diff --git a/gcloud/_version b/gcloud/_version
index d3a8737d4..72e3a7790 100644
--- a/gcloud/_version
+++ b/gcloud/_version
@@ -1,7 +1,7 @@
-Google Cloud SDK 401.0.0
-alpha 2022.09.03
-beta 2022.09.03
+Google Cloud SDK 402.0.0
+alpha 2022.09.12
+beta 2022.09.12
 bq 2.0.75
-core 2022.09.03
+core 2022.09.12
 gcloud-crc32c 1.0.0
-gsutil 5.12
+gsutil 5.13
diff --git a/gcloud/alpha/asset/query b/gcloud/alpha/asset/query
index 6b1cbb954..166f309d2 100644
--- a/gcloud/alpha/asset/query
+++ b/gcloud/alpha/asset/query
@@ -110,7 +110,7 @@ OPTIONAL FLAGS
           partition already exists. WRITE_DISPOSITION must be one of:
 
            write-append
-              AIf the table or partition already exists, BigQuery appends the
+              If the table or partition already exists, BigQuery appends the
               data to the table or the latest partition.
            write-empty
               If the table already exists and contains data, an error is
diff --git a/gcloud/alpha/batch/jobs/submit b/gcloud/alpha/batch/jobs/submit
index 6360b1250..fa9f38cfe 100644
--- a/gcloud/alpha/batch/jobs/submit
+++ b/gcloud/alpha/batch/jobs/submit
@@ -22,6 +22,28 @@ EXAMPLES
         $ gcloud alpha batch jobs submit \
             projects/foo/locations/us-central1/jobs/bar --config=config.json
 
+    To submit the job through stdin with json job config and name
+    projects/foo/locations/us-central1/jobs/bar, run:
+
+        $ gcloud alpha batch jobs submit \
+            projects/foo/locations/us-central1/jobs/bar --config=-
+
+        then input json job config via stdin
+        {
+          json job config
+        }
+
+    To submit the job through HereDoc with json job config and name
+    projects/foo/locations/us-central1/jobs/bar, run:
+
+        $ gcloud alpha batch jobs submit \
+            projects/foo/locations/us-central1/jobs/bar --config=- << EOF
+
+        {
+          json job config
+        }
+        EOF
+
 POSITIONAL ARGUMENTS
      Job resource - The Batch job resource. The arguments in this group can be
      used to specify the attributes of this resource. (NOTE) Some attributes
@@ -52,7 +74,9 @@ REQUIRED FLAGS
      At least one of these must be specified:
 
        --config=CONFIG
-          The JSON file of the job config.
+          The file path of the JSON job config JSON. It also supports direct
+          input from stdin with '-' or HereDoc (in shells with HereDoc support
+          like Bash) with '- <<DELIMITER'.
 
        Either specify the config file for the job or the first runnable in the
        task spec. Specify either a script file or container arguments for the
diff --git a/gcloud/alpha/batch/tasks/help b/gcloud/alpha/batch/tasks/help
index 0335add8f..caef66a93 100644
--- a/gcloud/alpha/batch/tasks/help
+++ b/gcloud/alpha/batch/tasks/help
@@ -27,7 +27,7 @@ COMMANDS
         (ALPHA) Show details of a task.
 
      list
-        (ALPHA) List tasks for a specified Batch task_group.
+        (ALPHA) List tasks for a specified Batch job.
 
 NOTES
     This command is currently in alpha and might change without notice. If this
diff --git a/gcloud/alpha/batch/tasks/list b/gcloud/alpha/batch/tasks/list
index 081c557d6..e17aa9c89 100644
--- a/gcloud/alpha/batch/tasks/list
+++ b/gcloud/alpha/batch/tasks/list
@@ -1,54 +1,50 @@
 NAME
-    gcloud alpha batch tasks list - list tasks for a specified Batch task_group
+    gcloud alpha batch tasks list - list tasks for a specified Batch job
 
 SYNOPSIS
-    gcloud alpha batch tasks list (TASK_GROUP : --job=JOB --location=LOCATION)
+    gcloud alpha batch tasks list (--job=JOB : --location=LOCATION)
         [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
         [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) This command can fail for the following reasons:
-      ▪ The task_group specified does not exist.
-      ▪ The active account does not have permission to access the given
-        task_group.
+    (ALPHA) Currently, since Batch only supports one taskGroup, group0, the
+    command takes --job as the required argument and will list all tasks in
+    group0 of the job.
+
+    This command can fail for the following reasons:
+      ▪ The job specified does not exist.
+      ▪ The active account does not have permission to access the given job
 
 EXAMPLES
-    To print all tasks under the task_group with name
-    projects/foo/locations/us-central1/jobs/bar/taskGroups/group0, run:
+    To print all tasks in the group0 of job with name
+    projects/foo/locations/us-central1/jobs/bar, run:
 
         $ gcloud alpha batch tasks list \
-            projects/foo/locations/us-central1/jobs/bar/taskGroups/group0
+            projects/foo/locations/us-central1/jobs/bar
 
-POSITIONAL ARGUMENTS
-     Task group resource - The Batch task_group resource. The arguments in this
-     group can be used to specify the attributes of this resource. (NOTE) Some
-     attributes are not given arguments in this group but can be set in other
-     ways. To set the project attribute:
-      ◆ provide the argument TASK_GROUP on the command line with a fully
-        specified name;
+REQUIRED FLAGS
+     Job resource - The Batch job resource. The arguments in this group can be
+     used to specify the attributes of this resource. (NOTE) Some attributes
+     are not given arguments in this group but can be set in other ways. To set
+     the project attribute:
+      ◆ provide the argument --job on the command line with a fully specified
+        name;
       ◆ provide the argument --project on the command line;
       ◆ set the property core/project.
 
      This must be specified.
 
-       TASK_GROUP
-          ID of the task_group or fully qualified identifier for the
-          task_group. To set the task_group attribute:
-          ▸ provide the argument TASK_GROUP on the command line.
-
-          This positional argument must be specified if any of the other
-          arguments in this group are specified.
-
        --job=JOB
-          The job ID for the task_group. To set the job attribute:
-          ▸ provide the argument TASK_GROUP on the command line with a fully
-            specified name;
+          ID of the job or fully qualified identifier for the job. To set the
+          job attribute:
           ▸ provide the argument --job on the command line.
 
+          This flag argument must be specified if any of the other arguments in
+          this group are specified.
+
        --location=LOCATION
-          Google Cloud location for the task_group. To set the location
-          attribute:
-          ▸ provide the argument TASK_GROUP on the command line with a fully
+          Google Cloud location for the job. To set the location attribute:
+          ▸ provide the argument --job on the command line with a fully
             specified name;
           ▸ provide the argument --location on the command line.
 
diff --git a/gcloud/alpha/compute/backend-services/add-iam-policy-binding b/gcloud/alpha/compute/backend-services/add-iam-policy-binding
index d9b0bfd3c..f628af7b2 100644
--- a/gcloud/alpha/compute/backend-services/add-iam-policy-binding
+++ b/gcloud/alpha/compute/backend-services/add-iam-policy-binding
@@ -89,7 +89,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud compute backend-services add-iam-policy-binding
 
         $ gcloud beta compute backend-services add-iam-policy-binding
 
diff --git a/gcloud/alpha/compute/backend-services/get-iam-policy b/gcloud/alpha/compute/backend-services/get-iam-policy
index aa3e9a646..58d4aa144 100644
--- a/gcloud/alpha/compute/backend-services/get-iam-policy
+++ b/gcloud/alpha/compute/backend-services/get-iam-policy
@@ -92,7 +92,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud compute backend-services get-iam-policy
 
         $ gcloud beta compute backend-services get-iam-policy
 
diff --git a/gcloud/alpha/compute/backend-services/remove-iam-policy-binding b/gcloud/alpha/compute/backend-services/remove-iam-policy-binding
index daf31a886..0d3a63c66 100644
--- a/gcloud/alpha/compute/backend-services/remove-iam-policy-binding
+++ b/gcloud/alpha/compute/backend-services/remove-iam-policy-binding
@@ -90,7 +90,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud compute backend-services remove-iam-policy-binding
 
         $ gcloud beta compute backend-services remove-iam-policy-binding
 
diff --git a/gcloud/alpha/compute/backend-services/set-iam-policy b/gcloud/alpha/compute/backend-services/set-iam-policy
index 35265e902..f376c3c27 100644
--- a/gcloud/alpha/compute/backend-services/set-iam-policy
+++ b/gcloud/alpha/compute/backend-services/set-iam-policy
@@ -71,7 +71,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud compute backend-services set-iam-policy
 
         $ gcloud beta compute backend-services set-iam-policy
 
diff --git a/gcloud/alpha/compute/backend-services/update b/gcloud/alpha/compute/backend-services/update
index 5c20bbc34..662d67030 100644
--- a/gcloud/alpha/compute/backend-services/update
+++ b/gcloud/alpha/compute/backend-services/update
@@ -199,7 +199,8 @@ FLAGS
         service.
 
      --no-health-checks
-        Removes all health checks for the backend service.
+        Removes all health checks for the backend service if the backend
+        service has no backends attached.
 
      --http-health-checks=HTTP_HEALTH_CHECK,[...]
         Specifies a list of legacy HTTP health check objects for checking the
diff --git a/gcloud/alpha/compute/instance-groups/managed/create b/gcloud/alpha/compute/instance-groups/managed/create
index d89f1c4c0..667003b90 100644
--- a/gcloud/alpha/compute/instance-groups/managed/create
+++ b/gcloud/alpha/compute/instance-groups/managed/create
@@ -5,8 +5,8 @@ NAME
 SYNOPSIS
     gcloud alpha compute instance-groups managed create NAME --size=SIZE
         --template=TEMPLATE [--base-instance-name=BASE_INSTANCE_NAME]
-        [--description=DESCRIPTION] [--initial-delay=INITIAL_DELAY]
-        [--instance-redistribution-type=TYPE]
+        [--description=DESCRIPTION] [--[no-]force-update-on-repair]
+        [--initial-delay=INITIAL_DELAY] [--instance-redistribution-type=TYPE]
         [--list-managed-instances-results=MODE]
         [--stateful-disk=[auto-delete=AUTO-DELETE],[device-name=DEVICE-NAME]]
         [--stateful-external-ip=[enabled],
@@ -52,6 +52,15 @@ OPTIONAL FLAGS
      --description=DESCRIPTION
         An optional description for this group.
 
+     --[no-]force-update-on-repair
+        Specifies whether to apply the group's latest configuration when
+        repairing a VM. If you updated the group's instance template or
+        per-instance configurations after the VM was created, then these
+        changes are applied when VM is repaired. If this flag is disabled with
+        -no-force-update-on-repair, then updates are applied in accordance with
+        the group's update policy type. Use --force-update-on-repair to enable
+        and --no-force-update-on-repair to disable.
+
      --initial-delay=INITIAL_DELAY
         Specifies the length of time during which the instance is known to be
         initializing and should not be autohealed even if unhealthy. This value
diff --git a/gcloud/alpha/compute/instance-groups/managed/update b/gcloud/alpha/compute/instance-groups/managed/update
index 5f883244e..82c500267 100644
--- a/gcloud/alpha/compute/instance-groups/managed/update
+++ b/gcloud/alpha/compute/instance-groups/managed/update
@@ -4,7 +4,8 @@ NAME
 
 SYNOPSIS
     gcloud alpha compute instance-groups managed update NAME
-        [--description=DESCRIPTION] [--instance-redistribution-type=TYPE]
+        [--description=DESCRIPTION] [--[no-]force-update-on-repair]
+        [--instance-redistribution-type=TYPE]
         [--list-managed-instances-results=MODE]
         [--remove-stateful-disks=DEVICE_NAME,[DEVICE_NAME,...]]
         [--remove-stateful-external-ips=INTERFACE_NAME,[...]]
@@ -51,6 +52,15 @@ FLAGS
         An optional description for this group. To clear the description, set
         the value to an empty string.
 
+     --[no-]force-update-on-repair
+        Specifies whether to apply the group's latest configuration when
+        repairing a VM. If you updated the group's instance template or
+        per-instance configurations after the VM was created, then these
+        changes are applied when VM is repaired. If this flag is disabled with
+        -no-force-update-on-repair, then updates are applied in accordance with
+        the group's update policy type. Use --force-update-on-repair to enable
+        and --no-force-update-on-repair to disable.
+
      --instance-redistribution-type=TYPE
         Specifies the type of the instance redistribution policy. An instance
         redistribution type lets you enable or disable automatic instance
diff --git a/gcloud/alpha/compute/instances/ops-agents/policies/create b/gcloud/alpha/compute/instances/ops-agents/policies/create
index a46e4482c..062582dbd 100644
--- a/gcloud/alpha/compute/instances/ops-agents/policies/create
+++ b/gcloud/alpha/compute/instances/ops-agents/policies/create
@@ -95,7 +95,7 @@ REQUIRED FLAGS
             The Ops Agent has both a logging module and a metrics module
             already. So other types of agents are not allowed when there is an
             agent with type ops-agent. See
-            https://cloud.google.com/stackdriver/docs/solutions/ops-agent#which_agent
+            https://cloud.google.com/stackdriver/docs/solutions/agents#which-agent-should-you-choose
             for which agent to use.
 
          enable-autoupgrade
diff --git a/gcloud/alpha/compute/instances/ops-agents/policies/update b/gcloud/alpha/compute/instances/ops-agents/policies/update
index ffab886ff..fe5c6c47c 100644
--- a/gcloud/alpha/compute/instances/ops-agents/policies/update
+++ b/gcloud/alpha/compute/instances/ops-agents/policies/update
@@ -117,7 +117,7 @@ FLAGS
             The Ops Agent has both a logging module and a metrics module
             already. So other types of agents are not allowed when there is an
             agent with type ops-agent. See
-            https://cloud.google.com/stackdriver/docs/solutions/ops-agent#which_agent
+            https://cloud.google.com/stackdriver/docs/solutions/agents#which-agent-should-you-choose
             for which agent to use.
 
