NAME
+    gcloud alpha recaptcha firewall-policies - managed reCAPTCHA Firewall
+        Policies
+
+SYNOPSIS
+    gcloud alpha recaptcha firewall-policies COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Managed reCAPTCHA Firewall Policies.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     create
+        (ALPHA) Create a Firewall Policy.
+
+     delete
+        (ALPHA) Delete one or more reCAPTCHA Firewall Policies.
+
+     describe
+        (ALPHA) Describe reCAPTCHA Firewall Policy.
+
+     list
+        (ALPHA) List reCAPTCHA Firewall Policies.
+
+     update
+        (ALPHA) Update a Firewall Policy.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. This variant is also available:
+
+        $ gcloud recaptcha firewall-policies
+
diff --git a/gcloud/alpha/recaptcha/firewall-policies/list b/gcloud/alpha/recaptcha/firewall-policies/list
new file mode 100644
index 000000000..76298cac1
--- /dev/null
+++ b/gcloud/alpha/recaptcha/firewall-policies/list
@@ -0,0 +1,71 @@
+NAME
+    gcloud alpha recaptcha firewall-policies list - list reCAPTCHA Firewall
+        Policies
+
+SYNOPSIS
+    gcloud alpha recaptcha firewall-policies list [--filter=EXPRESSION]
+        [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) List all of the reCAPTCHA Firewall Policies that exist in a given
+    project.
+
+EXAMPLES
+    To list all the reCAPTCHA firewall policies existing for your project, run:
+
+        $ gcloud alpha recaptcha firewall-policies list
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the recaptchaenterprise/v1 API. The full documentation
+    for this API can be found at:
+    https://cloud.google.com/recaptcha-enterprise/
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. This variant is also available:
+
+        $ gcloud recaptcha firewall-policies list
+
diff --git a/gcloud/alpha/recaptcha/firewall-policies/update b/gcloud/alpha/recaptcha/firewall-policies/update
new file mode 100644
index 000000000..7619fe5f1
--- /dev/null
+++ b/gcloud/alpha/recaptcha/firewall-policies/update
@@ -0,0 +1,89 @@
+NAME
+    gcloud alpha recaptcha firewall-policies update - update a Firewall Policy
+
+SYNOPSIS
+    gcloud alpha recaptcha firewall-policies update FIREWALL_POLICY
+        [--actions=ACTIONS] [--condition=CONDITION] [--description=DESCRIPTION]
+        [--path=PATH] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Update a reCAPTCHA Firewall Policy.
+
+EXAMPLES
+    To update the information of a reCAPTCHA firewall policy, run:
+
+        $ gcloud alpha recaptcha firewall-policies update policy-id \
+            --description='updated description' --actions=block
+
+POSITIONAL ARGUMENTS
+     Firewall policy resource - The reCAPTCHA firewall policy to update. This
+     represents a Cloud resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways. To set the project
+     attribute:
+      ◆ provide the argument firewall_policy on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       FIREWALL_POLICY
+          ID of the firewall_policy or fully qualified identifier for the
+          firewall_policy. To set the firewall_policy attribute:
+          ▸ provide the argument firewall_policy on the command line.
+
+FLAGS
+     --actions=ACTIONS
+        The actions that the caller should take regarding the user. There
+        should be at most 1 terminal action. A terminal action is any action
+        that forces a response, such as Allow, Block or Substitute. If it makes
+        sense for it to happen multple times, such as SetHeader, the action is
+        non-terminal.
+
+        Examples:
+        ◆ Block and set the header with key foo to value bar
+          ▸ --actions=block,set_header=foo=bar
+        ◆ Substitute with path google.com and set two headers, one with key
+          key1 to value value1 and one with key key2 to value value2
+          ▸ --actions=substitute=google.com,set_header=key1=value1,set_header=key2=value2
+
+     --condition=CONDITION
+        A CEL (Common Expression Language) conditional expression that
+        specifies if this policy applies to an incoming user request. If this
+        condition evaluates to true and the requested path matched the path
+        pattern, the associated actions should be executed by the caller. The
+        condition string is checked for CEL syntax correctness on creation. For
+        more information, see the CEL spec: https://github.com/google/cel-spec
+        and its language definition:
+        https://github.com/google/cel-spec/blob/master/doc/langdef.md
+
+     --description=DESCRIPTION
+        A description of what this policy aims to achieve, for convenience
+        purposes. The description can at most include 256 UTF-8 characters.
+
+     --path=PATH
+        The path for which this policy applies, specified as a glob pattern.
+        For more information on glob, see the manual page:
+        https://man7.org/linux/man-pages/man7/glob.7.html.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the recaptchaenterprise/v1 API. The full documentation
+    for this API can be found at:
+    https://cloud.google.com/recaptcha-enterprise/
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. This variant is also available:
+
+        $ gcloud recaptcha firewall-policies update
+
diff --git a/gcloud/alpha/recaptcha/help b/gcloud/alpha/recaptcha/help
index fc0e72899..c69727f73 100644
--- a/gcloud/alpha/recaptcha/help
+++ b/gcloud/alpha/recaptcha/help
@@ -15,6 +15,9 @@ GCLOUD WIDE FLAGS
 GROUPS
     GROUP is one of the following:
 
+     firewall-policies
+        (ALPHA) Managed reCAPTCHA Firewall Policies.
+
      keys
         (ALPHA) Managed reCAPTCHA Keys.
 
diff --git a/gcloud/alpha/recaptcha/keys/create b/gcloud/alpha/recaptcha/keys/create
index 7c80bdbfe..210054db1 100644
--- a/gcloud/alpha/recaptcha/keys/create
+++ b/gcloud/alpha/recaptcha/keys/create
@@ -45,7 +45,7 @@ REQUIRED FLAGS
             Store.
 
             This setting allows your key to accept traffic from devices without
-            Google Mobility Services (GMS) installed.
+            Google Mobile Services (GMS) installed.
 
          Exactly one of these must be specified:
 
diff --git a/gcloud/alpha/redis/instances/update b/gcloud/alpha/redis/instances/update
index 90792e98a..fbea1108b 100644
--- a/gcloud/alpha/redis/instances/update
+++ b/gcloud/alpha/redis/instances/update
@@ -4,6 +4,7 @@ NAME
 SYNOPSIS
     gcloud alpha redis instances update (INSTANCE : --region=REGION) [--async]
         [--display-name=DISPLAY_NAME] [--enable-auth]
+        [--maintenance-version=MAINTENANCE_VERSION]
         [--persistence-mode=PERSISTENCE_MODE]
         [--rdb-snapshot-period=RDB_SNAPSHOT_PERIOD]
         [--rdb-snapshot-start-time=RDB_SNAPSHOT_START_TIME]
@@ -77,6 +78,15 @@ FLAGS
      --enable-auth
         Enables Redis AUTH for the instance.
 
+     --maintenance-version=MAINTENANCE_VERSION
+        Specifies which maintenance version to apply to your instance during
+        self-service maintenance. To view the available maintenance versions
+        for your instance, run gcloud redis instances describe [INSTANCE_ID].
+        Acceptable values for this flag are either latest or one of the
+        specific versions listed by the describe command. If you pass the value
+        latest, the Memorystore updates to the most recent available
+        maintenance version during self service maintenance.
+
      --persistence-mode=PERSISTENCE_MODE
         Operation mode for automated persistence. PERSISTENCE_MODE must be one
         of:
diff --git a/gcloud/alpha/run/jobs/add-iam-policy-binding b/gcloud/alpha/run/jobs/add-iam-policy-binding
index 2260ed937..286758442 100644
--- a/gcloud/alpha/run/jobs/add-iam-policy-binding
+++ b/gcloud/alpha/run/jobs/add-iam-policy-binding
@@ -86,7 +86,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud run jobs add-iam-policy-binding
 
         $ gcloud beta run jobs add-iam-policy-binding
 
diff --git a/gcloud/alpha/run/jobs/create b/gcloud/alpha/run/jobs/create
index 8b3bbc01c..26290135d 100644
--- a/gcloud/alpha/run/jobs/create
+++ b/gcloud/alpha/run/jobs/create
@@ -191,7 +191,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud run jobs create
 
         $ gcloud beta run jobs create
 
diff --git a/gcloud/alpha/run/jobs/delete b/gcloud/alpha/run/jobs/delete
index 104dd6a03..6db70ed3b 100644
--- a/gcloud/alpha/run/jobs/delete
+++ b/gcloud/alpha/run/jobs/delete
@@ -45,7 +45,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud run jobs delete
 
         $ gcloud beta run jobs delete
 
diff --git a/gcloud/alpha/run/jobs/describe b/gcloud/alpha/run/jobs/describe
index 127da4dd2..16af8da53 100644
--- a/gcloud/alpha/run/jobs/describe
+++ b/gcloud/alpha/run/jobs/describe
@@ -45,7 +45,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud run jobs describe
 
         $ gcloud beta run jobs describe
 
diff --git a/gcloud/alpha/run/jobs/execute b/gcloud/alpha/run/jobs/execute
index 7e5147311..d03dcab8b 100644
--- a/gcloud/alpha/run/jobs/execute
+++ b/gcloud/alpha/run/jobs/execute
@@ -57,7 +57,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud run jobs execute
 
         $ gcloud beta run jobs execute
 
diff --git a/gcloud/alpha/run/jobs/executions/delete b/gcloud/alpha/run/jobs/executions/delete
index 5a55f98ea..379b9bc46 100644
--- a/gcloud/alpha/run/jobs/executions/delete
+++ b/gcloud/alpha/run/jobs/executions/delete
@@ -46,7 +46,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud run jobs executions delete
 
         $ gcloud beta run jobs executions delete
 
diff --git a/gcloud/alpha/run/jobs/executions/describe b/gcloud/alpha/run/jobs/executions/describe
index a82b54106..4e7b86822 100644
--- a/gcloud/alpha/run/jobs/executions/describe
+++ b/gcloud/alpha/run/jobs/executions/describe
@@ -46,7 +46,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud run jobs executions describe
 
         $ gcloud beta run jobs executions describe
 
diff --git a/gcloud/alpha/run/jobs/executions/help b/gcloud/alpha/run/jobs/executions/help
index 3c406fcb7..8c7b88a98 100644
--- a/gcloud/alpha/run/jobs/executions/help
+++ b/gcloud/alpha/run/jobs/executions/help
@@ -50,7 +50,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud run jobs executions
 
         $ gcloud beta run jobs executions
 
diff --git a/gcloud/alpha/run/jobs/executions/list b/gcloud/alpha/run/jobs/executions/list
index c90e01057..3886ec775 100644
--- a/gcloud/alpha/run/jobs/executions/list
+++ b/gcloud/alpha/run/jobs/executions/list
@@ -80,7 +80,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud run jobs executions list
 
         $ gcloud beta run jobs executions list
 
diff --git a/gcloud/alpha/run/jobs/executions/tasks/describe b/gcloud/alpha/run/jobs/executions/tasks/describe
index 4a7431d07..277b0d5e3 100644
--- a/gcloud/alpha/run/jobs/executions/tasks/describe
+++ b/gcloud/alpha/run/jobs/executions/tasks/describe
@@ -47,7 +47,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud run jobs executions tasks describe
 
         $ gcloud beta run jobs executions tasks describe
 
diff --git a/gcloud/alpha/run/jobs/executions/tasks/help b/gcloud/alpha/run/jobs/executions/tasks/help
index 60c51ec5f..9086d669d 100644
--- a/gcloud/alpha/run/jobs/executions/tasks/help
+++ b/gcloud/alpha/run/jobs/executions/tasks/help
@@ -39,7 +39,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud run jobs executions tasks
 
         $ gcloud beta run jobs executions tasks
 
diff --git a/gcloud/alpha/run/jobs/executions/tasks/list b/gcloud/alpha/run/jobs/executions/tasks/list
index 4a854922d..c10da2bce 100644
--- a/gcloud/alpha/run/jobs/executions/tasks/list
+++ b/gcloud/alpha/run/jobs/executions/tasks/list
@@ -84,7 +84,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud run jobs executions tasks list
 
         $ gcloud beta run jobs executions tasks list
 
diff --git a/gcloud/alpha/run/jobs/get-iam-policy b/gcloud/alpha/run/jobs/get-iam-policy
index 7ebeed3ad..473c28abc 100644
--- a/gcloud/alpha/run/jobs/get-iam-policy
+++ b/gcloud/alpha/run/jobs/get-iam-policy
@@ -89,7 +89,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud run jobs get-iam-policy
 
         $ gcloud beta run jobs get-iam-policy
 
diff --git a/gcloud/alpha/run/jobs/help b/gcloud/alpha/run/jobs/help
index a6ffbd4a3..03b841488 100644
--- a/gcloud/alpha/run/jobs/help
+++ b/gcloud/alpha/run/jobs/help
@@ -76,7 +76,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud run jobs
 
         $ gcloud beta run jobs
 
diff --git a/gcloud/alpha/run/jobs/list b/gcloud/alpha/run/jobs/list
index 5a0140398..8142743c3 100644
--- a/gcloud/alpha/run/jobs/list
+++ b/gcloud/alpha/run/jobs/list
@@ -76,7 +76,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud run jobs list
 
         $ gcloud beta run jobs list
 
diff --git a/gcloud/alpha/run/jobs/remove-iam-policy-binding b/gcloud/alpha/run/jobs/remove-iam-policy-binding
index 3fccd63a8..16897c9c2 100644
--- a/gcloud/alpha/run/jobs/remove-iam-policy-binding
+++ b/gcloud/alpha/run/jobs/remove-iam-policy-binding
@@ -88,7 +88,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud run jobs remove-iam-policy-binding
 
         $ gcloud beta run jobs remove-iam-policy-binding
 
diff --git a/gcloud/alpha/run/jobs/replace b/gcloud/alpha/run/jobs/replace
index 29ab60a79..c37801ecd 100644
--- a/gcloud/alpha/run/jobs/replace
+++ b/gcloud/alpha/run/jobs/replace
@@ -40,7 +40,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud run jobs replace
 
         $ gcloud beta run jobs replace
 
diff --git a/gcloud/alpha/run/jobs/set-iam-policy b/gcloud/alpha/run/jobs/set-iam-policy
index 853db7729..8d89af5c2 100644
--- a/gcloud/alpha/run/jobs/set-iam-policy
+++ b/gcloud/alpha/run/jobs/set-iam-policy
@@ -74,7 +74,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud run jobs set-iam-policy
 
         $ gcloud beta run jobs set-iam-policy
 
diff --git a/gcloud/alpha/run/jobs/update b/gcloud/alpha/run/jobs/update
index 0c7059e34..3a2b3cda7 100644
--- a/gcloud/alpha/run/jobs/update
+++ b/gcloud/alpha/run/jobs/update
@@ -278,7 +278,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud run jobs update
 
         $ gcloud beta run jobs update
 
diff --git a/gcloud/alpha/sql/export/csv b/gcloud/alpha/sql/export/csv
index 1403c8dad..619ad3350 100644
--- a/gcloud/alpha/sql/export/csv
+++ b/gcloud/alpha/sql/export/csv
@@ -27,7 +27,8 @@ POSITIONAL ARGUMENTS
 REQUIRED FLAGS
      --query=QUERY
         A SQL SELECT query (e.g., SELECT * FROM table) that specifies the data
-        to export.
+        to export. WARNING: While in-transit, the query might be processed in
+        intermediate locations other than the location of the target instance.
 
 OPTIONAL FLAGS
      --async
diff --git a/gcloud/alpha/sql/instances/create b/gcloud/alpha/sql/instances/create
index 11680b420..3693cff76 100644
--- a/gcloud/alpha/sql/instances/create
+++ b/gcloud/alpha/sql/instances/create
@@ -363,9 +363,10 @@ FLAGS
 
      --retained-transaction-log-days=RETAINED_TRANSACTION_LOG_DAYS
         How many days of transaction logs to keep. The valid range is between 1
-        and 7. The default value is 7 if not specified. Only valid when point
-        in time recovery is enabled. Keeping more days of transaction logs
-        requires bigger storage size
+        and 35. The default value is 7. The 35 days log retention feature is
+        only enabled for specific customer. Only use this option when
+        point-in-time recovery is enabled. Storage size for transaction logs
+        increases when the number of days for log retention increases.
 
      --root-password=ROOT_PASSWORD
         Root Cloud SQL user's password.
diff --git a/gcloud/alpha/sql/instances/patch b/gcloud/alpha/sql/instances/patch
index 485acad54..e6f90761c 100644
--- a/gcloud/alpha/sql/instances/patch
+++ b/gcloud/alpha/sql/instances/patch
@@ -441,9 +441,10 @@ FLAGS
 
        --retained-transaction-log-days=RETAINED_TRANSACTION_LOG_DAYS
           How many days of transaction logs to keep. The valid range is between
-          1 and 7. The default value is 7 if not specified. Only valid when
-          point in time recovery is enabled. Keeping more days of transaction
-          logs requires bigger storage size
+          1 and 35. The default value is 7. The 35 days log retention feature
+          is only enabled for specific customer. Only use this option when
+          point-in-time recovery is enabled. Storage size for transaction logs
+          increases when the number of days for log retention increases.
 
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
diff --git a/gcloud/alpha/storage/cp b/gcloud/alpha/storage/cp
index eaccaa4d0..22bc2ead0 100644
--- a/gcloud/alpha/storage/cp
+++ b/gcloud/alpha/storage/cp
@@ -93,8 +93,8 @@ FLAGS
 
      --no-clobber, -n
         Do not overwrite existing files or objects at the destination. Skipped
-        items will be printed. This option performs an additional GET request
-        for cloud objects before attempting an upload.
+        items will be printed. This option may perform an additional GET
+        request for cloud objects before attempting an upload.
 
      --continue-on-error, -c
         If any operations are unsuccessful, the command will exit with a
diff --git a/gcloud/alpha/storage/mv b/gcloud/alpha/storage/mv
index 7a7b61934..72d9ad265 100644
--- a/gcloud/alpha/storage/mv
+++ b/gcloud/alpha/storage/mv
@@ -104,8 +104,8 @@ FLAGS
 
      --no-clobber, -n
         Do not overwrite existing files or objects at the destination. Skipped
-        items will be printed. This option performs an additional GET request
-        for cloud objects before attempting an upload.
+        items will be printed. This option may perform an additional GET
+        request for cloud objects before attempting an upload.
 
      --continue-on-error, -c
         If any operations are unsuccessful, the command will exit with a
diff --git a/gcloud/alpha/telco-automation/help b/gcloud/alpha/telco-automation/help
new file mode 100644
index 000000000..6ebcfac4e
--- /dev/null
+++ b/gcloud/alpha/telco-automation/help
@@ -0,0 +1,29 @@
+NAME
+    gcloud alpha telco-automation - manage Telco Automation resources
+
+SYNOPSIS
+    gcloud alpha telco-automation GROUP [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Manage Telco Automation resources.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+GROUPS
+    GROUP is one of the following:
+
+     operations
+        (ALPHA) Command group for working with telco automation operations.
+
+     orchestration-cluster
+        (ALPHA) Manage telco automation orchestration cluster instances.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/telco-automation/operations/describe b/gcloud/alpha/telco-automation/operations/describe
new file mode 100644
index 000000000..2635f3b97
--- /dev/null
+++ b/gcloud/alpha/telco-automation/operations/describe
@@ -0,0 +1,63 @@
+NAME
+    gcloud alpha telco-automation operations describe - get description of a
+        long-running telco automation operation
+
+SYNOPSIS
+    gcloud alpha telco-automation operations describe
+        (OPERATION : --location=LOCATION) [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Get information about a long-running telco automation operation.
+
+EXAMPLES
+    To get information about a long-running operation with name test-operation
+    in region us-central1, run the following command:
+
+        $ gcloud alpha telco-automation operations describe test-operation \
+            --location=us-central1
+
+POSITIONAL ARGUMENTS
+     Operation resource - The ID of the operation to describe. The arguments in
+     this group can be used to specify the attributes of this resource. (NOTE)
+     Some attributes are not given arguments in this group but can be set in
+     other ways. To set the project attribute:
+      ◆ provide the argument operation on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       OPERATION
+          ID of the operation or fully qualified identifier for the operation.
+          To set the operation attribute:
+          ▸ provide the argument operation on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name. To set the location attribute:
+          ▸ provide the argument operation on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the telcoautomation/v1alpha1 API. The full documentation
+    for this API can be found at:
+    https://cloud.google.com/blog/topics/telecommunications/network-automation-csps-linus-nephio-cloud-native
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/telco-automation/operations/help b/gcloud/alpha/telco-automation/operations/help
new file mode 100644
index 000000000..cb1acc208
--- /dev/null
+++ b/gcloud/alpha/telco-automation/operations/help
@@ -0,0 +1,31 @@
+NAME
+    gcloud alpha telco-automation operations - command group for working with
+        telco automation operations
+
+SYNOPSIS
+    gcloud alpha telco-automation operations COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Command group for working with telco automation operations.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     describe
+        (ALPHA) Get description of a long-running telco automation operation.
+
+     wait
+        (ALPHA) Poll long-running telco automation operation until it
+        completes.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/telco-automation/operations/wait b/gcloud/alpha/telco-automation/operations/wait
new file mode 100644
index 000000000..30f5553d4
--- /dev/null
+++ b/gcloud/alpha/telco-automation/operations/wait
@@ -0,0 +1,65 @@
+NAME
+    gcloud alpha telco-automation operations wait - poll long-running telco
+        automation operation until it completes
+
+SYNOPSIS
+    gcloud alpha telco-automation operations wait
+        (OPERATION : --location=LOCATION) [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Poll a long-running telco automation operation until it completes.
+    When the operation is complete, this command will display the results of
+    the analysis.
+
+EXAMPLES
+    To poll a long-running telco automation operation named test-operation in
+    region us-central1 until it completes, run the following:
+
+        $ gcloud alpha telco-automation operations wait test-operation \
+            --location=us-central1
+
+POSITIONAL ARGUMENTS
+     Operation resource - ID for the operation to poll until complete. The
+     arguments in this group can be used to specify the attributes of this
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways. To set the project attribute:
+      ◆ provide the argument operation on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       OPERATION
+          ID of the operation or fully qualified identifier for the operation.
+          To set the operation attribute:
+          ▸ provide the argument operation on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name. To set the location attribute:
+          ▸ provide the argument operation on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the telcoautomation/v1alpha1 API. The full documentation
+    for this API can be found at:
+    https://cloud.google.com/blog/topics/telecommunications/network-automation-csps-linus-nephio-cloud-native
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/telco-automation/orchestration-cluster/create b/gcloud/alpha/telco-automation/orchestration-cluster/create
new file mode 100644
index 000000000..b9f7d17bd
--- /dev/null
+++ b/gcloud/alpha/telco-automation/orchestration-cluster/create
@@ -0,0 +1,119 @@
+NAME
+    gcloud alpha telco-automation orchestration-cluster create - create a telco
+        automation orchestration cluster
+
+SYNOPSIS
+    gcloud alpha telco-automation orchestration-cluster create
+        (ORCHESTRATION_CLUSTER : --location=LOCATION) [--async]
+        [--cidr-blocks=CIDR_BLOCKS] [--cluster-cidr-block=CLUSTER_CIDR_BLOCK]
+        [--cluster-named-range=CLUSTER_NAMED_RANGE] [--full-management-config]
+        [--master-ipv4-cidr-block=MASTER_IPV4_CIDR_BLOCK]
+        [--services-cidr-block=SERVICES_CIDR_BLOCK]
+        [--services-named-range=SERVICES_NAMED_RANGE]
+        [--network=NETWORK : --subnet=SUBNET] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Create a new telco automation orchestration cluster.
+
+EXAMPLES
+    To create an orchestration cluster called test-orchestrationCluster in
+    location us-central1, run:
+
+        $ gcloud alpha telco-automation orchestration-cluster create \
+            test-orchestrationCluster --location=us-central1
+
+POSITIONAL ARGUMENTS
+     Orchestration Cluster resource - Telco automation orchestration cluster to
+     create. The arguments in this group can be used to specify the attributes
+     of this resource. (NOTE) Some attributes are not given arguments in this
+     group but can be set in other ways. To set the project attribute:
+      ◆ provide the argument orchestration_cluster on the command line with a
+        fully specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       ORCHESTRATION_CLUSTER
+          ID of the Orchestration Cluster or fully qualified identifier for the
+          Orchestration Cluster. To set the orchestration_cluster attribute:
+          ▸ provide the argument orchestration_cluster on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name. To set the location attribute:
+          ▸ provide the argument orchestration_cluster on the command line
+            with a fully specified name;
+          ▸ provide the argument --location on the command line.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+     --cidr-blocks=CIDR_BLOCKS
+        Master Authorized Network that supports multiple CIDR blocks. Allows
+        access to the k8s master from multiple blocks.
+
+     --cluster-cidr-block=CLUSTER_CIDR_BLOCK
+        IP address range for the cluster pod IPs. Set to blank to have a range
+        chosen with the default size. Set to /netmask (e.g. /14) to have a
+        range chosen with a specific netmask. Set to a CIDR notation (e.g.
+        10.96.0.0/14) from the RFC-1918 private networks (e.g. 10.0.0.0/8,
+        172.16.0.0/12, 192.168.0.0/16) to pick a specific range to use.
+
+     --cluster-named-range=CLUSTER_NAMED_RANGE
+        Name of the existing secondary range in the cluster's subnetwork to use
+        for pod IP addresses. Alternatively, cluster_cidr_block can be used to
+        automatically create a GKE-managed one.
+
+     --full-management-config
+        This parameter is to marked true only if the management configuration
+        arguments which are provided, belong to full (Autopilot) cluster
+        management.
+
+     --master-ipv4-cidr-block=MASTER_IPV4_CIDR_BLOCK
+        /28 network that the control plane will use.
+
+     --services-cidr-block=SERVICES_CIDR_BLOCK
+        IP address range for the cluster service IPs. Set to blank to have a
+        range chosen with the default size. Set to /netmask (e.g. /14) to have
+        a range chosen with a specific netmask. Set to a CIDR notation (e.g.
+        10.96.0.0/14) from the RFC-1918 private networks (e.g. 10.0.0.0/8,
+        172.16.0.0/12, 192.168.0.0/16) to pick a specific range to use.
+
+     --services-named-range=SERVICES_NAMED_RANGE
+        Name of the existing secondary range in the cluster's subnetwork to use
+        for service ClusterIPs. Alternatively, services_cidr_block can be used
+        to automatically create a GKE-managed one.
+
+     --network=NETWORK
+        Name of the VPC Network to put the GKE cluster and nodes in. The VPC
+        will be created if it doesn't exist.
+
+     --subnet=SUBNET
+        Specifies the subnet that the interface will be part of. Network key
+        must be specified and the subnet must be a subnetwork of the specified
+        network.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the telcoautomation/v1alpha1 API. The full documentation
+    for this API can be found at:
+    https://cloud.google.com/blog/topics/telecommunications/network-automation-csps-linus-nephio-cloud-native
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/telco-automation/orchestration-cluster/delete b/gcloud/alpha/telco-automation/orchestration-cluster/delete
new file mode 100644
index 000000000..915c96e89
--- /dev/null
+++ b/gcloud/alpha/telco-automation/orchestration-cluster/delete
@@ -0,0 +1,69 @@
+NAME
+    gcloud alpha telco-automation orchestration-cluster delete - delete a telco
+        automation orchestration cluster
+
+SYNOPSIS
+    gcloud alpha telco-automation orchestration-cluster delete
+        (ORCHESTRATION_CLUSTER : --location=LOCATION) [--async]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Delete a telco automation orchestration cluster.
+
+EXAMPLES
+    To delete an orchestration cluster called test-cluster in region
+    us-central1, run:
+
+        $ gcloud alpha telco-automation orchestration-cluster delete \
+            test-cluster --location=us-central1
+
+POSITIONAL ARGUMENTS
+     Orchestration Cluster resource - Telco automation orchestration cluster to
+     delete. The arguments in this group can be used to specify the attributes
+     of this resource. (NOTE) Some attributes are not given arguments in this
+     group but can be set in other ways. To set the project attribute:
+      ◆ provide the argument orchestration_cluster on the command line with a
+        fully specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       ORCHESTRATION_CLUSTER
+          ID of the Orchestration Cluster or fully qualified identifier for the
+          Orchestration Cluster. To set the orchestration_cluster attribute:
+          ▸ provide the argument orchestration_cluster on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name. To set the location attribute:
+          ▸ provide the argument orchestration_cluster on the command line
+            with a fully specified name;
+          ▸ provide the argument --location on the command line.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the telcoautomation/v1alpha1 API. The full documentation
+    for this API can be found at:
+    https://cloud.google.com/blog/topics/telecommunications/network-automation-csps-linus-nephio-cloud-native
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/telco-automation/orchestration-cluster/describe b/gcloud/alpha/telco-automation/orchestration-cluster/describe
new file mode 100644
index 000000000..58cbb1129
--- /dev/null
+++ b/gcloud/alpha/telco-automation/orchestration-cluster/describe
@@ -0,0 +1,64 @@
+NAME
+    gcloud alpha telco-automation orchestration-cluster describe - show details
+        about the orchestration cluster
+
+SYNOPSIS
+    gcloud alpha telco-automation orchestration-cluster describe
+        (ORCHESTRATION_CLUSTER : --location=LOCATION) [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Show details about the orchestration cluster.
+
+EXAMPLES
+    To show details about an orchestration cluster called test-cluster in
+    region us-central1, run:
+
+        $ gcloud alpha telco-automation orchestration-cluster describe \
+            test-cluster --location=us-central1
+
+POSITIONAL ARGUMENTS
+     Orchestration Cluster resource - The orchestration cluster you want to
+     describe. The arguments in this group can be used to specify the
+     attributes of this resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways. To set the project
+     attribute:
+      ◆ provide the argument orchestration_cluster on the command line with a
+        fully specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       ORCHESTRATION_CLUSTER
+          ID of the Orchestration Cluster or fully qualified identifier for the
+          Orchestration Cluster. To set the orchestration_cluster attribute:
+          ▸ provide the argument orchestration_cluster on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name. To set the location attribute:
+          ▸ provide the argument orchestration_cluster on the command line
+            with a fully specified name;
+          ▸ provide the argument --location on the command line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the telcoautomation/v1alpha1 API. The full documentation
+    for this API can be found at:
+    https://cloud.google.com/blog/topics/telecommunications/network-automation-csps-linus-nephio-cloud-native
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/telco-automation/orchestration-cluster/help b/gcloud/alpha/telco-automation/orchestration-cluster/help
new file mode 100644
index 000000000..56bc43d5a
--- /dev/null
+++ b/gcloud/alpha/telco-automation/orchestration-cluster/help
@@ -0,0 +1,37 @@
+NAME
+    gcloud alpha telco-automation orchestration-cluster - manage telco
+        automation orchestration cluster instances
+
+SYNOPSIS
+    gcloud alpha telco-automation orchestration-cluster COMMAND
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Manage telco automation orchestration cluster instances.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     create
+        (ALPHA) Create a telco automation orchestration cluster.
+
+     delete
+        (ALPHA) Delete a telco automation orchestration cluster.
+
+     describe
+        (ALPHA) Show details about the orchestration cluster.
+
+     list
+        (ALPHA) List telco automation orchestration clusters.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/telco-automation/orchestration-cluster/list b/gcloud/alpha/telco-automation/orchestration-cluster/list
new file mode 100644
index 000000000..56a9b5f6d
--- /dev/null
+++ b/gcloud/alpha/telco-automation/orchestration-cluster/list
@@ -0,0 +1,87 @@
+NAME
+    gcloud alpha telco-automation orchestration-cluster list - list telco
+        automation orchestration clusters
+
+SYNOPSIS
+    gcloud alpha telco-automation orchestration-cluster list
+        --location=LOCATION [--filter=EXPRESSION] [--limit=LIMIT]
+        [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) List telco automation orchestration clusters.
+
+EXAMPLES
+    To list all orchestration clusters in region us-central1, run:
+
+        $ gcloud alpha telco-automation orchestration-cluster list \
+            --location=us-central1
+
+REQUIRED FLAGS
+     Location resource - Parent telco automation location to list all contained
+     telco automation orchestration clusters. This represents a Cloud resource.
+     (NOTE) Some attributes are not given arguments in this group but can be
+     set in other ways. To set the project attribute:
+      ◆ provide the argument --location on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       --location=LOCATION
+          ID of the location or fully qualified identifier for the location. To
+          set the location attribute:
+          ▸ provide the argument --location on the command line.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the telcoautomation/v1alpha1 API. The full documentation
+    for this API can be found at:
+    https://cloud.google.com/blog/topics/telecommunications/network-automation-csps-linus-nephio-cloud-native
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/artifacts/help b/gcloud/artifacts/help
index 4eac3511f..16a77ef09 100644
--- a/gcloud/artifacts/help
+++ b/gcloud/artifacts/help
@@ -39,6 +39,9 @@ GROUPS
      repositories
         Manage Artifact Registry repositories.
 
