gcloud: Wed Dec 10 10:54:29 UTC 2025

gcloud/beta/sql/instances/create

@@ -52,6 +52,7 @@ SYNOPSIS
         [--password-policy-min-length=PASSWORD_POLICY_MIN_LENGTH]
         [--password-policy-password-change-interval=PASSWORD_POLICY_PASSWORD_CHANGE_INTERVAL]
         [--password-policy-reuse-interval=PASSWORD_POLICY_REUSE_INTERVAL]
+        [--performance-capture-config=KEY=VALUE,[KEY=VALUE,...]]
         [--psc-auto-connections=[network=NETWORK],[project=PROJECT]]
         [--[no-]recreate-replicas-on-primary-crash]
         [--replica-type=REPLICA_TYPE] [--replication=REPLICATION]
@@ -75,6 +76,8 @@ SYNOPSIS
           : --disk-encryption-key-keyring=DISK_ENCRYPTION_KEY_KEYRING
           --disk-encryption-key-location=DISK_ENCRYPTION_KEY_LOCATION
           --disk-encryption-key-project=DISK_ENCRYPTION_KEY_PROJECT]
+        [--entra-id-application-id=ENTRA_ID_APPLICATION_ID
+          --entra-id-tenant-id=ENTRA_ID_TENANT_ID]
         [--master-dump-file-path=MASTER_DUMP_FILE_PATH
           --master-username=MASTER_USERNAME
           : [--master-ca-certificate-path=MASTER_CA_CERTIFICATE_PATH
@@ -503,6 +506,15 @@ FLAGS
         Number of previous passwords that cannot be reused. The valid range is
         0 to 100.
 
+     --performance-capture-config=KEY=VALUE,[KEY=VALUE,...]
+        A comma-separated list of performance capture settings to add to the
+        MySQL instance. The input should be in a format of key=value. Available
+        case-sensitive keys are: enabled (boolean), probing-interval-seconds
+        (integer), probe-threshold (integer), running-threads-threshold
+        (integer), seconds-behind-source-threshold (integer), and
+        transaction-duration-threshold (integer). Example:
+        --performance-capture-config enabled=true,probe-threshold=5
+
      --psc-auto-connections=[network=NETWORK],[project=PROJECT]
         A comma-separated list of networks or network-project pairs. Each
         project is represented by a project number (numeric) or by a project ID
@@ -716,6 +728,20 @@ FLAGS
             line;
           ▸ set the property core/project.
 
+     Entraid configuration for the SQL Server instance.
+
+       --entra-id-application-id=ENTRA_ID_APPLICATION_ID
+          Set the Entraid application ID.
+
+          This flag argument must be specified if any of the other arguments in
+          this group are specified.
+
+       --entra-id-tenant-id=ENTRA_ID_TENANT_ID
+          Set the Entraid tenant ID.
+
+          This flag argument must be specified if any of the other arguments in
+          this group are specified.
+
      Options for creating an internal replica of an external data source.
 
        --master-dump-file-path=MASTER_DUMP_FILE_PATH

gcloud/beta/sql/instances/patch

@@ -15,7 +15,7 @@ SYNOPSIS
         [--audit-retention-interval=AUDIT_RETENTION_INTERVAL]
         [--audit-upload-interval=AUDIT_UPLOAD_INTERVAL]
         [--availability-type=AVAILABILITY_TYPE] [--clear-active-directory]
-        [--clear-active-directory-dns-servers]
+        [--clear-active-directory-dns-servers] [--clear-entra-id-config]
         [--clear-failover-dr-replica-name] [--clear-password-policy]
         [--connector-enforcement=CONNECTOR_ENFORCEMENT] [--cpu=CPU]
         [--data-api-access=DATA_API_ACCESS]
@@ -53,6 +53,7 @@ SYNOPSIS
         [--password-policy-min-length=PASSWORD_POLICY_MIN_LENGTH]
         [--password-policy-password-change-interval=PASSWORD_POLICY_PASSWORD_CHANGE_INTERVAL]
         [--password-policy-reuse-interval=PASSWORD_POLICY_REUSE_INTERVAL]
+        [--performance-capture-config=KEY=VALUE,[KEY=VALUE,...]]
         [--pricing-plan=PRICING_PLAN, -p PRICING_PLAN]
         [--reconcile-psa-networking]
         [--[no-]recreate-replicas-on-primary-crash]
@@ -85,6 +86,8 @@ SYNOPSIS
           | --psc-auto-connections=[network=NETWORK],[project=PROJECT]]
         [--clear-psc-network-attachment-uri
           | --psc-network-attachment-uri=PSC_NETWORK_ATTACHMENT_URI]
+        [--entra-id-application-id=ENTRA_ID_APPLICATION_ID
+          --entra-id-tenant-id=ENTRA_ID_TENANT_ID]
         [--gce-zone=GCE_ZONE | --secondary-zone=SECONDARY_ZONE --zone=ZONE]
         [--[no-]auto-scale-disable-scale-in --[no-]auto-scale-enabled
           --auto-scale-in-cooldown-seconds=AUTO_SCALE_IN_COOLDOWN_SECONDS
@@ -182,6 +185,9 @@ FLAGS
      --clear-active-directory-dns-servers
         Removes the list of DNS Servers from the Active Directory Config.
 
+     --clear-entra-id-config
+        Clear the Entra ID config for the SQL Server instance.
+
      --clear-failover-dr-replica-name
         Clear the DR replica setting for the primary instance. Flag is only
         available for MySQL and PostgreSQL database instances.
@@ -465,6 +471,15 @@ FLAGS
         Number of previous passwords that cannot be reused. The valid range is
         0 to 100.
 