          enable-autoupgrade
diff --git a/gcloud/alpha/compute/security-policies/rules/add-preconfig-waf-exclusion b/gcloud/alpha/compute/security-policies/rules/add-preconfig-waf-exclusion
new file mode 100644
index 000000000..5eb6dfb63
--- /dev/null
+++ b/gcloud/alpha/compute/security-policies/rules/add-preconfig-waf-exclusion
@@ -0,0 +1,146 @@
+NAME
+    gcloud alpha compute security-policies rules add-preconfig-waf-exclusion -
+        add an exclusion configuration for preconfigured WAF evaluation into a
+        security policy rule
+
+SYNOPSIS
+    gcloud alpha compute security-policies rules add-preconfig-waf-exclusion
+        PRIORITY --target-rule-set=TARGET_RULE_SET
+        [--request-cookie-to-exclude=[op=OP],[val=VAL]]
+        [--request-header-to-exclude=[op=OP],[val=VAL]]
+        [--request-query-param-to-exclude=[op=OP],[val=VAL]]
+        [--request-uri-to-exclude=[op=OP],[val=VAL]]
+        [--security-policy=SECURITY_POLICY] [--target-rule-ids=[RULE_ID,...]]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) gcloud alpha compute security-policies rules
+    add-preconfig-waf-exclusion is used to add an exclusion configuration for
+    preconfigured WAF evaluation into a security policy rule.
+
+    Note that request field exclusions are associated with a target, which can
+    be a single rule set, or a rule set plus a list of rule IDs under the rule
+    set.
+
+EXAMPLES
+    To add specific request field exclusions that are associated with the
+    target of 'sqli-stable': ['owasp-crs-v030001-id942110-sqli',
+    'owasp-crs-v030001-id942120-sqli'], run:
+
+        $ gcloud alpha compute security-policies rules \
+            add-preconfig-waf-exclusion 1000 --security-policy=my-policy \
+            --target-rule-set=sqli-stable \
+            --target-rule-ids=owasp-crs-v030001-id942110-sqli,\
+        owasp-crs-v030001-id942120-sqli \
+            --request-header-to-exclude=op=EQUALS,val=abc \
+            --request-header-to-exclude=op=STARTS_WITH,val=xyz \
+            --request-uri-to-exclude=op=EQUALS_ANY
+
+    To add specific request field exclusions that are associated with the
+    target of 'sqli-stable': [], run:
+
+        $ gcloud alpha compute security-policies rules \
+            add-preconfig-waf-exclusion 1000 --security-policy=my-policy \
+            --target-rule-set=sqli-stable \
+            --request-cookie-to-exclude=op=EQUALS_ANY
+
+POSITIONAL ARGUMENTS
+     PRIORITY
+        The priority of the rule to add the exclusion configuration for
+        preconfigured WAF evaluation. Rules are evaluated in order from highest
+        priority to lowest priority where 0 is the highest priority and
+        2147483647 is the lowest priority.
+
+REQUIRED FLAGS
+     --target-rule-set=TARGET_RULE_SET
+        Target WAF rule set where the request field exclusions being added
+        would apply.
+
+        This, together with the target rule IDs (if given), determines the
+        target for associating request field exclusions. See --target-rule-ids.
+
+OPTIONAL FLAGS
+     --request-cookie-to-exclude=[op=OP],[val=VAL]
+        Adds a request cookie to the request field exclusions associated with
+        the rule set and rule IDs (if given). This specifies a request cookie
+        whose value will be excluded from inspection during preconfigured WAF
+        evaluation.
+
+        You can specify an exact match or a partial match by using a field
+        operator and a field value. Available field operators are:
+        ◆ EQUALS: the operator matches if the field value equals the
+          specified value.
+        ◆ STARTS_WITH: the operator matches if the field value starts with
+          the specified value.
+        ◆ ENDS_WITH: the operator matches if the field value ends with the
+          specified value.
+        ◆ CONTAINS: the operator matches if the field value contains the
+          specified value.
+        ◆ EQUALS_ANY: the operator matches if the field value is any value.
+
+        A field value must be given if the field operator is not EQUALS_ANY,
+        and cannot be given if the field operator is EQUALS_ANY. For example,
+        --request-header-to-exclude op=EQUALS,val=abc or
+        --request-header-to-exclude op=EQUALS_ANY.
+
+        This flag can be repeated to specify multiple request headers to
+        exclude. For example, --request-header-to-exclude op=EQUALS,val=abc
+        --request-header-to-exclude op=STARTS_WITH,val=xyz.
+
+     --request-header-to-exclude=[op=OP],[val=VAL]
+        Adds a request header to the request field exclusions associated with
+        the rule set and rule IDs (if given). This specifies a request header
+        whose value will be excluded from inspection during preconfigured WAF
+        evaluation.
+
+        Refer to the syntax under --request-cookie-to-exclude.
+
+        This flag can be repeated to specify multiple request headers.
+
+     --request-query-param-to-exclude=[op=OP],[val=VAL]
+        Adds a request query parameter to the request field exclusions
+        associated with the rule set and rule IDs (if given). This specifies a
+        request query parameter in the query string or in the POST body whose
+        value will be excluded from inspection during preconfigured WAF
+        evaluation.
+
+        Refer to the syntax under --request-cookie-to-exclude.
+
+        This flag can be repeated to specify multiple request query parameters.
+
+     --request-uri-to-exclude=[op=OP],[val=VAL]
+        Adds a request URI to the request field exclusions associated with the
+        rule set and rule IDs (if given). This specifies a request URI from the
+        request line to be excluded from inspection during preconfigured WAF
+        evaluation.
+
+        Refer to the syntax under --request-cookie-to-exclude.
+
+        This flag can be repeated to specify multiple request URIs.
+
+     --security-policy=SECURITY_POLICY
+        The security policy that this rule belongs to.
+
+     --target-rule-ids=[RULE_ID,...]
+        A comma-separated list of target rule IDs under the WAF rule set where
+        the request field exclusions being added would apply. If omitted, the
+        added request field exclusions will be associated with the rule set
+        only, which would apply to all the rule IDs under the rule set.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. This variant is also available:
+
+        $ gcloud beta compute security-policies rules \
+            add-preconfig-waf-exclusion
+
diff --git a/gcloud/alpha/compute/security-policies/rules/help b/gcloud/alpha/compute/security-policies/rules/help
index a0ce9d671..eccec0fcf 100644
--- a/gcloud/alpha/compute/security-policies/rules/help
+++ b/gcloud/alpha/compute/security-policies/rules/help
@@ -16,6 +16,10 @@ GCLOUD WIDE FLAGS
 COMMANDS
     COMMAND is one of the following:
 
+     add-preconfig-waf-exclusion
+        (ALPHA) Add an exclusion configuration for preconfigured WAF evaluation
+        into a security policy rule.
+
      create
         (ALPHA) Create a Compute Engine security policy rule.
 
@@ -25,6 +29,10 @@ COMMANDS
      describe
         (ALPHA) Describe a Compute Engine security policy rule.
 
+     remove-preconfig-waf-exclusion
+        (ALPHA) Remove an exclusion configuration for preconfigured WAF
+        evaluation from a security policy rule.
+
      update
         (ALPHA) Update a Compute Engine security policy rule.
 
diff --git a/gcloud/alpha/compute/security-policies/rules/remove-preconfig-waf-exclusion b/gcloud/alpha/compute/security-policies/rules/remove-preconfig-waf-exclusion
new file mode 100644
index 000000000..e643f0d6e
--- /dev/null
+++ b/gcloud/alpha/compute/security-policies/rules/remove-preconfig-waf-exclusion
@@ -0,0 +1,164 @@
+NAME
+    gcloud alpha compute security-policies rules remove-preconfig-waf-exclusion
+        - remove an exclusion configuration for preconfigured WAF evaluation
+        from a security policy rule
+
+SYNOPSIS
+    gcloud alpha compute security-policies rules remove-preconfig-waf-exclusion
+        PRIORITY --target-rule-set=TARGET_RULE_SET
+        [--request-cookie-to-exclude=[op=OP],[val=VAL]]
+        [--request-header-to-exclude=[op=OP],[val=VAL]]
+        [--request-query-param-to-exclude=[op=OP],[val=VAL]]
+        [--request-uri-to-exclude=[op=OP],[val=VAL]]
+        [--security-policy=SECURITY_POLICY] [--target-rule-ids=[RULE_ID,...]]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) gcloud alpha compute security-policies rules
+    remove-preconfig-waf-exclusion is used to remove an exclusion configuration
+    for preconfigured WAF evaluation from a security policy rule.
+
+    Note that request field exclusions are associated with a target, which can
+    be a single rule set, or a rule set plus a list of rule IDs under the rule
+    set.
+
+    It is possible to remove request field exclusions at 3 levels:
+      ▪ Remove specific request field exclusions that are associated with a
+        matching target.
+      ▪ Remove all the request field exclusions that are associated with a
+        matching target.
+      ▪ Remove all the request field exclusions that are configured under the
+        security policy rule, regardless of the target.
+
+EXAMPLES
+    To remove specific request field exclusions that are associated with the
+    target of 'sqli-stable': ['owasp-crs-v030001-id942110-sqli',
+    'owasp-crs-v030001-id942120-sqli'], run:
+
+        $ gcloud alpha compute security-policies rules \
+            remove-preconfig-waf-exclusion 1000 \
+            --security-policy=my-policy --target-rule-set=sqli-stable \
+            --target-rule-ids=owasp-crs-v030001-id942110-sqli,\
+        owasp-crs-v030001-id942120-sqli \
+            --request-header-to-exclude=op=EQUALS,val=abc \
+            --request-header-to-exclude=op=STARTS_WITH,val=xyz \
+            --request-uri-to-exclude=op=EQUALS_ANY
+
+    To remove all the request field exclusions that are associated with the
+    target of 'sqli-stable': ['owasp-crs-v030001-id942110-sqli',
+    'owasp-crs-v030001-id942120-sqli'], run:
+
+        $ gcloud alpha compute security-policies rules \
+            remove-preconfig-waf-exclusion 1000 \
+            --security-policy=my-policy --target-rule-set=sqli-stable \
+            --target-rule-ids=owasp-crs-v030001-id942110-sqli,\
+        owasp-crs-v030001-id942120-sqli
+
+    To remove all the request field exclusions that are associated with the
+    target of 'sqli-stable': [], run:
+
+        $ gcloud alpha compute security-policies rules \
+            remove-preconfig-waf-exclusion 1000 \
+            --security-policy=my-policy --target-rule-set=sqli-stable
+
+    To remove all the request field exclusions that are configured under the
+    security policy rule, regardless of the target, run:
+
+        $ gcloud alpha compute security-policies rules \
+            remove-preconfig-waf-exclusion 1000 \
+            --security-policy=my-policy --target-rule-set=*
+
+POSITIONAL ARGUMENTS
+     PRIORITY
+        The priority of the rule to remove the exclusion configuration for
+        preconfigured WAF evaluation. Rules are evaluated in order from highest
+        priority to lowest priority where 0 is the highest priority and
+        2147483647 is the lowest priority.
+
+REQUIRED FLAGS
+     --target-rule-set=TARGET_RULE_SET
+        Target WAF rule set from where to remove the request field exclusions.
+
+        This, together with the target rule IDs (if given), determines the
+        target for associating request field exclusions. See --target-rule-ids.
+
+        Note that the removal of request field exclusions is restricted to
+        those associated with a matching target. Set this flag to * if you want
+        to remove request field exclusions regardless of the target.
+
+OPTIONAL FLAGS
+     --request-cookie-to-exclude=[op=OP],[val=VAL]
+        Removes a request cookie from the existing request field exclusions
+        associated with the rule set and rule IDs (if given).
+
+        You can specify an exact match or a partial match by using a field
+        operator and a field value. Available field operators are:
+        ◆ EQUALS: the operator matches if the field value equals the
+          specified value.
+        ◆ STARTS_WITH: the operator matches if the field value starts with
+          the specified value.
+        ◆ ENDS_WITH: the operator matches if the field value ends with the
+          specified value.
+        ◆ CONTAINS: the operator matches if the field value contains the
+          specified value.
+        ◆ EQUALS_ANY: the operator matches if the field value is any value.
+
+        A field value must be given if the field operator is not EQUALS_ANY,
+        and cannot be given if the field operator is EQUALS_ANY. For example,
+        --request-header-to-exclude op=EQUALS,val=abc or
+        --request-header-to-exclude op=EQUALS_ANY.
+
+        This flag can be repeated to specify multiple request headers to
+        exclude. For example, --request-header-to-exclude op=EQUALS,val=abc
+        --request-header-to-exclude op=STARTS_WITH,val=xyz.
+
+     --request-header-to-exclude=[op=OP],[val=VAL]
+        Removes a request header from the existing request field exclusions
+        associated with the rule set and rule IDs (if given).
+
+        Refer to the syntax under --request-cookie-to-exclude.
+
+        This flag can be repeated to specify multiple request headers.
+
+     --request-query-param-to-exclude=[op=OP],[val=VAL]
+        Removes a request query parameter from the existing request field
+        exclusions associated with the rule set and rule IDs (if given).
+
+        Refer to the syntax under --request-cookie-to-exclude.
+
+        This flag can be repeated to specify multiple request query parameters.
+
+     --request-uri-to-exclude=[op=OP],[val=VAL]
+        Removes a request URI from the existing request field exclusions
+        associated with the rule set and rule IDs (if given).
+
+        Refer to the syntax under --request-cookie-to-exclude.
+
+        This flag can be repeated to specify multiple request URIs.
+
+     --security-policy=SECURITY_POLICY
+        The security policy that this rule belongs to.
+
+     --target-rule-ids=[RULE_ID,...]
+        A comma-separated list of target rule IDs under the WAF rule set from
+        where to remove the request field exclusions. If omitted, the removal
+        of request field exclusions is restricted to those associated with the
+        rule set only, without specific rule IDs.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. This variant is also available:
+
+        $ gcloud beta compute security-policies rules \
+            remove-preconfig-waf-exclusion
+
diff --git a/gcloud/alpha/config/help b/gcloud/alpha/config/help
index c7584f71f..89a105ddd 100644
--- a/gcloud/alpha/config/help
+++ b/gcloud/alpha/config/help
@@ -1073,6 +1073,11 @@ AVAILABLE PROPERTIES
          max_retry_delay
             Max second delay between retriable operations.
 
+         parallel_composite_upload_compatibility_check
+            Determines if the GET bucket call should be performed to check if
+            the default storage class and retention period for the destination
+            bucket meet the criteria for parallel composite upload.
+
          parallel_composite_upload_component_size
             Specifies the ideal size of a component in bytes, which will act as
             an upper bound to the size of the components if ceil(file_size /
@@ -1081,6 +1086,12 @@ AVAILABLE PROPERTIES
             provided either in bytes or as human-readable values (e.g., "150M"
             to represent 150 mebibytes).
 
+         parallel_composite_upload_enabled
+            Determines whether parallel composite upload should be used.
+            Default value is None which will use parallel composite upload and
+            log an appropriate warning for the user explaining that parallel
+            composite upload is being used by default.
+
          parallel_composite_upload_threshold
             Specifies the maximum size of a file to upload in a single stream.
             Files larger than this threshold will be partitioned into component
@@ -1088,8 +1099,8 @@ AVAILABLE PROPERTIES
             The number of components will be the smaller of ceil(file_size /
             parallel_composite_upload_component_size) and the maximum number of
             objects the API allows composing at once. For Cloud Storage this
-            limit is 32. If this property is set to 0, then automatic parallel
-            uploads will never occur.
+            limit is 32. This property has no effect if
+            parallel_composite_upload_enabled is set to False.
 
          process_count
             The maximum number of processes parallel execution should use. When
diff --git a/gcloud/alpha/config/list b/gcloud/alpha/config/list
index 7d63e9ddb..8fadaad0b 100644
--- a/gcloud/alpha/config/list
+++ b/gcloud/alpha/config/list
@@ -1082,6 +1082,11 @@ AVAILABLE PROPERTIES
          max_retry_delay
             Max second delay between retriable operations.
 