+     settings
+        Manage Artifact Registry project settings.
+
      tags
         Manage Artifact Registry tags.
 
diff --git a/gcloud/artifacts/settings/describe b/gcloud/artifacts/settings/describe
new file mode 100644
index 000000000..03efe301f
--- /dev/null
+++ b/gcloud/artifacts/settings/describe
@@ -0,0 +1,34 @@
+NAME
+    gcloud artifacts settings describe - list all Artifact Registry project
+        settings
+
+SYNOPSIS
+    gcloud artifacts settings describe [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    List all Artifact Registry project settings.
+
+EXAMPLES
+    To list project settings for project my-project:
+
+        $ gcloud artifacts settings describe --project=my-package
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the artifactregistry/v1 API. The full documentation for
+    this API can be found at: https://cloud.google.com/artifacts/docs/
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha artifacts settings describe
+
+        $ gcloud beta artifacts settings describe
+
diff --git a/gcloud/artifacts/settings/disable-upgrade-redirection b/gcloud/artifacts/settings/disable-upgrade-redirection
new file mode 100644
index 000000000..1790cee50
--- /dev/null
+++ b/gcloud/artifacts/settings/disable-upgrade-redirection
@@ -0,0 +1,36 @@
+NAME
+    gcloud artifacts settings disable-upgrade-redirection - disables
+        redirection from Container Registry to Artifact Registry
+
+SYNOPSIS
+    gcloud artifacts settings disable-upgrade-redirection
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Disables redirection from Container Registry to Artifact Registry.
+
+EXAMPLES
+    To disable redirection for project my-project:
+
+        $ gcloud artifacts settings disable-upgrade-redirection \
+           --project=my-project
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the artifactregistry/v1 API. The full documentation for
+    this API can be found at: https://cloud.google.com/artifacts/docs/
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha artifacts settings disable-upgrade-redirection
+
+        $ gcloud beta artifacts settings disable-upgrade-redirection
+
diff --git a/gcloud/artifacts/settings/enable-upgrade-redirection b/gcloud/artifacts/settings/enable-upgrade-redirection
new file mode 100644
index 000000000..a4e470a61
--- /dev/null
+++ b/gcloud/artifacts/settings/enable-upgrade-redirection
@@ -0,0 +1,40 @@
+NAME
+    gcloud artifacts settings enable-upgrade-redirection - enables redirection
+        from Container Registry to Artifact Registry
+
+SYNOPSIS
+    gcloud artifacts settings enable-upgrade-redirection [--dry-run]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Enables redirection from Container Registry to Artifact Registry.
+
+EXAMPLES
+    To enable redirection for project my-project:
+
+        $ gcloud artifacts settings enable-upgrade-redirection \
+           --project=my-project
+
+FLAGS
+     --dry-run
+        Validate the project setup, but do not enable redirection
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the artifactregistry/v1 API. The full documentation for
+    this API can be found at: https://cloud.google.com/artifacts/docs/
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha artifacts settings enable-upgrade-redirection
+
+        $ gcloud beta artifacts settings enable-upgrade-redirection
+
diff --git a/gcloud/artifacts/settings/help b/gcloud/artifacts/settings/help
new file mode 100644
index 000000000..c4e48e1b5
--- /dev/null
+++ b/gcloud/artifacts/settings/help
@@ -0,0 +1,33 @@
+NAME
+    gcloud artifacts settings - manage Artifact Registry project settings
+
+SYNOPSIS
+    gcloud artifacts settings COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Manage Artifact Registry project settings.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     describe
+        List all Artifact Registry project settings.
+
+     disable-upgrade-redirection
+        Disables redirection from Container Registry to Artifact Registry.
+
+     enable-upgrade-redirection
+        Enables redirection from Container Registry to Artifact Registry.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha artifacts settings
+
+        $ gcloud beta artifacts settings
+
diff --git a/gcloud/beta/artifacts/settings/describe b/gcloud/beta/artifacts/settings/describe
index 5067cc002..6fd4412f7 100644
--- a/gcloud/beta/artifacts/settings/describe
+++ b/gcloud/beta/artifacts/settings/describe
@@ -26,8 +26,10 @@ API REFERENCE
     this API can be found at: https://cloud.google.com/artifacts/docs/
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud artifacts settings describe
 
         $ gcloud alpha artifacts settings describe
 
diff --git a/gcloud/beta/artifacts/settings/disable-upgrade-redirection b/gcloud/beta/artifacts/settings/disable-upgrade-redirection
index c9cdcd4a2..b83802c11 100644
--- a/gcloud/beta/artifacts/settings/disable-upgrade-redirection
+++ b/gcloud/beta/artifacts/settings/disable-upgrade-redirection
@@ -28,8 +28,10 @@ API REFERENCE
     this API can be found at: https://cloud.google.com/artifacts/docs/
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud artifacts settings disable-upgrade-redirection
 
         $ gcloud alpha artifacts settings disable-upgrade-redirection
 
diff --git a/gcloud/beta/artifacts/settings/enable-upgrade-redirection b/gcloud/beta/artifacts/settings/enable-upgrade-redirection
index 1d65f23b6..54edce337 100644
--- a/gcloud/beta/artifacts/settings/enable-upgrade-redirection
+++ b/gcloud/beta/artifacts/settings/enable-upgrade-redirection
@@ -32,8 +32,10 @@ API REFERENCE
     this API can be found at: https://cloud.google.com/artifacts/docs/
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud artifacts settings enable-upgrade-redirection
 
         $ gcloud alpha artifacts settings enable-upgrade-redirection
 
diff --git a/gcloud/beta/artifacts/settings/help b/gcloud/beta/artifacts/settings/help
index dc184f577..dad7070de 100644
--- a/gcloud/beta/artifacts/settings/help
+++ b/gcloud/beta/artifacts/settings/help
@@ -27,8 +27,10 @@ COMMANDS
         Registry.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud artifacts settings
 
         $ gcloud alpha artifacts settings
 
diff --git a/gcloud/beta/builds/submit b/gcloud/beta/builds/submit
index efa898163..5fb2e9657 100644
--- a/gcloud/beta/builds/submit
+++ b/gcloud/beta/builds/submit
@@ -3,6 +3,7 @@ NAME
 
 SYNOPSIS
     gcloud beta builds submit [[SOURCE] --no-source] [--async] [--no-cache]
+        [--default-buckets-behavior=DEFAULT_BUCKETS_BEHAVIOR]
         [--disk-size=DISK_SIZE] [--gcs-log-dir=GCS_LOG_DIR]
         [--gcs-source-staging-dir=GCS_SOURCE_STAGING_DIR]
         [--ignore-file=IGNORE_FILE] [--machine-type=MACHINE_TYPE]
@@ -70,6 +71,10 @@ FLAGS
         Dockerfile builds are non-deterministic and a non-deterministic result
         should not be cached.
 
+     --default-buckets-behavior=DEFAULT_BUCKETS_BEHAVIOR
+        How default buckets are setup. DEFAULT_BUCKETS_BEHAVIOR must be one of:
+        default-logs-bucket-behavior-unspecified, regional-user-owned-bucket.
+
      --disk-size=DISK_SIZE
         Machine disk size (GB) to run the build.
 
@@ -77,13 +82,18 @@ FLAGS
         A directory in Google Cloud Storage to hold build logs. If this field
         is not set,
         gs://[PROJECT_NUMBER].cloudbuild-logs.googleusercontent.com/ will be
-        created and used.
+        created and used or
+        gs://[PROJECT_NUMBER]-[builds/region]-cloudbuild-logs is used when you
+        set --default-buckets-behavior to REGIONAL_USER_OWNED_BUCKET.
 
      --gcs-source-staging-dir=GCS_SOURCE_STAGING_DIR
         A directory in Google Cloud Storage to copy the source used for staging
         the build. If the specified bucket does not exist, Cloud Build will
         create one. If you don't set this field,
-        gs://[PROJECT_ID]_cloudbuild/source is used.
+        gs://[PROJECT_ID]_cloudbuild/source is used or
+        gs://[PROJECT_ID]_[builds/region]_cloudbuild/source is used when you
+        set --default-buckets-behavior to REGIONAL_USER_OWNED_BUCKET and
+        builds/region is not global.
 
      --ignore-file=IGNORE_FILE
         Override the .gcloudignore file and use the specified file instead.
diff --git a/gcloud/beta/certificate-manager/certificates/create b/gcloud/beta/certificate-manager/certificates/create
index 262145a46..ec08c0a24 100644
--- a/gcloud/beta/certificate-manager/certificates/create
+++ b/gcloud/beta/certificate-manager/certificates/create
@@ -6,7 +6,8 @@ SYNOPSIS
         (CERTIFICATE : --location=LOCATION)
         (--certificate-file=CERTIFICATE_FILE
           --private-key-file=PRIVATE_KEY_FILE | [--domains=[DOMAINS,...]
-          : --dns-authorizations=[DNS_AUTHORIZATIONS,...]]) [--async]
+          : --dns-authorizations=[DNS_AUTHORIZATIONS,...]
+          | --issuance-config=ISSUANCE_CONFIG]) [--async]
         [--description=DESCRIPTION] [--labels=[KEY=VALUE,...]]
         [--scope=SCOPE; default="DEFAULT"] [GCLOUD_WIDE_FLAG ...]
 
@@ -105,18 +106,23 @@ REQUIRED FLAGS
             This flag argument must be specified if any of the other arguments
             in this group are specified.
 
-         --dns-authorizations=[DNS_AUTHORIZATIONS,...]
-            Name(s) of the DNS authorizations for each listed domain.
+         At most one of these can be specified:
 
-            Note that each domain requires a matching authorization, and any
-            domain that fails authorization will prevent issuance and/or
-            renewal of the certificate.
+           --dns-authorizations=[DNS_AUTHORIZATIONS,...]
+              Name(s) of the DNS authorizations for each listed domain.
 
-            To reference multiple DNS authorizations, provide a list of comma
-            separated DNS authorization resource names or URLs. For example:
+              Note that each domain requires a matching authorization, and any
+              domain that fails authorization will prevent issuance and/or
+              renewal of the certificate.
 
-                $ gcloud beta certificate-manager certificates create \
-                     --dns-authorizations=api-example-com,www-example-com
+              To reference multiple DNS authorizations, provide a list of comma
+              separated DNS authorization resource names or URLs. For example:
+
+                  $ gcloud beta certificate-manager certificates create \
+                       --dns-authorizations=api-example-com,www-example-com
+
+           --issuance-config=ISSUANCE_CONFIG
+              Name of the Certificate Issuance Config to use for issuance.
 
 OPTIONAL FLAGS
      --async
diff --git a/gcloud/beta/certificate-manager/issuance-configs/create b/gcloud/beta/certificate-manager/issuance-configs/create
index 0fdf08e18..e1a82d7bf 100644
--- a/gcloud/beta/certificate-manager/issuance-configs/create
+++ b/gcloud/beta/certificate-manager/issuance-configs/create
@@ -99,8 +99,10 @@ API REFERENCE
     this API can be found at: https://cloud.google.com/certificate-manager
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud certificate-manager issuance-configs create
 
         $ gcloud alpha certificate-manager issuance-configs create
 
diff --git a/gcloud/beta/certificate-manager/issuance-configs/delete b/gcloud/beta/certificate-manager/issuance-configs/delete
index de0d87943..12c62434b 100644
--- a/gcloud/beta/certificate-manager/issuance-configs/delete
+++ b/gcloud/beta/certificate-manager/issuance-configs/delete
@@ -63,8 +63,10 @@ API REFERENCE
     this API can be found at: https://cloud.google.com/certificate-manager
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud certificate-manager issuance-configs delete
 
         $ gcloud alpha certificate-manager issuance-configs delete
 
diff --git a/gcloud/beta/certificate-manager/issuance-configs/describe b/gcloud/beta/certificate-manager/issuance-configs/describe
index 43bc329da..925d1580c 100644
--- a/gcloud/beta/certificate-manager/issuance-configs/describe
+++ b/gcloud/beta/certificate-manager/issuance-configs/describe
@@ -58,8 +58,10 @@ API REFERENCE
     this API can be found at: https://cloud.google.com/certificate-manager
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud certificate-manager issuance-configs describe
 
         $ gcloud alpha certificate-manager issuance-configs describe
 
diff --git a/gcloud/beta/certificate-manager/issuance-configs/help b/gcloud/beta/certificate-manager/issuance-configs/help
index c20f1a3d4..45712d71d 100644
--- a/gcloud/beta/certificate-manager/issuance-configs/help
+++ b/gcloud/beta/certificate-manager/issuance-configs/help
@@ -30,8 +30,10 @@ COMMANDS
         (BETA) List all Certificate Issuance Configs in a project.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud certificate-manager issuance-configs
 
         $ gcloud alpha certificate-manager issuance-configs
 
diff --git a/gcloud/beta/certificate-manager/issuance-configs/list b/gcloud/beta/certificate-manager/issuance-configs/list
index 9df62c456..cf6acbb67 100644
--- a/gcloud/beta/certificate-manager/issuance-configs/list
+++ b/gcloud/beta/certificate-manager/issuance-configs/list
@@ -77,8 +77,10 @@ API REFERENCE
     this API can be found at: https://cloud.google.com/certificate-manager
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud certificate-manager issuance-configs list
 
         $ gcloud alpha certificate-manager issuance-configs list
 
diff --git a/gcloud/beta/compute/disks/bulk/create b/gcloud/beta/compute/disks/bulk/create
new file mode 100644
index 000000000..67fd21b5d
--- /dev/null
+++ b/gcloud/beta/compute/disks/bulk/create
@@ -0,0 +1,88 @@
+NAME
+    gcloud beta compute disks bulk create - create multiple Compute Engine
+        disks
+
+SYNOPSIS
+    gcloud beta compute disks bulk create
+        --source-consistency-group-policy=SOURCE_CONSISTENCY_GROUP_POLICY
+        (--region=REGION | --zone=ZONE) [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) gcloud beta compute disks bulk create facilitates the creation of
+    multiple Compute Engine disks with a single command. This includes cloning
+    a set of Async PD secondary disks with the same consistency group policy.
+
+EXAMPLES
+    To consistently clone secondary disks with the same consistency group
+    policy
+    'projects/example-project/regions/us-central1/resourcePolicies/example-group-policy'
+    to target zone 'us-central1-a', run:
+
+        $ gcloud beta compute disks bulk create \
+            --source-consistency-group-policy=projects/example-project/\
+        regions/us-central1/resourcePolicies/example-group-policy \
+            --zone=us-central1-a
+
+REQUIRED FLAGS
+     --source-consistency-group-policy=SOURCE_CONSISTENCY_GROUP_POLICY
+        URL of the source consistency group resource policy. The resource
+        policy is always the same region as the source disks.
+
+     Exactly one of these must be specified:
+
+       --region=REGION
+          Target region of the created disks, which currently must be the same
+          as the source region. If not specified, you might be prompted to
+          select a region (interactive mode only).
+
+          To avoid prompting when this flag is omitted, you can set the
+          compute/region property:
+
+              $ gcloud config set compute/region REGION
+
+          A list of regions can be fetched by running:
+
+              $ gcloud compute regions list
+
+          To unset the property, run:
+
+              $ gcloud config unset compute/region
+
+          Alternatively, the region can be stored in the environment variable
+          CLOUDSDK_COMPUTE_REGION.
+
+       --zone=ZONE
+          Target zone of the created disks, which currently must be the same as
+          the source zone. If not specified and the compute/zone property isn't
+          set, you might be prompted to select a zone (interactive mode only).
+
+          To avoid prompting when this flag is omitted, you can set the
+          compute/zone property:
+
+              $ gcloud config set compute/zone ZONE
+
+          A list of zones can be fetched by running:
+
+              $ gcloud compute zones list
+
+          To unset the property, run:
+
+              $ gcloud config unset compute/zone
+
+          Alternatively, the zone can be stored in the environment variable
+          CLOUDSDK_COMPUTE_ZONE.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha compute disks bulk create
+
diff --git a/gcloud/beta/compute/disks/bulk/help b/gcloud/beta/compute/disks/bulk/help
new file mode 100644
index 000000000..c58fffeb7
--- /dev/null
+++ b/gcloud/beta/compute/disks/bulk/help
@@ -0,0 +1,28 @@
+NAME
+    gcloud beta compute disks bulk - manipulate multiple Compute Engine disks
+        with single command executions
+
+SYNOPSIS
+    gcloud beta compute disks bulk COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Manipulate multiple Compute Engine disks with single command
+    executions.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     create
+        (BETA) Create multiple Compute Engine disks.
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha compute disks bulk
+
diff --git a/gcloud/beta/compute/disks/create b/gcloud/beta/compute/disks/create
index c0bd975b9..44c7ddf5a 100644
--- a/gcloud/beta/compute/disks/create
+++ b/gcloud/beta/compute/disks/create
@@ -8,15 +8,18 @@ SYNOPSIS
         [--guest-os-features=[GUEST_OS_FEATURE,...]] [--interface=INTERFACE]
         [--labels=[KEY=VALUE,...]] [--licenses=[LICENSE,...]] [--multi-writer]
         [--physical-block-size=PHYSICAL_BLOCK_SIZE; default="4096"]
+        [--primary-disk-project=PRIMARY_DISK_PROJECT]
         [--provisioned-iops=PROVISIONED_IOPS] [--replica-zones=ZONE,ZONE]
         [--no-require-csek-key-create]
         [--resource-policies=[RESOURCE_POLICY,...]] [--size=SIZE] [--type=TYPE]
         [--image-family-scope=IMAGE_FAMILY_SCOPE
           --image-project=IMAGE_PROJECT --image=IMAGE
-          | --image-family=IMAGE_FAMILY | --source-disk=SOURCE_DISK
-          | --source-snapshot=SOURCE_SNAPSHOT]
+          | --image-family=IMAGE_FAMILY | --primary-disk=PRIMARY_DISK
+          | --source-disk=SOURCE_DISK | --source-snapshot=SOURCE_SNAPSHOT]
         [--kms-key=KMS_KEY : --kms-keyring=KMS_KEYRING
           --kms-location=KMS_LOCATION --kms-project=KMS_PROJECT]
+        [--primary-disk-region=PRIMARY_DISK_REGION
+          | --primary-disk-zone=PRIMARY_DISK_ZONE]
         [--region=REGION | --zone=ZONE]
         [--source-disk-region=SOURCE_DISK_REGION
           | --source-disk-zone=SOURCE_DISK_ZONE] [GCLOUD_WIDE_FLAG ...]
@@ -113,6 +116,9 @@ FLAGS
         4096(default) and 16384. PHYSICAL_BLOCK_SIZE must be one of: 4096,
         16384.
 
+     --primary-disk-project=PRIMARY_DISK_PROJECT
+        Project of the primary disk for asynchronous replication.
+
      --provisioned-iops=PROVISIONED_IOPS
         Provisioned IOPS of disk to create. Only for use with disks of type
         pd-extreme and hyperdisk-extreme.
@@ -192,6 +198,10 @@ FLAGS
           practice to use --image-family when the latest version of an image is
           needed.
 
+       --primary-disk=PRIMARY_DISK
+          Primary disk for asynchronous replication. This flag is required when
+          creating a secondary disk.
+
        --source-disk=SOURCE_DISK
           Source disk used to create the disk(s). It is safe to delete a source
           disk after a disk has been created from the source disk. To get a
@@ -250,6 +260,18 @@ FLAGS
           ▸ provide the argument --kms-project on the command line;
           ▸ set the property core/project.
 
+     At most one of these can be specified:
+
+       --primary-disk-region=PRIMARY_DISK_REGION
+          Region of the primary disk for asynchronous replication. The primary
+          and secondary disks must not be in the same region. Overrides the
+          default compute/region property value for this command invocation.
+
+       --primary-disk-zone=PRIMARY_DISK_ZONE
+          Zone of the primary disk for asynchronous replication. The primary
+          and secondary disks must not be in the same region. Overrides the
+          default compute/zone property value for this command invocation.
+
      At most one of these can be specified:
 
        --region=REGION
diff --git a/gcloud/beta/compute/disks/help b/gcloud/beta/compute/disks/help
index da5d9f378..8787bb608 100644
--- a/gcloud/beta/compute/disks/help
+++ b/gcloud/beta/compute/disks/help
@@ -2,7 +2,7 @@ NAME
     gcloud beta compute disks - read and manipulate Compute Engine disks
 
 SYNOPSIS
-    gcloud beta compute disks COMMAND [GCLOUD_WIDE_FLAG ...]
+    gcloud beta compute disks GROUP | COMMAND [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (BETA) Read and manipulate Compute Engine disks.
@@ -18,6 +18,13 @@ GCLOUD WIDE FLAGS
 
     Run $ gcloud help for details.
 
+GROUPS
+    GROUP is one of the following:
+
+     bulk
+        (BETA) Manipulate multiple Compute Engine disks with single command
+        executions.
+
 COMMANDS
     COMMAND is one of the following:
 
@@ -66,6 +73,16 @@ COMMANDS
      snapshot
         (BETA) Create snapshots of Compute Engine persistent disks.
 
