gcloud: Thu Jun 2 08:41:25 UTC 2022

gcloud/auth/application-default/login

@@ -104,7 +104,8 @@ FLAGS
      --scopes=SCOPES,[SCOPES,...]
         The names of the scopes to authorize for. By default openid,
         https://www.googleapis.com/auth/userinfo.email,
-        https://www.googleapis.com/auth/cloud-platform scopes are used. The
+        https://www.googleapis.com/auth/cloud-platform,
+        https://www.googleapis.com/auth/sqlservice.login scopes are used. The
         list of possible scopes can be found at:
         https://developers.google.com/identity/protocols/googlescopes.
 

gcloud/auth/application-default/print-access-token

@@ -49,7 +49,8 @@ FLAGS
 
         For end-user accounts, the provided scopes must be from [openid,
         https://www.googleapis.com/auth/userinfo.email,
-        https://www.googleapis.com/auth/cloud-platform], or the scopes
+        https://www.googleapis.com/auth/cloud-platform,
+        https://www.googleapis.com/auth/sqlservice.login], or the scopes
         previously specified through gcloud auth application-default login
         --scopes.
 

gcloud/auth/revoke

@@ -15,7 +15,10 @@ DESCRIPTION
     When given a service account, this command does not revoke the service
     account token on the server because service account tokens are not
     revocable. Instead, it will print a warning and remove the credential from
-    the local machine.
+    the local machine. When used with a service account, this command has only
+    a local effect and the key associated with the service account is not
+    deleted. This can be done by executing gcloud iam service-accounts keys
+    delete after revoke.
 
     When given an external account (workload identity pool), whether
     impersonated or not, the command does not revoke the corresponding token on