+         parallel_composite_upload_compatibility_check
+            Determines if the GET bucket call should be performed to check if
+            the default storage class and retention period for the destination
+            bucket meet the criteria for parallel composite upload.
+
          parallel_composite_upload_component_size
             Specifies the ideal size of a component in bytes, which will act as
             an upper bound to the size of the components if ceil(file_size /
@@ -1090,6 +1095,12 @@ AVAILABLE PROPERTIES
             provided either in bytes or as human-readable values (e.g., "150M"
             to represent 150 mebibytes).
 
+         parallel_composite_upload_enabled
+            Determines whether parallel composite upload should be used.
+            Default value is None which will use parallel composite upload and
+            log an appropriate warning for the user explaining that parallel
+            composite upload is being used by default.
+
          parallel_composite_upload_threshold
             Specifies the maximum size of a file to upload in a single stream.
             Files larger than this threshold will be partitioned into component
@@ -1097,8 +1108,8 @@ AVAILABLE PROPERTIES
             The number of components will be the smaller of ceil(file_size /
             parallel_composite_upload_component_size) and the maximum number of
             objects the API allows composing at once. For Cloud Storage this
-            limit is 32. If this property is set to 0, then automatic parallel
-            uploads will never occur.
+            limit is 32. This property has no effect if
+            parallel_composite_upload_enabled is set to False.
 
          process_count
             The maximum number of processes parallel execution should use. When
diff --git a/gcloud/alpha/config/set b/gcloud/alpha/config/set
index b7d8fc5cf..c5995711a 100644
--- a/gcloud/alpha/config/set
+++ b/gcloud/alpha/config/set
@@ -1091,6 +1091,11 @@ AVAILABLE PROPERTIES
          max_retry_delay
             Max second delay between retriable operations.
 
+         parallel_composite_upload_compatibility_check
+            Determines if the GET bucket call should be performed to check if
+            the default storage class and retention period for the destination
+            bucket meet the criteria for parallel composite upload.
+
          parallel_composite_upload_component_size
             Specifies the ideal size of a component in bytes, which will act as
             an upper bound to the size of the components if ceil(file_size /
@@ -1099,6 +1104,12 @@ AVAILABLE PROPERTIES
             provided either in bytes or as human-readable values (e.g., "150M"
             to represent 150 mebibytes).
 
+         parallel_composite_upload_enabled
+            Determines whether parallel composite upload should be used.
+            Default value is None which will use parallel composite upload and
+            log an appropriate warning for the user explaining that parallel
+            composite upload is being used by default.
+
          parallel_composite_upload_threshold
             Specifies the maximum size of a file to upload in a single stream.
             Files larger than this threshold will be partitioned into component
@@ -1106,8 +1117,8 @@ AVAILABLE PROPERTIES
             The number of components will be the smaller of ceil(file_size /
             parallel_composite_upload_component_size) and the maximum number of
             objects the API allows composing at once. For Cloud Storage this
-            limit is 32. If this property is set to 0, then automatic parallel
-            uploads will never occur.
+            limit is 32. This property has no effect if
+            parallel_composite_upload_enabled is set to False.
 
          process_count
             The maximum number of processes parallel execution should use. When
diff --git a/gcloud/alpha/config/unset b/gcloud/alpha/config/unset
index 93bdaa2e3..700ccff23 100644
--- a/gcloud/alpha/config/unset
+++ b/gcloud/alpha/config/unset
@@ -1052,6 +1052,11 @@ AVAILABLE PROPERTIES
          max_retry_delay
             Max second delay between retriable operations.
 
+         parallel_composite_upload_compatibility_check
+            Determines if the GET bucket call should be performed to check if
+            the default storage class and retention period for the destination
+            bucket meet the criteria for parallel composite upload.
+
          parallel_composite_upload_component_size
             Specifies the ideal size of a component in bytes, which will act as
             an upper bound to the size of the components if ceil(file_size /
@@ -1060,6 +1065,12 @@ AVAILABLE PROPERTIES
             provided either in bytes or as human-readable values (e.g., "150M"
             to represent 150 mebibytes).
 
+         parallel_composite_upload_enabled
+            Determines whether parallel composite upload should be used.
+            Default value is None which will use parallel composite upload and
+            log an appropriate warning for the user explaining that parallel
+            composite upload is being used by default.
+
          parallel_composite_upload_threshold
             Specifies the maximum size of a file to upload in a single stream.
             Files larger than this threshold will be partitioned into component
@@ -1067,8 +1078,8 @@ AVAILABLE PROPERTIES
             The number of components will be the smaller of ceil(file_size /
             parallel_composite_upload_component_size) and the maximum number of
             objects the API allows composing at once. For Cloud Storage this
-            limit is 32. If this property is set to 0, then automatic parallel
-            uploads will never occur.
+            limit is 32. This property has no effect if
+            parallel_composite_upload_enabled is set to False.
 
          process_count
             The maximum number of processes parallel execution should use. When
diff --git a/gcloud/alpha/container/aws/node-pools/create b/gcloud/alpha/container/aws/node-pools/create
index 07c328956..ce186ee10 100644
--- a/gcloud/alpha/container/aws/node-pools/create
+++ b/gcloud/alpha/container/aws/node-pools/create
@@ -7,7 +7,8 @@ SYNOPSIS
         (NODE_POOL : --cluster=CLUSTER --location=LOCATION)
         --config-encryption-kms-key-arn=CONFIG_ENCRYPTION_KMS_KEY_ARN
         --iam-instance-profile=IAM_INSTANCE_PROFILE --node-version=NODE_VERSION
-        --subnet-id=SUBNET_ID [--async] [--image-type=IMAGE_TYPE]
+        --subnet-id=SUBNET_ID [--annotations=ANNOTATION,[ANNOTATION,...]]
+        [--async] [--image-type=IMAGE_TYPE]
         [--instance-placement=INSTANCE_PLACEMENT]
         [--instance-type=INSTANCE_TYPE] [--max-pods-per-node=MAX_PODS_PER_NODE]
         [--node-labels=NODE_LABEL,[NODE_LABEL,...]]
@@ -83,6 +84,9 @@ REQUIRED FLAGS
         Subnet ID of an existing VNET to use for the node pool.
 
 OPTIONAL FLAGS
+     --annotations=ANNOTATION,[ANNOTATION,...]
+        Annotations for the node pool.
+
      --async
         Return immediately, without waiting for the operation in progress to
         complete.
diff --git a/gcloud/alpha/container/aws/node-pools/update b/gcloud/alpha/container/aws/node-pools/update
index 302e40c9c..bb92ab00e 100644
--- a/gcloud/alpha/container/aws/node-pools/update
+++ b/gcloud/alpha/container/aws/node-pools/update
@@ -11,6 +11,7 @@ SYNOPSIS
         [--root-volume-kms-key-arn=ROOT_VOLUME_KMS_KEY_ARN]
         [--root-volume-size=ROOT_VOLUME_SIZE]
         [--root-volume-type=ROOT_VOLUME_TYPE] [--validate-only]
+        [--annotations=ANNOTATION,[ANNOTATION,...] | --clear-annotations]
         [--clear-proxy-config | --proxy-secret-arn=PROXY_SECRET_ARN
           --proxy-secret-version-id=PROXY_SECRET_VERSION_ID]
         [--clear-security-group-ids
@@ -96,6 +97,16 @@ FLAGS
      --validate-only
         Validate the node pool to update, but don't actually perform it.
 
+     Annotations
+
+     At most one of these can be specified:
+
+       --annotations=ANNOTATION,[ANNOTATION,...]
+          Annotations for the node pool.
+
+       --clear-annotations
+          Clear the annotations for the node pool.
+
      Proxy config
 
      At most one of these can be specified:
diff --git a/gcloud/alpha/container/fleet/mesh/update b/gcloud/alpha/container/fleet/mesh/update
index 7777df376..a8bf6ba08 100644
--- a/gcloud/alpha/container/fleet/mesh/update
+++ b/gcloud/alpha/container/fleet/mesh/update
@@ -3,7 +3,8 @@ NAME
         Service Mesh Feature
 
 SYNOPSIS
-    gcloud alpha container fleet mesh update --control-plane=CONTROL_PLANE
+    gcloud alpha container fleet mesh update
+        (--control-plane=CONTROL_PLANE --management=MANAGEMENT)
         [--membership=MEMBERSHIP | --memberships=MEMBERSHIPS]
         [GCLOUD_WIDE_FLAG ...]
 
@@ -19,9 +20,15 @@ EXAMPLES
             --control-plane=CONTROL_PLANE
 
 REQUIRED FLAGS
-     --control-plane=CONTROL_PLANE
-        The control plane management to update to. CONTROL_PLANE must be one
-        of: automatic, manual.
+     At least one of these must be specified:
+
+       --control-plane=CONTROL_PLANE
+          The control plane management to update to. CONTROL_PLANE must be one
+          of: automatic, manual.
+
+       --management=MANAGEMENT
+          The management mode to update to. MANAGEMENT must be one of:
+          automatic, manual.
 
 OPTIONAL FLAGS
      At most one of these can be specified:
diff --git a/gcloud/alpha/container/hub/mesh/update b/gcloud/alpha/container/hub/mesh/update
index a45e93d58..df4c5f7f9 100644
--- a/gcloud/alpha/container/hub/mesh/update
+++ b/gcloud/alpha/container/hub/mesh/update
@@ -3,7 +3,8 @@ NAME
         Service Mesh Feature
 
 SYNOPSIS
-    gcloud alpha container hub mesh update --control-plane=CONTROL_PLANE
+    gcloud alpha container hub mesh update
+        (--control-plane=CONTROL_PLANE --management=MANAGEMENT)
         [--membership=MEMBERSHIP | --memberships=MEMBERSHIPS]
         [GCLOUD_WIDE_FLAG ...]
 
@@ -19,9 +20,15 @@ EXAMPLES
             --control-plane=CONTROL_PLANE
 
 REQUIRED FLAGS
-     --control-plane=CONTROL_PLANE
-        The control plane management to update to. CONTROL_PLANE must be one
-        of: automatic, manual.
+     At least one of these must be specified:
+
+       --control-plane=CONTROL_PLANE
+          The control plane management to update to. CONTROL_PLANE must be one
+          of: automatic, manual.
+
+       --management=MANAGEMENT
+          The management mode to update to. MANAGEMENT must be one of:
+          automatic, manual.
 
 OPTIONAL FLAGS
      At most one of these can be specified:
diff --git a/gcloud/alpha/deploy/help b/gcloud/alpha/deploy/help
index f22f07c7c..80209513b 100644
--- a/gcloud/alpha/deploy/help
+++ b/gcloud/alpha/deploy/help
@@ -19,6 +19,9 @@ GROUPS
         (ALPHA) Create and manage Delivery Pipeline resources for Google Cloud
         Deploy.
 
+     job-runs
+        (ALPHA) Manages job runs resources for Google Cloud Deploy.
+
      releases
         (ALPHA) Create and manage Release resources for Google Cloud Deploy.
 
diff --git a/gcloud/alpha/deploy/job-runs/describe b/gcloud/alpha/deploy/job-runs/describe
new file mode 100644
index 000000000..3086ce7c5
--- /dev/null
+++ b/gcloud/alpha/deploy/job-runs/describe
@@ -0,0 +1,97 @@
+NAME
+    gcloud alpha deploy job-runs describe - show details for a job run
+
+SYNOPSIS
+    gcloud alpha deploy job-runs describe
+        (JOB_RUN : --delivery-pipeline=DELIVERY_PIPELINE
+          --region=REGION --release=RELEASE --rollout=ROLLOUT)
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Show details for a specified job run.
+
+EXAMPLES
+    To show details about a job run 'test-jobrun', for delivery pipeline
+    'test-pipeline', release 'test-release', rollout 'test-rollout', in region
+    'us-central1', run:
+
+        $ gcloud alpha deploy job-runs describe test-jobrun \
+            --delivery-pipeline=test-pipeline --release=test-release \
+            --rollout=test-rollout --region=us-central1
+
+POSITIONAL ARGUMENTS
+     Job run resource - The name of the job run you want to describe. The
+     arguments in this group can be used to specify the attributes of this
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways. To set the project attribute:
+      ◆ provide the argument job_run on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       JOB_RUN
+          ID of the job run or fully qualified identifier for the job run. To
+          set the job_run attribute:
+          ▸ provide the argument job_run on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --delivery-pipeline=DELIVERY_PIPELINE
+          The name of the Cloud Deploy delivery pipeline.
+
+          To set the delivery-pipeline attribute:
+          ▸ provide the argument job_run on the command line with a fully
+            specified name;
+          ▸ provide the argument --delivery-pipeline on the command line;
+          ▸ set the property deploy/delivery_pipeline.
+
+       --region=REGION
+          Location of the job run.
+
+          To set the region attribute:
+          ▸ provide the argument job_run on the command line with a fully
+            specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property deploy/region.
+
+       --release=RELEASE
+          The name of the Cloud Deploy release.
+
+          To set the release attribute:
+          ▸ provide the argument job_run on the command line with a fully
+            specified name;
+          ▸ provide the argument --release on the command line.
+
+       --rollout=ROLLOUT
+          The name of the Cloud Deploy rollout.
+
+          To set the rollout attribute:
+          ▸ provide the argument job_run on the command line with a fully
+            specified name;
+          ▸ provide the argument --rollout on the command line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the clouddeploy/v1 API. The full documentation for this
+    API can be found at: https://cloud.google.com/deploy/
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. These variants are also available:
+
+        $ gcloud deploy job-runs describe
+
+        $ gcloud beta deploy job-runs describe
+
diff --git a/gcloud/alpha/deploy/job-runs/help b/gcloud/alpha/deploy/job-runs/help
new file mode 100644
index 000000000..d8cec84be
--- /dev/null
+++ b/gcloud/alpha/deploy/job-runs/help
@@ -0,0 +1,34 @@
+NAME
+    gcloud alpha deploy job-runs - manages job runs resources for Google Cloud
+        Deploy
+
+SYNOPSIS
+    gcloud alpha deploy job-runs COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Manages job runs resources for Google Cloud Deploy.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     describe
+        (ALPHA) Show details for a job run.
+
+     list
+        (ALPHA) List the job runs.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. These variants are also available:
+
+        $ gcloud deploy job-runs
+
+        $ gcloud beta deploy job-runs
+
diff --git a/gcloud/alpha/deploy/job-runs/list b/gcloud/alpha/deploy/job-runs/list
new file mode 100644
index 000000000..6d7b3c6b5
--- /dev/null
+++ b/gcloud/alpha/deploy/job-runs/list
@@ -0,0 +1,121 @@
+NAME
+    gcloud alpha deploy job-runs list - list the job runs
+
+SYNOPSIS
+    gcloud alpha deploy job-runs list
+        (--rollout=ROLLOUT : --delivery-pipeline=DELIVERY_PIPELINE
+          --region=REGION --release=RELEASE) [--filter=EXPRESSION]
+        [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) List the job runs for a specified delivery pipeline.
+
+EXAMPLES
+    To list the job runs for delivery pipeline 'test-pipeline', release
+    'test-release', and rollout 'test-rollout' in region 'us-central1', run:
+
+        $ gcloud alpha deploy job-runs list \
+            --delivery-pipeline=test-pipeline --release=test-release \
+            --rollout=test-rollout --region=us-central1
+
+REQUIRED FLAGS
+     Rollout resource - The rollouts for which you want to list the job runs.
+     The arguments in this group can be used to specify the attributes of this
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways. To set the project attribute:
+      ◆ provide the argument --rollout on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       --rollout=ROLLOUT
+          ID of the rollout or fully qualified identifier for the rollout. To
+          set the rollout attribute:
+          ▸ provide the argument --rollout on the command line.
+
+          This flag argument must be specified if any of the other arguments in
+          this group are specified.
+
+       --delivery-pipeline=DELIVERY_PIPELINE
+          The name of the Cloud Deploy delivery pipeline.
+
+          To set the delivery-pipeline attribute:
+          ▸ provide the argument --rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --delivery-pipeline on the command line;
+          ▸ set the property deploy/delivery_pipeline.
+
+       --region=REGION
+          Location of the rollout.
+
+          To set the region attribute:
+          ▸ provide the argument --rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property deploy/region.
+
+       --release=RELEASE
+          The name of the Cloud Deploy release.
+
+          To set the release attribute:
+          ▸ provide the argument --rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --release on the command line.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the clouddeploy/v1 API. The full documentation for this
+    API can be found at: https://cloud.google.com/deploy/
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. These variants are also available:
+
+        $ gcloud deploy job-runs list
+
+        $ gcloud beta deploy job-runs list
+
diff --git a/gcloud/alpha/deploy/rollouts/help b/gcloud/alpha/deploy/rollouts/help
index fd9a22259..414931745 100644
--- a/gcloud/alpha/deploy/rollouts/help
+++ b/gcloud/alpha/deploy/rollouts/help
@@ -28,6 +28,9 @@ COMMANDS
      reject
         (ALPHA) Rejects a rollout having an Approval state of "Required".
 