+     start-async-replication
+        (BETA) Start asynchronous replication on a Compute Engine persistent
+        disk.
+
+     stop-async-replication
+        (BETA) Stop async replication on a Compute Engine persistent disk.
+
+     stop-group-async-replication
+        (BETA) Consistently stops a group of asynchronously replicating disks.
+
      update
         (BETA) Update a Compute Engine persistent disk.
 
diff --git a/gcloud/beta/compute/disks/start-async-replication b/gcloud/beta/compute/disks/start-async-replication
new file mode 100644
index 000000000..ecca4fceb
--- /dev/null
+++ b/gcloud/beta/compute/disks/start-async-replication
@@ -0,0 +1,106 @@
+NAME
+    gcloud beta compute disks start-async-replication - start asynchronous
+        replication on a Compute Engine persistent disk
+
+SYNOPSIS
+    gcloud beta compute disks start-async-replication DISK_NAME
+        --secondary-disk=SECONDARY_DISK [--region=REGION | --zone=ZONE]
+        [--secondary-disk-project=SECONDARY_DISK_PROJECT]
+        [--secondary-disk-region=SECONDARY_DISK_REGION
+          | --secondary-disk-zone=SECONDARY_DISK_ZONE] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) gcloud beta compute disks start-async-replication starts async
+    replication on a Compute Engine persistent disk. This command must be
+    invoked on the primary disk and --secondary-disk must be provided.
+
+EXAMPLES
+    Start replication from the primary disk 'my-disk-1' in zone us-east1-a to
+    the secondary disk 'my-disk-2' in zone us-west1-a:
+
+        $ gcloud beta compute disks start-async-replication my-disk-1 \
+            --zone=us-east1-a --secondary-disk=my-disk-2 \
+            --secondary-disk-zone=us-west1-a
+
+POSITIONAL ARGUMENTS
+     DISK_NAME
+        Name of the disk to operate on.
+
+REQUIRED FLAGS
+     --secondary-disk=SECONDARY_DISK
+        Secondary disk for asynchronous replication. This flag is required when
+        starting replication.
+
+FLAGS
+     At most one of these can be specified:
+
+       --region=REGION
+          Region of the disk to operate on. If not specified, you might be
+          prompted to select a region (interactive mode only).
+
+          To avoid prompting when this flag is omitted, you can set the
+          compute/region property:
+
+              $ gcloud config set compute/region REGION
+
+          A list of regions can be fetched by running:
+
+              $ gcloud compute regions list
+
+          To unset the property, run:
+
+              $ gcloud config unset compute/region
+
+          Alternatively, the region can be stored in the environment variable
+          CLOUDSDK_COMPUTE_REGION.
+
+       --zone=ZONE
+          Zone of the disk to operate on. If not specified and the compute/zone
+          property isn't set, you might be prompted to select a zone
+          (interactive mode only).
+
+          To avoid prompting when this flag is omitted, you can set the
+          compute/zone property:
+
+              $ gcloud config set compute/zone ZONE
+
+          A list of zones can be fetched by running:
+
+              $ gcloud compute zones list
+
+          To unset the property, run:
+
+              $ gcloud config unset compute/zone
+
+          Alternatively, the zone can be stored in the environment variable
+          CLOUDSDK_COMPUTE_ZONE.
+
+SECONDARY DISK FLAGS
+     --secondary-disk-project=SECONDARY_DISK_PROJECT
+        Project of the secondary disk for asynchronous replication.
+
+     At most one of these can be specified:
+
+       --secondary-disk-region=SECONDARY_DISK_REGION
+          Region of the secondary disk for asynchronous replication. Overrides
+          the default compute/region property value for this command
+          invocation.
+
+       --secondary-disk-zone=SECONDARY_DISK_ZONE
+          Zone of the secondary disk for asynchronous replication. Overrides
+          the default compute/zone property value for this command invocation.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha compute disks start-async-replication
+
diff --git a/gcloud/beta/compute/disks/stop-async-replication b/gcloud/beta/compute/disks/stop-async-replication
new file mode 100644
index 000000000..01c26999e
--- /dev/null
+++ b/gcloud/beta/compute/disks/stop-async-replication
@@ -0,0 +1,86 @@
+NAME
+    gcloud beta compute disks stop-async-replication - stop async replication
+        on a Compute Engine persistent disk
+
+SYNOPSIS
+    gcloud beta compute disks stop-async-replication DISK_NAME
+        [--region=REGION | --zone=ZONE] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) gcloud beta compute disks stop-async-replication stops async
+    replication on a Compute Engine persistent disk. This command can be
+    invoked either on the primary or on the secondary disk.
+
+EXAMPLES
+    Stop replication on the primary disk 'my-disk-1' in zone us-east1-a:
+
+        $ gcloud beta compute disks stop-async-replication my-disk-1 \
+            --zone=us-east1-a
+
+    Stop replication on the secondary disk 'my-disk-2' in zone us-west1-a:
+
+        $ gcloud beta compute disks stop-async-replication my-disk-2 \
+            --zone=us-west1-a
+
+POSITIONAL ARGUMENTS
+     DISK_NAME
+        Name of the disk to stop async replication.
+
+FLAGS
+     At most one of these can be specified:
+
+       --region=REGION
+          Region of the disk to stop async replication. If not specified, you
+          might be prompted to select a region (interactive mode only).
+
+          To avoid prompting when this flag is omitted, you can set the
+          compute/region property:
+
+              $ gcloud config set compute/region REGION
+
+          A list of regions can be fetched by running:
+
+              $ gcloud compute regions list
+
+          To unset the property, run:
+
+              $ gcloud config unset compute/region
+
+          Alternatively, the region can be stored in the environment variable
+          CLOUDSDK_COMPUTE_REGION.
+
+       --zone=ZONE
+          Zone of the disk to stop async replication. If not specified and the
+          compute/zone property isn't set, you might be prompted to select a
+          zone (interactive mode only).
+
+          To avoid prompting when this flag is omitted, you can set the
+          compute/zone property:
+
+              $ gcloud config set compute/zone ZONE
+
+          A list of zones can be fetched by running:
+
+              $ gcloud compute zones list
+
+          To unset the property, run:
+
+              $ gcloud config unset compute/zone
+
+          Alternatively, the zone can be stored in the environment variable
+          CLOUDSDK_COMPUTE_ZONE.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha compute disks stop-async-replication
+
diff --git a/gcloud/beta/compute/disks/stop-group-async-replication b/gcloud/beta/compute/disks/stop-group-async-replication
new file mode 100644
index 000000000..58dcddd22
--- /dev/null
+++ b/gcloud/beta/compute/disks/stop-group-async-replication
@@ -0,0 +1,96 @@
+NAME
+    gcloud beta compute disks stop-group-async-replication - consistently stops
+        a group of asynchronously replicating disks
+
+SYNOPSIS
+    gcloud beta compute disks stop-group-async-replication
+        DISK_CONSISTENCY_GROUP_POLICY [--region=REGION | --zone=ZONE]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) gcloud beta compute disks stop-group-async-replication consistently
+    stops a group of asynchronously replicating disks. This command can be
+    invoked in either in the primary or secondary scope of the replicating
+    disks.
+
+EXAMPLES
+    To stop group replication in the primary scope, include the zone or region
+    of the primary disks. The URL of the disk consistency group resource policy
+    always uses the region of the primary disks:
+
+        $ gcloud beta compute disks stop-group-async-replication \
+            projects/my-project/regions/us-west1/resourcePolicies/\
+        my-policy --zone=us-west1-a
+
+    Alternatively, you can stop replication in the secondary scope. Include the
+    region or zone of the secondary disks. The URL of the disk consistency
+    group resource policy always uses the region of the primary disks:
+
+        $ gcloud beta compute disks stop-group-async-replication \
+            projects/my-project/regions/us-west1/resourcePolicies/\
+        my-policy --zone=us-west2-a
+
+POSITIONAL ARGUMENTS
+     DISK_CONSISTENCY_GROUP_POLICY
+        URL of the disk consistency group resource policy. The resourcepolicy
+        is always in the region of the primary disks.
+
+FLAGS
+     At most one of these can be specified:
+
+       --region=REGION
+          Region of the consistency group's primary or secondary disks. If not
+          specified, you might be prompted to select a region (interactive mode
+          only).
+
+          To avoid prompting when this flag is omitted, you can set the
+          compute/region property:
+
+              $ gcloud config set compute/region REGION
+
+          A list of regions can be fetched by running:
+
+              $ gcloud compute regions list
+
+          To unset the property, run:
+
+              $ gcloud config unset compute/region
+
+          Alternatively, the region can be stored in the environment variable
+          CLOUDSDK_COMPUTE_REGION.
+
+       --zone=ZONE
+          Zone of the consistency group's primary or secondary disks. If not
+          specified and the compute/zone property isn't set, you might be
+          prompted to select a zone (interactive mode only).
+
+          To avoid prompting when this flag is omitted, you can set the
+          compute/zone property:
+
+              $ gcloud config set compute/zone ZONE
+
+          A list of zones can be fetched by running:
+
+              $ gcloud compute zones list
+
+          To unset the property, run:
+
+              $ gcloud config unset compute/zone
+
+          Alternatively, the zone can be stored in the environment variable
+          CLOUDSDK_COMPUTE_ZONE.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha compute disks stop-group-async-replication
+
diff --git a/gcloud/beta/compute/instance-groups/managed/create b/gcloud/beta/compute/instance-groups/managed/create
index eb42ef36e..142de04d4 100644
--- a/gcloud/beta/compute/instance-groups/managed/create
+++ b/gcloud/beta/compute/instance-groups/managed/create
@@ -291,9 +291,7 @@ OPTIONAL FLAGS
        --update-policy-max-surge=MAX_SURGE
           Maximum additional number of VMs that can be created during the
           update process. This can be a fixed number (e.g. 5) or a percentage
-          of size to the managed instance group (e.g. 10%). Defaults to 0 if
-          the managed instance group has stateful configuration, or to the
-          number of zones in which it operates otherwise.
+          of size to the managed instance group (e.g. 10%).
 
        --update-policy-max-unavailable=MAX_UNAVAILABLE
           Maximum number of VMs that can be unavailable during the update
@@ -352,9 +350,7 @@ OPTIONAL FLAGS
 
        --update-policy-replacement-method=UPDATE_POLICY_REPLACEMENT_METHOD
           Type of replacement method. Specifies what action will be taken to
-          update VMs. Defaults to ``recreate`` if the managed instance group
-          has stateful configuration, or to ``substitute`` otherwise.
-          UPDATE_POLICY_REPLACEMENT_METHOD must be one of:
+          update VMs. UPDATE_POLICY_REPLACEMENT_METHOD must be one of:
 
            recreate
               Recreate VMs and preserve the VM names. The VM IDs and creation
diff --git a/gcloud/beta/compute/instance-groups/managed/update b/gcloud/beta/compute/instance-groups/managed/update
index ae4ea4e40..f8f6d4e82 100644
--- a/gcloud/beta/compute/instance-groups/managed/update
+++ b/gcloud/beta/compute/instance-groups/managed/update
@@ -308,9 +308,7 @@ FLAGS
        --update-policy-max-surge=MAX_SURGE
           Maximum additional number of VMs that can be created during the
           update process. This can be a fixed number (e.g. 5) or a percentage
-          of size to the managed instance group (e.g. 10%). Defaults to 0 if
-          the managed instance group has stateful configuration, or to the
-          number of zones in which it operates otherwise.
+          of size to the managed instance group (e.g. 10%).
 
        --update-policy-max-unavailable=MAX_UNAVAILABLE
           Maximum number of VMs that can be unavailable during the update
@@ -369,9 +367,7 @@ FLAGS
 
        --update-policy-replacement-method=UPDATE_POLICY_REPLACEMENT_METHOD
           Type of replacement method. Specifies what action will be taken to
-          update VMs. Defaults to ``recreate`` if the managed instance group
-          has stateful configuration, or to ``substitute`` otherwise.
-          UPDATE_POLICY_REPLACEMENT_METHOD must be one of:
+          update VMs. UPDATE_POLICY_REPLACEMENT_METHOD must be one of:
 
            recreate
               Recreate VMs and preserve the VM names. The VM IDs and creation
diff --git a/gcloud/beta/compute/instance-templates/create b/gcloud/beta/compute/instance-templates/create
index 556e54194..7273fd288 100644
--- a/gcloud/beta/compute/instance-templates/create
+++ b/gcloud/beta/compute/instance-templates/create
@@ -603,6 +603,13 @@ FLAGS
             Specifies the Network Interface Controller (NIC) type for the
             interface. NIC_TYPE must be one of: GVNIC, VIRTIO_NET.
 
+         queue-count
+            Specifies the networking queue count for this interface. Both Rx
+            and Tx queues will be set to this number. If it's not specified, a
+            default queue count will be assigned. For Virtio-net, each
+            interface will get min(floor(#vCPU / #vNIC), 32) queues. For gVNIC,
+            each interface will get min(floor(#vCPU / #vNIC / 2), 16) qeueus.
+
          stack-type
             Specifies whether IPv6 is enabled on the interface. STACK_TYPE must
             be one of: IPV4_ONLY, IPV4_IPV6. The default value is IPV4_ONLY.
diff --git a/gcloud/beta/compute/instance-templates/list b/gcloud/beta/compute/instance-templates/list
index 955ebf50c..b380cd0af 100644
--- a/gcloud/beta/compute/instance-templates/list
+++ b/gcloud/beta/compute/instance-templates/list
@@ -12,9 +12,6 @@ DESCRIPTION
     (BETA) gcloud beta compute instance-templates list displays all Google
     Compute Engine instance templates in a project.
 
-    By default, instance templates from all zones are listed. The results can
-    be narrowed down using a filter: --filter="zone:( ZONE ... )".
-
 EXAMPLES
     To list all instance templates in a project in table form, run:
 
@@ -24,12 +21,6 @@ EXAMPLES
 
         $ gcloud beta compute instance-templates list --uri
 
-    To list all instance templates in the us-central1-b and europe-west1-d
-    zones, run:
-
-        $ gcloud beta compute instance-templates list \
-            --filter="zone:( us-central1-b europe-west1-d )"
-
 POSITIONAL ARGUMENTS
      [NAME ...]
         (DEPRECATED) If provided, show details for the specified names and/or
diff --git a/gcloud/beta/compute/instances/bulk/create b/gcloud/beta/compute/instances/bulk/create
index 7b5b13f57..4b97fd70f 100644
--- a/gcloud/beta/compute/instances/bulk/create
+++ b/gcloud/beta/compute/instances/bulk/create
@@ -575,6 +575,13 @@ OPTIONAL FLAGS
             Specifies the Network Interface Controller (NIC) type for the
             interface. NIC_TYPE must be one of: GVNIC, VIRTIO_NET.
 
+         queue-count
+            Specifies the networking queue count for this interface. Both Rx
+            and Tx queues will be set to this number. If it's not specified, a
+            default queue count will be assigned. For Virtio-net, each
+            interface will get min(floor(#vCPU / #vNIC), 32) queues. For gVNIC,
+            each interface will get min(floor(#vCPU / #vNIC / 2), 16) qeueus.
+
      --network-performance-configs=[PROPERTY=VALUE,...]
         Configures network performance settings for the instance. If this flag
         is not specified, the instance will be created with its default network
diff --git a/gcloud/beta/compute/resource-policies/create/disk-consistency-group b/gcloud/beta/compute/resource-policies/create/disk-consistency-group
new file mode 100644
index 000000000..e345420e2
--- /dev/null
+++ b/gcloud/beta/compute/resource-policies/create/disk-consistency-group
@@ -0,0 +1,60 @@
+NAME
+    gcloud beta compute resource-policies create disk-consistency-group -
+        create a Compute Engine Disk Consistency Group resource policy
+
+SYNOPSIS
+    gcloud beta compute resource-policies create disk-consistency-group NAME
+        [--description=DESCRIPTION] [--region=REGION] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Create a Compute Engine disk consistency group resource policy.
+
+EXAMPLES
+    Create a disk consistency group policy:
+
+        $ gcloud beta compute resource-policies create \
+            disk-consistency-group my-resource-policy --region=REGION
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the resource policy to operate on.
+
+FLAGS
+     --description=DESCRIPTION
+        An optional, textual description for the backend.
+
+     --region=REGION
+        Region of the resource policy to operate on. If not specified, you
+        might be prompted to select a region (interactive mode only).
+
+        To avoid prompting when this flag is omitted, you can set the
+        compute/region property:
+
+            $ gcloud config set compute/region REGION
+
+        A list of regions can be fetched by running:
+
+            $ gcloud compute regions list
+
+        To unset the property, run:
+
+            $ gcloud config unset compute/region
+
+        Alternatively, the region can be stored in the environment variable
+        CLOUDSDK_COMPUTE_REGION.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha compute resource-policies create \
+            disk-consistency-group
+
diff --git a/gcloud/beta/compute/resource-policies/create/help b/gcloud/beta/compute/resource-policies/create/help
index 1283c4cda..e886d4679 100644
--- a/gcloud/beta/compute/resource-policies/create/help
+++ b/gcloud/beta/compute/resource-policies/create/help
@@ -16,6 +16,9 @@ GCLOUD WIDE FLAGS
 COMMANDS
     COMMAND is one of the following:
 
+     disk-consistency-group
+        (BETA) Create a Compute Engine Disk Consistency Group resource policy.
+
      group-placement
         (BETA) Create a Compute Engine group placement resource policy.
 
diff --git a/gcloud/beta/config/get b/gcloud/beta/config/get
index 26210298d..be1212d61 100644
--- a/gcloud/beta/config/get
+++ b/gcloud/beta/config/get
@@ -394,6 +394,10 @@ AVAILABLE PROPERTIES
             Overrides API endpoint for gcloud iam command group. Defaults to
             https://iam.googleapis.com/
 
+         iamcredentials
+            Overrides API endpoint for gcloud iam command group. Defaults to
+            https://iamcredentials.googleapis.com/
+
          iap
             Overrides API endpoint for gcloud iap command group. Defaults to
             https://iap.googleapis.com/
diff --git a/gcloud/beta/config/help b/gcloud/beta/config/help
index 288d49ee3..56f6613e4 100644
--- a/gcloud/beta/config/help
+++ b/gcloud/beta/config/help
@@ -426,6 +426,10 @@ AVAILABLE PROPERTIES
             Overrides API endpoint for gcloud iam command group. Defaults to
             https://iam.googleapis.com/
 
+         iamcredentials
+            Overrides API endpoint for gcloud iam command group. Defaults to
+            https://iamcredentials.googleapis.com/
+
          iap
             Overrides API endpoint for gcloud iap command group. Defaults to
             https://iap.googleapis.com/
diff --git a/gcloud/beta/config/list b/gcloud/beta/config/list
index af9881050..085df539a 100644
--- a/gcloud/beta/config/list
+++ b/gcloud/beta/config/list
@@ -438,6 +438,10 @@ AVAILABLE PROPERTIES
             Overrides API endpoint for gcloud iam command group. Defaults to
             https://iam.googleapis.com/
 
+         iamcredentials
+            Overrides API endpoint for gcloud iam command group. Defaults to
+            https://iamcredentials.googleapis.com/
+
          iap
             Overrides API endpoint for gcloud iap command group. Defaults to
             https://iap.googleapis.com/
diff --git a/gcloud/beta/config/set b/gcloud/beta/config/set
index da3481275..1d8ee24cb 100644
--- a/gcloud/beta/config/set
+++ b/gcloud/beta/config/set
@@ -441,6 +441,10 @@ AVAILABLE PROPERTIES
             Overrides API endpoint for gcloud iam command group. Defaults to
             https://iam.googleapis.com/
 
+         iamcredentials
+            Overrides API endpoint for gcloud iam command group. Defaults to
+            https://iamcredentials.googleapis.com/
+
          iap
             Overrides API endpoint for gcloud iap command group. Defaults to
             https://iap.googleapis.com/
diff --git a/gcloud/beta/config/unset b/gcloud/beta/config/unset
index 203186883..120ebec04 100644
--- a/gcloud/beta/config/unset
+++ b/gcloud/beta/config/unset
@@ -402,6 +402,10 @@ AVAILABLE PROPERTIES
             Overrides API endpoint for gcloud iam command group. Defaults to
             https://iam.googleapis.com/
 
+         iamcredentials
+            Overrides API endpoint for gcloud iam command group. Defaults to
+            https://iamcredentials.googleapis.com/
+
          iap
             Overrides API endpoint for gcloud iap command group. Defaults to
             https://iap.googleapis.com/
diff --git a/gcloud/beta/deploy/job-runs/help b/gcloud/beta/deploy/job-runs/help
index a9106f406..617c9a59c 100644
--- a/gcloud/beta/deploy/job-runs/help
+++ b/gcloud/beta/deploy/job-runs/help
@@ -22,6 +22,9 @@ COMMANDS
      list
         (BETA) List the job runs.
 
+     terminate
+        (BETA) Terminates a Cloud Deploy job run.
+
 NOTES
     This command is currently in beta and might change without notice. These
     variants are also available:
diff --git a/gcloud/beta/deploy/job-runs/terminate b/gcloud/beta/deploy/job-runs/terminate
new file mode 100644
index 000000000..899558741
--- /dev/null
+++ b/gcloud/beta/deploy/job-runs/terminate
@@ -0,0 +1,86 @@
+NAME
+    gcloud beta deploy job-runs terminate - terminates a Cloud Deploy job run
+
+SYNOPSIS
+    gcloud beta deploy job-runs terminate
+        (JOB_RUN : --delivery-pipeline=DELIVERY_PIPELINE
+          --region=REGION --release=RELEASE --rollout=ROLLOUT)
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Terminates a Cloud Deploy job run.
+
+EXAMPLES
+    To terminate a job run test-jobrun, for delivery pipeline 'test-pipeline',
+    release 'test-release', rollout 'test-rollout', in region 'us-central1',
+    run:
+
+        $ gcloud beta deploy job-runs terminate test-jobrun \
+             --delivery-pipeline=test-pipeline --release=test-release \
+             --rollout=test-rollout --region=us-central1
+
+POSITIONAL ARGUMENTS
+     Job run resource - The name of the Job Run. The arguments in this group
+     can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways. To set the project attribute:
+      ◆ provide the argument job_run on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       JOB_RUN
+          ID of the job_run or fully qualified identifier for the job_run. To
+          set the name attribute:
+          ▸ provide the argument job_run on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --delivery-pipeline=DELIVERY_PIPELINE
+          The delivery pipeline associated with the job_run. Alternatively, set
+          the property [deploy/delivery-pipeline]. To set the delivery-pipeline
+          attribute:
+          ▸ provide the argument job_run on the command line with a fully
+            specified name;
+          ▸ provide the argument --delivery-pipeline on the command line;
+          ▸ set the property deploy/delivery_pipeline.
+
+       --region=REGION
+          The Cloud region for the job_run. Alternatively, set the property
+          [deploy/region]. To set the region attribute:
+          ▸ provide the argument job_run on the command line with a fully
+            specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property deploy/region.
+
+       --release=RELEASE
+          The release associated with the job_run. To set the release
+          attribute:
+          ▸ provide the argument job_run on the command line with a fully
+            specified name;
+          ▸ provide the argument --release on the command line.
+
+       --rollout=ROLLOUT
+          The rollout associated with the job_run. To set the rollout
+          attribute:
+          ▸ provide the argument job_run on the command line with a fully
+            specified name;
+          ▸ provide the argument --rollout on the command line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha deploy job-runs terminate
+
diff --git a/gcloud/beta/deploy/releases/create b/gcloud/beta/deploy/releases/create
index d7f2b0229..69ff3e0a6 100644
--- a/gcloud/beta/deploy/releases/create
+++ b/gcloud/beta/deploy/releases/create
@@ -12,7 +12,8 @@ SYNOPSIS
         [--build-artifacts=BUILD_ARTIFACTS | --images=[NAME=TAG,...]]
         [--disable-initial-rollout | --enable-initial-rollout
           --initial-rollout-annotations=[KEY=VALUE,...]
-          --initial-rollout-labels=[KEY=VALUE,...]]
+          --initial-rollout-labels=[KEY=VALUE,...]
+          --initial-rollout-phase-id=INITIAL_ROLLOUT_PHASE_ID]
         [--from-k8s-manifest=FROM_K8S_MANIFEST
           | --from-run-manifest=FROM_RUN_MANIFEST
           | --skaffold-file=SKAFFOLD_FILE --source=SOURCE; default="."]
@@ -184,6 +185,18 @@ FLAGS
               $ gcloud beta deploy releases create \
                   initial-rollout-labels="commit=abc123,author=foo"
 
+       --initial-rollout-phase-id=INITIAL_ROLLOUT_PHASE_ID
+          The phase to start the initial rollout at when creating the release.
+          The phase ID must be a valid phase on the rollout. If not specified,
+          then the rollout will start at the first phase.
+
+          Examples:
+
+          Start rollout at stable phase:
+
+              $ gcloud beta deploy releases create \
+                  --initial-rollout-phase-id=stable
+
      At most one of these can be specified:
 
        --from-k8s-manifest=FROM_K8S_MANIFEST
diff --git a/gcloud/beta/deploy/releases/promote b/gcloud/beta/deploy/releases/promote
index 44f664d85..c7a9e55fb 100644
--- a/gcloud/beta/deploy/releases/promote
+++ b/gcloud/beta/deploy/releases/promote
@@ -7,8 +7,8 @@ SYNOPSIS
         (--release=RELEASE
           : --delivery-pipeline=DELIVERY_PIPELINE --region=REGION)
         [--annotations=[KEY=VALUE,...]] [--labels=[KEY=VALUE,...]]
-        [--rollout-id=ROLLOUT_ID] [--to-target=TO_TARGET]
-        [GCLOUD_WIDE_FLAG ...]
+        [--rollout-id=ROLLOUT_ID] [--starting-phase-id=STARTING_PHASE_ID]
+        [--to-target=TO_TARGET] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (BETA) If to-target is not specified the command promotes the release from
@@ -86,6 +86,13 @@ OPTIONAL FLAGS
      --rollout-id=ROLLOUT_ID
         ID to assign to the generated rollout for promotion.
 
+     --starting-phase-id=STARTING_PHASE_ID
+        If set, starts the created rollout at the specified phase.
+
+        Start rollout at stable phase:
+
+            $ gcloud beta deploy releases promote --starting-phase-id=stable
+
      --to-target=TO_TARGET
         Destination target to promote into.
 
diff --git a/gcloud/beta/deploy/rollouts/advance b/gcloud/beta/deploy/rollouts/advance
new file mode 100644
index 000000000..b47411b49
--- /dev/null
+++ b/gcloud/beta/deploy/rollouts/advance
@@ -0,0 +1,82 @@
+NAME
+    gcloud beta deploy rollouts advance - advances a rollout
+
+SYNOPSIS
+    gcloud beta deploy rollouts advance
+        (ROLLOUT : --delivery-pipeline=DELIVERY_PIPELINE
+          --region=REGION --release=RELEASE) [--phase-id=PHASE_ID]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Advances a rollout.
+
+EXAMPLES
+    To advance a rollout test-rollout to phase test-phase for delivery pipeline
+    test-pipeline, release test-release in region us-central1, run:
+
+        $ gcloud beta deploy rollouts advance test-rollout \
+             --phase-id=test-phase --delivery-pipeline=test-pipeline \
+             --release=test-release --region=us-central1
+
+POSITIONAL ARGUMENTS
+     Rollout resource - The name of the Rollout. The arguments in this group
+     can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways. To set the project attribute:
+      ◆ provide the argument rollout on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       ROLLOUT
+          ID of the rollout or fully qualified identifier for the rollout. To
+          set the rollout attribute:
+          ▸ provide the argument rollout on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --delivery-pipeline=DELIVERY_PIPELINE
+          The delivery pipeline associated with the rollout. Alternatively, set
+          the property [deploy/delivery-pipeline]. To set the delivery-pipeline
+          attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --delivery-pipeline on the command line;
+          ▸ set the property deploy/delivery_pipeline.
+
+       --region=REGION
+          The Cloud region for the rollout. Alternatively, set the property
+          [deploy/region]. To set the region attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property deploy/region.
+
+       --release=RELEASE
+          The release associated with the rollout. To set the release
+          attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --release on the command line.
+
+FLAGS
+     --phase-id=PHASE_ID
+        Phase ID on a rollout resource
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha deploy rollouts advance
+
diff --git a/gcloud/beta/deploy/rollouts/cancel b/gcloud/beta/deploy/rollouts/cancel
new file mode 100644
index 000000000..1609b2846
--- /dev/null
+++ b/gcloud/beta/deploy/rollouts/cancel
@@ -0,0 +1,77 @@
+NAME
+    gcloud beta deploy rollouts cancel - cancel a Rollout
+
+SYNOPSIS
+    gcloud beta deploy rollouts cancel
+        (ROLLOUT : --delivery-pipeline=DELIVERY_PIPELINE
+          --region=REGION --release=RELEASE) [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Cancel a Rollout.
+
+EXAMPLES
+    To cancel a rollout test-rollout for delivery pipeline test-pipeline,
+    release test-release in region us-central1, run:
+
+        $ gcloud beta deploy rollouts cancel test-rollout \
+             --delivery-pipeline=test-pipeline --release=test-release \
+             --region=us-central1
+
+POSITIONAL ARGUMENTS
+     Rollout resource - The name of the Rollout. The arguments in this group
+     can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways. To set the project attribute:
+      ◆ provide the argument rollout on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       ROLLOUT
+          ID of the rollout or fully qualified identifier for the rollout. To
+          set the rollout attribute:
+          ▸ provide the argument rollout on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --delivery-pipeline=DELIVERY_PIPELINE
+          The delivery pipeline associated with the rollout. Alternatively, set
+          the property [deploy/delivery-pipeline]. To set the delivery-pipeline
+          attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --delivery-pipeline on the command line;
+          ▸ set the property deploy/delivery_pipeline.
+
+       --region=REGION
+          The Cloud region for the rollout. Alternatively, set the property
+          [deploy/region]. To set the region attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property deploy/region.
+
+       --release=RELEASE
+          The release associated with the rollout. To set the release
+          attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --release on the command line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha deploy rollouts cancel
+
diff --git a/gcloud/beta/deploy/rollouts/help b/gcloud/beta/deploy/rollouts/help
index 13ce09c6b..fd8ce4f26 100644
--- a/gcloud/beta/deploy/rollouts/help
+++ b/gcloud/beta/deploy/rollouts/help
@@ -16,12 +16,21 @@ GCLOUD WIDE FLAGS
 COMMANDS
     COMMAND is one of the following:
 
+     advance
+        (BETA) Advances a rollout.
+
      approve
         (BETA) Approves a rollout having an Approval state of "Required".
 
+     cancel
+        (BETA) Cancel a Rollout.
+
      describe
         (BETA) Show details for a rollout.
 
+     ignore-job
+        (BETA) Ignores a specified job and phase combination on a rollout.
+
      list
         (BETA) List the rollouts.
 
diff --git a/gcloud/beta/deploy/rollouts/ignore-job b/gcloud/beta/deploy/rollouts/ignore-job
new file mode 100644
index 000000000..93674a85c
--- /dev/null
+++ b/gcloud/beta/deploy/rollouts/ignore-job
@@ -0,0 +1,88 @@
+NAME
+    gcloud beta deploy rollouts ignore-job - ignores a specified job and phase
+        combination on a rollout
+
+SYNOPSIS
+    gcloud beta deploy rollouts ignore-job
+        (ROLLOUT : --delivery-pipeline=DELIVERY_PIPELINE
+          --region=REGION --release=RELEASE) --job-id=JOB_ID
+        --phase-id=PHASE_ID [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Ignores a specified job and phase combination on a rollout.
+
+EXAMPLES
+    To ignore a job test-job in phase test-phase on a rollout test-rollout for
+    delivery pipeline test-pipeline, release test-release in region
+    us-central1, run:
+
+        $ gcloud beta deploy rollouts ignore-job test-rollout \
+             --job-id=test-job --phase-id=test-phase \
+             --delivery-pipeline=test-pipeline --release=test-release \
+             --region=us-central1
+
+POSITIONAL ARGUMENTS
+     Rollout resource - The name of the Rollout. The arguments in this group
+     can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways. To set the project attribute:
+      ◆ provide the argument rollout on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       ROLLOUT
+          ID of the rollout or fully qualified identifier for the rollout. To
+          set the rollout attribute:
+          ▸ provide the argument rollout on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --delivery-pipeline=DELIVERY_PIPELINE
+          The delivery pipeline associated with the rollout. Alternatively, set
+          the property [deploy/delivery-pipeline]. To set the delivery-pipeline
+          attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --delivery-pipeline on the command line;
+          ▸ set the property deploy/delivery_pipeline.
+
+       --region=REGION
+          The Cloud region for the rollout. Alternatively, set the property
+          [deploy/region]. To set the region attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property deploy/region.
+
+       --release=RELEASE
+          The release associated with the rollout. To set the release
+          attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --release on the command line.
+
+REQUIRED FLAGS
+     --job-id=JOB_ID
+        Job ID on a rollout resource
+
+     --phase-id=PHASE_ID
+        Phase ID on a rollout resource
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha deploy rollouts ignore-job
+
diff --git a/gcloud/beta/deploy/targets/redeploy b/gcloud/beta/deploy/targets/redeploy
index f172723ff..6637db21c 100644
--- a/gcloud/beta/deploy/targets/redeploy
+++ b/gcloud/beta/deploy/targets/redeploy
@@ -5,7 +5,8 @@ SYNOPSIS
     gcloud beta deploy targets redeploy (TARGET : --region=REGION)
         --delivery-pipeline=DELIVERY_PIPELINE [--annotations=[KEY=VALUE,...]]
         [--description=DESCRIPTION] [--labels=[KEY=VALUE,...]]
-        [--rollout-id=ROLLOUT_ID] [GCLOUD_WIDE_FLAG ...]
+        [--rollout-id=ROLLOUT_ID] [--starting-phase-id=STARTING_PHASE_ID]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (BETA) Redeploy the last rollout that has a state of SUCCESSFUL or FAILED
@@ -80,6 +81,13 @@ OPTIONAL FLAGS
      --rollout-id=ROLLOUT_ID
         ID to assign to the generated rollout for promotion.
 