+     --performance-capture-config=KEY=VALUE,[KEY=VALUE,...]
+        A comma-separated list of performance capture settings to add to the
+        MySQL instance. The input should be in a format of key=value. Available
+        case-sensitive keys are: enabled (boolean), probing-interval-seconds
+        (integer), probe-threshold (integer), running-threads-threshold
+        (integer), seconds-behind-source-threshold (integer), and
+        transaction-duration-threshold (integer). Example:
+        --performance-capture-config enabled=true,probe-threshold=5
+
      --pricing-plan=PRICING_PLAN, -p PRICING_PLAN
         First Generation instances only. The pricing plan for this instance.
         PRICING_PLAN must be one of: PER_USE, PACKAGE.
@@ -753,6 +768,20 @@ FLAGS
           Service Connect (PSC). For example, this would be of the
           form:--psc-network-attachment-uri=projects/test-project/regions/us-central1/networkAttachments/my-na
 
+     Entraid configuration for the SQL Server instance.
+
+       --entra-id-application-id=ENTRA_ID_APPLICATION_ID
+          Set the Entraid application ID.
+
+          This flag argument must be specified if any of the other arguments in
+          this group are specified.
+
+       --entra-id-tenant-id=ENTRA_ID_TENANT_ID
+          Set the Entraid tenant ID.
+
+          This flag argument must be specified if any of the other arguments in
+          this group are specified.
+
      At most one of these can be specified:
 
        --gce-zone=GCE_ZONE

gcloud/beta/sql/ssl/entraid-certs/create

@@ -0,0 +1,34 @@
+NAME
+    gcloud beta sql ssl entraid-certs create - create an Entra ID certificate
+        for a Cloud SQL instance
+
+SYNOPSIS
+    gcloud beta sql ssl entraid-certs create --instance=INSTANCE, -i INSTANCE
+        [--async] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Create an Entra ID certificate for a Cloud SQL instance.
+
+REQUIRED FLAGS
+     --instance=INSTANCE, -i INSTANCE
+        Cloud SQL instance ID.
+
+OPTIONAL FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha sql ssl entraid-certs create
+

gcloud/beta/sql/ssl/entraid-certs/help

@@ -0,0 +1,40 @@
+NAME
+    gcloud beta sql ssl entraid-certs - provide commands for managing Entra ID
+        certificates of Cloud SQL instances
+
+SYNOPSIS
+    gcloud beta sql ssl entraid-certs COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Provide commands for managing Entra ID certificates of Cloud SQL
+    instances, including creating, listing, rotating in, and rolling back
+    certificates.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     create
+        (BETA) Create an Entra ID certificate for a Cloud SQL instance.
+
+     list
+        (BETA) List all Entra ID certificates for a Cloud SQL instance.
+
+     rollback
+        (BETA) Roll back to the previous Entra ID certificate for a Cloud SQL
+        instance.
+
+     rotate
+        (BETA) Rotate in the upcoming Entra ID certificate for a Cloud SQL
+        instance.
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha sql ssl entraid-certs
+

gcloud/beta/sql/ssl/entraid-certs/list

@@ -0,0 +1,62 @@
+NAME
+    gcloud beta sql ssl entraid-certs list - list all Entra ID certificates for
+        a Cloud SQL instance
+
+SYNOPSIS
+    gcloud beta sql ssl entraid-certs list --instance=INSTANCE, -i INSTANCE
+        [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
+        [--sort-by=[FIELD,...]] [--uri] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) List all Entra ID certificates for a Cloud SQL instance.
+
+REQUIRED FLAGS
+     --instance=INSTANCE, -i INSTANCE
+        Cloud SQL instance ID.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha sql ssl entraid-certs list
+

gcloud/beta/sql/ssl/entraid-certs/rollback

@@ -0,0 +1,35 @@
+NAME
+    gcloud beta sql ssl entraid-certs rollback - roll back to the previous
+        Entra ID certificate for a Cloud SQL instance
+
+SYNOPSIS
+    gcloud beta sql ssl entraid-certs rollback --instance=INSTANCE, -i INSTANCE
+        [--async] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Roll back to the previous Entra ID certificate for a Cloud SQL
+    instance.
+
+REQUIRED FLAGS
+     --instance=INSTANCE, -i INSTANCE
+        Cloud SQL instance ID.
+
+OPTIONAL FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha sql ssl entraid-certs rollback
+

gcloud/beta/sql/ssl/entraid-certs/rotate

@@ -0,0 +1,35 @@
+NAME
+    gcloud beta sql ssl entraid-certs rotate - rotate in the upcoming Entra ID
+        certificate for a Cloud SQL instance
+
+SYNOPSIS
+    gcloud beta sql ssl entraid-certs rotate --instance=INSTANCE, -i INSTANCE
+        [--async] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Rotate in the upcoming Entra ID certificate for a Cloud SQL
+    instance.
+
+REQUIRED FLAGS
+     --instance=INSTANCE, -i INSTANCE
+        Cloud SQL instance ID.
+
+OPTIONAL FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha sql ssl entraid-certs rotate
+

gcloud/beta/sql/ssl/help

@@ -21,6 +21,10 @@ GROUPS
         (BETA) Provide commands for managing client certificates of Cloud SQL
         instances.
 
+     entraid-certs
+        (BETA) Provide commands for managing Entra ID certificates of Cloud SQL
+        instances.
+
      server-ca-certs
         (BETA) Provide commands for managing server CA certs of Cloud SQL
         instances.