+     retry-job
+        (ALPHA) Retries a specified job, phase combination on a rollout.
+
 NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
diff --git a/gcloud/alpha/deploy/rollouts/retry-job b/gcloud/alpha/deploy/rollouts/retry-job
new file mode 100644
index 000000000..3bf11ef68
--- /dev/null
+++ b/gcloud/alpha/deploy/rollouts/retry-job
@@ -0,0 +1,92 @@
+NAME
+    gcloud alpha deploy rollouts retry-job - retries a specified job, phase
+        combination on a rollout
+
+SYNOPSIS
+    gcloud alpha deploy rollouts retry-job
+        (ROLLOUT : --delivery-pipeline=DELIVERY_PIPELINE
+          --region=REGION --release=RELEASE) --job-id=JOB_ID
+        --phase-id=PHASE_ID [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Retries a specified job, phase combination on a rollout.
+
+EXAMPLES
+    To retry a job 'test-job' in phase 'test-phase' on a rollout 'test-rollout'
+    for delivery pipeline 'test-pipeline', release 'test-release' in region
+    'us-central1', run:
+
+        $ gcloud alpha deploy rollouts retry-job test-rollout \
+             --job-id=test-job --phase-id=test-phase \
+             --delivery-pipeline=test-pipeline --release=test-release \
+             --region=us-central1
+
+POSITIONAL ARGUMENTS
+     Rollout resource - The name of the Rollout. The arguments in this group
+     can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways. To set the project attribute:
+      ◆ provide the argument rollout on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       ROLLOUT
+          ID of the rollout or fully qualified identifier for the rollout. To
+          set the rollout attribute:
+          ▸ provide the argument rollout on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --delivery-pipeline=DELIVERY_PIPELINE
+          The delivery pipeline associated with the rollout. Alternatively, set
+          the property [deploy/delivery-pipeline]. To set the delivery-pipeline
+          attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --delivery-pipeline on the command line;
+          ▸ set the property deploy/delivery_pipeline.
+
+       --region=REGION
+          The Cloud region for the rollout. Alternatively, set the property
+          [deploy/region]. To set the region attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property deploy/region.
+
+       --release=RELEASE
+          The release associated with the rollout. To set the release
+          attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --release on the command line.
+
+REQUIRED FLAGS
+     --job-id=JOB_ID
+        Job ID on a rollout resource
+
+     --phase-id=PHASE_ID
+        Phase ID on a rollout resource
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. These variants are also available:
+
+        $ gcloud deploy rollouts retry-job
+
+        $ gcloud beta deploy rollouts retry-job
+
diff --git a/gcloud/alpha/deploy/targets/help b/gcloud/alpha/deploy/targets/help
index c7dd494d6..9e307069f 100644
--- a/gcloud/alpha/deploy/targets/help
+++ b/gcloud/alpha/deploy/targets/help
@@ -35,6 +35,9 @@ COMMANDS
      list
         (ALPHA) List Cloud Deploy targets.
 
+     redeploy
+        (ALPHA) Redeploy the last rollout to a target.
+
      remove-iam-policy-binding
         (ALPHA) Remove an IAM policy binding for a Cloud Deploy target.
 
diff --git a/gcloud/alpha/deploy/targets/redeploy b/gcloud/alpha/deploy/targets/redeploy
new file mode 100644
index 000000000..8a036bf7f
--- /dev/null
+++ b/gcloud/alpha/deploy/targets/redeploy
@@ -0,0 +1,101 @@
+NAME
+    gcloud alpha deploy targets redeploy - redeploy the last rollout to a
+        target
+
+SYNOPSIS
+    gcloud alpha deploy targets redeploy (TARGET : --region=REGION)
+        --delivery-pipeline=DELIVERY_PIPELINE [--annotations=[KEY=VALUE,...]]
+        [--description=DESCRIPTION] [--labels=[KEY=VALUE,...]]
+        [--rollout-id=ROLLOUT_ID] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Redeploy the last rollout that has a state of SUCCESSFUL or FAILED
+    to a target. If rollout-id is not specified, a rollout ID will be
+    generated.
+
+EXAMPLES
+    To redeploy a target prod for delivery pipeline test-pipeline in region
+    us-central1, run:
+
+        $ gcloud alpha deploy targets redeploy prod \
+            --delivery-pipeline=test-pipeline --region=us-central1
+
+POSITIONAL ARGUMENTS
+     Target resource - The name of the Target. The arguments in this group can
+     be used to specify the attributes of this resource. (NOTE) Some attributes
+     are not given arguments in this group but can be set in other ways. To set
+     the project attribute:
+      ◆ provide the argument target on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       TARGET
+          ID of the target or fully qualified identifier for the target. To set
+          the target attribute:
+          ▸ provide the argument target on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --region=REGION
+          The Cloud region for the target. Alternatively, set the property
+          [deploy/region]. To set the region attribute:
+          ▸ provide the argument target on the command line with a fully
+            specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property deploy/region.
+
+REQUIRED FLAGS
+     --delivery-pipeline=DELIVERY_PIPELINE
+        The name of the Cloud Deploy delivery pipeline
+
+OPTIONAL FLAGS
+     --annotations=[KEY=VALUE,...]
+        Annotations to apply to the rollout. Annotations take the form of
+        key/value string pairs.
+
+        Examples:
+
+        Add annotations:
+
+            $ gcloud alpha deploy targets redeploy \
+                --annotations="from_target=test,status=stable"
+
+     --description=DESCRIPTION
+        Description of rollout created during a rollback.
+
+     --labels=[KEY=VALUE,...]
+        Labels to apply to the rollout. Labels take the form of key/value
+        string pairs.
+
+        Examples:
+
+        Add labels:
+
+            $ gcloud alpha deploy targets redeploy \
+                --labels="commit=abc123,author=foo"
+
+     --rollout-id=ROLLOUT_ID
+        ID to assign to the generated rollout for promotion.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. These variants are also available:
+
+        $ gcloud deploy targets redeploy
+
+        $ gcloud beta deploy targets redeploy
+
diff --git a/gcloud/alpha/ids/endpoints/create b/gcloud/alpha/ids/endpoints/create
index c3f44fa23..14000da08 100644
--- a/gcloud/alpha/ids/endpoints/create
+++ b/gcloud/alpha/ids/endpoints/create
@@ -6,7 +6,7 @@ SYNOPSIS
         --network=NETWORK --severity=SEVERITY [--async]
         [--description=DESCRIPTION] [--enable-traffic-logs]
         [--labels=[KEY=VALUE,...]] [--max-wait=MAX_WAIT; default="60m"]
-        [GCLOUD_WIDE_FLAG ...]
+        [--threat-exceptions=[exc1,exc2,...,...]] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) Create an endpoint for the specified VPC network. Successful
@@ -22,6 +22,14 @@ EXAMPLES
         $ gcloud alpha ids endpoints create my-endpoint --network=my-net \
             --zone=us-central1-a --project=my-project --severity=LOW
 
+    To create an endpoint called my-endpoint for VPC network my-net, in zone
+    us-central1-a, alerting on LOW threats or higher, excluding threat IDs 1000
+    and 2000, run:
+
+        $ gcloud alpha ids endpoints create my-endpoint --network=my-net \
+            --zone=us-central1-a --project=my-project --severity=LOW \
+            --threat-exceptions=1000,2000
+
 POSITIONAL ARGUMENTS
      Endpoint resource - endpoint. The arguments in this group can be used to
      specify the attributes of this resource. (NOTE) Some attributes are not
@@ -43,17 +51,17 @@ POSITIONAL ARGUMENTS
           arguments in this group are specified.
 
        --zone=ZONE
-          The zone of the endpoint. To set the zone attribute:
+          Zone of the endpoint. To set the zone attribute:
           ▸ provide the argument endpoint on the command line with a fully
             specified name;
           ▸ provide the argument --zone on the command line.
 
 REQUIRED FLAGS
      --network=NETWORK
-        The name of the VPC network to monitor
+        Name of the VPC network to monitor
 
      --severity=SEVERITY
-        The minimum severity of threats to report on. SEVERITY must be one of:
+        Minimum severity of threats to report on. SEVERITY must be one of:
         INFORMATIONAL, LOW, MEDIUM, HIGH, CRITICAL.
 
 OPTIONAL FLAGS
@@ -84,6 +92,10 @@ OPTIONAL FLAGS
         specified. See $ gcloud topic datetimes for information on time
         formats.
 
+     --threat-exceptions=[exc1,exc2,...,...]
+        List of threat IDs to be excepted from alerting. Passing empty list
+        clears the exceptions.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/alpha/ids/endpoints/delete b/gcloud/alpha/ids/endpoints/delete
index 030ba2af6..f29c422f7 100644
--- a/gcloud/alpha/ids/endpoints/delete
+++ b/gcloud/alpha/ids/endpoints/delete
@@ -41,7 +41,7 @@ POSITIONAL ARGUMENTS
           arguments in this group are specified.
 
        --zone=ZONE
-          The zone of the endpoint. To set the zone attribute:
+          Zone of the endpoint. To set the zone attribute:
           ▸ provide the argument endpoint on the command line with a fully
             specified name;
           ▸ provide the argument --zone on the command line.
diff --git a/gcloud/alpha/ids/endpoints/describe b/gcloud/alpha/ids/endpoints/describe
index ee334d65a..bac7b8c26 100644
--- a/gcloud/alpha/ids/endpoints/describe
+++ b/gcloud/alpha/ids/endpoints/describe
@@ -41,7 +41,7 @@ POSITIONAL ARGUMENTS
           arguments in this group are specified.
 
        --zone=ZONE
-          The zone of the endpoint. To set the zone attribute:
+          Zone of the endpoint. To set the zone attribute:
           ▸ provide the argument endpoint on the command line with a fully
             specified name;
           ▸ provide the argument --zone on the command line.
diff --git a/gcloud/alpha/ids/endpoints/help b/gcloud/alpha/ids/endpoints/help
index 4fb79e83a..e53709568 100644
--- a/gcloud/alpha/ids/endpoints/help
+++ b/gcloud/alpha/ids/endpoints/help
@@ -32,6 +32,9 @@ COMMANDS
      list
         (ALPHA) List Cloud IDS endpoints.
 
+     update
+        (ALPHA) Update an existing Cloud IDS endpoint.
+
 NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
diff --git a/gcloud/alpha/ids/endpoints/update b/gcloud/alpha/ids/endpoints/update
new file mode 100644
index 000000000..f1df850ff
--- /dev/null
+++ b/gcloud/alpha/ids/endpoints/update
@@ -0,0 +1,82 @@
+NAME
+    gcloud alpha ids endpoints update - update an existing Cloud IDS endpoint
+
+SYNOPSIS
+    gcloud alpha ids endpoints update (ENDPOINT : --zone=ZONE) [--async]
+        [--max-wait=MAX_WAIT; default="60m"]
+        [--threat-exceptions=[exc1,exc2,...,...]] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Update the endpoint for the specified VPC network. Check the
+    progress of endpoint update by using gcloud alpha ids endpoints list.
+
+    For more examples, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To update an endpoint called my-endpoint, excluding threat IDs 1000 and
+    2000, run:
+
+        $ gcloud alpha ids endpoints update my-endpoint \
+            --threat-exceptions=1000,2000
+
+    To update an endpoint called my-endpoint, clearing the excluded threat
+    list, run:
+
+        $ gcloud alpha ids endpoints update my-endpoint --threat-exceptions=
+
+POSITIONAL ARGUMENTS
+     Endpoint resource - endpoint. The arguments in this group can be used to
+     specify the attributes of this resource. (NOTE) Some attributes are not
+     given arguments in this group but can be set in other ways. To set the
+     project attribute:
+      ◆ provide the argument endpoint on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       ENDPOINT
+          ID of the endpoint or fully qualified identifier for the endpoint. To
+          set the endpoint attribute:
+          ▸ provide the argument endpoint on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --zone=ZONE
+          Zone of the endpoint. To set the zone attribute:
+          ▸ provide the argument endpoint on the command line with a fully
+            specified name;
+          ▸ provide the argument --zone on the command line.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete. The default is True. Enabled by default, use --no-async to
+        disable.
+
+     --max-wait=MAX_WAIT; default="60m"
+        Time to synchronously wait for the operation to complete, after which
+        the operation continues asynchronously. Ignored if --no-async isn't
+        specified. See $ gcloud topic datetimes for information on time
+        formats.
+
+     --threat-exceptions=[exc1,exc2,...,...]
+        List of threat IDs to be excepted from alerting. Passing empty list
+        clears the exceptions.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/ids/operations/cancel b/gcloud/alpha/ids/operations/cancel
index e7d1f0900..3a7475deb 100644
--- a/gcloud/alpha/ids/operations/cancel
+++ b/gcloud/alpha/ids/operations/cancel
@@ -42,7 +42,7 @@ POSITIONAL ARGUMENTS
           arguments in this group are specified.
 
        --zone=ZONE
-          The zone of the operation. To set the zone attribute:
+          Zone of the operation. To set the zone attribute:
           ▸ provide the argument operation on the command line with a fully
             specified name;
           ▸ provide the argument --zone on the command line.
diff --git a/gcloud/alpha/ids/operations/describe b/gcloud/alpha/ids/operations/describe
index 29529e639..c43f1e1f8 100644
--- a/gcloud/alpha/ids/operations/describe
+++ b/gcloud/alpha/ids/operations/describe
@@ -42,7 +42,7 @@ POSITIONAL ARGUMENTS
           arguments in this group are specified.
 