+     --starting-phase-id=STARTING_PHASE_ID
+        If set, starts the created rollout at the specified phase.
+
+        Start rollout at stable phase:
+
+            $ gcloud beta deploy targets redeploy --starting-phase-id=stable
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/beta/deploy/targets/rollback b/gcloud/beta/deploy/targets/rollback
index a206818fb..8a4b7aa2c 100644
--- a/gcloud/beta/deploy/targets/rollback
+++ b/gcloud/beta/deploy/targets/rollback
@@ -5,7 +5,8 @@ SYNOPSIS
     gcloud beta deploy targets rollback (TARGET : --region=REGION)
         --delivery-pipeline=DELIVERY_PIPELINE [--annotations=[KEY=VALUE,...]]
         [--description=DESCRIPTION] [--labels=[KEY=VALUE,...]]
-        [--release=RELEASE] [--rollout-id=ROLLOUT_ID] [GCLOUD_WIDE_FLAG ...]
+        [--release=RELEASE] [--rollout-id=ROLLOUT_ID]
+        [--starting-phase-id=STARTING_PHASE_ID] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (BETA) If release is not specified, the command rollbacks the target with
@@ -83,6 +84,13 @@ OPTIONAL FLAGS
      --rollout-id=ROLLOUT_ID
         ID to assign to the generated rollout for promotion.
 
+     --starting-phase-id=STARTING_PHASE_ID
+        If set, starts the created rollout at the specified phase.
+
+        Start rollout at stable phase:
+
+            $ gcloud beta deploy targets rollback --starting-phase-id=stable
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/beta/metastore/services/create b/gcloud/beta/metastore/services/create
index c2b7837b6..f2a643a13 100644
--- a/gcloud/beta/metastore/services/create
+++ b/gcloud/beta/metastore/services/create
@@ -249,10 +249,10 @@ FLAGS
        --instance-size=INSTANCE_SIZE
           The instance size of the service. INSTANCE_SIZE must be one of:
 
-           extra_large
+           extra-large
               Extra large instance size, maps to a scaling factor of 6.0.
 
-           extra_small
+           extra-small
               Extra small instance size, maps to a scaling factor of 0.1.
 
            large
diff --git a/gcloud/beta/metastore/services/update b/gcloud/beta/metastore/services/update
index 4baf03011..f8c627c93 100644
--- a/gcloud/beta/metastore/services/update
+++ b/gcloud/beta/metastore/services/update
@@ -126,10 +126,10 @@ FLAGS
        --instance-size=INSTANCE_SIZE
           The instance size of the service. INSTANCE_SIZE must be one of:
 
-           extra_large
+           extra-large
               Extra large instance size, maps to a scaling factor of 6.0.
 
-           extra_small
+           extra-small
               Extra small instance size, maps to a scaling factor of 0.1.
 
            large
diff --git a/gcloud/beta/network-security/gateway-security-policies/delete b/gcloud/beta/network-security/gateway-security-policies/delete
new file mode 100644
index 000000000..fc3bc69d5
--- /dev/null
+++ b/gcloud/beta/network-security/gateway-security-policies/delete
@@ -0,0 +1,72 @@
+NAME
+    gcloud beta network-security gateway-security-policies delete - delete
+        Gateway Security Policy
+
+SYNOPSIS
+    gcloud beta network-security gateway-security-policies delete
+        (GATEWAY_SECURITY_POLICY : --location=LOCATION) [--async]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Delete the specified Gateway Security Policy.
+
+EXAMPLES
+    To delete a Gateway Security Policy called 'my-gateway-security-policy',
+    run:
+
+        $ gcloud beta network-security gateway-security-policies delete \
+            my-gateway-security-policy --location=global
+
+POSITIONAL ARGUMENTS
+     Gateway security policy resource - Name of the Gateway Security Policy you
+     want to delete. The arguments in this group can be used to specify the
+     attributes of this resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways. To set the project
+     attribute:
+      ◆ provide the argument gateway_security_policy on the command line with
+        a fully specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       GATEWAY_SECURITY_POLICY
+          ID of the gateway security policy or fully qualified identifier for
+          the gateway security policy. To set the gateway_security_policy
+          attribute:
+          ▸ provide the argument gateway_security_policy on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location Id.
+
+          To set the location attribute:
+          ▸ provide the argument gateway_security_policy on the command line
+            with a fully specified name;
+          ▸ provide the argument --location on the command line.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networksecurity/v1beta1 API. The full documentation
+    for this API can be found at: https://cloud.google.com/networking
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha network-security gateway-security-policies delete
+
diff --git a/gcloud/beta/network-security/gateway-security-policies/export b/gcloud/beta/network-security/gateway-security-policies/export
new file mode 100644
index 000000000..48848dd9a
--- /dev/null
+++ b/gcloud/beta/network-security/gateway-security-policies/export
@@ -0,0 +1,75 @@
+NAME
+    gcloud beta network-security gateway-security-policies export - export
+        Gateway Security Policy
+
+SYNOPSIS
+    gcloud beta network-security gateway-security-policies export
+        (GATEWAY_SECURITY_POLICY : --location=LOCATION)
+        [--destination=DESTINATION] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Export a Gateway Security Policy.
+
+EXAMPLES
+    To export a Gateway Security Policy, run:
+
+        $ gcloud beta network-security gateway-security-policies export \
+            my-gateway-security-policy \
+            --destination=my-gateway-security-policy-list.yaml \
+            --location=global
+
+POSITIONAL ARGUMENTS
+     Gateway security policy resource - Name of the Gateway Security Policy to
+     export. The arguments in this group can be used to specify the attributes
+     of this resource. (NOTE) Some attributes are not given arguments in this
+     group but can be set in other ways. To set the project attribute:
+      ◆ provide the argument gateway_security_policy on the command line with
+        a fully specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       GATEWAY_SECURITY_POLICY
+          ID of the gateway security policy or fully qualified identifier for
+          the gateway security policy. To set the gateway_security_policy
+          attribute:
+          ▸ provide the argument gateway_security_policy on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location Id.
+
+          To set the location attribute:
+          ▸ provide the argument gateway_security_policy on the command line
+            with a fully specified name;
+          ▸ provide the argument --location on the command line.
+
+FLAGS
+     --destination=DESTINATION
+        Path to a YAML file where the configuration will be exported. The
+        exported data will not contain any output-only fields. Alternatively,
+        you may omit this flag to write to standard output. For a schema
+        describing the export/import format, see
+        $CLOUDSDKROOT/lib/googlecloudsdk/schemas/...
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networksecurity/v1beta1 API. The full documentation
+    for this API can be found at: https://cloud.google.com/networking
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha network-security gateway-security-policies export
+
diff --git a/gcloud/beta/network-security/gateway-security-policies/help b/gcloud/beta/network-security/gateway-security-policies/help
new file mode 100644
index 000000000..33f040ae8
--- /dev/null
+++ b/gcloud/beta/network-security/gateway-security-policies/help
@@ -0,0 +1,43 @@
+NAME
+    gcloud beta network-security gateway-security-policies - manage Network
+        Security Gateway Security Policies
+
+SYNOPSIS
+    gcloud beta network-security gateway-security-policies GROUP | COMMAND
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Manage Network Security Gateway Security Policies.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+GROUPS
+    GROUP is one of the following:
+
+     rules
+        (BETA) Manage Network Security GatewaySecurityPolicyRules.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     delete
+        (BETA) Delete Gateway Security Policy.
+
+     export
+        (BETA) Export Gateway Security Policy.
+
+     import
+        (BETA) Import Gateway Security Policy.
+
+     list
+        (BETA) List Gateway Security Policies.
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha network-security gateway-security-policies
+
diff --git a/gcloud/beta/network-security/gateway-security-policies/import b/gcloud/beta/network-security/gateway-security-policies/import
new file mode 100644
index 000000000..f3f38a63b
--- /dev/null
+++ b/gcloud/beta/network-security/gateway-security-policies/import
@@ -0,0 +1,81 @@
+NAME
+    gcloud beta network-security gateway-security-policies import - import
+        Gateway Security Policy
+
+SYNOPSIS
+    gcloud beta network-security gateway-security-policies import
+        (GATEWAY_SECURITY_POLICY : --location=LOCATION) [--async]
+        [--source=SOURCE] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Import a Gateway Security Policy.
+
+EXAMPLES
+    To import a Gateway Security Policy from a YAML file, run:
+
+        $ gcloud beta network-security gateway-security-policies import \
+            my-gateway-security-policy \
+            --source=my-gateway-security-policy-list.yaml --location=global
+
+POSITIONAL ARGUMENTS
+     Gateway security policy resource - Name of the Gateway Security Policy to
+     import. The arguments in this group can be used to specify the attributes
+     of this resource. (NOTE) Some attributes are not given arguments in this
+     group but can be set in other ways. To set the project attribute:
+      ◆ provide the argument gateway_security_policy on the command line with
+        a fully specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       GATEWAY_SECURITY_POLICY
+          ID of the gateway security policy or fully qualified identifier for
+          the gateway security policy. To set the gateway_security_policy
+          attribute:
+          ▸ provide the argument gateway_security_policy on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location Id.
+
+          To set the location attribute:
+          ▸ provide the argument gateway_security_policy on the command line
+            with a fully specified name;
+          ▸ provide the argument --location on the command line.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+     --source=SOURCE
+        Path to a YAML file containing the configuration export data. The YAML
+        file must not contain any output-only fields. Alternatively, you may
+        omit this flag to read from standard input. For a schema describing the
+        export/import format, see: $CLOUDSDKROOT/lib/googlecloudsdk/schemas/...
+
+        $CLOUDSDKROOT is can be obtained with the following command:
+
+            $ gcloud info --format='value(installation.sdk_root)'
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networksecurity/v1beta1 API. The full documentation
+    for this API can be found at: https://cloud.google.com/networking
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha network-security gateway-security-policies import
+
diff --git a/gcloud/beta/network-security/gateway-security-policies/list b/gcloud/beta/network-security/gateway-security-policies/list
new file mode 100644
index 000000000..c0dd8f169
--- /dev/null
+++ b/gcloud/beta/network-security/gateway-security-policies/list
@@ -0,0 +1,87 @@
+NAME
+    gcloud beta network-security gateway-security-policies list - list Gateway
+        Security Policies
+
+SYNOPSIS
+    gcloud beta network-security gateway-security-policies list
+        --location=LOCATION [--filter=EXPRESSION] [--limit=LIMIT]
+        [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) List all Gateway Security Policies in the specified location of the
+    current project.
+
+EXAMPLES
+    To list Gateway Security Policies in the current project, run:
+
+        $ gcloud beta network-security gateway-security-policies list \
+            --location=global
+
+REQUIRED FLAGS
+     Location resource - The project of the Gateway Security Policies to
+     display. This represents a Cloud resource. (NOTE) Some attributes are not
+     given arguments in this group but can be set in other ways. To set the
+     project attribute:
+      ◆ provide the argument --location on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       --location=LOCATION
+          ID of the location or fully qualified identifier for the location. To
+          set the location attribute:
+          ▸ provide the argument --location on the command line.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networksecurity/v1beta1 API. The full documentation
+    for this API can be found at: https://cloud.google.com/networking
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha network-security gateway-security-policies list
+
diff --git a/gcloud/beta/network-security/gateway-security-policies/rules/delete b/gcloud/beta/network-security/gateway-security-policies/rules/delete
new file mode 100644
index 000000000..ad450c500
--- /dev/null
+++ b/gcloud/beta/network-security/gateway-security-policies/rules/delete
@@ -0,0 +1,83 @@
+NAME
+    gcloud beta network-security gateway-security-policies rules delete -
+        delete GatewaySecurityPolicyRule
+
+SYNOPSIS
+    gcloud beta network-security gateway-security-policies rules delete
+        (GATEWAY_SECURITY_POLICY_RULE
+          : --gateway-security-policy=GATEWAY_SECURITY_POLICY
+          --location=LOCATION) [--async] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Delete the specified GatewaySecurityPolicyRule.
+
+EXAMPLES
+    To delete a GatewaySecurityPolicyRule called 'my-rule', run:
+
+        $ gcloud beta network-security gateway-security-policies rules \
+            delete my-rule --location={region} \
+            --gateway-security-policy={policy-name}
+
+POSITIONAL ARGUMENTS
+     Gateway security policy rule resource - Name of the
+     GatewaySecurityPolicyRule you want to delete. The arguments in this group
+     can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways. To set the project attribute:
+      ◆ provide the argument gateway_security_policy_rule on the command line
+        with a fully specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       GATEWAY_SECURITY_POLICY_RULE
+          ID of the gateway security policy rule or fully qualified identifier
+          for the gateway security policy rule. To set the
+          gateway_security_policy_rule attribute:
+          ▸ provide the argument gateway_security_policy_rule on the command
+            line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --gateway-security-policy=GATEWAY_SECURITY_POLICY
+          Id of the gateway security policy. To set the gateway-security-policy
+          attribute:
+          ▸ provide the argument gateway_security_policy_rule on the command
+            line with a fully specified name;
+          ▸ provide the argument --gateway-security-policy on the command
+            line.
+
+       --location=LOCATION
+          The location Id.
+
+          To set the location attribute:
+          ▸ provide the argument gateway_security_policy_rule on the command
+            line with a fully specified name;
+          ▸ provide the argument --location on the command line.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networksecurity/v1beta1 API. The full documentation
+    for this API can be found at: https://cloud.google.com/networking
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha network-security gateway-security-policies rules \
+            delete
+
diff --git a/gcloud/beta/network-security/gateway-security-policies/rules/export b/gcloud/beta/network-security/gateway-security-policies/rules/export
new file mode 100644
index 000000000..ed5860ee0
--- /dev/null
+++ b/gcloud/beta/network-security/gateway-security-policies/rules/export
@@ -0,0 +1,87 @@
+NAME
+    gcloud beta network-security gateway-security-policies rules export -
+        export GatewaySecurityPolicyRule
+
+SYNOPSIS
+    gcloud beta network-security gateway-security-policies rules export
+        (GATEWAY_SECURITY_POLICY_RULE
+          : --gateway-security-policy=GATEWAY_SECURITY_POLICY
+          --location=LOCATION) [--destination=DESTINATION]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Export a GatewaySecurityPolicyRule.
+
+EXAMPLES
+    To export a GatewaySecurityPolicyRule, run:
+
+        $ gcloud beta network-security gateway-security-policies rules \
+            export my-rule --destination=my-rule.yaml --location={region} \
+            --gateway-security-policy={policy-name}
+
+POSITIONAL ARGUMENTS
+     Gateway security policy rule resource - Name of the
+     GatewaySecurityPolicyRule to export. The arguments in this group can be
+     used to specify the attributes of this resource. (NOTE) Some attributes
+     are not given arguments in this group but can be set in other ways. To set
+     the project attribute:
+      ◆ provide the argument gateway_security_policy_rule on the command line
+        with a fully specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       GATEWAY_SECURITY_POLICY_RULE
+          ID of the gateway security policy rule or fully qualified identifier
+          for the gateway security policy rule. To set the
+          gateway_security_policy_rule attribute:
+          ▸ provide the argument gateway_security_policy_rule on the command
+            line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --gateway-security-policy=GATEWAY_SECURITY_POLICY
+          Id of the gateway security policy. To set the gateway-security-policy
+          attribute:
+          ▸ provide the argument gateway_security_policy_rule on the command
+            line with a fully specified name;
+          ▸ provide the argument --gateway-security-policy on the command
+            line.
+
+       --location=LOCATION
+          The location Id.
+
+          To set the location attribute:
+          ▸ provide the argument gateway_security_policy_rule on the command
+            line with a fully specified name;
+          ▸ provide the argument --location on the command line.
+
+FLAGS
+     --destination=DESTINATION
+        Path to a YAML file where the configuration will be exported. The
+        exported data will not contain any output-only fields. Alternatively,
+        you may omit this flag to write to standard output. For a schema
+        describing the export/import format, see
+        $CLOUDSDKROOT/lib/googlecloudsdk/schemas/...
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networksecurity/v1beta1 API. The full documentation
+    for this API can be found at: https://cloud.google.com/networking
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha network-security gateway-security-policies rules \
+            export
+
diff --git a/gcloud/beta/network-security/gateway-security-policies/rules/help b/gcloud/beta/network-security/gateway-security-policies/rules/help
new file mode 100644
index 000000000..03074476f
--- /dev/null
+++ b/gcloud/beta/network-security/gateway-security-policies/rules/help
@@ -0,0 +1,37 @@
+NAME
+    gcloud beta network-security gateway-security-policies rules - manage
+        Network Security GatewaySecurityPolicyRules
+
+SYNOPSIS
+    gcloud beta network-security gateway-security-policies rules COMMAND
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Manage Network Security GatewaySecurityPolicyRules.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     delete
+        (BETA) Delete GatewaySecurityPolicyRule.
+
+     export
+        (BETA) Export GatewaySecurityPolicyRule.
+
+     import
+        (BETA) Import GatewaySecurityPolicy.
+
+     list
+        (BETA) List GatewaySecurityPolicyRules.
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha network-security gateway-security-policies rules
+
diff --git a/gcloud/beta/network-security/gateway-security-policies/rules/import b/gcloud/beta/network-security/gateway-security-policies/rules/import
new file mode 100644
index 000000000..60835f0f4
--- /dev/null
+++ b/gcloud/beta/network-security/gateway-security-policies/rules/import
@@ -0,0 +1,94 @@
+NAME
+    gcloud beta network-security gateway-security-policies rules import -
+        import GatewaySecurityPolicy
+
+SYNOPSIS
+    gcloud beta network-security gateway-security-policies rules import
+        (GATEWAY_SECURITY_POLICY_RULE
+          : --gateway-security-policy=GATEWAY_SECURITY_POLICY
+          --location=LOCATION) [--async] [--source=SOURCE]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Import a GatewaySecurityPolicy.
+
+EXAMPLES
+    To import a GatewaySecurityPolicy from a YAML file, run:
+
+        $ gcloud beta network-security gateway-security-policies rules \
+            import my-rule --source=my-rule.yaml --location={region} \
+            --gateway-security-policy={policy-name}
+
+POSITIONAL ARGUMENTS
+     Gateway security policy rule resource - Name of the GatewaySecurityPolicy
+     to import. The arguments in this group can be used to specify the
+     attributes of this resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways. To set the project
+     attribute:
+      ◆ provide the argument gateway_security_policy_rule on the command line
+        with a fully specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       GATEWAY_SECURITY_POLICY_RULE
+          ID of the gateway security policy rule or fully qualified identifier
+          for the gateway security policy rule. To set the
+          gateway_security_policy_rule attribute:
+          ▸ provide the argument gateway_security_policy_rule on the command
+            line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --gateway-security-policy=GATEWAY_SECURITY_POLICY
+          Id of the gateway security policy. To set the gateway-security-policy
+          attribute:
+          ▸ provide the argument gateway_security_policy_rule on the command
+            line with a fully specified name;
+          ▸ provide the argument --gateway-security-policy on the command
+            line.
+
+       --location=LOCATION
+          The location Id.
+
+          To set the location attribute:
+          ▸ provide the argument gateway_security_policy_rule on the command
+            line with a fully specified name;
+          ▸ provide the argument --location on the command line.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+     --source=SOURCE
+        Path to a YAML file containing the configuration export data. The YAML
+        file must not contain any output-only fields. Alternatively, you may
+        omit this flag to read from standard input. For a schema describing the
+        export/import format, see: $CLOUDSDKROOT/lib/googlecloudsdk/schemas/...
+
+        $CLOUDSDKROOT is can be obtained with the following command:
+
+            $ gcloud info --format='value(installation.sdk_root)'
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networksecurity/v1beta1 API. The full documentation
+    for this API can be found at: https://cloud.google.com/networking
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha network-security gateway-security-policies rules \
+            import
+
diff --git a/gcloud/beta/network-security/gateway-security-policies/rules/list b/gcloud/beta/network-security/gateway-security-policies/rules/list
new file mode 100644
index 000000000..2a1686447
--- /dev/null
+++ b/gcloud/beta/network-security/gateway-security-policies/rules/list
@@ -0,0 +1,102 @@
+NAME
+    gcloud beta network-security gateway-security-policies rules list - list
+        GatewaySecurityPolicyRules
+
+SYNOPSIS
+    gcloud beta network-security gateway-security-policies rules list
+        (--gateway-security-policy=GATEWAY_SECURITY_POLICY
+          : --location=LOCATION) [--filter=EXPRESSION] [--limit=LIMIT]
+        [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) List all GatewaySecurityPolicyRules in the specified location of the
+    current project.
+
+EXAMPLES
+    To list GatewaySecurityPolicyRules in the current project, run:
+
+        $ gcloud beta network-security gateway-security-policies rules \
+            list --location={region} --gateway-security-policy={policy-name}
+
+REQUIRED FLAGS
+     Gateway security policy resource - The project of the
+     GatewaySecurityPolicyRules to display. The arguments in this group can be
+     used to specify the attributes of this resource. (NOTE) Some attributes
+     are not given arguments in this group but can be set in other ways. To set
+     the project attribute:
+      ◆ provide the argument --gateway-security-policy on the command line
+        with a fully specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       --gateway-security-policy=GATEWAY_SECURITY_POLICY
+          ID of the gateway security policy or fully qualified identifier for
+          the gateway security policy. To set the gateway-security-policy
+          attribute:
+          ▸ provide the argument --gateway-security-policy on the command
+            line.
+
+          This flag argument must be specified if any of the other arguments in
+          this group are specified.
+
+       --location=LOCATION
+          The location Id.
+
+          To set the location attribute:
+          ▸ provide the argument --gateway-security-policy on the command
+            line with a fully specified name;
+          ▸ provide the argument --location on the command line.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networksecurity/v1beta1 API. The full documentation
+    for this API can be found at: https://cloud.google.com/networking
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha network-security gateway-security-policies rules list
+
diff --git a/gcloud/beta/network-security/help b/gcloud/beta/network-security/help
index 0b0af6e01..e7e225a7e 100644
--- a/gcloud/beta/network-security/help
+++ b/gcloud/beta/network-security/help
@@ -21,9 +21,15 @@ GROUPS
      client-tls-policies
         (BETA) Manage Network Security ClientTlsPolicies.
 
+     gateway-security-policies
+        (BETA) Manage Network Security Gateway Security Policies.
+
      server-tls-policies
         (BETA) Manage Network Security ServerTlsPolicies.
 
+     url-lists
+        (BETA) Manage Network Security UrlLists.
+
 NOTES
     This command is currently in beta and might change without notice. These
     variants are also available:
diff --git a/gcloud/beta/network-security/url-lists/delete b/gcloud/beta/network-security/url-lists/delete
new file mode 100644
index 000000000..3f41f7a4d
--- /dev/null
+++ b/gcloud/beta/network-security/url-lists/delete
@@ -0,0 +1,67 @@
+NAME
+    gcloud beta network-security url-lists delete - delete UrlList
+
+SYNOPSIS
+    gcloud beta network-security url-lists delete
+        (URL_LIST : --location=LOCATION) [--async] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Delete the specified UrlList.
+
+EXAMPLES
+    To delete a UrlList called 'my-url-list', run:
+
+        $ gcloud beta network-security url-lists delete my-url-list \
+            --location=global
+
+POSITIONAL ARGUMENTS
+     Url list resource - Name of the UrlList you want to delete. The arguments
+     in this group can be used to specify the attributes of this resource.
+     (NOTE) Some attributes are not given arguments in this group but can be
+     set in other ways. To set the project attribute:
+      ◆ provide the argument url_list on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       URL_LIST
+          ID of the url list or fully qualified identifier for the url list. To
+          set the url_list attribute:
+          ▸ provide the argument url_list on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location Id.
+
+          To set the location attribute:
+          ▸ provide the argument url_list on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networksecurity/v1beta1 API. The full documentation
+    for this API can be found at: https://cloud.google.com/networking
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha network-security url-lists delete
+
diff --git a/gcloud/beta/network-security/url-lists/export b/gcloud/beta/network-security/url-lists/export
new file mode 100644
index 000000000..09962cfbb
--- /dev/null
+++ b/gcloud/beta/network-security/url-lists/export
@@ -0,0 +1,71 @@
+NAME
+    gcloud beta network-security url-lists export - export UrlList
+
+SYNOPSIS
+    gcloud beta network-security url-lists export
+        (URL_LIST : --location=LOCATION) [--destination=DESTINATION]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Export a UrlList.
+
+EXAMPLES
+    To export a UrlList, run:
+
+        $ gcloud beta network-security url-lists export my-url-list \
+            --destination=my-url-list.yaml --location=global
+
+POSITIONAL ARGUMENTS
+     Url list resource - Name of the UrlList to export. The arguments in this
+     group can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways. To set the project attribute:
+      ◆ provide the argument url_list on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       URL_LIST
+          ID of the url list or fully qualified identifier for the url list. To
+          set the url_list attribute:
+          ▸ provide the argument url_list on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location Id.
+
+          To set the location attribute:
+          ▸ provide the argument url_list on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+FLAGS
+     --destination=DESTINATION
+        Path to a YAML file where the configuration will be exported. The
+        exported data will not contain any output-only fields. Alternatively,
+        you may omit this flag to write to standard output. For a schema
+        describing the export/import format, see
+        $CLOUDSDKROOT/lib/googlecloudsdk/schemas/...
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networksecurity/v1beta1 API. The full documentation
+    for this API can be found at: https://cloud.google.com/networking
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha network-security url-lists export
+
diff --git a/gcloud/beta/network-security/url-lists/help b/gcloud/beta/network-security/url-lists/help
new file mode 100644
index 000000000..2dc43f81d
--- /dev/null
+++ b/gcloud/beta/network-security/url-lists/help
@@ -0,0 +1,35 @@
+NAME
+    gcloud beta network-security url-lists - manage Network Security UrlLists
+
+SYNOPSIS
+    gcloud beta network-security url-lists COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Manage Network Security UrlLists.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     delete
+        (BETA) Delete UrlList.
+
+     export
+        (BETA) Export UrlList.
+
+     import
+        (BETA) Import UrlList.
+
+     list
+        (BETA) List UrlLists.
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha network-security url-lists
+
diff --git a/gcloud/beta/network-security/url-lists/import b/gcloud/beta/network-security/url-lists/import
new file mode 100644
index 000000000..e8f693d4a
--- /dev/null
+++ b/gcloud/beta/network-security/url-lists/import
@@ -0,0 +1,78 @@
+NAME
+    gcloud beta network-security url-lists import - import UrlList
+
+SYNOPSIS
+    gcloud beta network-security url-lists import
+        (URL_LIST : --location=LOCATION) [--async] [--source=SOURCE]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Import a UrlList.
+
+EXAMPLES
+    To import a UrlList from a YAML file, run:
+
+        $ gcloud beta network-security url-lists import my-url-list \
+            --source=my-url-list.yaml --location=global
+
+POSITIONAL ARGUMENTS
+     Url list resource - Name of the UrlList to import. The arguments in this
+     group can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways. To set the project attribute:
+      ◆ provide the argument url_list on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       URL_LIST
+          ID of the url list or fully qualified identifier for the url list. To
+          set the url_list attribute:
+          ▸ provide the argument url_list on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location Id.
+
+          To set the location attribute:
+          ▸ provide the argument url_list on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+     --source=SOURCE
+        Path to a YAML file containing the configuration export data. The YAML
+        file must not contain any output-only fields. Alternatively, you may
+        omit this flag to read from standard input. For a schema describing the
+        export/import format, see: $CLOUDSDKROOT/lib/googlecloudsdk/schemas/...
+
+        $CLOUDSDKROOT is can be obtained with the following command:
+
+            $ gcloud info --format='value(installation.sdk_root)'
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networksecurity/v1beta1 API. The full documentation
+    for this API can be found at: https://cloud.google.com/networking
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha network-security url-lists import
+
diff --git a/gcloud/beta/network-security/url-lists/list b/gcloud/beta/network-security/url-lists/list
new file mode 100644
index 000000000..398de30f4
--- /dev/null
+++ b/gcloud/beta/network-security/url-lists/list
@@ -0,0 +1,83 @@
+NAME
+    gcloud beta network-security url-lists list - list UrlLists
+
+SYNOPSIS
+    gcloud beta network-security url-lists list --location=LOCATION
+        [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
+        [--sort-by=[FIELD,...]] [--uri] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) List all UrlLists in the specified location of the current project.
+
+EXAMPLES
+    To list UrlLists in the current project, run:
+
+        $ gcloud beta network-security url-lists list --location=global
+
+REQUIRED FLAGS
+     Location resource - The project of the UrlLists to display. This
+     represents a Cloud resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways. To set the project
+     attribute:
+      ◆ provide the argument --location on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       --location=LOCATION
+          ID of the location or fully qualified identifier for the location. To
+          set the location attribute:
+          ▸ provide the argument --location on the command line.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networksecurity/v1beta1 API. The full documentation
+    for this API can be found at: https://cloud.google.com/networking
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha network-security url-lists list
+
diff --git a/gcloud/beta/redis/instances/update b/gcloud/beta/redis/instances/update
index 94d1b9a77..5bd633987 100644
--- a/gcloud/beta/redis/instances/update
+++ b/gcloud/beta/redis/instances/update
@@ -4,6 +4,7 @@ NAME
 SYNOPSIS
     gcloud beta redis instances update (INSTANCE : --region=REGION) [--async]
         [--display-name=DISPLAY_NAME] [--enable-auth]
+        [--maintenance-version=MAINTENANCE_VERSION]
         [--persistence-mode=PERSISTENCE_MODE]
         [--rdb-snapshot-period=RDB_SNAPSHOT_PERIOD]
         [--rdb-snapshot-start-time=RDB_SNAPSHOT_START_TIME]
@@ -77,6 +78,15 @@ FLAGS
      --enable-auth
         Enables Redis AUTH for the instance.
 
