gcloud: Wed Oct 8 11:07:39 UTC 2025

gcloud/beta/sql/instances/patch

@@ -53,6 +53,7 @@ SYNOPSIS
         [--remove-deny-maintenance-period] [--replication=REPLICATION]
         [--replication-lag-max-seconds-for-recreate=REPLICATION_LAG_MAX_SECONDS_FOR_RECREATE]
         [--[no-]require-ssl] [--[no-]retain-backups-on-delete]
+        [--server-ca-mode=SERVER_CA_MODE] [--server-ca-pool=SERVER_CA_POOL]
         [--simulate-maintenance-event] [--ssl-mode=SSL_MODE]
         [--[no-]storage-auto-increase]
         [--storage-auto-increase-limit=STORAGE_AUTO_INCREASE_LIMIT]
@@ -450,6 +451,21 @@ FLAGS
         deleted. Use --retain-backups-on-delete to enable and
         --no-retain-backups-on-delete to disable.
 
+     --server-ca-mode=SERVER_CA_MODE
+        Set the server CA mode of the instance. SERVER_CA_MODE must be one of:
+
+         CUSTOMER_MANAGED_CAS_CA
+            Customer-managed CA hosted on Google Cloud's Certificate Authority
+            Service (CAS).
+         GOOGLE_MANAGED_CAS_CA
+            Google-managed regional CA part of root CA hierarchy hosted on
+            Google Cloud's Certificate Authority Service (CAS).
+         GOOGLE_MANAGED_INTERNAL_CA
+            Google-managed self-signed internal CA.
+
+     --server-ca-pool=SERVER_CA_POOL
+        Set the server CA pool of the instance.
+
      --simulate-maintenance-event
         Simulate a maintenance event without changing the version. Only
         applicable to instances that support near-zero downtime planned

gcloud/beta/sql/instances/reset-ssl-config

@@ -3,7 +3,7 @@ NAME
         to the reset SSL mode
 
 SYNOPSIS
-    gcloud beta sql instances reset-ssl-config INSTANCE [--async]
+    gcloud beta sql instances reset-ssl-config INSTANCE [--async] [--mode=MODE]
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
@@ -18,6 +18,16 @@ FLAGS
         Return immediately, without waiting for the operation in progress to
         complete.
 
+     --mode=MODE
+        Selectively refresh the SSL materials. MODE must be one of:
+
+         ALL
+            Refresh all TLS configs. This is the default behaviour.
+         SYNC_FROM_PRIMARY
+            Refreshes the replication-related TLS configuration settings
+            provided by the primary instance. Not applicable to on-premises
+            replication instances.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,