        --zone=ZONE
-          The zone of the operation. To set the zone attribute:
+          Zone of the operation. To set the zone attribute:
           ▸ provide the argument operation on the command line with a fully
             specified name;
           ▸ provide the argument --zone on the command line.
diff --git a/gcloud/alpha/ids/operations/wait b/gcloud/alpha/ids/operations/wait
index e83439050..4756af04b 100644
--- a/gcloud/alpha/ids/operations/wait
+++ b/gcloud/alpha/ids/operations/wait
@@ -43,7 +43,7 @@ POSITIONAL ARGUMENTS
           arguments in this group are specified.
 
        --zone=ZONE
-          The zone of the operation. To set the zone attribute:
+          Zone of the operation. To set the zone attribute:
           ▸ provide the argument operation on the command line with a fully
             specified name;
           ▸ provide the argument --zone on the command line.
diff --git a/gcloud/alpha/run/integrations/create b/gcloud/alpha/run/integrations/create
index c51f49f50..27f708c87 100644
--- a/gcloud/alpha/run/integrations/create
+++ b/gcloud/alpha/run/integrations/create
@@ -17,8 +17,8 @@ EXAMPLES
 
     To attach a custom domain to a Cloud Run service
 
-        $ gcloud alpha run integrations create --type=custom-domain \
-          --service=myservice --parameters=domain=mydomain.com
+        $ gcloud alpha run integrations create --type=domain-routing \
+          --parameters='set-mapping=example.com/*:myservice'
 
 REQUIRED FLAGS
      --type=TYPE
diff --git a/gcloud/alpha/run/integrations/types/describe b/gcloud/alpha/run/integrations/types/describe
index 7d6fce443..92379d9e0 100644
--- a/gcloud/alpha/run/integrations/types/describe
+++ b/gcloud/alpha/run/integrations/types/describe
@@ -1,13 +1,13 @@
 NAME
     gcloud alpha run integrations types describe - describes a Cloud Run
-        Integration
+        Integration type
 
 SYNOPSIS
     gcloud alpha run integrations types describe TYPE [--region=REGION]
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) Describes a Cloud Run Integration.
+    (ALPHA) Describes a Cloud Run Integration type.
 
 EXAMPLES
     To describe an integration type
diff --git a/gcloud/alpha/run/integrations/types/help b/gcloud/alpha/run/integrations/types/help
index fbbfea798..0e26b7e27 100644
--- a/gcloud/alpha/run/integrations/types/help
+++ b/gcloud/alpha/run/integrations/types/help
@@ -29,7 +29,7 @@ COMMANDS
     COMMAND is one of the following:
 
      describe
-        (ALPHA) Describes a Cloud Run Integration.
+        (ALPHA) Describes a Cloud Run Integration type.
 
      list
         (ALPHA) Lists Cloud Run Integration Types.
diff --git a/gcloud/alpha/storage/buckets/create b/gcloud/alpha/storage/buckets/create
index f16d1bbf4..6decab510 100644
--- a/gcloud/alpha/storage/buckets/create
+++ b/gcloud/alpha/storage/buckets/create
@@ -7,7 +7,8 @@ SYNOPSIS
           -k DEFAULT_ENCRYPTION_KEY]
         [--default-storage-class=DEFAULT_STORAGE_CLASS,
           -c DEFAULT_STORAGE_CLASS, -s DEFAULT_STORAGE_CLASS]
-        [--location=LOCATION, -l LOCATION] [--pap, --public-access-prevention]
+        [--location=LOCATION, -l LOCATION]
+        [--[no-]pap, --[no-]public-access-prevention]
         [--retention-period=RETENTION_PERIOD]
         [--[no-]uniform-bucket-level-access, -b] [GCLOUD_WIDE_FLAG ...]
 
@@ -47,10 +48,12 @@ FLAGS
         bucket. If not specified, the location used by Cloud Storage is us. A
         bucket's location cannot be changed after creation.
 
-     --pap, --public-access-prevention
+     --[no-]pap, --[no-]public-access-prevention
         Sets public access prevention to "enforced". For details on how exactly
         public access is blocked, see:
-        http://cloud/storage/docs/public-access-prevention
+        http://cloud/storage/docs/public-access-prevention. Use
+        --public-access-prevention to enable and --no-public-access-prevention
+        to disable.
 
      --retention-period=RETENTION_PERIOD
         Minimum retention period
@@ -78,5 +81,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud storage buckets create
 
diff --git a/gcloud/alpha/storage/buckets/delete b/gcloud/alpha/storage/buckets/delete
index b3540662c..5bb05dceb 100644
--- a/gcloud/alpha/storage/buckets/delete
+++ b/gcloud/alpha/storage/buckets/delete
@@ -11,11 +11,11 @@ DESCRIPTION
 EXAMPLES
     Delete a Google Cloud Storage bucket named "my-bucket":
 
-        $ *gcloud alpha storage buckets delete* gs://my-bucket
+        $ gcloud alpha storage buckets delete gs://my-bucket
 
     Delete two buckets:
 
-        $ *gcloud alpha storage buckets delete* gs://my-bucket \
+        $ gcloud alpha storage buckets delete gs://my-bucket \
             gs://my-other-bucket
 
 POSITIONAL ARGUMENTS
@@ -41,5 +41,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud storage buckets delete
 
diff --git a/gcloud/alpha/storage/buckets/describe b/gcloud/alpha/storage/buckets/describe
index 5a1c10b79..6660c3aaa 100644
--- a/gcloud/alpha/storage/buckets/describe
+++ b/gcloud/alpha/storage/buckets/describe
@@ -33,5 +33,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud storage buckets describe
 
diff --git a/gcloud/alpha/storage/buckets/help b/gcloud/alpha/storage/buckets/help
index 0c0e95643..f4179ddf0 100644
--- a/gcloud/alpha/storage/buckets/help
+++ b/gcloud/alpha/storage/buckets/help
@@ -12,6 +12,12 @@ GCLOUD WIDE FLAGS
 
     Run $ gcloud help for details.
 
+GROUPS
+    GROUP is one of the following:
+
+     notifications
+        (ALPHA) Manage Cloud Storage bucket notifications.
+
 COMMANDS
     COMMAND is one of the following:
 
@@ -34,5 +40,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud storage buckets
 
diff --git a/gcloud/alpha/storage/buckets/list b/gcloud/alpha/storage/buckets/list
index 08d363150..a6540b5e7 100644
--- a/gcloud/alpha/storage/buckets/list
+++ b/gcloud/alpha/storage/buckets/list
@@ -70,5 +70,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud storage buckets list
 
diff --git a/gcloud/alpha/storage/buckets/notifications/create b/gcloud/alpha/storage/buckets/notifications/create
new file mode 100644
index 000000000..002ca2f11
--- /dev/null
+++ b/gcloud/alpha/storage/buckets/notifications/create
@@ -0,0 +1,142 @@
+NAME
+    gcloud alpha storage buckets notifications create - create a notification
+        configuration on a bucket
+
+SYNOPSIS
+    gcloud alpha storage buckets notifications create URL
+        [--custom-attributes=[KEY=VALUE,...], -m [KEY=VALUE,...]]
+        [--event-types=[NOTIFICATION_EVENT_TYPE,...],
+          -e [NOTIFICATION_EVENT_TYPE,...]]
+        [--object-prefix=OBJECT_PREFIX, -p OBJECT_PREFIX]
+        [--payload-format=PAYLOAD_FORMAT, -f PAYLOAD_FORMAT; default="json"]
+        [--skip-topic-setup, -s] [--topic=TOPIC, -t TOPIC]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) gcloud alpha storage buckets notifications create creates a
+    notification configuration on a bucket, establishing a flow of event
+    notifications from Cloud Storage to a Cloud Pub/Sub topic. As part of
+    creating this flow, it also verifies that the destination Cloud Pub/Sub
+    topic exists, creating it if necessary, and verifies that the Cloud Storage
+    bucket has permission to publish events to that topic, granting the
+    permission if necessary.
+
+    If a destination Cloud Pub/Sub topic is not specified with the -t flag,
+    Cloud Storage chooses a topic name in the default project whose ID is the
+    same as the bucket name. For example, if the default project ID specified
+    is default-project and the bucket being configured is gs://example-bucket,
+    the create command uses the Cloud Pub/Sub topic
+    projects/default-project/topics/example-bucket.
+
+    In order to enable notifications, your project's [Cloud Storage service
+    agent] (https://cloud.google.com/storage/docs/projects#service-accounts)
+    must have the IAM permission "pubsub.topics.publish". This command checks
+    to see if the destination Cloud Pub/Sub topic grants the service agent this
+    permission. If not, the create command attempts to grant it.
+
+    A bucket can have up to 100 total notification configurations and up to 10
+    notification configurations set to trigger for a specific event.
+
+EXAMPLES
+    Send notifications of all changes to the bucket example-bucket to the Cloud
+    Pub/Sub topic projects/default-project/topics/example-bucket:
+
+        $ gcloud alpha storage buckets notifications create \
+            gs://example-bucket
+
+    The same as the above but sends no notification payload:
+
+        $ gcloud alpha storage buckets notifications create \
+            --payload-format=none gs://example-bucket
+
+    Include custom metadata in notification payloads:
+
+        $ gcloud alpha storage buckets notifications create \
+            --custom-attributes=key1:value1,key2:value2 gs://example-bucket
+
+    Create a notification configuration that only sends an event when a new
+    object has been created or an object is deleted:
+
+        $ gcloud alpha storage buckets notifications create \
+            --event-types=OBJECT_FINALIZE,OBJECT_DELETE gs://example-bucket
+
+    Create a topic and notification configuration that sends events only when
+    they affect objects with the prefix photos/:
+
+        $ gcloud alpha storage buckets notifications create \
+            --object-prefix=photos/ gs://example-bucket
+
+    Specifies the destination topic ID files-to-process in the default project:
+
+        $ gcloud alpha storage buckets notifications create \
+            --topic=files-to-process gs://example-bucket
+
+    The same as above but specifies a Cloud Pub/Sub topic belonging to the
+    specific cloud project example-project:
+
+        $ gcloud alpha storage buckets notifications create \
+            --topic=projects/example-project/topics/files-to-process \
+            gs://example-bucket
+
+    Skip creating a topic when creating the notification configuraiton:
+
+        $ gcloud alpha storage buckets notifications create \
+            --skip-topic-setup gs://example-bucket
+
+POSITIONAL ARGUMENTS
+     URL
+        URL of the bucket to create the notification configuration on.
+
+FLAGS
+     --custom-attributes=[KEY=VALUE,...], -m [KEY=VALUE,...]
+        Specifies key:value attributes that are appended to the set of
+        attributes sent to Cloud Pub/Sub for all events associated with this
+        notification configuration.
+
+     --event-types=[NOTIFICATION_EVENT_TYPE,...], -e [NOTIFICATION_EVENT_TYPE,...]
+        Specify event type filters for this notification configuration. Cloud
+        Storage will send notifications of only these types. By default, Cloud
+        Storage sends notifications for all event types. * OBJECT_FINALIZE: An
+        object has been created. * OBJECT_METADATA_UPDATE: The metadata of an
+        object has changed. * OBJECT_DELETE: An object has been permanently
+        deleted. * OBJECT_ARCHIVE: A live version of an object has become a
+        noncurrent version. NOTIFICATION_EVENT_TYPE must be one of:
+        OBJECT_ARCHIVE, OBJECT_DELETE, OBJECT_FINALIZE, OBJECT_METADATA_UPDATE.
+
+     --object-prefix=OBJECT_PREFIX, -p OBJECT_PREFIX
+        Specifies a prefix path for this notification configuration. Cloud
+        Storage will send notifications for only objects in the bucket whose
+        names begin with the prefix.
+
+     --payload-format=PAYLOAD_FORMAT, -f PAYLOAD_FORMAT; default="json"
+        Specifies the payload format of notification messages. Notification
+        details are available in the message attributes. 'none' sends no
+        payload. PAYLOAD_FORMAT must be one of: json, none.
+
+     --skip-topic-setup, -s
+        Skips creation and permission assignment of the Cloud Pub/Sub topic.
+        This is useful if the caller does not have permission to access the
+        topic in question, or if the topic already exists and has the
+        appropriate publish permission assigned.
+
+     --topic=TOPIC, -t TOPIC
+        Specifies the Cloud Pub/Sub topic to send notifications to. If not
+        specified, this command chooses a topic whose project is your default
+        project and whose ID is the same as the Cloud Storage bucket name.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. This variant is also available:
+
+        $ gcloud storage buckets notifications create
+
diff --git a/gcloud/alpha/storage/buckets/notifications/delete b/gcloud/alpha/storage/buckets/notifications/delete
new file mode 100644
index 000000000..739edbd6e
--- /dev/null
+++ b/gcloud/alpha/storage/buckets/notifications/delete
@@ -0,0 +1,51 @@
+NAME
+    gcloud alpha storage buckets notifications delete - delete notification
+        configurations from a bucket
+
+SYNOPSIS
+    gcloud alpha storage buckets notifications delete URLS [URLS ...]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) gcloud alpha storage buckets notifications delete deletes
+    notification configurations from a bucket. If a notification configuration
+    name is passed as a parameter, that configuration alone is deleted. If a
+    bucket name is passed, all notification configurations associated with the
+    bucket are deleted.
+
+    Cloud Pub/Sub topics associated with this notification configuration are
+    not deleted by this command. Those must be deleted separately, for example
+    with the command "gcloud pubsub topics delete".
+
+EXAMPLES
+    Delete a single notification configuration (with ID 3) in the bucket
+    example-bucket:
+
+        $ gcloud alpha storage buckets notifications delete \
+            b/example-bucket/notificationConfigs/3
+
+    Delete all notification configurations in the bucket example-bucket:
+
+        $ gcloud alpha storage buckets notifications delete \
+            gs://example-bucket
+
+POSITIONAL ARGUMENTS
+     URLS [URLS ...]
+        Specifies notification configuration names or buckets.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. This variant is also available:
+
+        $ gcloud storage buckets notifications delete
+
diff --git a/gcloud/alpha/storage/buckets/notifications/describe b/gcloud/alpha/storage/buckets/notifications/describe
new file mode 100644
index 000000000..4b6d8cd3e
--- /dev/null
+++ b/gcloud/alpha/storage/buckets/notifications/describe
@@ -0,0 +1,39 @@
+NAME
+    gcloud alpha storage buckets notifications describe - show metadata for a
+        notification configuration
+
+SYNOPSIS
+    gcloud alpha storage buckets notifications describe URL
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) gcloud alpha storage buckets notifications describe prints
+    populated metadata for a notification configuration.
+
+EXAMPLES
+    Describe a single notification configuration (with ID 3) in the bucket
+    example-bucket:
+
+        $ gcloud alpha storage buckets notifications describe \
+            b/example-bucket/notificationConfigs/3
+
+POSITIONAL ARGUMENTS
+     URL
+        The url of the notification configuration
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. This variant is also available:
+
+        $ gcloud storage buckets notifications describe
+
diff --git a/gcloud/alpha/storage/buckets/notifications/help b/gcloud/alpha/storage/buckets/notifications/help
new file mode 100644
index 000000000..c2ff1ab75
--- /dev/null
+++ b/gcloud/alpha/storage/buckets/notifications/help
@@ -0,0 +1,39 @@
+NAME
+    gcloud alpha storage buckets notifications - manage Cloud Storage bucket
+        notifications
+
+SYNOPSIS
+    gcloud alpha storage buckets notifications COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Manage Cloud Storage bucket notifications.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     create
+        (ALPHA) Create a notification configuration on a bucket.
+
+     delete
+        (ALPHA) Delete notification configurations from a bucket.
+
+     describe
+        (ALPHA) Show metadata for a notification configuration.
+
+     list
+        (ALPHA) List the notification configurations belonging to a given
+        bucket.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. This variant is also available:
+
+        $ gcloud storage buckets notifications
+
diff --git a/gcloud/alpha/storage/buckets/notifications/list b/gcloud/alpha/storage/buckets/notifications/list
new file mode 100644
index 000000000..7f1743c71
--- /dev/null
+++ b/gcloud/alpha/storage/buckets/notifications/list
@@ -0,0 +1,81 @@
+NAME
+    gcloud alpha storage buckets notifications list - list the notification
+        configurations belonging to a given bucket
+
+SYNOPSIS
+    gcloud alpha storage buckets notifications list [URLS ...]
+        [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
+        [--sort-by=[FIELD,...]] [--uri] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) gcloud alpha storage buckets notifications list provides a list of
+    notification configurations belonging to a given bucket. The listed name of
+    each configuration can be used with the delete sub-command to delete that
+    specific notification config.
+
+EXAMPLES
+    Fetch the list of notification configs for the bucket example-bucket:
+
+        $ gcloud alpha storage buckets notifications list gs://example-bucket
+
+    Fetch the notification configs in all buckets matching a wildcard:
+
+        $ gcloud alpha storage buckets notifications list gs://example-*
+
+    Fetch all of the notification configs for buckets in the default project:
+
+        $ gcloud alpha storage buckets notifications list
+
+POSITIONAL ARGUMENTS
+     [URLS ...]
+        Google Cloud Storage bucket paths. The path must begin with gs:// and
+        may contain wildcard characters.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. This variant is also available:
+
+        $ gcloud storage buckets notifications list
+
diff --git a/gcloud/alpha/storage/buckets/update b/gcloud/alpha/storage/buckets/update
index 79776dfbd..977327d41 100644
--- a/gcloud/alpha/storage/buckets/update
+++ b/gcloud/alpha/storage/buckets/update
@@ -2,26 +2,26 @@ NAME
     gcloud alpha storage buckets update - update bucket settings
 