+     --maintenance-version=MAINTENANCE_VERSION
+        Specifies which maintenance version to apply to your instance during
+        self-service maintenance. To view the available maintenance versions
+        for your instance, run gcloud redis instances describe [INSTANCE_ID].
+        Acceptable values for this flag are either latest or one of the
+        specific versions listed by the describe command. If you pass the value
+        latest, the Memorystore updates to the most recent available
+        maintenance version during self service maintenance.
+
      --persistence-mode=PERSISTENCE_MODE
         Operation mode for automated persistence. PERSISTENCE_MODE must be one
         of:
diff --git a/gcloud/beta/run/jobs/add-iam-policy-binding b/gcloud/beta/run/jobs/add-iam-policy-binding
index 8260d1168..de126b41b 100644
--- a/gcloud/beta/run/jobs/add-iam-policy-binding
+++ b/gcloud/beta/run/jobs/add-iam-policy-binding
@@ -83,8 +83,10 @@ API REFERENCE
     be found at: https://cloud.google.com/run/
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud run jobs add-iam-policy-binding
 
         $ gcloud alpha run jobs add-iam-policy-binding
 
diff --git a/gcloud/beta/run/jobs/create b/gcloud/beta/run/jobs/create
index eed8dbe06..7e5c3a095 100644
--- a/gcloud/beta/run/jobs/create
+++ b/gcloud/beta/run/jobs/create
@@ -187,8 +187,10 @@ GCLOUD WIDE FLAGS
     Run $ gcloud help for details.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud run jobs create
 
         $ gcloud alpha run jobs create
 
diff --git a/gcloud/beta/run/jobs/delete b/gcloud/beta/run/jobs/delete
index dadd2ab51..50adab096 100644
--- a/gcloud/beta/run/jobs/delete
+++ b/gcloud/beta/run/jobs/delete
@@ -42,8 +42,10 @@ GCLOUD WIDE FLAGS
     Run $ gcloud help for details.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud run jobs delete
 
         $ gcloud alpha run jobs delete
 
diff --git a/gcloud/beta/run/jobs/describe b/gcloud/beta/run/jobs/describe
index 66a6ce78b..26be93aa3 100644
--- a/gcloud/beta/run/jobs/describe
+++ b/gcloud/beta/run/jobs/describe
@@ -42,8 +42,10 @@ GCLOUD WIDE FLAGS
     Run $ gcloud help for details.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud run jobs describe
 
         $ gcloud alpha run jobs describe
 
diff --git a/gcloud/beta/run/jobs/execute b/gcloud/beta/run/jobs/execute
index b9b13431c..4a2724e16 100644
--- a/gcloud/beta/run/jobs/execute
+++ b/gcloud/beta/run/jobs/execute
@@ -54,8 +54,10 @@ GCLOUD WIDE FLAGS
     Run $ gcloud help for details.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud run jobs execute
 
         $ gcloud alpha run jobs execute
 
diff --git a/gcloud/beta/run/jobs/executions/delete b/gcloud/beta/run/jobs/executions/delete
index ff9ba7a9c..339956834 100644
--- a/gcloud/beta/run/jobs/executions/delete
+++ b/gcloud/beta/run/jobs/executions/delete
@@ -43,8 +43,10 @@ GCLOUD WIDE FLAGS
     Run $ gcloud help for details.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud run jobs executions delete
 
         $ gcloud alpha run jobs executions delete
 
diff --git a/gcloud/beta/run/jobs/executions/describe b/gcloud/beta/run/jobs/executions/describe
index 97370ea5f..256c81f15 100644
--- a/gcloud/beta/run/jobs/executions/describe
+++ b/gcloud/beta/run/jobs/executions/describe
@@ -43,8 +43,10 @@ GCLOUD WIDE FLAGS
     Run $ gcloud help for details.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud run jobs executions describe
 
         $ gcloud alpha run jobs executions describe
 
diff --git a/gcloud/beta/run/jobs/executions/help b/gcloud/beta/run/jobs/executions/help
index 88497648c..15aad0d6f 100644
--- a/gcloud/beta/run/jobs/executions/help
+++ b/gcloud/beta/run/jobs/executions/help
@@ -47,8 +47,10 @@ COMMANDS
         (BETA) List executions.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud run jobs executions
 
         $ gcloud alpha run jobs executions
 
diff --git a/gcloud/beta/run/jobs/executions/list b/gcloud/beta/run/jobs/executions/list
index 42a7f30a6..d011babd0 100644
--- a/gcloud/beta/run/jobs/executions/list
+++ b/gcloud/beta/run/jobs/executions/list
@@ -77,8 +77,10 @@ GCLOUD WIDE FLAGS
     Run $ gcloud help for details.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud run jobs executions list
 
         $ gcloud alpha run jobs executions list
 
diff --git a/gcloud/beta/run/jobs/executions/tasks/describe b/gcloud/beta/run/jobs/executions/tasks/describe
index f6329243e..bbe4b62b7 100644
--- a/gcloud/beta/run/jobs/executions/tasks/describe
+++ b/gcloud/beta/run/jobs/executions/tasks/describe
@@ -43,8 +43,10 @@ GCLOUD WIDE FLAGS
     Run $ gcloud help for details.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud run jobs executions tasks describe
 
         $ gcloud alpha run jobs executions tasks describe
 
diff --git a/gcloud/beta/run/jobs/executions/tasks/help b/gcloud/beta/run/jobs/executions/tasks/help
index 5254e8a28..186b10b6b 100644
--- a/gcloud/beta/run/jobs/executions/tasks/help
+++ b/gcloud/beta/run/jobs/executions/tasks/help
@@ -35,8 +35,10 @@ COMMANDS
         (BETA) List tasks.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud run jobs executions tasks
 
         $ gcloud alpha run jobs executions tasks
 
diff --git a/gcloud/beta/run/jobs/executions/tasks/list b/gcloud/beta/run/jobs/executions/tasks/list
index 3e009f280..dac856d42 100644
--- a/gcloud/beta/run/jobs/executions/tasks/list
+++ b/gcloud/beta/run/jobs/executions/tasks/list
@@ -80,8 +80,10 @@ GCLOUD WIDE FLAGS
     Run $ gcloud help for details.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud run jobs executions tasks list
 
         $ gcloud alpha run jobs executions tasks list
 
diff --git a/gcloud/beta/run/jobs/get-iam-policy b/gcloud/beta/run/jobs/get-iam-policy
index a9621d3fb..5c94e4589 100644
--- a/gcloud/beta/run/jobs/get-iam-policy
+++ b/gcloud/beta/run/jobs/get-iam-policy
@@ -86,8 +86,10 @@ API REFERENCE
     be found at: https://cloud.google.com/run/
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud run jobs get-iam-policy
 
         $ gcloud alpha run jobs get-iam-policy
 
diff --git a/gcloud/beta/run/jobs/help b/gcloud/beta/run/jobs/help
index 3e49b1078..0ce05b2af 100644
--- a/gcloud/beta/run/jobs/help
+++ b/gcloud/beta/run/jobs/help
@@ -73,8 +73,10 @@ COMMANDS
         (BETA) Update a Cloud Run Job.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud run jobs
 
         $ gcloud alpha run jobs
 
diff --git a/gcloud/beta/run/jobs/list b/gcloud/beta/run/jobs/list
index f021c8e84..d4d7ef9ea 100644
--- a/gcloud/beta/run/jobs/list
+++ b/gcloud/beta/run/jobs/list
@@ -73,8 +73,10 @@ GCLOUD WIDE FLAGS
     Run $ gcloud help for details.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud run jobs list
 
         $ gcloud alpha run jobs list
 
diff --git a/gcloud/beta/run/jobs/remove-iam-policy-binding b/gcloud/beta/run/jobs/remove-iam-policy-binding
index 6d7aa266b..fc4813470 100644
--- a/gcloud/beta/run/jobs/remove-iam-policy-binding
+++ b/gcloud/beta/run/jobs/remove-iam-policy-binding
@@ -85,8 +85,10 @@ API REFERENCE
     be found at: https://cloud.google.com/run/
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud run jobs remove-iam-policy-binding
 
         $ gcloud alpha run jobs remove-iam-policy-binding
 
diff --git a/gcloud/beta/run/jobs/replace b/gcloud/beta/run/jobs/replace
index 696e15695..777f52eb2 100644
--- a/gcloud/beta/run/jobs/replace
+++ b/gcloud/beta/run/jobs/replace
@@ -37,8 +37,10 @@ GCLOUD WIDE FLAGS
     Run $ gcloud help for details.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud run jobs replace
 
         $ gcloud alpha run jobs replace
 
diff --git a/gcloud/beta/run/jobs/set-iam-policy b/gcloud/beta/run/jobs/set-iam-policy
index c0eda9eb0..c96e3f6b9 100644
--- a/gcloud/beta/run/jobs/set-iam-policy
+++ b/gcloud/beta/run/jobs/set-iam-policy
@@ -71,8 +71,10 @@ API REFERENCE
     be found at: https://cloud.google.com/run/
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud run jobs set-iam-policy
 
         $ gcloud alpha run jobs set-iam-policy
 
diff --git a/gcloud/beta/run/jobs/update b/gcloud/beta/run/jobs/update
index 5b74802a9..16ef034c7 100644
--- a/gcloud/beta/run/jobs/update
+++ b/gcloud/beta/run/jobs/update
@@ -275,8 +275,10 @@ GCLOUD WIDE FLAGS
     Run $ gcloud help for details.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud run jobs update
 
         $ gcloud alpha run jobs update
 
diff --git a/gcloud/beta/sql/export/csv b/gcloud/beta/sql/export/csv
index cb2af69ba..8545d56bc 100644
--- a/gcloud/beta/sql/export/csv
+++ b/gcloud/beta/sql/export/csv
@@ -27,7 +27,8 @@ POSITIONAL ARGUMENTS
 REQUIRED FLAGS
      --query=QUERY
         A SQL SELECT query (e.g., SELECT * FROM table) that specifies the data
-        to export.
+        to export. WARNING: While in-transit, the query might be processed in
+        intermediate locations other than the location of the target instance.
 
 OPTIONAL FLAGS
      --async
diff --git a/gcloud/beta/sql/instances/create b/gcloud/beta/sql/instances/create
index 4a8fa2992..294c0377d 100644
--- a/gcloud/beta/sql/instances/create
+++ b/gcloud/beta/sql/instances/create
@@ -363,9 +363,10 @@ FLAGS
 
      --retained-transaction-log-days=RETAINED_TRANSACTION_LOG_DAYS
         How many days of transaction logs to keep. The valid range is between 1
-        and 7. The default value is 7 if not specified. Only valid when point
-        in time recovery is enabled. Keeping more days of transaction logs
-        requires bigger storage size
+        and 35. The default value is 7. The 35 days log retention feature is
+        only enabled for specific customer. Only use this option when
+        point-in-time recovery is enabled. Storage size for transaction logs
+        increases when the number of days for log retention increases.
 
      --root-password=ROOT_PASSWORD
         Root Cloud SQL user's password.
diff --git a/gcloud/beta/sql/instances/patch b/gcloud/beta/sql/instances/patch
index 9103366cc..342a19f92 100644
--- a/gcloud/beta/sql/instances/patch
+++ b/gcloud/beta/sql/instances/patch
@@ -441,9 +441,10 @@ FLAGS
 
        --retained-transaction-log-days=RETAINED_TRANSACTION_LOG_DAYS
           How many days of transaction logs to keep. The valid range is between
-          1 and 7. The default value is 7 if not specified. Only valid when
-          point in time recovery is enabled. Keeping more days of transaction
-          logs requires bigger storage size
+          1 and 35. The default value is 7. The 35 days log retention feature
+          is only enabled for specific customer. Only use this option when
+          point-in-time recovery is enabled. Storage size for transaction logs
+          increases when the number of days for log retention increases.
 
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
diff --git a/gcloud/builds/submit b/gcloud/builds/submit
index 318b0ece3..0f6714056 100644
--- a/gcloud/builds/submit
+++ b/gcloud/builds/submit
@@ -3,6 +3,7 @@ NAME
 
 SYNOPSIS
     gcloud builds submit [[SOURCE] --no-source] [--async] [--no-cache]
+        [--default-buckets-behavior=DEFAULT_BUCKETS_BEHAVIOR]
         [--disk-size=DISK_SIZE] [--gcs-log-dir=GCS_LOG_DIR]
         [--gcs-source-staging-dir=GCS_SOURCE_STAGING_DIR]
         [--ignore-file=IGNORE_FILE] [--machine-type=MACHINE_TYPE]
@@ -70,6 +71,10 @@ FLAGS
         Dockerfile builds are non-deterministic and a non-deterministic result
         should not be cached.
 
+     --default-buckets-behavior=DEFAULT_BUCKETS_BEHAVIOR
+        How default buckets are setup. DEFAULT_BUCKETS_BEHAVIOR must be one of:
+        default-logs-bucket-behavior-unspecified, regional-user-owned-bucket.
+
      --disk-size=DISK_SIZE
         Machine disk size (GB) to run the build.
 
@@ -77,13 +82,18 @@ FLAGS
         A directory in Google Cloud Storage to hold build logs. If this field
         is not set,
         gs://[PROJECT_NUMBER].cloudbuild-logs.googleusercontent.com/ will be
-        created and used.
+        created and used or
+        gs://[PROJECT_NUMBER]-[builds/region]-cloudbuild-logs is used when you
+        set --default-buckets-behavior to REGIONAL_USER_OWNED_BUCKET.
 
      --gcs-source-staging-dir=GCS_SOURCE_STAGING_DIR
         A directory in Google Cloud Storage to copy the source used for staging
         the build. If the specified bucket does not exist, Cloud Build will
         create one. If you don't set this field,
-        gs://[PROJECT_ID]_cloudbuild/source is used.
+        gs://[PROJECT_ID]_cloudbuild/source is used or
+        gs://[PROJECT_ID]_[builds/region]_cloudbuild/source is used when you
+        set --default-buckets-behavior to REGIONAL_USER_OWNED_BUCKET and
+        builds/region is not global.
 
      --ignore-file=IGNORE_FILE
         Override the .gcloudignore file and use the specified file instead.
diff --git a/gcloud/certificate-manager/certificates/create b/gcloud/certificate-manager/certificates/create
index 7d07c4db7..b04f5167f 100644
--- a/gcloud/certificate-manager/certificates/create
+++ b/gcloud/certificate-manager/certificates/create
@@ -6,7 +6,8 @@ SYNOPSIS
         (CERTIFICATE : --location=LOCATION)
         (--certificate-file=CERTIFICATE_FILE
           --private-key-file=PRIVATE_KEY_FILE | [--domains=[DOMAINS,...]
-          : --dns-authorizations=[DNS_AUTHORIZATIONS,...]]) [--async]
+          : --dns-authorizations=[DNS_AUTHORIZATIONS,...]
+          | --issuance-config=ISSUANCE_CONFIG]) [--async]
         [--description=DESCRIPTION] [--labels=[KEY=VALUE,...]]
         [--scope=SCOPE; default="DEFAULT"] [GCLOUD_WIDE_FLAG ...]
 
@@ -103,18 +104,23 @@ REQUIRED FLAGS
             This flag argument must be specified if any of the other arguments
             in this group are specified.
 
-         --dns-authorizations=[DNS_AUTHORIZATIONS,...]
-            Name(s) of the DNS authorizations for each listed domain.
+         At most one of these can be specified:
 
-            Note that each domain requires a matching authorization, and any
-            domain that fails authorization will prevent issuance and/or
-            renewal of the certificate.
+           --dns-authorizations=[DNS_AUTHORIZATIONS,...]
+              Name(s) of the DNS authorizations for each listed domain.
 
-            To reference multiple DNS authorizations, provide a list of comma
-            separated DNS authorization resource names or URLs. For example:
+              Note that each domain requires a matching authorization, and any
+              domain that fails authorization will prevent issuance and/or
+              renewal of the certificate.
 
-                $ gcloud certificate-manager certificates create \
-                     --dns-authorizations=api-example-com,www-example-com
+              To reference multiple DNS authorizations, provide a list of comma
+              separated DNS authorization resource names or URLs. For example:
+
+                  $ gcloud certificate-manager certificates create \
+                       --dns-authorizations=api-example-com,www-example-com
+
+           --issuance-config=ISSUANCE_CONFIG
+              Name of the Certificate Issuance Config to use for issuance.
 
 OPTIONAL FLAGS
      --async
diff --git a/gcloud/certificate-manager/help b/gcloud/certificate-manager/help
index 851cef80f..7ee7f0919 100644
--- a/gcloud/certificate-manager/help
+++ b/gcloud/certificate-manager/help
@@ -22,6 +22,9 @@ GROUPS
      dns-authorizations
         Manage Certificate Manager DNS authorizations.
 
+     issuance-configs
+        Manage Certificate Manager Certificate Issuance Configs.
+
      maps
         Manage Certificate Manager certificate maps.
 
diff --git a/gcloud/certificate-manager/issuance-configs/create b/gcloud/certificate-manager/issuance-configs/create
new file mode 100644
index 000000000..eda46c16e
--- /dev/null
+++ b/gcloud/certificate-manager/issuance-configs/create
@@ -0,0 +1,107 @@
+NAME
+    gcloud certificate-manager issuance-configs create - create a Certificate
+        Issuance Config
+
+SYNOPSIS
+    gcloud certificate-manager issuance-configs create
+        (CERTIFICATE_ISSUANCE_CONFIG : --location=LOCATION) --ca-pool=CA_POOL
+        [--async] [--description=DESCRIPTION]
+        [--key-algorithm=KEY_ALGORITHM; default="rsa-2048"]
+        [--labels=[KEY=VALUE,...]] [--lifetime=LIFETIME; default="P30D"]
+        [--rotation-window-percentage=ROTATION_WINDOW_PERCENTAGE; default=66]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Create a new Certificate Issuance Config.
+
+EXAMPLES
+    To create a Certificate Issuance Config called my-cic, run:
+
+        $ gcloud certificate-manager issuance-configs create my-cic \
+            --ca-pool=my-ca-pool
+
+POSITIONAL ARGUMENTS
+     CertificateIssuanceConfig resource - Name of the Certificate Issuance
+     Config to create. The arguments in this group can be used to specify the
+     attributes of this resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways. To set the project
+     attribute:
+      ◆ provide the argument certificate_issuance_config on the command line
+        with a fully specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       CERTIFICATE_ISSUANCE_CONFIG
+          ID of the certificateIssuanceConfig or fully qualified identifier for
+          the certificateIssuanceConfig. To set the certificate_issuance_config
+          attribute:
+          ▸ provide the argument certificate_issuance_config on the command
+            line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          Certificate Manager location. To set the location attribute:
+          ▸ provide the argument certificate_issuance_config on the command
+            line with a fully specified name;
+          ▸ provide the argument --location on the command line;
+          ▸ default value of location is [global].
+
+REQUIRED FLAGS
+     --ca-pool=CA_POOL
+        CA Pool used for issuing certificates. For example:
+
+            $ gcloud certificate-manager issuance-configs create \
+                 --ca-pool=projects/test-project/locations/us-west1/caPools/\
+             my-ca-pool
+
+OPTIONAL FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+     --description=DESCRIPTION
+        Human-readable description of the resource.
+
+     --key-algorithm=KEY_ALGORITHM; default="rsa-2048"
+        Key algorithm to use when generating the private key. Defaults to
+        rsa-2048. KEY_ALGORITHM must be one of: ecdsa-p256, rsa-2048.
+
+     --labels=[KEY=VALUE,...]
+        List of label KEY=VALUE pairs to add.
+
+        Keys must start with a lowercase character and contain only hyphens
+        (-), underscores (_), lowercase characters, and numbers. Values must
+        contain only hyphens (-), underscores (_), lowercase characters, and
+        numbers.
+
+     --lifetime=LIFETIME; default="P30D"
+        Lifetime of issued certificates in ISO 8601 format. Use gcloud topic
+        datetimes for details. Defaults to P30D.
+
+     --rotation-window-percentage=ROTATION_WINDOW_PERCENTAGE; default=66
+        How long along the lifetime of the ceritificate to renew, expressed as
+        a percentage. Defaults to 66.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the certificatemanager/v1 API. The full documentation for
+    this API can be found at: https://cloud.google.com/certificate-manager
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha certificate-manager issuance-configs create
+
+        $ gcloud beta certificate-manager issuance-configs create
+
diff --git a/gcloud/certificate-manager/issuance-configs/delete b/gcloud/certificate-manager/issuance-configs/delete
new file mode 100644
index 000000000..469a734e3
--- /dev/null
+++ b/gcloud/certificate-manager/issuance-configs/delete
@@ -0,0 +1,71 @@
+NAME
+    gcloud certificate-manager issuance-configs delete - delete a Certificate
+        Issuance Config
+
+SYNOPSIS
+    gcloud certificate-manager issuance-configs delete
+        (CERTIFICATE_ISSUANCE_CONFIG : --location=LOCATION) [--async]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Delete a Certificate Issuance Config.
+
+EXAMPLES
+    To delete a Certificate Issuance Config called my-cic, run:
+
+        $ gcloud certificate-manager issuance-configs delete my-cic
+
+POSITIONAL ARGUMENTS
+     CertificateIssuanceConfig resource - Name of the CertificateIssuanceConfig
+     to delete. The arguments in this group can be used to specify the
+     attributes of this resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways. To set the project
+     attribute:
+      ◆ provide the argument certificate_issuance_config on the command line
+        with a fully specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       CERTIFICATE_ISSUANCE_CONFIG
+          ID of the certificateIssuanceConfig or fully qualified identifier for
+          the certificateIssuanceConfig. To set the certificate_issuance_config
+          attribute:
+          ▸ provide the argument certificate_issuance_config on the command
+            line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          Certificate Manager location. To set the location attribute:
+          ▸ provide the argument certificate_issuance_config on the command
+            line with a fully specified name;
+          ▸ provide the argument --location on the command line;
+          ▸ default value of location is [global].
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the certificatemanager/v1 API. The full documentation for
+    this API can be found at: https://cloud.google.com/certificate-manager
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha certificate-manager issuance-configs delete
+
+        $ gcloud beta certificate-manager issuance-configs delete
+
diff --git a/gcloud/certificate-manager/issuance-configs/describe b/gcloud/certificate-manager/issuance-configs/describe
new file mode 100644
index 000000000..3ecabde48
--- /dev/null
+++ b/gcloud/certificate-manager/issuance-configs/describe
@@ -0,0 +1,66 @@
+NAME
+    gcloud certificate-manager issuance-configs describe - show details about a
+        Certificate Issuance Config
+
+SYNOPSIS
+    gcloud certificate-manager issuance-configs describe
+        (CERTIFICATE_ISSUANCE_CONFIG : --location=LOCATION)
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Show details about a Certificate Issuance Config.
+
+EXAMPLES
+    To show details about an existing Certificate Issuance Config my-cic, run:
+
+        $ gcloud certificate-manager issuance-configs describe my-cic
+
+POSITIONAL ARGUMENTS
+     CertificateIssuanceConfig resource - CertificateIssuanceConfig you want to
+     describe. The arguments in this group can be used to specify the
+     attributes of this resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways. To set the project
+     attribute:
+      ◆ provide the argument certificate_issuance_config on the command line
+        with a fully specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       CERTIFICATE_ISSUANCE_CONFIG
+          ID of the certificateIssuanceConfig or fully qualified identifier for
+          the certificateIssuanceConfig. To set the certificate_issuance_config
+          attribute:
+          ▸ provide the argument certificate_issuance_config on the command
+            line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          Certificate Manager location. To set the location attribute:
+          ▸ provide the argument certificate_issuance_config on the command
+            line with a fully specified name;
+          ▸ provide the argument --location on the command line;
+          ▸ default value of location is [global].
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the certificatemanager/v1 API. The full documentation for
+    this API can be found at: https://cloud.google.com/certificate-manager
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha certificate-manager issuance-configs describe
+
+        $ gcloud beta certificate-manager issuance-configs describe
+
diff --git a/gcloud/certificate-manager/issuance-configs/help b/gcloud/certificate-manager/issuance-configs/help
new file mode 100644
index 000000000..491943228
--- /dev/null
+++ b/gcloud/certificate-manager/issuance-configs/help
@@ -0,0 +1,37 @@
+NAME
+    gcloud certificate-manager issuance-configs - manage Certificate Manager
+        Certificate Issuance Configs
+
+SYNOPSIS
+    gcloud certificate-manager issuance-configs COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Commands for managing Certificate Issuance Configs.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     create
+        Create a Certificate Issuance Config.
+
+     delete
+        Delete a Certificate Issuance Config.
+
+     describe
+        Show details about a Certificate Issuance Config.
+
+     list
+        List all Certificate Issuance Configs in a project.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha certificate-manager issuance-configs
+
+        $ gcloud beta certificate-manager issuance-configs
+
diff --git a/gcloud/certificate-manager/issuance-configs/list b/gcloud/certificate-manager/issuance-configs/list
new file mode 100644
index 000000000..9588b8e37
--- /dev/null
+++ b/gcloud/certificate-manager/issuance-configs/list
@@ -0,0 +1,85 @@
+NAME
+    gcloud certificate-manager issuance-configs list - list all Certificate
+        Issuance Configs in a project
+
+SYNOPSIS
+    gcloud certificate-manager issuance-configs list [--location=LOCATION]
+        [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
+        [--sort-by=[FIELD,...]] [--uri] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    List existing Certificate Issuance Configs.
+
+EXAMPLES
+    To list existing Certificate Issuance Configs, run:
+
+        $ gcloud certificate-manager issuance-configs list
+
+FLAGS
+     Location resource - Location (defaults to global) of the resources. This
+     represents a Cloud resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways. To set the project
+     attribute:
+      ◆ provide the argument --location on the command line with a fully
+        specified name;
+      ◆ default value of location is [global] with a fully specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+       --location=LOCATION
+          ID of the location or fully qualified identifier for the location. To
+          set the location attribute:
+          ▸ provide the argument --location on the command line;
+          ▸ default value of location is [global].
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the certificatemanager/v1 API. The full documentation for
+    this API can be found at: https://cloud.google.com/certificate-manager
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha certificate-manager issuance-configs list
+
+        $ gcloud beta certificate-manager issuance-configs list
+
diff --git a/gcloud/compute/instance-groups/managed/create b/gcloud/compute/instance-groups/managed/create
index cc16029c1..592131975 100644
--- a/gcloud/compute/instance-groups/managed/create
+++ b/gcloud/compute/instance-groups/managed/create
@@ -199,9 +199,7 @@ OPTIONAL FLAGS
        --update-policy-max-surge=MAX_SURGE
           Maximum additional number of VMs that can be created during the
           update process. This can be a fixed number (e.g. 5) or a percentage
-          of size to the managed instance group (e.g. 10%). Defaults to 0 if
-          the managed instance group has stateful configuration, or to the
-          number of zones in which it operates otherwise.
+          of size to the managed instance group (e.g. 10%).
 
        --update-policy-max-unavailable=MAX_UNAVAILABLE
           Maximum number of VMs that can be unavailable during the update
@@ -255,9 +253,7 @@ OPTIONAL FLAGS
 
        --update-policy-replacement-method=UPDATE_POLICY_REPLACEMENT_METHOD
           Type of replacement method. Specifies what action will be taken to
-          update VMs. Defaults to ``recreate`` if the managed instance group
-          has stateful configuration, or to ``substitute`` otherwise.
-          UPDATE_POLICY_REPLACEMENT_METHOD must be one of:
+          update VMs. UPDATE_POLICY_REPLACEMENT_METHOD must be one of:
 
            recreate
               Recreate VMs and preserve the VM names. The VM IDs and creation
diff --git a/gcloud/compute/instance-groups/managed/update b/gcloud/compute/instance-groups/managed/update
index 73ced9dfd..bbe4a10b3 100644
--- a/gcloud/compute/instance-groups/managed/update
+++ b/gcloud/compute/instance-groups/managed/update
@@ -197,9 +197,7 @@ FLAGS
        --update-policy-max-surge=MAX_SURGE
           Maximum additional number of VMs that can be created during the
           update process. This can be a fixed number (e.g. 5) or a percentage
-          of size to the managed instance group (e.g. 10%). Defaults to 0 if
-          the managed instance group has stateful configuration, or to the
-          number of zones in which it operates otherwise.
+          of size to the managed instance group (e.g. 10%).
 
        --update-policy-max-unavailable=MAX_UNAVAILABLE
           Maximum number of VMs that can be unavailable during the update
@@ -253,9 +251,7 @@ FLAGS
 
        --update-policy-replacement-method=UPDATE_POLICY_REPLACEMENT_METHOD
           Type of replacement method. Specifies what action will be taken to
-          update VMs. Defaults to ``recreate`` if the managed instance group
-          has stateful configuration, or to ``substitute`` otherwise.
-          UPDATE_POLICY_REPLACEMENT_METHOD must be one of:
+          update VMs. UPDATE_POLICY_REPLACEMENT_METHOD must be one of:
 
            recreate
               Recreate VMs and preserve the VM names. The VM IDs and creation
diff --git a/gcloud/compute/instance-templates/create b/gcloud/compute/instance-templates/create
index 6814cb5d3..4665cbeea 100644
--- a/gcloud/compute/instance-templates/create
+++ b/gcloud/compute/instance-templates/create
@@ -546,6 +546,13 @@ FLAGS
             Specifies the Network Interface Controller (NIC) type for the
             interface. NIC_TYPE must be one of: GVNIC, VIRTIO_NET.
 
+         queue-count
+            Specifies the networking queue count for this interface. Both Rx
+            and Tx queues will be set to this number. If it's not specified, a
+            default queue count will be assigned. For Virtio-net, each
+            interface will get min(floor(#vCPU / #vNIC), 32) queues. For gVNIC,
+            each interface will get min(floor(#vCPU / #vNIC / 2), 16) qeueus.
+
          stack-type
             Specifies whether IPv6 is enabled on the interface. STACK_TYPE must
             be one of: IPV4_ONLY, IPV4_IPV6. The default value is IPV4_ONLY.
diff --git a/gcloud/compute/instance-templates/list b/gcloud/compute/instance-templates/list
index 41eb464af..051ef43d7 100644
--- a/gcloud/compute/instance-templates/list
+++ b/gcloud/compute/instance-templates/list
@@ -12,9 +12,6 @@ DESCRIPTION
     gcloud compute instance-templates list displays all Google Compute Engine
     instance templates in a project.
 
-    By default, instance templates from all zones are listed. The results can
-    be narrowed down using a filter: --filter="zone:( ZONE ... )".
-
 EXAMPLES
     To list all instance templates in a project in table form, run:
 
@@ -24,12 +21,6 @@ EXAMPLES
 
         $ gcloud compute instance-templates list --uri
 
-    To list all instance templates in the us-central1-b and europe-west1-d
-    zones, run:
-
-        $ gcloud compute instance-templates list \
-            --filter="zone:( us-central1-b europe-west1-d )"
-
 POSITIONAL ARGUMENTS
      [NAME ...]
         (DEPRECATED) If provided, show details for the specified names and/or
diff --git a/gcloud/compute/instances/bulk/create b/gcloud/compute/instances/bulk/create
index be209a7ef..b39442e8e 100644
--- a/gcloud/compute/instances/bulk/create
+++ b/gcloud/compute/instances/bulk/create
@@ -543,6 +543,13 @@ OPTIONAL FLAGS
             Specifies the Network Interface Controller (NIC) type for the
             interface. NIC_TYPE must be one of: GVNIC, VIRTIO_NET.
 
+         queue-count
+            Specifies the networking queue count for this interface. Both Rx
+            and Tx queues will be set to this number. If it's not specified, a
+            default queue count will be assigned. For Virtio-net, each
+            interface will get min(floor(#vCPU / #vNIC), 32) queues. For gVNIC,
+            each interface will get min(floor(#vCPU / #vNIC / 2), 16) qeueus.
+
      --network-performance-configs=[PROPERTY=VALUE,...]
         Configures network performance settings for the instance. If this flag
         is not specified, the instance will be created with its default network
diff --git a/gcloud/compute/tpus/tpu-vm/create b/gcloud/compute/tpus/tpu-vm/create
index 666dcdc8c..914a89756 100644
--- a/gcloud/compute/tpus/tpu-vm/create
+++ b/gcloud/compute/tpus/tpu-vm/create
@@ -3,14 +3,15 @@ NAME
 
 SYNOPSIS
     gcloud compute tpus tpu-vm create (TPU : --zone=ZONE) --version=VERSION
-        [--accelerator-type=ACCELERATOR_TYPE; default="v2-8"] [--async]
-        [--data-disk=DATA_DISK] [--description=DESCRIPTION] [--internal-ips]
-        [--labels=[LABELS,...]] [--metadata=[METADATA,...]]
+        [--async] [--data-disk=DATA_DISK] [--description=DESCRIPTION]
+        [--internal-ips] [--labels=[LABELS,...]] [--metadata=[METADATA,...]]
         [--metadata-from-file=[METADATA_FROM_FILE,...]]
         [--network=NETWORK; default="default"] [--preemptible] [--range=RANGE]
         [--reserved] [--scopes=[SCOPES,...]]
         [--service-account=SERVICE_ACCOUNT] [--shielded-secure-boot]
-        [--subnetwork=SUBNETWORK] [--tags=[TAGS,...]] [GCLOUD_WIDE_FLAG ...]
+        [--subnetwork=SUBNETWORK] [--tags=[TAGS,...]]
+        [--accelerator-type=ACCELERATOR_TYPE; default="v2-8"
+          | --topology=TOPOLOGY --type=TYPE] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     Create a new Cloud TPU VM node.
@@ -73,14 +74,6 @@ REQUIRED FLAGS
         gcloud compute tpus tpu-vm versions list
 
 OPTIONAL FLAGS
-     --accelerator-type=ACCELERATOR_TYPE; default="v2-8"
-        TPU accelerator type for the TPU. If not specified, this defaults to
-        v2-8.
-
-        For a list of available accelerator types run:
-
-        gcloud compute tpus tpu-vm accelerator-types list
-
      --async
         Return immediately, without waiting for the operation in progress to
         complete.
@@ -176,6 +169,34 @@ OPTIONAL FLAGS
         https://cloud.google.com/vpc/docs/add-remove-network-tags for more
         details.
 
+     Specify a TPU node in either chips or cores
+
+     At most one of these can be specified:
+
+       Core based TPU configuration
+
+         --accelerator-type=ACCELERATOR_TYPE; default="v2-8"
+            TPU accelerator type for the TPU. If not specified, this defaults
+            to v2-8.
+
+            For a list of available accelerator types run:
+
+            gcloud compute tpus tpu-vm accelerator-types list
+
+       Chip based TPU configuration
+
+         --topology=TOPOLOGY
+            Chip topology for TPU.
+
+            This flag argument must be specified if any of the other arguments
+            in this group are specified.
+
+         --type=TYPE
+            Type of TPU. TYPE must be one of: v2, v3, v4.
+
+            This flag argument must be specified if any of the other arguments
+            in this group are specified.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/config/get b/gcloud/config/get
index be97bf498..9216fe7b0 100644
--- a/gcloud/config/get
+++ b/gcloud/config/get
@@ -394,6 +394,10 @@ AVAILABLE PROPERTIES
             Overrides API endpoint for gcloud iam command group. Defaults to
             https://iam.googleapis.com/
 
+         iamcredentials
+            Overrides API endpoint for gcloud iam command group. Defaults to
+            https://iamcredentials.googleapis.com/
+
          iap
             Overrides API endpoint for gcloud iap command group. Defaults to
             https://iap.googleapis.com/
diff --git a/gcloud/config/help b/gcloud/config/help
index d51a2d72b..78a7f7d83 100644
--- a/gcloud/config/help
+++ b/gcloud/config/help
@@ -426,6 +426,10 @@ AVAILABLE PROPERTIES
             Overrides API endpoint for gcloud iam command group. Defaults to
             https://iam.googleapis.com/
 
+         iamcredentials
+            Overrides API endpoint for gcloud iam command group. Defaults to
+            https://iamcredentials.googleapis.com/
+
          iap
             Overrides API endpoint for gcloud iap command group. Defaults to
             https://iap.googleapis.com/
diff --git a/gcloud/config/list b/gcloud/config/list
index 587e1f0cb..a746767ca 100644
--- a/gcloud/config/list
+++ b/gcloud/config/list
@@ -438,6 +438,10 @@ AVAILABLE PROPERTIES
             Overrides API endpoint for gcloud iam command group. Defaults to
             https://iam.googleapis.com/
 
+         iamcredentials
+            Overrides API endpoint for gcloud iam command group. Defaults to
+            https://iamcredentials.googleapis.com/
+
          iap
             Overrides API endpoint for gcloud iap command group. Defaults to
             https://iap.googleapis.com/
diff --git a/gcloud/config/set b/gcloud/config/set
index 5acb4aa0f..33178da49 100644
--- a/gcloud/config/set
+++ b/gcloud/config/set
@@ -441,6 +441,10 @@ AVAILABLE PROPERTIES
             Overrides API endpoint for gcloud iam command group. Defaults to
             https://iam.googleapis.com/
 
+         iamcredentials
+            Overrides API endpoint for gcloud iam command group. Defaults to
+            https://iamcredentials.googleapis.com/
+
          iap
             Overrides API endpoint for gcloud iap command group. Defaults to
             https://iap.googleapis.com/
diff --git a/gcloud/config/unset b/gcloud/config/unset
index 6a825cf31..526fd6952 100644
--- a/gcloud/config/unset
+++ b/gcloud/config/unset
@@ -402,6 +402,10 @@ AVAILABLE PROPERTIES
             Overrides API endpoint for gcloud iam command group. Defaults to
             https://iam.googleapis.com/
 
+         iamcredentials
+            Overrides API endpoint for gcloud iam command group. Defaults to
+            https://iamcredentials.googleapis.com/
+
          iap
             Overrides API endpoint for gcloud iap command group. Defaults to
             https://iap.googleapis.com/
diff --git a/gcloud/deploy/releases/create b/gcloud/deploy/releases/create
index 01a262241..44b5ac84f 100644
--- a/gcloud/deploy/releases/create
+++ b/gcloud/deploy/releases/create
@@ -12,7 +12,8 @@ SYNOPSIS
         [--build-artifacts=BUILD_ARTIFACTS | --images=[NAME=TAG,...]]
         [--disable-initial-rollout | --enable-initial-rollout
           --initial-rollout-annotations=[KEY=VALUE,...]
-          --initial-rollout-labels=[KEY=VALUE,...]]
+          --initial-rollout-labels=[KEY=VALUE,...]
+          --initial-rollout-phase-id=INITIAL_ROLLOUT_PHASE_ID]
         [--from-k8s-manifest=FROM_K8S_MANIFEST
           | --from-run-manifest=FROM_RUN_MANIFEST
           | --skaffold-file=SKAFFOLD_FILE --source=SOURCE; default="."]
@@ -183,6 +184,17 @@ FLAGS
               $ gcloud deploy releases create \
                   initial-rollout-labels="commit=abc123,author=foo"
 
+       --initial-rollout-phase-id=INITIAL_ROLLOUT_PHASE_ID
+          The phase to start the initial rollout at when creating the release.
+          The phase ID must be a valid phase on the rollout. If not specified,
+          then the rollout will start at the first phase.
+
+          Examples:
+
+          Start rollout at stable phase:
+
+              $ gcloud deploy releases create --initial-rollout-phase-id=stable
+
      At most one of these can be specified:
 
        --from-k8s-manifest=FROM_K8S_MANIFEST
diff --git a/gcloud/deploy/releases/promote b/gcloud/deploy/releases/promote
index 8a52b8b48..6f6753df5 100644
--- a/gcloud/deploy/releases/promote
+++ b/gcloud/deploy/releases/promote
@@ -7,8 +7,8 @@ SYNOPSIS
         (--release=RELEASE
           : --delivery-pipeline=DELIVERY_PIPELINE --region=REGION)
         [--annotations=[KEY=VALUE,...]] [--labels=[KEY=VALUE,...]]
-        [--rollout-id=ROLLOUT_ID] [--to-target=TO_TARGET]
-        [GCLOUD_WIDE_FLAG ...]
+        [--rollout-id=ROLLOUT_ID] [--starting-phase-id=STARTING_PHASE_ID]
+        [--to-target=TO_TARGET] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     If to-target is not specified the command promotes the release from the
@@ -85,6 +85,13 @@ OPTIONAL FLAGS
      --rollout-id=ROLLOUT_ID
         ID to assign to the generated rollout for promotion.
 
+     --starting-phase-id=STARTING_PHASE_ID
+        If set, starts the created rollout at the specified phase.
+
+        Start rollout at stable phase:
+
+            $ gcloud deploy releases promote --starting-phase-id=stable
+
      --to-target=TO_TARGET
         Destination target to promote into.
 
diff --git a/gcloud/deploy/targets/redeploy b/gcloud/deploy/targets/redeploy
index 82834a92c..c11c31717 100644
--- a/gcloud/deploy/targets/redeploy
+++ b/gcloud/deploy/targets/redeploy
@@ -5,7 +5,8 @@ SYNOPSIS
     gcloud deploy targets redeploy (TARGET : --region=REGION)
         --delivery-pipeline=DELIVERY_PIPELINE [--annotations=[KEY=VALUE,...]]
         [--description=DESCRIPTION] [--labels=[KEY=VALUE,...]]
-        [--rollout-id=ROLLOUT_ID] [GCLOUD_WIDE_FLAG ...]
+        [--rollout-id=ROLLOUT_ID] [--starting-phase-id=STARTING_PHASE_ID]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     Redeploy the last rollout that has a state of SUCCESSFUL or FAILED to a
@@ -78,6 +79,13 @@ OPTIONAL FLAGS
      --rollout-id=ROLLOUT_ID
         ID to assign to the generated rollout for promotion.
 
+     --starting-phase-id=STARTING_PHASE_ID
+        If set, starts the created rollout at the specified phase.
+
+        Start rollout at stable phase:
+
+            $ gcloud deploy targets redeploy --starting-phase-id=stable
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/deploy/targets/rollback b/gcloud/deploy/targets/rollback
index 40bc0878c..e01205266 100644
--- a/gcloud/deploy/targets/rollback
+++ b/gcloud/deploy/targets/rollback
@@ -5,7 +5,8 @@ SYNOPSIS
     gcloud deploy targets rollback (TARGET : --region=REGION)
         --delivery-pipeline=DELIVERY_PIPELINE [--annotations=[KEY=VALUE,...]]
         [--description=DESCRIPTION] [--labels=[KEY=VALUE,...]]
-        [--release=RELEASE] [--rollout-id=ROLLOUT_ID] [GCLOUD_WIDE_FLAG ...]
+        [--release=RELEASE] [--rollout-id=ROLLOUT_ID]
+        [--starting-phase-id=STARTING_PHASE_ID] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     If release is not specified, the command rollbacks the target with the last
@@ -82,6 +83,13 @@ OPTIONAL FLAGS
      --rollout-id=ROLLOUT_ID
         ID to assign to the generated rollout for promotion.
 
+     --starting-phase-id=STARTING_PHASE_ID
+        If set, starts the created rollout at the specified phase.
+
+        Start rollout at stable phase:
+
+            $ gcloud deploy targets rollback --starting-phase-id=stable
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/edge-cloud/container/clusters/create b/gcloud/edge-cloud/container/clusters/create
index 6cabf5300..72fb2f170 100644
--- a/gcloud/edge-cloud/container/clusters/create
+++ b/gcloud/edge-cloud/container/clusters/create
@@ -18,7 +18,7 @@ DESCRIPTION
     Create an Edge Container cluster.
 
 EXAMPLES
-    To create a cluster called 'my-cluster' in region us-central1, run:
+    To create a cluster called my-cluster in region us-central1, run:
 
         $ gcloud edge-cloud container clusters create my-cluster \
             --location=us-central1
@@ -30,8 +30,8 @@ POSITIONAL ARGUMENTS
      ways. To set the project attribute:
       ◆ provide the argument cluster on the command line with a fully
         specified name;
-      ◆ set the property core/project;
-      ◆ provide the argument --project on the command line.
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
 
      This must be specified.
 
@@ -44,11 +44,10 @@ POSITIONAL ARGUMENTS
           arguments in this group are specified.
 
        --location=LOCATION
-          The global location name. To set the location attribute:
+          Google Cloud location for the cluster. To set the location attribute:
           ▸ provide the argument cluster on the command line with a fully
             specified name;
-          ▸ provide the argument --location on the command line;
-          ▸ set the property edge_container/location.
+          ▸ provide the argument --location on the command line.
 
 FLAGS
      --admin-users=ADMIN_USERS
diff --git a/gcloud/edge-cloud/container/clusters/get-credentials b/gcloud/edge-cloud/container/clusters/get-credentials
index 1c1070c85..d520c9881 100644
--- a/gcloud/edge-cloud/container/clusters/get-credentials
+++ b/gcloud/edge-cloud/container/clusters/get-credentials
@@ -28,7 +28,7 @@ EXAMPLES
             --location=us-west1
 
 POSITIONAL ARGUMENTS
-     Cluster resource - edge-cloud container cluster to get credentials. The
+     Cluster resource - Edge Container cluster to get credentials. The
      arguments in this group can be used to specify the attributes of this
      resource. (NOTE) Some attributes are not given arguments in this group but
      can be set in other ways. To set the project attribute:
diff --git a/gcloud/eventarc/triggers/create b/gcloud/eventarc/triggers/create
index 8d2c6bf6b..17dd0835a 100644
--- a/gcloud/eventarc/triggers/create
+++ b/gcloud/eventarc/triggers/create
@@ -12,7 +12,7 @@ SYNOPSIS
           | [--destination-run-service=DESTINATION_RUN_SERVICE
           : --destination-run-path=DESTINATION_RUN_PATH
           --destination-run-region=DESTINATION_RUN_REGION]) [--async]
-        [--channel=CHANNEL]
+        [--channel=CHANNEL] [--event-data-content-type=EVENT_DATA_CONTENT_TYPE]
         [--event-filters-path-pattern=[ATTRIBUTE=PATH_PATTERN,...]]
         [--service-account=SERVICE_ACCOUNT] [--transport-topic=TRANSPORT_TOPIC]
         [GCLOUD_WIDE_FLAG ...]
@@ -144,6 +144,14 @@ OPTIONAL FLAGS
           set the channel attribute:
           ▸ provide the argument --channel on the command line.
 
+     --event-data-content-type=EVENT_DATA_CONTENT_TYPE
+        Depending on the event provider, you can specify the encoding of the
+        event data payload that will be delivered to your destination, to
+        either be encoded in application/json or application/protobuf. The
+        default encoding is application/json. Note that for custom sources or
+        third-party providers, or for direct events from Cloud Pub/Sub, this
+        formatting option is not supported.
+
      --event-filters-path-pattern=[ATTRIBUTE=PATH_PATTERN,...]
         The trigger's list of filters in path pattern format that apply to
         CloudEvent attributes. This flag can be repeated to add more filters to
diff --git a/gcloud/eventarc/triggers/update b/gcloud/eventarc/triggers/update
index e96c73699..6bcbd28a2 100644
--- a/gcloud/eventarc/triggers/update
+++ b/gcloud/eventarc/triggers/update
@@ -3,6 +3,7 @@ NAME
 
 SYNOPSIS
     gcloud eventarc triggers update (TRIGGER : --location=LOCATION) [--async]
+        [--event-data-content-type=EVENT_DATA_CONTENT_TYPE]
         [--event-filters=[ATTRIBUTE=VALUE,...]]
         [--event-filters-path-pattern=[ATTRIBUTE=PATH_PATTERN,...]]
         [--clear-service-account | --service-account=SERVICE_ACCOUNT]
@@ -59,6 +60,14 @@ FLAGS
         Return immediately, without waiting for the operation in progress to
         complete.
 
+     --event-data-content-type=EVENT_DATA_CONTENT_TYPE
+        Depending on the event provider, you can specify the encoding of the
+        event data payload that will be delivered to your destination, to
+        either be encoded in application/json or application/protobuf. The
+        default encoding is application/json. Note that for custom sources or
+        third-party providers, or for direct events from Cloud Pub/Sub, this
+        formatting option is not supported.
+
      --event-filters=[ATTRIBUTE=VALUE,...]
         The trigger's list of filters that apply to CloudEvents attributes.
         This flag can be repeated to add more filters to the list. Only events
diff --git a/gcloud/metastore/services/create b/gcloud/metastore/services/create
index 8cdad88c4..3d2bfd386 100644
--- a/gcloud/metastore/services/create
+++ b/gcloud/metastore/services/create
@@ -232,10 +232,10 @@ FLAGS
        --instance-size=INSTANCE_SIZE
           The instance size of the service. INSTANCE_SIZE must be one of:
 
-           extra_large
+           extra-large
               Extra large instance size, maps to a scaling factor of 6.0.
 
-           extra_small
+           extra-small
               Extra small instance size, maps to a scaling factor of 0.1.
 
            large
diff --git a/gcloud/metastore/services/update b/gcloud/metastore/services/update
index ce9a939a0..5e4d095ed 100644
--- a/gcloud/metastore/services/update
+++ b/gcloud/metastore/services/update
@@ -110,10 +110,10 @@ FLAGS
        --instance-size=INSTANCE_SIZE
           The instance size of the service. INSTANCE_SIZE must be one of:
 
-           extra_large
+           extra-large
               Extra large instance size, maps to a scaling factor of 6.0.
 
-           extra_small
+           extra-small
               Extra small instance size, maps to a scaling factor of 0.1.
 
            large
diff --git a/gcloud/recaptcha/firewall-policies/create b/gcloud/recaptcha/firewall-policies/create
new file mode 100644
index 000000000..89c0f859f
--- /dev/null
+++ b/gcloud/recaptcha/firewall-policies/create
@@ -0,0 +1,72 @@
+NAME
+    gcloud recaptcha firewall-policies create - create a Firewall Policy
+
+SYNOPSIS
+    gcloud recaptcha firewall-policies create [--actions=ACTIONS]
+        [--condition=CONDITION] [--description=DESCRIPTION] [--path=PATH]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Create a reCAPTCHA Firewall Policy.
+
+EXAMPLES
+    To create a new reCAPTCHA firewall policy covering the path "/login/" for
+    all requests with a reCAPTCHA Lite score of >= 0.5 to allow the requests
+    and set the header 'foo' to the value 'bar':
+
+        $ gcloud recaptcha firewall-policies create --path='/login/*' \
+            --condition='recaptcha.assessment_type == AssessmentType.LITE
+        && recaptcha.score >= 0.5' --actions=allow,set_header=foo=bar
+
+FLAGS
+     --actions=ACTIONS
+        The actions that the caller should take regarding the user. There
+        should be at most 1 terminal action. A terminal action is any action
+        that forces a response, such as Allow, Block or Substitute. If it makes
+        sense for it to happen multple times, such as SetHeader, the action is
+        non-terminal.
+
+        Examples:
+        ◆ Block and set the header with key foo to value bar
+          ▸ --actions=block,set_header=foo=bar
+        ◆ Substitute with path google.com and set two headers, one with key
+          key1 to value value1 and one with key key2 to value value2
+          ▸ --actions=substitute=google.com,set_header=key1=value1,set_header=key2=value2
+
+     --condition=CONDITION
+        A CEL (Common Expression Language) conditional expression that
+        specifies if this policy applies to an incoming user request. If this
+        condition evaluates to true and the requested path matched the path
+        pattern, the associated actions should be executed by the caller. The
+        condition string is checked for CEL syntax correctness on creation. For
+        more information, see the CEL spec: https://github.com/google/cel-spec
+        and its language definition:
+        https://github.com/google/cel-spec/blob/master/doc/langdef.md
+
+     --description=DESCRIPTION
+        A description of what this policy aims to achieve, for convenience
+        purposes. The description can at most include 256 UTF-8 characters.
+
+     --path=PATH
+        The path for which this policy applies, specified as a glob pattern.
+        For more information on glob, see the manual page:
+        https://man7.org/linux/man-pages/man7/glob.7.html.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the recaptchaenterprise/v1 API. The full documentation
+    for this API can be found at:
+    https://cloud.google.com/recaptcha-enterprise/
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha recaptcha firewall-policies create
+
diff --git a/gcloud/recaptcha/firewall-policies/delete b/gcloud/recaptcha/firewall-policies/delete
new file mode 100644
index 000000000..11bde8b4f
--- /dev/null
+++ b/gcloud/recaptcha/firewall-policies/delete
@@ -0,0 +1,51 @@
+NAME
+    gcloud recaptcha firewall-policies delete - delete one or more reCAPTCHA
+        Firewall Policies
+
+SYNOPSIS
+    gcloud recaptcha firewall-policies delete FIREWALL_POLICY
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Delete one or more reCAPTCHA Firewall Policies from a given cloud project.
+
+EXAMPLES
+    To delete a reCAPTCHA firewall policies, run:
+
+        $ gcloud recaptcha firewall-policies delete policy-id
+
+POSITIONAL ARGUMENTS
+     Firewall policy resource - The reCAPTCHA firewall policy to delete. This
+     represents a Cloud resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways. To set the project
+     attribute:
+      ◆ provide the argument firewall_policy on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       FIREWALL_POLICY
+          ID of the firewall_policy or fully qualified identifier for the
+          firewall_policy. To set the firewall_policy attribute:
+          ▸ provide the argument firewall_policy on the command line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the recaptchaenterprise/v1 API. The full documentation
+    for this API can be found at:
+    https://cloud.google.com/recaptcha-enterprise/
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha recaptcha firewall-policies delete
+
diff --git a/gcloud/recaptcha/firewall-policies/describe b/gcloud/recaptcha/firewall-policies/describe
new file mode 100644
index 000000000..73b2a3282
--- /dev/null
+++ b/gcloud/recaptcha/firewall-policies/describe
@@ -0,0 +1,51 @@
+NAME
+    gcloud recaptcha firewall-policies describe - describe reCAPTCHA Firewall
+        Policy
+
+SYNOPSIS
+    gcloud recaptcha firewall-policies describe FIREWALL_POLICY
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Get the details of a reCAPTCHA Firewall Policy.
+
+EXAMPLES
+    To get details on a reCAPTCHA firewall policy, run:
+
+        $ gcloud recaptcha firewall-policies describe policy-id
+
+POSITIONAL ARGUMENTS
+     Firewall policy resource - The reCAPTCHA firewall policy to describe. This
+     represents a Cloud resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways. To set the project
+     attribute:
+      ◆ provide the argument firewall_policy on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       FIREWALL_POLICY
+          ID of the firewall_policy or fully qualified identifier for the
+          firewall_policy. To set the firewall_policy attribute:
+          ▸ provide the argument firewall_policy on the command line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the recaptchaenterprise/v1 API. The full documentation
+    for this API can be found at:
+    https://cloud.google.com/recaptcha-enterprise/
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha recaptcha firewall-policies describe
+
diff --git a/gcloud/recaptcha/firewall-policies/help b/gcloud/recaptcha/firewall-policies/help
new file mode 100644
index 000000000..44e1d2af0
--- /dev/null
+++ b/gcloud/recaptcha/firewall-policies/help
@@ -0,0 +1,37 @@
+NAME
+    gcloud recaptcha firewall-policies - managed reCAPTCHA Firewall Policies
+
+SYNOPSIS
+    gcloud recaptcha firewall-policies COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Managed reCAPTCHA Firewall Policies.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     create
+        Create a Firewall Policy.
+
+     delete
+        Delete one or more reCAPTCHA Firewall Policies.
+
+     describe
+        Describe reCAPTCHA Firewall Policy.
+
+     list
+        List reCAPTCHA Firewall Policies.
+
+     update
+        Update a Firewall Policy.
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha recaptcha firewall-policies
+
diff --git a/gcloud/recaptcha/firewall-policies/list b/gcloud/recaptcha/firewall-policies/list
new file mode 100644
index 000000000..88d9f0997
--- /dev/null
+++ b/gcloud/recaptcha/firewall-policies/list
@@ -0,0 +1,66 @@
+NAME
+    gcloud recaptcha firewall-policies list - list reCAPTCHA Firewall Policies
+
+SYNOPSIS
+    gcloud recaptcha firewall-policies list [--filter=EXPRESSION]
+        [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    List all of the reCAPTCHA Firewall Policies that exist in a given project.
+
+EXAMPLES
+    To list all the reCAPTCHA firewall policies existing for your project, run:
+
+        $ gcloud recaptcha firewall-policies list
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the recaptchaenterprise/v1 API. The full documentation
+    for this API can be found at:
+    https://cloud.google.com/recaptcha-enterprise/
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha recaptcha firewall-policies list
+
diff --git a/gcloud/recaptcha/firewall-policies/update b/gcloud/recaptcha/firewall-policies/update
new file mode 100644
index 000000000..1b5c539b1
--- /dev/null
+++ b/gcloud/recaptcha/firewall-policies/update
@@ -0,0 +1,86 @@
+NAME
+    gcloud recaptcha firewall-policies update - update a Firewall Policy
+
+SYNOPSIS
+    gcloud recaptcha firewall-policies update FIREWALL_POLICY
+        [--actions=ACTIONS] [--condition=CONDITION] [--description=DESCRIPTION]
+        [--path=PATH] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Update a reCAPTCHA Firewall Policy.
+
+EXAMPLES
+    To update the information of a reCAPTCHA firewall policy, run:
+
+        $ gcloud recaptcha firewall-policies update policy-id \
+            --description='updated description' --actions=block
+
+POSITIONAL ARGUMENTS
+     Firewall policy resource - The reCAPTCHA firewall policy to update. This
+     represents a Cloud resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways. To set the project
+     attribute:
+      ◆ provide the argument firewall_policy on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       FIREWALL_POLICY
+          ID of the firewall_policy or fully qualified identifier for the
+          firewall_policy. To set the firewall_policy attribute:
+          ▸ provide the argument firewall_policy on the command line.
+
+FLAGS
+     --actions=ACTIONS
+        The actions that the caller should take regarding the user. There
+        should be at most 1 terminal action. A terminal action is any action
+        that forces a response, such as Allow, Block or Substitute. If it makes
+        sense for it to happen multple times, such as SetHeader, the action is
+        non-terminal.
+
+        Examples:
+        ◆ Block and set the header with key foo to value bar
+          ▸ --actions=block,set_header=foo=bar
+        ◆ Substitute with path google.com and set two headers, one with key
+          key1 to value value1 and one with key key2 to value value2
+          ▸ --actions=substitute=google.com,set_header=key1=value1,set_header=key2=value2
+
+     --condition=CONDITION
+        A CEL (Common Expression Language) conditional expression that
+        specifies if this policy applies to an incoming user request. If this
+        condition evaluates to true and the requested path matched the path
+        pattern, the associated actions should be executed by the caller. The
+        condition string is checked for CEL syntax correctness on creation. For
+        more information, see the CEL spec: https://github.com/google/cel-spec
+        and its language definition:
+        https://github.com/google/cel-spec/blob/master/doc/langdef.md
+
+     --description=DESCRIPTION
+        A description of what this policy aims to achieve, for convenience
+        purposes. The description can at most include 256 UTF-8 characters.
+
+     --path=PATH
+        The path for which this policy applies, specified as a glob pattern.
+        For more information on glob, see the manual page:
+        https://man7.org/linux/man-pages/man7/glob.7.html.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the recaptchaenterprise/v1 API. The full documentation
+    for this API can be found at:
+    https://cloud.google.com/recaptcha-enterprise/
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha recaptcha firewall-policies update
+
diff --git a/gcloud/recaptcha/help b/gcloud/recaptcha/help
index 49e8f0ce4..510bdecea 100644
--- a/gcloud/recaptcha/help
+++ b/gcloud/recaptcha/help
@@ -15,6 +15,9 @@ GCLOUD WIDE FLAGS
 GROUPS
     GROUP is one of the following:
 