 SYNOPSIS
-    gcloud alpha storage buckets update URL [URL ...] [--clear-cors]
-        [--clear-default-encryption-key] [--clear-lifecycle]
-        [--clear-log-bucket] [--clear-log-object-prefix]
-        [--clear-pap, --clear-public-access-prevention]
-        [--clear-retention-period] [--clear-web-error-page]
-        [--clear-web-main-page-suffix] [--continue-on-error, -c]
-        [--cors-file=CORS_FILE]
-        [--default-encryption-key=DEFAULT_ENCRYPTION_KEY]
+    gcloud alpha storage buckets update URL [URL ...] [--continue-on-error, -c]
         [--[no-]default-event-based-hold]
         [--default-storage-class=DEFAULT_STORAGE_CLASS]
-        [--lifecycle-file=LIFECYCLE_FILE] [--[no-]lock-retention-period]
-        [--log-bucket=LOG_BUCKET] [--log-object-prefix=LOG_OBJECT_PREFIX]
-        [--[no-]pap, --[no-]public-access-prevention] [--[no-]requester-pays]
-        [--retention-period=RETENTION_PERIOD]
+        [--[no-]lock-retention-period] [--[no-]requester-pays]
         [--[no-]uniform-bucket-level-access] [--[no-]versioning]
-        [--web-error-page=WEB_ERROR_PAGE]
-        [--web-main-page-suffix=WEB_MAIN_PAGE_SUFFIX]
+        [--clear-cors | --cors-file=CORS_FILE]
+        [--clear-default-encryption-key
+          | --default-encryption-key=DEFAULT_ENCRYPTION_KEY]
         [--clear-labels | --labels-file=LABELS_FILE
           | --remove-labels=[LABEL_KEYS,...]
-          --update-labels=[LABEL_KEYS_AND_VALUES,...]] [GCLOUD_WIDE_FLAG ...]
+          --update-labels=[LABEL_KEYS_AND_VALUES,...]]
+        [--clear-lifecycle | --lifecycle-file=LIFECYCLE_FILE]
+        [--clear-log-bucket | --log-bucket=LOG_BUCKET]
+        [--clear-log-object-prefix | --log-object-prefix=LOG_OBJECT_PREFIX]
+        [--clear-pap, --clear-public-access-prevention
+          | --[no-]pap, --[no-]public-access-prevention]
+        [--clear-retention-period | --retention-period=RETENTION_PERIOD]
+        [--clear-web-error-page | --web-error-page=WEB_ERROR_PAGE]
+        [--clear-web-main-page-suffix
+          | --web-main-page-suffix=WEB_MAIN_PAGE_SUFFIX] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) Update a bucket.
@@ -40,63 +40,15 @@ EXAMPLES
 
 POSITIONAL ARGUMENTS
      URL [URL ...]
-        The URLs of the buckets to update.
+        URLs of the buckets to update.
 
 FLAGS
-     --clear-cors
-        Clears the bucket's CORS settings.
-
-     --clear-default-encryption-key
-        Clears the bucket's default encryption key.
-
-     --clear-lifecycle
-        Removes all lifecycle configuration for the bucket.
-
-     --clear-log-bucket
-        Clears logging bucket receiving the usage current bucket's data.
-
-     --clear-log-object-prefix
-        Clears prefix used to determine what usage data to send to logging
-        bucket.
-
-     --clear-pap, --clear-public-access-prevention
-        Unsets the public access prevention setting on a bucket.
-
-     --clear-retention-period
-        Clears the object retention period for a bucket.
-
-     --clear-web-error-page
-        Clear website error page if bucket is hosting website.
-
-     --clear-web-main-page-suffix
-        Clear website main page suffix if bucket is hosting website.
-
      --continue-on-error, -c
         If any operations are unsuccessful, the command will exit with a
         non-zero exit status after completing the remaining operations. This
         flag takes effect only in sequential execution mode (i.e. processor and
         thread count are set to 1). Parallelism is default.
 
-     --cors-file=CORS_FILE
-        Sets the Cross-Origin Resource Sharing (CORS) configuration on a
-        bucket. An example CORS JSON document looks like the following:
-
-            [
-              {
-                "origin": ["http://origin1.example.com"],
-                "responseHeader": ["Content-Type"],
-                "method": ["GET"],
-                "maxAgeSeconds": 3600
-              }
-            ]
-
-        For more information about supported endpoints for CORS, see [Cloud
-        Storage CORS support]
-        (https://cloud.google.com/storage/docs/cross-origin#server-side-support).
-
-     --default-encryption-key=DEFAULT_ENCRYPTION_KEY
-        Set the default KMS key for the bucket.
-
      --[no-]default-event-based-hold
         Sets the default value for an event-based hold on the bucket. By
         setting the default event-based hold on a bucket, newly-created objects
@@ -107,22 +59,6 @@ FLAGS
      --default-storage-class=DEFAULT_STORAGE_CLASS
         Sets the default storage class for the bucket.
 
-     --lifecycle-file=LIFECYCLE_FILE
-        Sets the lifecycle management configuration on a bucket. For example,
-        The following lifecycle management configuration JSON document
-        specifies that all objects in this bucket that are more than 365 days
-        old are deleted automatically:
-
-            {
-              "rule":
-              [
-                {
-                  "action": {"type": "Delete"},
-                  "condition": {"age": 365}
-                }
-              ]
-            }
-
      --[no-]lock-retention-period
         Locks an unlocked retention policy on the buckets. Caution: A locked
         retention policy cannot be removed from a bucket or reduced in
@@ -130,40 +66,11 @@ FLAGS
         a retention policy. Use --lock-retention-period to enable and
         --no-lock-retention-period to disable.
 
-     --log-bucket=LOG_BUCKET
-        Enables usage logging of the bucket, outputting log files to the
-        specified logging_bucket in this flag. Cloud Storage doesn't validate
-        the existence of the bucket receiving logs. In addition to enabling
-        logging on your bucket, you will also need to grant
-        cloud-storage-analytics@google.com write access to the log bucket.
-
-     --log-object-prefix=LOG_OBJECT_PREFIX
-        Specifies the object prefix for logging activity to the log bucket. The
-        default prefix is the bucket name. All read and write activity to
-        objects in the bucket will be logged for objects matching the prefix.
-
-     --[no-]pap, --[no-]public-access-prevention
-        If True, sets public access prevention to "enforced". If False, sets
-        public access prevention to "inherited". For details on how exactly
-        public access is blocked, see:
-        http://cloud/storage/docs/public-access-prevention. Use
-        --public-access-prevention to enable and --no-public-access-prevention
-        to disable.
-
      --[no-]requester-pays
         Allows you to configure a Cloud Storage bucket so that the requester
         pays all costs related to accessing the bucket and its objects. Use
         --requester-pays to enable and --no-requester-pays to disable.
 
-     --retention-period=RETENTION_PERIOD
-        Minimum retention period
-        (https://cloud.google.com/storage/docs/bucket-lock#retention-periods)
-        for objects stored in the bucket, for example
-        --retention-period=1Y1M1D5S. Objects added to the bucket cannot be
-        deleted until they've been stored for the specified length of time.
-        Default is no retention period. Only available for Cloud Storage using
-        the JSON API.
-
      --[no-]uniform-bucket-level-access
         Enables or disables uniform bucket-level access
         (https://cloud.google.com/storage/docs/bucket-policy-only) for the
@@ -174,17 +81,35 @@ FLAGS
         Allows you to configure a Cloud Storage bucket to keep old versions of
         objects. Use --versioning to enable and --no-versioning to disable.
 
-     --web-error-page=WEB_ERROR_PAGE
-        Cloud Storage allows you to configure a bucket to behave like a static
-        website. A subsequent GET bucket request through a custom domain for a
-        non-existent object serves the specified error page instead of the
-        standard Cloud Storage error.
+     At most one of these can be specified:
 
-     --web-main-page-suffix=WEB_MAIN_PAGE_SUFFIX
-        Cloud Storage allows you to configure a bucket to behave like a static
-        website. A subsequent GET bucket request through a custom domain serves
-        the specified "main" page instead of performing the usual bucket
-        listing.
+       --clear-cors
+          Clears the bucket's CORS settings.
+
+       --cors-file=CORS_FILE
+          Sets the Cross-Origin Resource Sharing (CORS) configuration on a
+          bucket. An example CORS JSON document looks like the following:
+
+              [
+                {
+                  "origin": ["http://origin1.example.com"],
+                  "responseHeader": ["Content-Type"],
+                  "method": ["GET"],
+                  "maxAgeSeconds": 3600
+                }
+              ]
+
+          For more information about supported endpoints for CORS, see [Cloud
+          Storage CORS support]
+          (https://cloud.google.com/storage/docs/cross-origin#server-side-support).
+
+     At most one of these can be specified:
+
+       --clear-default-encryption-key
+          Clears the bucket's default encryption key.
+
+       --default-encryption-key=DEFAULT_ENCRYPTION_KEY
+          Set the default KMS key for the bucket.
 
      At most one of these can be specified:
 
@@ -207,6 +132,99 @@ FLAGS
           Add or update labels. Example:
           --update-labels=key1=value1,key2=value2
 
+     At most one of these can be specified:
+
+       --clear-lifecycle
+          Removes all lifecycle configuration for the bucket.
+
+       --lifecycle-file=LIFECYCLE_FILE
+          Sets the lifecycle management configuration on a bucket. For example,
+          The following lifecycle management configuration JSON document
+          specifies that all objects in this bucket that are more than 365 days
+          old are deleted automatically:
+
+              {
+                "rule":
+                [
+                  {
+                    "action": {"type": "Delete"},
+                    "condition": {"age": 365}
+                  }
+                ]
+              }
+
+     At most one of these can be specified:
+
+       --clear-log-bucket
+          Clears logging bucket receiving the usage current bucket's data.
+
+       --log-bucket=LOG_BUCKET
+          Enables usage logging of the bucket, outputting log files to the
+          specified logging_bucket in this flag. Cloud Storage doesn't validate
+          the existence of the bucket receiving logs. In addition to enabling
+          logging on your bucket, you will also need to grant
+          cloud-storage-analytics@google.com write access to the log bucket.
+
+     At most one of these can be specified:
+
+       --clear-log-object-prefix
+          Clears prefix used to determine what usage data to send to logging
+          bucket.
+
+       --log-object-prefix=LOG_OBJECT_PREFIX
+          Specifies the object prefix for logging activity to the log bucket.
+          The default prefix is the bucket name. All read and write activity to
+          objects in the bucket will be logged for objects matching the prefix.
+
+     At most one of these can be specified:
+
+       --clear-pap, --clear-public-access-prevention
+          Unsets the public access prevention setting on a bucket.
+
+       --[no-]pap, --[no-]public-access-prevention
+          If True, sets public access prevention to "enforced". If False, sets
+          public access prevention to "inherited". For details on how exactly
+          public access is blocked, see:
+          http://cloud/storage/docs/public-access-prevention. Use
+          --public-access-prevention to enable and
+          --no-public-access-prevention to disable.
+
+     At most one of these can be specified:
+
+       --clear-retention-period
+          Clears the object retention period for a bucket.
+
+       --retention-period=RETENTION_PERIOD
+          Minimum retention period
+          (https://cloud.google.com/storage/docs/bucket-lock#retention-periods)
+          for objects stored in the bucket, for example
+          --retention-period=1Y1M1D5S. Objects added to the bucket cannot be
+          deleted until they've been stored for the specified length of time.
+          Default is no retention period. Only available for Cloud Storage
+          using the JSON API.
+
+     At most one of these can be specified:
+
+       --clear-web-error-page
+          Clear website error page if bucket is hosting website.
+
+       --web-error-page=WEB_ERROR_PAGE
+          Cloud Storage allows you to configure a bucket to behave like a
+          static website. A subsequent GET bucket request through a custom
+          domain for a non-existent object serves the specified error page
+          instead of the standard Cloud Storage error.
+
+     At most one of these can be specified:
+
+       --clear-web-main-page-suffix
+          Clear website main page suffix if bucket is hosting website.
+
+       --web-main-page-suffix=WEB_MAIN_PAGE_SUFFIX
+          Cloud Storage allows you to configure a bucket to behave like a
+          static website. A subsequent GET bucket request through a custom
+          domain serves the specified "main" page instead of performing the
+          usual bucket listing.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
@@ -219,5 +237,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud storage buckets update
 
diff --git a/gcloud/alpha/storage/cat b/gcloud/alpha/storage/cat
index 89b05dad2..553240bc3 100644
--- a/gcloud/alpha/storage/cat
+++ b/gcloud/alpha/storage/cat
@@ -74,5 +74,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud storage cat
 
diff --git a/gcloud/alpha/storage/cp b/gcloud/alpha/storage/cp
index 3474bfb47..5b683c31e 100644
--- a/gcloud/alpha/storage/cp
+++ b/gcloud/alpha/storage/cp
@@ -164,9 +164,7 @@ FLAGS
         path expression.
 