+     firewall-policies
+        Managed reCAPTCHA Firewall Policies.
+
      keys
         Managed reCAPTCHA Keys.
 
diff --git a/gcloud/recaptcha/keys/create b/gcloud/recaptcha/keys/create
index a0cfa465b..f34b43bae 100644
--- a/gcloud/recaptcha/keys/create
+++ b/gcloud/recaptcha/keys/create
@@ -3,8 +3,9 @@ NAME
 
 SYNOPSIS
     gcloud recaptcha keys create --display-name=DISPLAY_NAME
-        (--android (--allow-all-package-names
+        ([--android (--allow-all-package-names
           | --package-names=[PACKAGE_NAMES,...])
+          : --support-non-google-app-store-distribution]
           | --ios (--allow-all-bundle-ids | --bundle-ids=[BUNDLE_IDS,...])
           | [--web (--allow-all-domains | --domains=[DOMAINS,...])
           : --allow-amp-traffic --integration-type=INTEGRATION_TYPE
@@ -38,6 +39,14 @@ REQUIRED FLAGS
             This flag argument must be specified if any of the other arguments
             in this group are specified.
 
+         --support-non-google-app-store-distribution
+            If set, this key can be used in an Android application that is
+            available for download in app stores other than the Google Play
+            Store.
+
+            This setting allows your key to accept traffic from devices without
+            Google Mobile Services (GMS) installed.
+
          Exactly one of these must be specified:
 
            --allow-all-package-names
diff --git a/gcloud/redis/instances/update b/gcloud/redis/instances/update
index b88929ebb..c55e6f1cf 100644
--- a/gcloud/redis/instances/update
+++ b/gcloud/redis/instances/update
@@ -4,6 +4,7 @@ NAME
 SYNOPSIS
     gcloud redis instances update (INSTANCE : --region=REGION) [--async]
         [--display-name=DISPLAY_NAME] [--enable-auth]
+        [--maintenance-version=MAINTENANCE_VERSION]
         [--persistence-mode=PERSISTENCE_MODE]
         [--rdb-snapshot-period=RDB_SNAPSHOT_PERIOD]
         [--rdb-snapshot-start-time=RDB_SNAPSHOT_START_TIME]
@@ -76,6 +77,15 @@ FLAGS
      --enable-auth
         Enables Redis AUTH for the instance.
 
+     --maintenance-version=MAINTENANCE_VERSION
+        Specifies which maintenance version to apply to your instance during
+        self-service maintenance. To view the available maintenance versions
+        for your instance, run gcloud redis instances describe [INSTANCE_ID].
+        Acceptable values for this flag are either latest or one of the
+        specific versions listed by the describe command. If you pass the value
+        latest, the Memorystore updates to the most recent available
+        maintenance version during self service maintenance.
+
      --persistence-mode=PERSISTENCE_MODE
         Operation mode for automated persistence. PERSISTENCE_MODE must be one
         of:
diff --git a/gcloud/run/deploy b/gcloud/run/deploy
index 51f629f56..88027d16d 100644
--- a/gcloud/run/deploy
+++ b/gcloud/run/deploy
@@ -31,8 +31,9 @@ SYNOPSIS
           | --remove-cloudsql-instances=[CLOUDSQL-INSTANCES,...]
           | --set-cloudsql-instances=[CLOUDSQL-INSTANCES,...]
           --binary-authorization=POLICY
-          | --clear-binary-authorization --clear-key
-          | --key=KEY --clear-post-key-revocation-action-type
+          | --clear-binary-authorization --clear-encryption-key-shutdown-hours
+          | --encryption-key-shutdown-hours=ENCRYPTION_KEY_SHUTDOWN_HOURS
+          --clear-key | --key=KEY --clear-post-key-revocation-action-type
           | --post-key-revocation-action-type=POST_KEY_REVOCATION_ACTION_TYPE]
         [--region=REGION
           | --cluster=CLUSTER --cluster-location=CLUSTER_LOCATION
@@ -446,6 +447,15 @@ FLAGS
          --clear-binary-authorization
             Remove any previously set Binary Authorization policy.
 
+       At most one of these can be specified:
+
+         --clear-encryption-key-shutdown-hours
+            Remove any previously set CMEK key shutdown hours setting.
+
+         --encryption-key-shutdown-hours=ENCRYPTION_KEY_SHUTDOWN_HOURS
+            The number of hours to wait before an automatic shutdown server
+            after CMEK key revocation is detected.
+
        At most one of these can be specified:
 
          --clear-key
diff --git a/gcloud/run/help b/gcloud/run/help
index 87750ba40..c3e121128 100644
--- a/gcloud/run/help
+++ b/gcloud/run/help
@@ -26,6 +26,9 @@ GROUPS
      domain-mappings
         View and manage your Cloud Run for Anthos domain mappings.
 
+     jobs
+        View and manage your Cloud Run jobs.
+
      regions
         View available Cloud Run (fully managed) regions.
 