      --skip-unsupported, -U
-        Skip objects with unsupported object types.Currently, the only
-        unsupported category is Amazon S3 objects with the GLACIER storage
-        class.
+        Skip objects with unsupported object types.
 
      --storage-class=STORAGE_CLASS, -s STORAGE_CLASS
         Specify the storage class of the destination object. If not specified,
@@ -329,5 +327,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud storage cp
 
diff --git a/gcloud/alpha/storage/help b/gcloud/alpha/storage/help
index aa6e01ce8..b68af75f2 100644
--- a/gcloud/alpha/storage/help
+++ b/gcloud/alpha/storage/help
@@ -5,8 +5,8 @@ SYNOPSIS
     gcloud alpha storage GROUP | COMMAND [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) The gcloud alpha storage command group lets you create and manage
-    Cloud Storage resources such as buckets and objects.
+    (ALPHA) The gcloud storage command group lets you create and manage Cloud
+    Storage resources such as buckets and objects.
 
     More information on Cloud Storage can be found here:
     https://cloud.google.com/storage, and detailed documentation can be found
@@ -52,5 +52,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud storage
 
diff --git a/gcloud/alpha/storage/ls b/gcloud/alpha/storage/ls
index 919785b15..54ab5365f 100644
--- a/gcloud/alpha/storage/ls
+++ b/gcloud/alpha/storage/ls
@@ -112,8 +112,7 @@ FLAGS
           List all available metadata about items as a JSON dump.
 
        --long, -l
-          For objects only. List size in bytes, creation time, and URL. Note:
-          Creation time not available for S3.
+          For objects only. List size in bytes, creation time, and URL.
 
 ENCRYPTION FLAGS
      --decryption-keys=[DECRYPTION_KEY,...]
@@ -135,5 +134,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud storage ls
 
diff --git a/gcloud/alpha/storage/mv b/gcloud/alpha/storage/mv
index 6cb1209b9..a5a92ca96 100644
--- a/gcloud/alpha/storage/mv
+++ b/gcloud/alpha/storage/mv
@@ -171,9 +171,7 @@ FLAGS
         flag.
 
      --skip-unsupported, -U
-        Skip objects with unsupported object types.Currently, the only
-        unsupported category is Amazon S3 objects with the GLACIER storage
-        class.
+        Skip objects with unsupported object types.
 
      --storage-class=STORAGE_CLASS, -s STORAGE_CLASS
         Specify the storage class of the destination object. If not specified,
@@ -336,5 +334,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud storage mv
 
diff --git a/gcloud/alpha/storage/objects/compose b/gcloud/alpha/storage/objects/compose
index 73312d496..c24d958c9 100644
--- a/gcloud/alpha/storage/objects/compose
+++ b/gcloud/alpha/storage/objects/compose
@@ -52,5 +52,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud storage objects compose
 
diff --git a/gcloud/alpha/storage/objects/describe b/gcloud/alpha/storage/objects/describe
index 959a45d65..4982ccfc9 100644
--- a/gcloud/alpha/storage/objects/describe
+++ b/gcloud/alpha/storage/objects/describe
@@ -43,5 +43,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud storage objects describe
 
diff --git a/gcloud/alpha/storage/objects/help b/gcloud/alpha/storage/objects/help
index 03ef4338e..58d7aa428 100644
--- a/gcloud/alpha/storage/objects/help
+++ b/gcloud/alpha/storage/objects/help
@@ -31,5 +31,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud storage objects
 
diff --git a/gcloud/alpha/storage/objects/list b/gcloud/alpha/storage/objects/list
index c5b4d2ab0..5b0d05258 100644
--- a/gcloud/alpha/storage/objects/list
+++ b/gcloud/alpha/storage/objects/list
@@ -2,7 +2,7 @@ NAME
     gcloud alpha storage objects list - lists Cloud Storage objects
 
 SYNOPSIS
-    gcloud alpha storage objects list URLS [URLS ...]
+    gcloud alpha storage objects list URLS [URLS ...] [--stat]
         [--decryption-keys=[DECRYPTION_KEY,...]] [--filter=EXPRESSION]
         [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
         [GCLOUD_WIDE_FLAG ...]
@@ -32,6 +32,11 @@ POSITIONAL ARGUMENTS
      URLS [URLS ...]
         Specifies URL of objects to list.
 
+FLAGS
+     --stat
+        Emulates gsutil stat-style behavior. Does not show past object versions
+        and changes output format.
+
 ENCRYPTION FLAGS
      --decryption-keys=[DECRYPTION_KEY,...]
         A comma-separated list of customer-supplied encryption keys (RFC 4648
@@ -84,5 +89,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud storage objects list
 
diff --git a/gcloud/alpha/storage/objects/update b/gcloud/alpha/storage/objects/update
index db2474d61..64193e56e 100644
--- a/gcloud/alpha/storage/objects/update
+++ b/gcloud/alpha/storage/objects/update
@@ -29,19 +29,19 @@ DESCRIPTION
 EXAMPLES
     Update a Google Cloud Storage object's custom-metadata:
 
-        $ *gcloud alpha storage objects update* gs://bucket/my-object \
+        $ gcloud alpha storage objects update gs://bucket/my-object \
             --custom-metadata=key1=value1,key2=value2
 
-    Set a temporary hold on JPG images:
+    Rewrite all JPEG images to the NEARLINE storage class:
 
-        $ *gcloud alpha storage objects update* gs://bucket/*.jpg \
-            --temporary-hold
+        $ gcloud alpha storage objects update gs://bucket/*.jpg \
+            --storage-class=NEARLINE
 
         You can also provide a precondition on an object's metageneration in
         order to avoid potential race conditions:
 
-        $ *gcloud alpha storage objects update* gs://bucket/*.jpg \
-            --temporary-hold --if-metageneration-match=123456789
+        $ gcloud alpha storage objects update gs://bucket/*.jpg \
+            --storage-class=NEARLINE --if-metageneration-match=123456789
 
 POSITIONAL ARGUMENTS
      [URL ...]
@@ -201,5 +201,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud storage objects update
 
diff --git a/gcloud/alpha/storage/rm b/gcloud/alpha/storage/rm
index 46a04a8c4..c1a76df15 100644
--- a/gcloud/alpha/storage/rm
+++ b/gcloud/alpha/storage/rm
@@ -93,5 +93,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud storage rm
 
diff --git a/gcloud/alpha/storage/service-agent b/gcloud/alpha/storage/service-agent
index a61d0332f..fd14e9039 100644
--- a/gcloud/alpha/storage/service-agent
+++ b/gcloud/alpha/storage/service-agent
@@ -46,5 +46,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud storage service-agent
 
diff --git a/gcloud/beta/asset/query b/gcloud/beta/asset/query
index 8d68aa5b8..062133222 100644
--- a/gcloud/beta/asset/query
+++ b/gcloud/beta/asset/query
@@ -110,7 +110,7 @@ OPTIONAL FLAGS
           partition already exists. WRITE_DISPOSITION must be one of:
 
            write-append
-              AIf the table or partition already exists, BigQuery appends the
+              If the table or partition already exists, BigQuery appends the
               data to the table or the latest partition.
            write-empty
               If the table already exists and contains data, an error is
diff --git a/gcloud/beta/batch/jobs/submit b/gcloud/beta/batch/jobs/submit
index 5a961e38c..02c2927f2 100644
--- a/gcloud/beta/batch/jobs/submit
+++ b/gcloud/beta/batch/jobs/submit
@@ -22,6 +22,28 @@ EXAMPLES
         $ gcloud beta batch jobs submit \
             projects/foo/locations/us-central1/jobs/bar --config=config.json
 
+    To submit the job through stdin with json job config and name
+    projects/foo/locations/us-central1/jobs/bar, run:
+
+        $ gcloud beta batch jobs submit \
+            projects/foo/locations/us-central1/jobs/bar --config=-
+
+        then input json job config via stdin
+        {
+          json job config
+        }
+
+    To submit the job through HereDoc with json job config and name
+    projects/foo/locations/us-central1/jobs/bar, run:
+
+        $ gcloud beta batch jobs submit \
+            projects/foo/locations/us-central1/jobs/bar --config=- << EOF
+
+        {
+          json job config
+        }
+        EOF
+
 POSITIONAL ARGUMENTS
      Job resource - The Batch job resource. The arguments in this group can be
      used to specify the attributes of this resource. (NOTE) Some attributes
@@ -52,7 +74,9 @@ REQUIRED FLAGS
      At least one of these must be specified:
 
        --config=CONFIG
-          The JSON file of the job config.
+          The file path of the JSON job config JSON. It also supports direct
+          input from stdin with '-' or HereDoc (in shells with HereDoc support
+          like Bash) with '- <<DELIMITER'.
 
        Either specify the config file for the job or the first runnable in the
        task spec. Specify either a script file or container arguments for the
diff --git a/gcloud/beta/batch/tasks/help b/gcloud/beta/batch/tasks/help
index a20f9f28a..88afd0fb2 100644
--- a/gcloud/beta/batch/tasks/help
+++ b/gcloud/beta/batch/tasks/help
@@ -27,7 +27,7 @@ COMMANDS
         (BETA) Show details of a task.
 
      list
-        (BETA) List tasks for a specified Batch task_group.
+        (BETA) List tasks for a specified Batch job.
 
 NOTES
     This command is currently in beta and might change without notice. This
diff --git a/gcloud/beta/batch/tasks/list b/gcloud/beta/batch/tasks/list
index d416df79d..d141e1aaf 100644
--- a/gcloud/beta/batch/tasks/list
+++ b/gcloud/beta/batch/tasks/list
@@ -1,54 +1,50 @@
 NAME
-    gcloud beta batch tasks list - list tasks for a specified Batch task_group
+    gcloud beta batch tasks list - list tasks for a specified Batch job
 
 SYNOPSIS
-    gcloud beta batch tasks list (TASK_GROUP : --job=JOB --location=LOCATION)
+    gcloud beta batch tasks list (--job=JOB : --location=LOCATION)
         [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
         [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (BETA) This command can fail for the following reasons:
-      ▪ The task_group specified does not exist.
-      ▪ The active account does not have permission to access the given
-        task_group.
+    (BETA) Currently, since Batch only supports one taskGroup, group0, the
+    command takes --job as the required argument and will list all tasks in
+    group0 of the job.
+
+    This command can fail for the following reasons:
+      ▪ The job specified does not exist.
+      ▪ The active account does not have permission to access the given job
 
 EXAMPLES
-    To print all tasks under the task_group with name
-    projects/foo/locations/us-central1/jobs/bar/taskGroups/group0, run:
+    To print all tasks in the group0 of job with name
+    projects/foo/locations/us-central1/jobs/bar, run:
 
         $ gcloud beta batch tasks list \
-            projects/foo/locations/us-central1/jobs/bar/taskGroups/group0
+            projects/foo/locations/us-central1/jobs/bar
 
-POSITIONAL ARGUMENTS
-     Task group resource - The Batch task_group resource. The arguments in this
-     group can be used to specify the attributes of this resource. (NOTE) Some
-     attributes are not given arguments in this group but can be set in other
-     ways. To set the project attribute:
-      ◆ provide the argument TASK_GROUP on the command line with a fully
-        specified name;
+REQUIRED FLAGS
+     Job resource - The Batch job resource. The arguments in this group can be
+     used to specify the attributes of this resource. (NOTE) Some attributes
+     are not given arguments in this group but can be set in other ways. To set
+     the project attribute:
+      ◆ provide the argument --job on the command line with a fully specified
+        name;
       ◆ provide the argument --project on the command line;
       ◆ set the property core/project.
 
      This must be specified.
 
-       TASK_GROUP
-          ID of the task_group or fully qualified identifier for the
-          task_group. To set the task_group attribute:
-          ▸ provide the argument TASK_GROUP on the command line.
-
-          This positional argument must be specified if any of the other
-          arguments in this group are specified.
-
        --job=JOB
-          The job ID for the task_group. To set the job attribute:
-          ▸ provide the argument TASK_GROUP on the command line with a fully
-            specified name;
+          ID of the job or fully qualified identifier for the job. To set the
+          job attribute:
           ▸ provide the argument --job on the command line.
 
+          This flag argument must be specified if any of the other arguments in
+          this group are specified.
+
        --location=LOCATION
-          Google Cloud location for the task_group. To set the location
-          attribute:
-          ▸ provide the argument TASK_GROUP on the command line with a fully
+          Google Cloud location for the job. To set the location attribute:
+          ▸ provide the argument --job on the command line with a fully
             specified name;
           ▸ provide the argument --location on the command line.
 
diff --git a/gcloud/beta/compute/backend-services/add-iam-policy-binding b/gcloud/beta/compute/backend-services/add-iam-policy-binding
index fab6ecf62..45361be33 100644
--- a/gcloud/beta/compute/backend-services/add-iam-policy-binding
+++ b/gcloud/beta/compute/backend-services/add-iam-policy-binding
@@ -86,8 +86,10 @@ API REFERENCE
     can be found at: https://cloud.google.com/compute/
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute backend-services add-iam-policy-binding
 
         $ gcloud alpha compute backend-services add-iam-policy-binding
 
diff --git a/gcloud/beta/compute/backend-services/get-iam-policy b/gcloud/beta/compute/backend-services/get-iam-policy
index 00646c355..4258dec0d 100644
--- a/gcloud/beta/compute/backend-services/get-iam-policy
+++ b/gcloud/beta/compute/backend-services/get-iam-policy
@@ -89,8 +89,10 @@ API REFERENCE
     can be found at: https://cloud.google.com/compute/
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute backend-services get-iam-policy
 
         $ gcloud alpha compute backend-services get-iam-policy
 
diff --git a/gcloud/beta/compute/backend-services/remove-iam-policy-binding b/gcloud/beta/compute/backend-services/remove-iam-policy-binding
index 5d5b9aaaa..d7962d0e2 100644
--- a/gcloud/beta/compute/backend-services/remove-iam-policy-binding
+++ b/gcloud/beta/compute/backend-services/remove-iam-policy-binding
@@ -87,8 +87,10 @@ API REFERENCE
     can be found at: https://cloud.google.com/compute/
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute backend-services remove-iam-policy-binding
 
         $ gcloud alpha compute backend-services remove-iam-policy-binding
 
diff --git a/gcloud/beta/compute/backend-services/set-iam-policy b/gcloud/beta/compute/backend-services/set-iam-policy
index 3ab74a3c4..5afe403fb 100644
--- a/gcloud/beta/compute/backend-services/set-iam-policy
+++ b/gcloud/beta/compute/backend-services/set-iam-policy
@@ -68,8 +68,10 @@ API REFERENCE
     can be found at: https://cloud.google.com/compute/
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute backend-services set-iam-policy
 
         $ gcloud alpha compute backend-services set-iam-policy
 
diff --git a/gcloud/beta/compute/backend-services/update b/gcloud/beta/compute/backend-services/update
index 3cc3a615e..26e972f4d 100644
--- a/gcloud/beta/compute/backend-services/update
+++ b/gcloud/beta/compute/backend-services/update
@@ -198,7 +198,8 @@ FLAGS
         service.
 