diff --git a/gcloud/run/jobs/add-iam-policy-binding b/gcloud/run/jobs/add-iam-policy-binding
new file mode 100644
index 000000000..ed1d36ce2
--- /dev/null
+++ b/gcloud/run/jobs/add-iam-policy-binding
@@ -0,0 +1,91 @@
+NAME
+    gcloud run jobs add-iam-policy-binding - add IAM policy binding to a Cloud
+        Run job
+
+SYNOPSIS
+    gcloud run jobs add-iam-policy-binding JOB --member=PRINCIPAL --role=ROLE
+        [--region=REGION] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Add an IAM policy binding to the IAM policy of a Cloud Run job. One binding
+    consists of a member, and a role.
+
+EXAMPLES
+    To add an IAM policy binding for the role of 'roles/run.invoker' for the
+    user 'test-user@gmail.com' with job 'my-job' and region 'us-central1', run:
+
+        $ gcloud run jobs add-iam-policy-binding my-job \
+            --region='us-central1' --member='user:test-user@gmail.com' \
+            --role='roles/run.invoker'
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of
+    policy role and member types.
+
+POSITIONAL ARGUMENTS
+     Job resource - The job for which to add IAM policy binding to. This
+     represents a Cloud resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways. To set the project
+     attribute:
+      ◆ provide the argument job on the command line with a fully specified
+        name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line. To set the region
+        attribute:
+      ◆ provide the argument job on the command line with a fully specified
+        name;
+      ◆ provide the argument --region on the command line;
+      ◆ set the property run/region;
+      ◆ specify from a list of available regions in a prompt.
+
+     This must be specified.
+
+       JOB
+          ID of the job or fully qualified identifier for the job. To set the
+          job attribute:
+          ▸ provide the argument job on the command line.
+
+REQUIRED FLAGS
+     --member=PRINCIPAL
+        The principal to add the binding for. Should be of the form
+        user|group|serviceAccount:email or domain:domain.
+
+        Examples: user:test-user@gmail.com, group:admins@example.com,
+        serviceAccount:test123@example.domain.com, or
+        domain:example.domain.com.
+
+        Some resources also accept the following special values:
+        ◆ allUsers - Special identifier that represents anyone who is on the
+          internet, with or without a Google account.
+        ◆ allAuthenticatedUsers - Special identifier that represents anyone
+          who is authenticated with a Google account or a service account.
+
+     --role=ROLE
+        Role name to assign to the principal. The role name is the complete
+        path of a predefined role, such as roles/logging.viewer, or the role ID
+        for a custom role, such as
+        organizations/{ORGANIZATION_ID}/roles/logging.viewer.
+
+OPTIONAL FLAGS
+     --region=REGION
+        Region in which the resource can be found. Alternatively, set the
+        property [run/region].
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the run/v1 API. The full documentation for this API can
+    be found at: https://cloud.google.com/run/
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha run jobs add-iam-policy-binding
+
+        $ gcloud beta run jobs add-iam-policy-binding
+
diff --git a/gcloud/run/jobs/create b/gcloud/run/jobs/create
new file mode 100644
index 000000000..63afa8dfc
--- /dev/null
+++ b/gcloud/run/jobs/create
@@ -0,0 +1,195 @@
+NAME
+    gcloud run jobs create - create a Cloud Run job
+
+SYNOPSIS
+    gcloud run jobs create [JOB] --image=IMAGE [--args=[ARG,...]]
+        [--binary-authorization=POLICY] [--breakglass=JUSTIFICATION]
+        [--command=[COMMAND,...]] [--cpu=CPU] [--execute-now] [--key=KEY]
+        [--labels=[KEY=VALUE,...]] [--max-retries=MAX_RETRIES]
+        [--memory=MEMORY] [--parallelism=PARALLELISM] [--region=REGION]
+        [--service-account=SERVICE_ACCOUNT]
+        [--set-cloudsql-instances=[CLOUDSQL-INSTANCES,...]]
+        [--set-secrets=[KEY=SECRET_NAME:SECRET_VERSION,...]]
+        [--task-timeout=TASK_TIMEOUT] [--tasks=TASKS; default=1]
+        [--vpc-connector=VPC_CONNECTOR] [--vpc-egress=VPC_EGRESS]
+        [--async | --wait]
+        [--env-vars-file=FILE_PATH | --set-env-vars=[KEY=VALUE,...]]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Creates a new Cloud Run job.
+
+EXAMPLES
+    To deploy a new job my-data-transformation on Cloud Run:
+
+        $ gcloud run jobs create my-data-transformation \
+          --image=us-docker.pkg.dev/project/image
+
+    You may also omit the job name. Then a prompt will be displayed with a
+    suggested default value:
+
+        $ gcloud run jobs create --image=us-docker.pkg.dev/project/image
+
+POSITIONAL ARGUMENTS
+     Job resource - Job to create. This represents a Cloud resource. (NOTE)
+     Some attributes are not given arguments in this group but can be set in
+     other ways. To set the project attribute:
+      ◆ provide the argument JOB on the command line with a fully specified
+        name;
+      ◆ specify the job name from an interactive prompt with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+       [JOB]
+          ID of the Job or fully qualified identifier for the Job. To set the
+          jobs attribute:
+          ▸ provide the argument JOB on the command line;
+          ▸ specify the job name from an interactive prompt.
+
+REQUIRED FLAGS
+     --image=IMAGE
+        Name of the container image to deploy (e.g.
+        us-docker.pkg.dev/cloudrun/container/job:latest).
+
+OPTIONAL FLAGS
+     --args=[ARG,...]
+        Comma-separated arguments passed to the command run by the container
+        image. If not specified and no '--command' is provided, the container
+        image's default Cmd is used. Otherwise, if not specified, no arguments
+        are passed. To reset this field to its default, pass an empty string.
+
+     --binary-authorization=POLICY
+        Binary Authorization policy to check against. This must be set to
+        "default".
+
+     --breakglass=JUSTIFICATION
+        Justification to bypass Binary Authorization policy constraints and
+        allow the operation. See
+        https://cloud.google.com/binary-authorization/docs/using-breakglass for
+        more information. Next update or deploy command will automatically
+        clear existing breakglass justification.
+
+     --command=[COMMAND,...]
+        Entrypoint for the container image. If not specified, the container
+        image's default Entrypoint is run. To reset this field to its default,
+        pass an empty string.
+
+     --cpu=CPU
+        Set a CPU limit in Kubernetes cpu units.
+
+        Cloud Run (fully managed) supports values 1, 2 and 4. For Cloud Run
+        (fully managed), 4 cpus also requires a minimum 2Gi --memory value.
+        Examples 2, 2.0, 2000m
+
+     --execute-now
+        Execute the job immediately after creation.
+
+     --key=KEY
+        CMEK key reference to encrypt the container with.
+
+     --labels=[KEY=VALUE,...]
+        List of label KEY=VALUE pairs to add.
+
+     --max-retries=MAX_RETRIES
+        Number of times a task is allowed to restart in case of failure before
+        being failed permanently. This applies per-task, not per-job. If set to
+        0, tasks will only run once and never be retried on failure.
+
+     --memory=MEMORY
+        Set a memory limit. Ex: 1024Mi, 4Gi.
+
+     --parallelism=PARALLELISM
+        Number of tasks that may run concurrently. Must be less than or equal
+        to the number of tasks. Set to 0 to unset.
+
+     --region=REGION
+        Region in which the resource can be found. Alternatively, set the
+        property [run/region].
+
+     --service-account=SERVICE_ACCOUNT
+        Service account associated with the revision of the service. The
+        service account represents the identity of the running revision, and
+        determines what permissions the revision has. This is the email address
+        of an IAM service account.
+
+     --set-cloudsql-instances=[CLOUDSQL-INSTANCES,...]
+        You can specify a name of a Cloud SQL instance if it's in the same
+        project and region as your Cloud Run resource; otherwise specify
+        <project>:<region>:<instance> for the instance.
+
+     --set-secrets=[KEY=SECRET_NAME:SECRET_VERSION,...]
+        Specify secrets to provide as environment variables. For example:
+        '--set-secrets=ENV=mysecret:latest,OTHER_ENV=othersecret:1' will create
+        an environment variable named ENV whose value is the latest version of
+        secret 'mysecret' and an environment variable OTHER_ENV whose value is
+        version of 1 of secret 'othersecret'.
+
+     --task-timeout=TASK_TIMEOUT
+        Set the maximum time (deadline) a job task attempt can run for. In the
+        case of retries, this deadline applies to each attempt of a task. If
+        the task attempt does not complete within this time, it will be killed.
+        It is specified as a duration; for example, "10m5s" is ten minutes, and
+        five seconds. If you don't specify a unit, seconds is assumed. For
+        example, "10" is 10 seconds.
+
+     --tasks=TASKS; default=1
+        Number of tasks that must run to completion for the job to be
+        considered done. Use this flag to trigger multiple runs of the job.
+
+     --vpc-connector=VPC_CONNECTOR
+        Set a VPC connector for this resource.
+
+     --vpc-egress=VPC_EGRESS
+        The outbound traffic to send through the VPC connector for this
+        resource. This resource must have a VPC connector to set VPC egress.
+        VPC_EGRESS must be one of:
+
+         all
+            (DEPRECATED) Sends all outbound traffic through the VPC connector.
+            Provides the same functionality as 'all-traffic'. Prefer to use
+            'all-traffic' instead.
+         all-traffic
+            Sends all outbound traffic through the VPC connector.
+         private-ranges-only
+            Default option. Sends outbound traffic to private IP addresses
+            defined by RFC1918 through the VPC connector.
+
+     At most one of these can be specified:
+
+       --async
+          Return immediately, without waiting for the operation in progress to
+          complete.
+
+       --wait
+          Wait until the execution has completed running before exiting. If not
+          set, gcloud exits successfully when the execution has started.
+          Implies --execute-now.
+
+     At most one of these can be specified:
+
+       --env-vars-file=FILE_PATH
+          Path to a local YAML file with definitions for all environment
+          variables. Example YAML content:
+
+              KEY_1: "value1"
+              KEY_2: "value 2"
+
+       --set-env-vars=[KEY=VALUE,...]
+          List of key-value pairs to set as environment variables.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha run jobs create
+
+        $ gcloud beta run jobs create
+
diff --git a/gcloud/run/jobs/delete b/gcloud/run/jobs/delete
new file mode 100644
index 000000000..5f63b2b87
--- /dev/null
+++ b/gcloud/run/jobs/delete
@@ -0,0 +1,50 @@
+NAME
+    gcloud run jobs delete - delete a job
+
+SYNOPSIS
+    gcloud run jobs delete JOB [--region=REGION] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Delete a job.
+
+EXAMPLES
+    To delete a job:
+
+        $ gcloud run jobs delete job-name
+
+POSITIONAL ARGUMENTS
+     Job resource - Job to delete. This represents a Cloud resource. (NOTE)
+     Some attributes are not given arguments in this group but can be set in
+     other ways. To set the project attribute:
+      ◆ provide the argument JOB on the command line with a fully specified
+        name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       JOB
+          ID of the Job or fully qualified identifier for the Job. To set the
+          jobs attribute:
+          ▸ provide the argument JOB on the command line.
+
+FLAGS
+     --region=REGION
+        Region in which the resource can be found. Alternatively, set the
+        property [run/region].
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha run jobs delete
+
+        $ gcloud beta run jobs delete
+
diff --git a/gcloud/run/jobs/describe b/gcloud/run/jobs/describe
new file mode 100644
index 000000000..6f18085b5
--- /dev/null
+++ b/gcloud/run/jobs/describe
@@ -0,0 +1,50 @@
+NAME
+    gcloud run jobs describe - obtain details about jobs
+
+SYNOPSIS
+    gcloud run jobs describe JOB [--region=REGION] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Obtain details about jobs.
+
+EXAMPLES
+    To describe a job:
+
+        $ gcloud run jobs describe my-job
+
+POSITIONAL ARGUMENTS
+     Job resource - Job to describe. This represents a Cloud resource. (NOTE)
+     Some attributes are not given arguments in this group but can be set in
+     other ways. To set the project attribute:
+      ◆ provide the argument JOB on the command line with a fully specified
+        name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       JOB
+          ID of the Job or fully qualified identifier for the Job. To set the
+          jobs attribute:
+          ▸ provide the argument JOB on the command line.
+
+FLAGS
+     --region=REGION
+        Region in which the resource can be found. Alternatively, set the
+        property [run/region].
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha run jobs describe
+
+        $ gcloud beta run jobs describe
+
diff --git a/gcloud/run/jobs/execute b/gcloud/run/jobs/execute
new file mode 100644
index 000000000..f6ac9c66e
--- /dev/null
+++ b/gcloud/run/jobs/execute
@@ -0,0 +1,62 @@
+NAME
+    gcloud run jobs execute - execute a job
+
+SYNOPSIS
+    gcloud run jobs execute [JOB] [--region=REGION] [--async | --wait]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Execute a job.
+
+EXAMPLES
+    To execute a job:
+
+        $ gcloud run jobs execute my-job
+
+POSITIONAL ARGUMENTS
+     Job resource - Job to execute. This represents a Cloud resource. (NOTE)
+     Some attributes are not given arguments in this group but can be set in
+     other ways. To set the project attribute:
+      ◆ provide the argument JOB on the command line with a fully specified
+        name;
+      ◆ specify the job name from an interactive prompt with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+       [JOB]
+          ID of the Job or fully qualified identifier for the Job. To set the
+          jobs attribute:
+          ▸ provide the argument JOB on the command line;
+          ▸ specify the job name from an interactive prompt.
+
+FLAGS
+     --region=REGION
+        Region in which the resource can be found. Alternatively, set the
+        property [run/region].
+
+     At most one of these can be specified:
+
+       --async
+          Return immediately, without waiting for the operation in progress to
+          complete.
+
+       --wait
+          Wait until the execution has completed running before exiting. If not
+          set, gcloud exits successfully when the execution has started.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha run jobs execute
+
+        $ gcloud beta run jobs execute
+
diff --git a/gcloud/run/jobs/executions/delete b/gcloud/run/jobs/executions/delete
new file mode 100644
index 000000000..6b360e0ea
--- /dev/null
+++ b/gcloud/run/jobs/executions/delete
@@ -0,0 +1,51 @@
+NAME
+    gcloud run jobs executions delete - delete an execution
+
+SYNOPSIS
+    gcloud run jobs executions delete EXECUTION [--region=REGION]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Delete an execution.
+
+EXAMPLES
+    To delete an execution:
+
+        $ gcloud run jobs executions delete my-execution
+
+POSITIONAL ARGUMENTS
+     Execution resource - Execution to delete. This represents a Cloud
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways. To set the project attribute:
+      ◆ provide the argument EXECUTION on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       EXECUTION
+          ID of the Execution or fully qualified identifier for the Execution.
+          To set the executions attribute:
+          ▸ provide the argument EXECUTION on the command line.
+
+FLAGS
+     --region=REGION
+        Region in which the resource can be found. Alternatively, set the
+        property [run/region].
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha run jobs executions delete
+
+        $ gcloud beta run jobs executions delete
+
diff --git a/gcloud/run/jobs/executions/describe b/gcloud/run/jobs/executions/describe
new file mode 100644
index 000000000..9e9b6b254
--- /dev/null
+++ b/gcloud/run/jobs/executions/describe
@@ -0,0 +1,51 @@
+NAME
+    gcloud run jobs executions describe - obtain details about executions
+
+SYNOPSIS
+    gcloud run jobs executions describe EXECUTION [--region=REGION]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Obtain details about executions.
+
+EXAMPLES
+    To describe an execution:
+
+        $ gcloud run jobs executions describe my-execution
+
+POSITIONAL ARGUMENTS
+     Execution resource - Execution to describe. This represents a Cloud
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways. To set the project attribute:
+      ◆ provide the argument EXECUTION on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       EXECUTION
+          ID of the Execution or fully qualified identifier for the Execution.
+          To set the executions attribute:
+          ▸ provide the argument EXECUTION on the command line.
+
+FLAGS
+     --region=REGION
+        Region in which the resource can be found. Alternatively, set the
+        property [run/region].
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha run jobs executions describe
+
+        $ gcloud beta run jobs executions describe
+
diff --git a/gcloud/run/jobs/executions/help b/gcloud/run/jobs/executions/help
new file mode 100644
index 000000000..69e7542d0
--- /dev/null
+++ b/gcloud/run/jobs/executions/help
@@ -0,0 +1,51 @@
+NAME
+    gcloud run jobs executions - view and manage your Cloud Run jobs executions
+
+SYNOPSIS
+    gcloud run jobs executions GROUP | COMMAND [--region=REGION]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    This set of commands can be used to view and manage your Cloud Run jobs
+    executions.
+
+EXAMPLES
+    To list your executions for a job, run:
+
+        $ gcloud run jobs executions list --job=my-job
+
+FLAGS
+     --region=REGION
+        Region in which the resource can be found. Alternatively, set the
+        property [run/region].
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+GROUPS
+    GROUP is one of the following:
+
+     tasks
+        View and manage your Cloud Run jobs tasks.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     delete
+        Delete an execution.
+
+     describe
+        Obtain details about executions.
+
+     list
+        List executions.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha run jobs executions
+
+        $ gcloud beta run jobs executions
+
diff --git a/gcloud/run/jobs/executions/list b/gcloud/run/jobs/executions/list
new file mode 100644
index 000000000..81f4a6677
--- /dev/null
+++ b/gcloud/run/jobs/executions/list
@@ -0,0 +1,85 @@
+NAME
+    gcloud run jobs executions list - list executions
+
+SYNOPSIS
+    gcloud run jobs executions list [--job=JOB] [--namespace=NAMESPACE]
+        [--region=REGION] [--filter=EXPRESSION] [--limit=LIMIT]
+        [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    List executions.
+
+EXAMPLES
+    To list all executions in all regions:
+
+        $ gcloud run jobs executions list
+
+FLAGS
+     --job=JOB
+        Limit matched resources to the given job.
+
+     Namespace resource - Namespace to list executions in. This represents a
+     Cloud resource.
+
+       --namespace=NAMESPACE
+          ID of the namespace or fully qualified identifier for the namespace.
+          To set the namespace attribute:
+          ▸ provide the argument --namespace on the command line;
+          ▸ set the property run/namespace;
+          ▸ For Cloud Run on Kubernetes Engine, defaults to "default".
+            Otherwise, defaults to project ID.;
+          ▸ provide the argument project on the command line;
+          ▸ set the property core/project.
+
+     --region=REGION
+        Region in which the resource can be found. Alternatively, set the
+        property [run/region].
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha run jobs executions list
+
+        $ gcloud beta run jobs executions list
+
diff --git a/gcloud/run/jobs/executions/tasks/describe b/gcloud/run/jobs/executions/tasks/describe
new file mode 100644
index 000000000..4e64e18e5
--- /dev/null
+++ b/gcloud/run/jobs/executions/tasks/describe
@@ -0,0 +1,51 @@
+NAME
+    gcloud run jobs executions tasks describe - obtain details about tasks
+
+SYNOPSIS
+    gcloud run jobs executions tasks describe TASK [--region=REGION]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Obtain details about tasks.
+
+EXAMPLES
+    To describe a task:
+
+        $ gcloud run jobs executions tasks describe my-task
+
+POSITIONAL ARGUMENTS
+     Task resource - Task to describe. This represents a Cloud resource. (NOTE)
+     Some attributes are not given arguments in this group but can be set in
+     other ways. To set the project attribute:
+      ◆ provide the argument TASK on the command line with a fully specified
+        name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       TASK
+          ID of the Task or fully qualified identifier for the Task. To set the
+          tasks attribute:
+          ▸ provide the argument TASK on the command line.
+
+FLAGS
+     --region=REGION
+        Region in which the resource can be found. Alternatively, set the
+        property [run/region].
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha run jobs executions tasks describe
+
+        $ gcloud beta run jobs executions tasks describe
+
diff --git a/gcloud/run/jobs/executions/tasks/help b/gcloud/run/jobs/executions/tasks/help
new file mode 100644
index 000000000..b2caf5170
--- /dev/null
+++ b/gcloud/run/jobs/executions/tasks/help
@@ -0,0 +1,43 @@
+NAME
+    gcloud run jobs executions tasks - view and manage your Cloud Run jobs
+        tasks
+
+SYNOPSIS
+    gcloud run jobs executions tasks COMMAND [--region=REGION]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    This set of commands can be used to view and manage your Cloud Run jobs
+    tasks.
+
+EXAMPLES
+    To list your existing tasks for an execution, run:
+
+        $ gcloud run jobs executions tasks list --execution my_execution
+
+FLAGS
+     --region=REGION
+        Region in which the resource can be found. Alternatively, set the
+        property [run/region].
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     describe
+        Obtain details about tasks.
+
+     list
+        List tasks.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha run jobs executions tasks
+
+        $ gcloud beta run jobs executions tasks
+
diff --git a/gcloud/run/jobs/executions/tasks/list b/gcloud/run/jobs/executions/tasks/list
new file mode 100644
index 000000000..b4761b48f
--- /dev/null
+++ b/gcloud/run/jobs/executions/tasks/list
@@ -0,0 +1,88 @@
+NAME
+    gcloud run jobs executions tasks list - list tasks
+
+SYNOPSIS
+    gcloud run jobs executions tasks list --execution=EXECUTION
+        [--region=REGION] [--succeeded] [--filter=EXPRESSION] [--limit=LIMIT]
+        [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    List tasks.
+
+EXAMPLES
+    To list all tasks for an execution:
+
+        $ gcloud run jobs executions tasks list --execution=my-execution
+
+REQUIRED FLAGS
+     Execution resource - Execution for which to list tasks. This represents a
+     Cloud resource. (NOTE) Some attributes are not given arguments in this
+     group but can be set in other ways. To set the project attribute:
+      ◆ provide the argument --execution on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       --execution=EXECUTION
+          ID of the Execution or fully qualified identifier for the Execution.
+          To set the executions attribute:
+          ▸ provide the argument --execution on the command line.
+
+FLAGS
+     --region=REGION
+        Region in which the resource can be found. Alternatively, set the
+        property [run/region].
+
+     --succeeded
+        Include succeeded tasks.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha run jobs executions tasks list
+
+        $ gcloud beta run jobs executions tasks list
+
diff --git a/gcloud/run/jobs/get-iam-policy b/gcloud/run/jobs/get-iam-policy
new file mode 100644
index 000000000..21fa466e7
--- /dev/null
+++ b/gcloud/run/jobs/get-iam-policy
@@ -0,0 +1,93 @@
+NAME
+    gcloud run jobs get-iam-policy - get the IAM policy for a Cloud Run job
+
+SYNOPSIS
+    gcloud run jobs get-iam-policy JOB [--region=REGION] [--filter=EXPRESSION]
+        [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    This command gets the IAM policy for a job. If formatted as JSON, the
+    output can be edited and used as a policy file for set-iam-policy. The
+    output includes an "etag" field identifying the version emitted and
+    allowing detection of concurrent policy updates; see $ gcloud alpha run
+    registries set-iam-policy for additional details.
+
+EXAMPLES
+    To print the IAM policy for a given job, run:
+
+        $ gcloud run jobs get-iam-policy --region=us-central1 my-job
+
+POSITIONAL ARGUMENTS
+     Job resource - The job for which to display the IAM policy. This
+     represents a Cloud resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways. To set the project
+     attribute:
+      ◆ provide the argument job on the command line with a fully specified
+        name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line. To set the region
+        attribute:
+      ◆ provide the argument job on the command line with a fully specified
+        name;
+      ◆ provide the argument --region on the command line;
+      ◆ set the property run/region;
+      ◆ specify from a list of available regions in a prompt.
+
+     This must be specified.
+
+       JOB
+          ID of the job or fully qualified identifier for the job. To set the
+          job attribute:
+          ▸ provide the argument job on the command line.
+
+FLAGS
+     --region=REGION
+        Region in which the resource can be found. Alternatively, set the
+        property [run/region].
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the run/v1 API. The full documentation for this API can
+    be found at: https://cloud.google.com/run/
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha run jobs get-iam-policy
+
+        $ gcloud beta run jobs get-iam-policy
+
diff --git a/gcloud/run/jobs/help b/gcloud/run/jobs/help
new file mode 100644
index 000000000..9703d9a74
--- /dev/null
+++ b/gcloud/run/jobs/help
@@ -0,0 +1,73 @@
+NAME
+    gcloud run jobs - view and manage your Cloud Run jobs
+
+SYNOPSIS
+    gcloud run jobs GROUP | COMMAND [--region=REGION] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    This set of commands can be used to view and manage your Cloud Run jobs.
+
+EXAMPLES
+    To list your existing jobs, run:
+
+        $ gcloud run jobs list
+
+FLAGS
+     --region=REGION
+        Region in which the resource can be found. Alternatively, set the
+        property [run/region].
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+GROUPS
+    GROUP is one of the following:
+
+     executions
+        View and manage your Cloud Run jobs executions.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     add-iam-policy-binding
+        Add IAM policy binding to a Cloud Run job.
+
+     create
+        Create a Cloud Run job.
+
+     delete
+        Delete a job.
+
+     describe
+        Obtain details about jobs.
+
+     execute
+        Execute a job.
+
+     get-iam-policy
+        Get the IAM policy for a Cloud Run job.
+
+     list
+        List jobs.
+
+     remove-iam-policy-binding
+        Remove IAM policy binding of a Cloud Run job.
+
+     replace
+        Create or replace a job from a YAML job specification.
+
+     set-iam-policy
+        Set the IAM policy for a job.
+
+     update
+        Update a Cloud Run Job.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha run jobs
+
+        $ gcloud beta run jobs
+
diff --git a/gcloud/run/jobs/list b/gcloud/run/jobs/list
new file mode 100644
index 000000000..4f41b2e8b
--- /dev/null
+++ b/gcloud/run/jobs/list
@@ -0,0 +1,81 @@
+NAME
+    gcloud run jobs list - list jobs
+
+SYNOPSIS
+    gcloud run jobs list [--namespace=NAMESPACE] [--region=REGION]
+        [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
+        [--sort-by=[FIELD,...]] [--uri] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    List jobs.
+
+EXAMPLES
+    To list all jobs in all regions:
+
+        $ gcloud run jobs list
+
+FLAGS
+     Namespace resource - Namespace to list jobs in. This represents a Cloud
+     resource.
+
+       --namespace=NAMESPACE
+          ID of the namespace or fully qualified identifier for the namespace.
+          To set the namespace attribute:
+          ▸ provide the argument --namespace on the command line;
+          ▸ set the property run/namespace;
+          ▸ For Cloud Run on Kubernetes Engine, defaults to "default".
+            Otherwise, defaults to project ID.;
+          ▸ provide the argument project on the command line;
+          ▸ set the property core/project.
+
+     --region=REGION
+        Region in which the resource can be found. Alternatively, set the
+        property [run/region].
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha run jobs list
+
+        $ gcloud beta run jobs list
+
diff --git a/gcloud/run/jobs/remove-iam-policy-binding b/gcloud/run/jobs/remove-iam-policy-binding
new file mode 100644
index 000000000..e5fbc747a
--- /dev/null
+++ b/gcloud/run/jobs/remove-iam-policy-binding
@@ -0,0 +1,93 @@
+NAME
+    gcloud run jobs remove-iam-policy-binding - remove IAM policy binding of a
+        Cloud Run job
+
+SYNOPSIS
+    gcloud run jobs remove-iam-policy-binding JOB --member=PRINCIPAL
+        --role=ROLE [--region=REGION] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Remove an IAM policy binding from the IAM policy of a job. One binding
+    consists of a member, and a role.
+
+EXAMPLES
+    To remove an IAM policy binding for the role of 'roles/run.invoker' for the
+    user 'test-user@gmail.com' with servcie 'my-job' and region 'us-central1',
+    run:
+
+        $ gcloud run jobs remove-iam-policy-binding my-job \
+            --region='us-central1' --member='user:test-user@gmail.com' \
+            --role='roles/run.invoker'
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of
+    policy role and member types.
+
+POSITIONAL ARGUMENTS
+     Job resource - The job for which to remove the IAM policy binding. This
+     represents a Cloud resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways. To set the project
+     attribute:
+      ◆ provide the argument job on the command line with a fully specified
+        name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line. To set the region
+        attribute:
+      ◆ provide the argument job on the command line with a fully specified
+        name;
+      ◆ provide the argument --region on the command line;
+      ◆ set the property run/region;
+      ◆ specify from a list of available regions in a prompt.
+
+     This must be specified.
+
+       JOB
+          ID of the job or fully qualified identifier for the job. To set the
+          job attribute:
+          ▸ provide the argument job on the command line.
+
+REQUIRED FLAGS
+     --member=PRINCIPAL
+        The principal to remove the binding for. Should be of the form
+        user|group|serviceAccount:email or domain:domain.
+
+        Examples: user:test-user@gmail.com, group:admins@example.com,
+        serviceAccount:test123@example.domain.com, or
+        domain:example.domain.com.
+
+        Deleted principals have an additional deleted: prefix and a ?uid=UID
+        suffix, where UID is a unique identifier for the principal. Example:
+        deleted:user:test-user@gmail.com?uid=123456789012345678901.
+
+        Some resources also accept the following special values:
+        ◆ allUsers - Special identifier that represents anyone who is on the
+          internet, with or without a Google account.
+        ◆ allAuthenticatedUsers - Special identifier that represents anyone
+          who is authenticated with a Google account or a service account.
+
+     --role=ROLE
+        The role to remove the principal from.
+
+OPTIONAL FLAGS
+     --region=REGION
+        Region in which the resource can be found. Alternatively, set the
+        property [run/region].
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the run/v1 API. The full documentation for this API can
+    be found at: https://cloud.google.com/run/
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha run jobs remove-iam-policy-binding
+
+        $ gcloud beta run jobs remove-iam-policy-binding
+
diff --git a/gcloud/run/jobs/replace b/gcloud/run/jobs/replace
new file mode 100644
index 000000000..5d7e4df96
--- /dev/null
+++ b/gcloud/run/jobs/replace
@@ -0,0 +1,45 @@
+NAME
+    gcloud run jobs replace - create or replace a job from a YAML job
+        specification
+
+SYNOPSIS
+    gcloud run jobs replace FILE [--async] [--region=REGION]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Creates or replaces a job from a YAML job specification.
+
+EXAMPLES
+    To replace the specification for a job defined in myjob.yaml
+
+        $ gcloud run jobs replace myjob.yaml
+
+POSITIONAL ARGUMENTS
+     FILE
+        The absolute path to the YAML file with a Cloud Run job definition for
+        the job to update or create.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+     --region=REGION
+        Region in which the resource can be found. Alternatively, set the
+        property [run/region].
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha run jobs replace
+
+        $ gcloud beta run jobs replace
+
diff --git a/gcloud/run/jobs/set-iam-policy b/gcloud/run/jobs/set-iam-policy
new file mode 100644
index 000000000..d59d47752
--- /dev/null
+++ b/gcloud/run/jobs/set-iam-policy
@@ -0,0 +1,79 @@
+NAME
+    gcloud run jobs set-iam-policy - set the IAM policy for a job
+
+SYNOPSIS
+    gcloud run jobs set-iam-policy JOB POLICY_FILE [--region=REGION]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    This command replaces the existing IAM policy for a job, given a job and a
+    file encoded in JSON or YAML that contains the IAM policy. If the given
+    policy file specifies an "etag" value, then the replacement will succeed
+    only if the policy already in place matches that etag. (An etag obtain via
+    get-iam-policy will prevent the replacement if the policy for the job has
+    been subsequently updated.) A policy file that does not contain an etag
+    value will replace any existing policy for the job.
+
+EXAMPLES
+    The following command will read an IAM policy defined in a JSON file
+    'policy.json' and set it for a job with identifier 'my-job'
+
+        $ gcloud run jobs set-iam-policy --region=us-central1 my-job \
+            policy.json
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of the
+    policy file format and contents.
+
+POSITIONAL ARGUMENTS
+     Job resource - The job for which to set the IAM policy. This represents a
+     Cloud resource. (NOTE) Some attributes are not given arguments in this
+     group but can be set in other ways. To set the project attribute:
+      ◆ provide the argument job on the command line with a fully specified
+        name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line. To set the region
+        attribute:
+      ◆ provide the argument job on the command line with a fully specified
+        name;
+      ◆ provide the argument --region on the command line;
+      ◆ set the property run/region;
+      ◆ specify from a list of available regions in a prompt.
+
+     This must be specified.
+
+       JOB
+          ID of the job or fully qualified identifier for the job. To set the
+          job attribute:
+          ▸ provide the argument job on the command line.
+
+     POLICY_FILE
+        Path to a local JSON or YAML formatted file containing a valid policy.
+
+        The output of the get-iam-policy command is a valid file, as is any
+        JSON or YAML file conforming to the structure of a Policy
+        (https://cloud.google.com/iam/reference/rest/v1/Policy).
+
+FLAGS
+     --region=REGION
+        Region in which the resource can be found. Alternatively, set the
+        property [run/region].
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the run/v1 API. The full documentation for this API can
+    be found at: https://cloud.google.com/run/
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha run jobs set-iam-policy
+
+        $ gcloud beta run jobs set-iam-policy
+
diff --git a/gcloud/run/jobs/update b/gcloud/run/jobs/update
new file mode 100644
index 000000000..cb6196cc7
--- /dev/null
+++ b/gcloud/run/jobs/update
@@ -0,0 +1,283 @@
+NAME
+    gcloud run jobs update - update a Cloud Run Job
+
+SYNOPSIS
+    gcloud run jobs update [JOB] [--args=[ARG,...]]
+        [--breakglass=JUSTIFICATION] [--clear-vpc-connector]
+        [--command=[COMMAND,...]] [--cpu=CPU] [--execute-now] [--image=IMAGE]
+        [--key=KEY] [--max-retries=MAX_RETRIES] [--memory=MEMORY]
+        [--parallelism=PARALLELISM] [--region=REGION]
+        [--service-account=SERVICE_ACCOUNT] [--task-timeout=TASK_TIMEOUT]
+        [--tasks=TASKS; default=1] [--vpc-connector=VPC_CONNECTOR]
+        [--vpc-egress=VPC_EGRESS]
+        [--add-cloudsql-instances=[CLOUDSQL-INSTANCES,...]
+          | --clear-cloudsql-instances
+          | --remove-cloudsql-instances=[CLOUDSQL-INSTANCES,...]
+          | --set-cloudsql-instances=[CLOUDSQL-INSTANCES,...]]
+        [--async | --wait]
+        [--binary-authorization=POLICY | --clear-binary-authorization]
+        [--clear-env-vars | --env-vars-file=FILE_PATH
+          | --set-env-vars=[KEY=VALUE,...]
+          | --remove-env-vars=[KEY,...] --update-env-vars=[KEY=VALUE,...]]
+        [--clear-labels | --remove-labels=[KEY,...] --labels=[KEY=VALUE,...]
+          | --update-labels=[KEY=VALUE,...]]
+        [--clear-secrets | --set-secrets=[KEY=VALUE,...]
+          | --remove-secrets=[KEY,...] --update-secrets=[KEY=VALUE,...]]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Updates a Cloud Run job.
+
+EXAMPLES
+    To update the container image of Cloud Run job my-job:
+
+        $ gcloud run jobs update my-job \
+          --image=us-docker.pkg.dev/project/image
+
+POSITIONAL ARGUMENTS
+     Job resource - Job to update. This represents a Cloud resource. (NOTE)
+     Some attributes are not given arguments in this group but can be set in
+     other ways. To set the project attribute:
+      ◆ provide the argument JOB on the command line with a fully specified
+        name;
+      ◆ specify the job name from an interactive prompt with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+       [JOB]
+          ID of the Job or fully qualified identifier for the Job. To set the
+          jobs attribute:
+          ▸ provide the argument JOB on the command line;
+          ▸ specify the job name from an interactive prompt.
+
+FLAGS
+     --args=[ARG,...]
+        Comma-separated arguments passed to the command run by the container
+        image. If not specified and no '--command' is provided, the container
+        image's default Cmd is used. Otherwise, if not specified, no arguments
+        are passed. To reset this field to its default, pass an empty string.
+
+     --breakglass=JUSTIFICATION
+        Justification to bypass Binary Authorization policy constraints and
+        allow the operation. See
+        https://cloud.google.com/binary-authorization/docs/using-breakglass for
+        more information. Next update or deploy command will automatically
+        clear existing breakglass justification.
+
+     --clear-vpc-connector
+        Remove the VPC connector for this resource.
+
+     --command=[COMMAND,...]
+        Entrypoint for the container image. If not specified, the container
+        image's default Entrypoint is run. To reset this field to its default,
+        pass an empty string.
+
+     --cpu=CPU
+        Set a CPU limit in Kubernetes cpu units.
+
+        Cloud Run (fully managed) supports values 1, 2 and 4. For Cloud Run
+        (fully managed), 4 cpus also requires a minimum 2Gi --memory value.
+        Examples 2, 2.0, 2000m
+
+     --execute-now
+        Execute the job immediately after creation.
+
+     --image=IMAGE
+        Name of the container image to deploy (e.g.
+        us-docker.pkg.dev/cloudrun/container/job:latest).
+
+     --key=KEY
+        CMEK key reference to encrypt the container with.
+
+     --max-retries=MAX_RETRIES
+        Number of times a task is allowed to restart in case of failure before
+        being failed permanently. This applies per-task, not per-job. If set to
+        0, tasks will only run once and never be retried on failure.
+
+     --memory=MEMORY
+        Set a memory limit. Ex: 1024Mi, 4Gi.
+
+     --parallelism=PARALLELISM
+        Number of tasks that may run concurrently. Must be less than or equal
+        to the number of tasks. Set to 0 to unset.
+
+     --region=REGION
+        Region in which the resource can be found. Alternatively, set the
+        property [run/region].
+
+     --service-account=SERVICE_ACCOUNT
+        Service account associated with the revision of the service. The
+        service account represents the identity of the running revision, and
+        determines what permissions the revision has. This is the email address
+        of an IAM service account.
+
+     --task-timeout=TASK_TIMEOUT
+        Set the maximum time (deadline) a job task attempt can run for. In the
+        case of retries, this deadline applies to each attempt of a task. If
+        the task attempt does not complete within this time, it will be killed.
+        It is specified as a duration; for example, "10m5s" is ten minutes, and
+        five seconds. If you don't specify a unit, seconds is assumed. For
+        example, "10" is 10 seconds.
+
+     --tasks=TASKS; default=1
+        Number of tasks that must run to completion for the job to be
+        considered done. Use this flag to trigger multiple runs of the job.
+
+     --vpc-connector=VPC_CONNECTOR
+        Set a VPC connector for this resource.
+
+     --vpc-egress=VPC_EGRESS
+        The outbound traffic to send through the VPC connector for this
+        resource. This resource must have a VPC connector to set VPC egress.
+        VPC_EGRESS must be one of:
+
+         all
+            (DEPRECATED) Sends all outbound traffic through the VPC connector.
+            Provides the same functionality as 'all-traffic'. Prefer to use
+            'all-traffic' instead.
+         all-traffic
+            Sends all outbound traffic through the VPC connector.
+         private-ranges-only
+            Default option. Sends outbound traffic to private IP addresses
+            defined by RFC1918 through the VPC connector.
+
+     These flags modify the Cloud SQL instances this Service connects to. You
+     can specify a name of a Cloud SQL instance if it's in the same project and
+     region as your Cloud Run service; otherwise specify
+     <project>:<region>:<instance> for the instance.
+
+     At most one of these can be specified:
+
+       --add-cloudsql-instances=[CLOUDSQL-INSTANCES,...]
+          Append the given values to the current Cloud SQL instances.
+
+       --clear-cloudsql-instances
+          Empty the current Cloud SQL instances.
+
+       --remove-cloudsql-instances=[CLOUDSQL-INSTANCES,...]
+          Remove the given values from the current Cloud SQL instances.
+
+       --set-cloudsql-instances=[CLOUDSQL-INSTANCES,...]
+          Completely replace the current Cloud SQL instances with the given
+          values.
+
+     At most one of these can be specified:
+
+       --async
+          Return immediately, without waiting for the operation in progress to
+          complete.
+
+       --wait
+          Wait until the execution has completed running before exiting. If not
+          set, gcloud exits successfully when the execution has started.
+          Implies --execute-now.
+
+     At most one of these can be specified:
+
+       --binary-authorization=POLICY
+          Binary Authorization policy to check against. This must be set to
+          "default".
+
+       --clear-binary-authorization
+          Remove any previously set Binary Authorization policy.
+
+     At most one of these can be specified:
+
+       --clear-env-vars
+          Remove all environment variables.
+
+       --env-vars-file=FILE_PATH
+          Path to a local YAML file with definitions for all environment
+          variables. All existing environment variables will be removed before
+          the new environment variables are added. Example YAML content:
+
+              KEY_1: "value1"
+              KEY_2: "value 2"
+
+       --set-env-vars=[KEY=VALUE,...]
+          List of key-value pairs to set as environment variables. All existing
+          environment variables will be removed first.
+
+       Only --update-env-vars and --remove-env-vars can be used together. If
+       both are specified, --remove-env-vars will be applied first.
+
+         --remove-env-vars=[KEY,...]
+            List of environment variables to be removed.
+
+         --update-env-vars=[KEY=VALUE,...]
+            List of key-value pairs to set as environment variables.
+
+     At most one of these can be specified:
+
+       --clear-labels
+          Remove all labels. If --update-labels is also specified then
+          --clear-labels is applied first.
+
+          For example, to remove all labels:
+
+              $ gcloud run jobs update --clear-labels
+
+          To remove all existing labels and create two new labels, foo and baz:
+
+              $ gcloud run jobs update --clear-labels \
+                --update-labels foo=bar,baz=qux
+
+       --remove-labels=[KEY,...]
+          List of label keys to remove. If a label does not exist it is
+          silently ignored. If --update-labels is also specified then
+          --update-labels is applied first.
+
+     At most one of these can be specified:
+
+       --labels=[KEY=VALUE,...]
+          List of label KEY=VALUE pairs to add.
+
+          An alias to --update-labels.
+
+       --update-labels=[KEY=VALUE,...]
+          List of label KEY=VALUE pairs to update. If a label exists, its value
+          is modified. Otherwise, a new label is created.
+
+     Specify secrets to mount or provide as environment variables. Keys
+     starting with a forward slash '/' are mount paths. All other keys
+     correspond to environment variables. Values should be in the form
+     SECRET_NAME:SECRET_VERSION. For example:
+     '--update-secrets=/secrets/api/key=mysecret:latest,ENV=othersecret:1' will
+     mount a volume at '/secrets/api' containing a file 'key' with the latest
+     version of secret 'mysecret'. An environment variable named ENV will also
+     be created whose value is version 1 of secret 'othersecret'.
+
+     At most one of these can be specified:
+
+       --clear-secrets
+          Remove all secrets.
+
+       --set-secrets=[KEY=VALUE,...]
+          List of key-value pairs to set as secrets. All existing secrets will
+          be removed first.
+
+       Only --update-secrets and --remove-secrets can be used together. If both
+       are specified, --remove-secrets will be applied first.
+
+         --remove-secrets=[KEY,...]
+            List of secrets to be removed.
+
+         --update-secrets=[KEY=VALUE,...]
+            List of key-value pairs to set as secrets.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha run jobs update
+
+        $ gcloud beta run jobs update
+
diff --git a/gcloud/run/services/update b/gcloud/run/services/update
index 159bb9e0b..08929a2a3 100644
--- a/gcloud/run/services/update
+++ b/gcloud/run/services/update
@@ -20,8 +20,9 @@ SYNOPSIS
           | --remove-cloudsql-instances=[CLOUDSQL-INSTANCES,...]
           | --set-cloudsql-instances=[CLOUDSQL-INSTANCES,...]
           --binary-authorization=POLICY
-          | --clear-binary-authorization --clear-key
-          | --key=KEY --clear-post-key-revocation-action-type
+          | --clear-binary-authorization --clear-encryption-key-shutdown-hours
+          | --encryption-key-shutdown-hours=ENCRYPTION_KEY_SHUTDOWN_HOURS
+          --clear-key | --key=KEY --clear-post-key-revocation-action-type
           | --post-key-revocation-action-type=POST_KEY_REVOCATION_ACTION_TYPE]
         [--clear-env-vars | --env-vars-file=FILE_PATH
           | --set-env-vars=[KEY=VALUE,...]
@@ -276,6 +277,15 @@ FLAGS
          --clear-binary-authorization
             Remove any previously set Binary Authorization policy.
 
+       At most one of these can be specified:
+
+         --clear-encryption-key-shutdown-hours
+            Remove any previously set CMEK key shutdown hours setting.
+
+         --encryption-key-shutdown-hours=ENCRYPTION_KEY_SHUTDOWN_HOURS
+            The number of hours to wait before an automatic shutdown server
+            after CMEK key revocation is detected.
+
        At most one of these can be specified:
 
          --clear-key
diff --git a/gcloud/sql/export/csv b/gcloud/sql/export/csv
index 5f5b4a26a..eef711940 100644
--- a/gcloud/sql/export/csv
+++ b/gcloud/sql/export/csv
@@ -26,7 +26,8 @@ POSITIONAL ARGUMENTS
 REQUIRED FLAGS
      --query=QUERY
         A SQL SELECT query (e.g., SELECT * FROM table) that specifies the data
-        to export.
+        to export. WARNING: While in-transit, the query might be processed in
+        intermediate locations other than the location of the target instance.
 
 OPTIONAL FLAGS
      --async
diff --git a/gcloud/sql/instances/create b/gcloud/sql/instances/create
index 46fc9e978..c79940b3a 100644
--- a/gcloud/sql/instances/create
+++ b/gcloud/sql/instances/create
@@ -345,9 +345,10 @@ FLAGS
 
      --retained-transaction-log-days=RETAINED_TRANSACTION_LOG_DAYS
         How many days of transaction logs to keep. The valid range is between 1
-        and 7. The default value is 7 if not specified. Only valid when point
-        in time recovery is enabled. Keeping more days of transaction logs
-        requires bigger storage size
+        and 35. The default value is 7. The 35 days log retention feature is
+        only enabled for specific customer. Only use this option when
+        point-in-time recovery is enabled. Storage size for transaction logs
+        increases when the number of days for log retention increases.
 
      --root-password=ROOT_PASSWORD
         Root Cloud SQL user's password.
diff --git a/gcloud/sql/instances/patch b/gcloud/sql/instances/patch
index a7b968426..33f85c018 100644
--- a/gcloud/sql/instances/patch
+++ b/gcloud/sql/instances/patch
@@ -402,9 +402,10 @@ FLAGS
 
        --retained-transaction-log-days=RETAINED_TRANSACTION_LOG_DAYS
           How many days of transaction logs to keep. The valid range is between
-          1 and 7. The default value is 7 if not specified. Only valid when
-          point in time recovery is enabled. Keeping more days of transaction
-          logs requires bigger storage size
+          1 and 35. The default value is 7. The 35 days log retention feature
+          is only enabled for specific customer. Only use this option when
+          point-in-time recovery is enabled. Storage size for transaction logs
+          increases when the number of days for log retention increases.
 
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
diff --git a/gcloud/storage/cp b/gcloud/storage/cp
index 8b92d472d..a8dc359e7 100644
--- a/gcloud/storage/cp
+++ b/gcloud/storage/cp
@@ -93,8 +93,8 @@ FLAGS
 
      --no-clobber, -n
         Do not overwrite existing files or objects at the destination. Skipped
-        items will be printed. This option performs an additional GET request
-        for cloud objects before attempting an upload.
+        items will be printed. This option may perform an additional GET
+        request for cloud objects before attempting an upload.
 
      --continue-on-error, -c
         If any operations are unsuccessful, the command will exit with a
diff --git a/gcloud/storage/mv b/gcloud/storage/mv
index 88ba45039..65ce88fa0 100644
--- a/gcloud/storage/mv
+++ b/gcloud/storage/mv
@@ -102,8 +102,8 @@ FLAGS
 
      --no-clobber, -n
         Do not overwrite existing files or objects at the destination. Skipped
-        items will be printed. This option performs an additional GET request
-        for cloud objects before attempting an upload.
+        items will be printed. This option may perform an additional GET
+        request for cloud objects before attempting an upload.
 
      --continue-on-error, -c
         If any operations are unsuccessful, the command will exit with a