      --no-health-checks
-        Removes all health checks for the backend service.
+        Removes all health checks for the backend service if the backend
+        service has no backends attached.
 
      --http-health-checks=HTTP_HEALTH_CHECK,[...]
         Specifies a list of legacy HTTP health check objects for checking the
diff --git a/gcloud/beta/compute/instances/ops-agents/policies/create b/gcloud/beta/compute/instances/ops-agents/policies/create
index edb44cc3d..1690424e8 100644
--- a/gcloud/beta/compute/instances/ops-agents/policies/create
+++ b/gcloud/beta/compute/instances/ops-agents/policies/create
@@ -95,7 +95,7 @@ REQUIRED FLAGS
             The Ops Agent has both a logging module and a metrics module
             already. So other types of agents are not allowed when there is an
             agent with type ops-agent. See
-            https://cloud.google.com/stackdriver/docs/solutions/ops-agent#which_agent
+            https://cloud.google.com/stackdriver/docs/solutions/agents#which-agent-should-you-choose
             for which agent to use.
 
          enable-autoupgrade
diff --git a/gcloud/beta/compute/instances/ops-agents/policies/update b/gcloud/beta/compute/instances/ops-agents/policies/update
index 480be561c..73218338c 100644
--- a/gcloud/beta/compute/instances/ops-agents/policies/update
+++ b/gcloud/beta/compute/instances/ops-agents/policies/update
@@ -117,7 +117,7 @@ FLAGS
             The Ops Agent has both a logging module and a metrics module
             already. So other types of agents are not allowed when there is an
             agent with type ops-agent. See
-            https://cloud.google.com/stackdriver/docs/solutions/ops-agent#which_agent
+            https://cloud.google.com/stackdriver/docs/solutions/agents#which-agent-should-you-choose
             for which agent to use.
 
          enable-autoupgrade
diff --git a/gcloud/beta/compute/security-policies/rules/add-preconfig-waf-exclusion b/gcloud/beta/compute/security-policies/rules/add-preconfig-waf-exclusion
new file mode 100644
index 000000000..4d2de9f80
--- /dev/null
+++ b/gcloud/beta/compute/security-policies/rules/add-preconfig-waf-exclusion
@@ -0,0 +1,144 @@
+NAME
+    gcloud beta compute security-policies rules add-preconfig-waf-exclusion -
+        add an exclusion configuration for preconfigured WAF evaluation into a
+        security policy rule
+
+SYNOPSIS
+    gcloud beta compute security-policies rules add-preconfig-waf-exclusion
+        PRIORITY --target-rule-set=TARGET_RULE_SET
+        [--request-cookie-to-exclude=[op=OP],[val=VAL]]
+        [--request-header-to-exclude=[op=OP],[val=VAL]]
+        [--request-query-param-to-exclude=[op=OP],[val=VAL]]
+        [--request-uri-to-exclude=[op=OP],[val=VAL]]
+        [--security-policy=SECURITY_POLICY] [--target-rule-ids=[RULE_ID,...]]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) gcloud beta compute security-policies rules
+    add-preconfig-waf-exclusion is used to add an exclusion configuration for
+    preconfigured WAF evaluation into a security policy rule.
+
+    Note that request field exclusions are associated with a target, which can
+    be a single rule set, or a rule set plus a list of rule IDs under the rule
+    set.
+
+EXAMPLES
+    To add specific request field exclusions that are associated with the
+    target of 'sqli-stable': ['owasp-crs-v030001-id942110-sqli',
+    'owasp-crs-v030001-id942120-sqli'], run:
+
+        $ gcloud beta compute security-policies rules \
+            add-preconfig-waf-exclusion 1000 --security-policy=my-policy \
+            --target-rule-set=sqli-stable \
+            --target-rule-ids=owasp-crs-v030001-id942110-sqli,\
+        owasp-crs-v030001-id942120-sqli \
+            --request-header-to-exclude=op=EQUALS,val=abc \
+            --request-header-to-exclude=op=STARTS_WITH,val=xyz \
+            --request-uri-to-exclude=op=EQUALS_ANY
+
+    To add specific request field exclusions that are associated with the
+    target of 'sqli-stable': [], run:
+
+        $ gcloud beta compute security-policies rules \
+            add-preconfig-waf-exclusion 1000 --security-policy=my-policy \
+            --target-rule-set=sqli-stable \
+            --request-cookie-to-exclude=op=EQUALS_ANY
+
+POSITIONAL ARGUMENTS
+     PRIORITY
+        The priority of the rule to add the exclusion configuration for
+        preconfigured WAF evaluation. Rules are evaluated in order from highest
+        priority to lowest priority where 0 is the highest priority and
+        2147483647 is the lowest priority.
+
+REQUIRED FLAGS
+     --target-rule-set=TARGET_RULE_SET
+        Target WAF rule set where the request field exclusions being added
+        would apply.
+
+        This, together with the target rule IDs (if given), determines the
+        target for associating request field exclusions. See --target-rule-ids.
+
+OPTIONAL FLAGS
+     --request-cookie-to-exclude=[op=OP],[val=VAL]
+        Adds a request cookie to the request field exclusions associated with
+        the rule set and rule IDs (if given). This specifies a request cookie
+        whose value will be excluded from inspection during preconfigured WAF
+        evaluation.
+
+        You can specify an exact match or a partial match by using a field
+        operator and a field value. Available field operators are:
+        ◆ EQUALS: the operator matches if the field value equals the
+          specified value.
+        ◆ STARTS_WITH: the operator matches if the field value starts with
+          the specified value.
+        ◆ ENDS_WITH: the operator matches if the field value ends with the
+          specified value.
+        ◆ CONTAINS: the operator matches if the field value contains the
+          specified value.
+        ◆ EQUALS_ANY: the operator matches if the field value is any value.
+
+        A field value must be given if the field operator is not EQUALS_ANY,
+        and cannot be given if the field operator is EQUALS_ANY. For example,
+        --request-header-to-exclude op=EQUALS,val=abc or
+        --request-header-to-exclude op=EQUALS_ANY.
+
+        This flag can be repeated to specify multiple request headers to
+        exclude. For example, --request-header-to-exclude op=EQUALS,val=abc
+        --request-header-to-exclude op=STARTS_WITH,val=xyz.
+
+     --request-header-to-exclude=[op=OP],[val=VAL]
+        Adds a request header to the request field exclusions associated with
+        the rule set and rule IDs (if given). This specifies a request header
+        whose value will be excluded from inspection during preconfigured WAF
+        evaluation.
+
+        Refer to the syntax under --request-cookie-to-exclude.
+
+        This flag can be repeated to specify multiple request headers.
+
+     --request-query-param-to-exclude=[op=OP],[val=VAL]
+        Adds a request query parameter to the request field exclusions
+        associated with the rule set and rule IDs (if given). This specifies a
+        request query parameter in the query string or in the POST body whose
+        value will be excluded from inspection during preconfigured WAF
+        evaluation.
+
+        Refer to the syntax under --request-cookie-to-exclude.
+
+        This flag can be repeated to specify multiple request query parameters.
+
+     --request-uri-to-exclude=[op=OP],[val=VAL]
+        Adds a request URI to the request field exclusions associated with the
+        rule set and rule IDs (if given). This specifies a request URI from the
+        request line to be excluded from inspection during preconfigured WAF
+        evaluation.
+
+        Refer to the syntax under --request-cookie-to-exclude.
+
+        This flag can be repeated to specify multiple request URIs.
+
+     --security-policy=SECURITY_POLICY
+        The security policy that this rule belongs to.
+
+     --target-rule-ids=[RULE_ID,...]
+        A comma-separated list of target rule IDs under the WAF rule set where
+        the request field exclusions being added would apply. If omitted, the
+        added request field exclusions will be associated with the rule set
+        only, which would apply to all the rule IDs under the rule set.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha compute security-policies rules \
+            add-preconfig-waf-exclusion
+
diff --git a/gcloud/beta/compute/security-policies/rules/help b/gcloud/beta/compute/security-policies/rules/help
index cc3c8857e..f610ad094 100644
--- a/gcloud/beta/compute/security-policies/rules/help
+++ b/gcloud/beta/compute/security-policies/rules/help
@@ -16,6 +16,10 @@ GCLOUD WIDE FLAGS
 COMMANDS
     COMMAND is one of the following:
 
+     add-preconfig-waf-exclusion
+        (BETA) Add an exclusion configuration for preconfigured WAF evaluation
+        into a security policy rule.
+
      create
         (BETA) Create a Compute Engine security policy rule.
 
@@ -25,6 +29,10 @@ COMMANDS
      describe
         (BETA) Describe a Compute Engine security policy rule.
 
+     remove-preconfig-waf-exclusion
+        (BETA) Remove an exclusion configuration for preconfigured WAF
+        evaluation from a security policy rule.
+
      update
         (BETA) Update a Compute Engine security policy rule.
 
diff --git a/gcloud/beta/compute/security-policies/rules/remove-preconfig-waf-exclusion b/gcloud/beta/compute/security-policies/rules/remove-preconfig-waf-exclusion
new file mode 100644
index 000000000..306601128
--- /dev/null
+++ b/gcloud/beta/compute/security-policies/rules/remove-preconfig-waf-exclusion
@@ -0,0 +1,162 @@
+NAME
+    gcloud beta compute security-policies rules remove-preconfig-waf-exclusion
+        - remove an exclusion configuration for preconfigured WAF evaluation
+        from a security policy rule
+
+SYNOPSIS
+    gcloud beta compute security-policies rules remove-preconfig-waf-exclusion
+        PRIORITY --target-rule-set=TARGET_RULE_SET
+        [--request-cookie-to-exclude=[op=OP],[val=VAL]]
+        [--request-header-to-exclude=[op=OP],[val=VAL]]
+        [--request-query-param-to-exclude=[op=OP],[val=VAL]]
+        [--request-uri-to-exclude=[op=OP],[val=VAL]]
+        [--security-policy=SECURITY_POLICY] [--target-rule-ids=[RULE_ID,...]]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) gcloud beta compute security-policies rules
+    remove-preconfig-waf-exclusion is used to remove an exclusion configuration
+    for preconfigured WAF evaluation from a security policy rule.
+
+    Note that request field exclusions are associated with a target, which can
+    be a single rule set, or a rule set plus a list of rule IDs under the rule
+    set.
+
+    It is possible to remove request field exclusions at 3 levels:
+      ▪ Remove specific request field exclusions that are associated with a
+        matching target.
+      ▪ Remove all the request field exclusions that are associated with a
+        matching target.
+      ▪ Remove all the request field exclusions that are configured under the
+        security policy rule, regardless of the target.
+
+EXAMPLES
+    To remove specific request field exclusions that are associated with the
+    target of 'sqli-stable': ['owasp-crs-v030001-id942110-sqli',
+    'owasp-crs-v030001-id942120-sqli'], run:
+
+        $ gcloud beta compute security-policies rules \
+            remove-preconfig-waf-exclusion 1000 \
+            --security-policy=my-policy --target-rule-set=sqli-stable \
+            --target-rule-ids=owasp-crs-v030001-id942110-sqli,\
+        owasp-crs-v030001-id942120-sqli \
+            --request-header-to-exclude=op=EQUALS,val=abc \
+            --request-header-to-exclude=op=STARTS_WITH,val=xyz \
+            --request-uri-to-exclude=op=EQUALS_ANY
+
+    To remove all the request field exclusions that are associated with the
+    target of 'sqli-stable': ['owasp-crs-v030001-id942110-sqli',
+    'owasp-crs-v030001-id942120-sqli'], run:
+
+        $ gcloud beta compute security-policies rules \
+            remove-preconfig-waf-exclusion 1000 \
+            --security-policy=my-policy --target-rule-set=sqli-stable \
+            --target-rule-ids=owasp-crs-v030001-id942110-sqli,\
+        owasp-crs-v030001-id942120-sqli
+
+    To remove all the request field exclusions that are associated with the
+    target of 'sqli-stable': [], run:
+
+        $ gcloud beta compute security-policies rules \
+            remove-preconfig-waf-exclusion 1000 \
+            --security-policy=my-policy --target-rule-set=sqli-stable
+
+    To remove all the request field exclusions that are configured under the
+    security policy rule, regardless of the target, run:
+
+        $ gcloud beta compute security-policies rules \
+            remove-preconfig-waf-exclusion 1000 \
+            --security-policy=my-policy --target-rule-set=*
+
+POSITIONAL ARGUMENTS
+     PRIORITY
+        The priority of the rule to remove the exclusion configuration for
+        preconfigured WAF evaluation. Rules are evaluated in order from highest
+        priority to lowest priority where 0 is the highest priority and
+        2147483647 is the lowest priority.
+
+REQUIRED FLAGS
+     --target-rule-set=TARGET_RULE_SET
+        Target WAF rule set from where to remove the request field exclusions.
+
+        This, together with the target rule IDs (if given), determines the
+        target for associating request field exclusions. See --target-rule-ids.
+
+        Note that the removal of request field exclusions is restricted to
+        those associated with a matching target. Set this flag to * if you want
+        to remove request field exclusions regardless of the target.
+
+OPTIONAL FLAGS
+     --request-cookie-to-exclude=[op=OP],[val=VAL]
+        Removes a request cookie from the existing request field exclusions
+        associated with the rule set and rule IDs (if given).
+
+        You can specify an exact match or a partial match by using a field
+        operator and a field value. Available field operators are:
+        ◆ EQUALS: the operator matches if the field value equals the
+          specified value.
+        ◆ STARTS_WITH: the operator matches if the field value starts with
+          the specified value.
+        ◆ ENDS_WITH: the operator matches if the field value ends with the
+          specified value.
+        ◆ CONTAINS: the operator matches if the field value contains the
+          specified value.
+        ◆ EQUALS_ANY: the operator matches if the field value is any value.
+
+        A field value must be given if the field operator is not EQUALS_ANY,
+        and cannot be given if the field operator is EQUALS_ANY. For example,
+        --request-header-to-exclude op=EQUALS,val=abc or
+        --request-header-to-exclude op=EQUALS_ANY.
+
+        This flag can be repeated to specify multiple request headers to
+        exclude. For example, --request-header-to-exclude op=EQUALS,val=abc
+        --request-header-to-exclude op=STARTS_WITH,val=xyz.
+
+     --request-header-to-exclude=[op=OP],[val=VAL]
+        Removes a request header from the existing request field exclusions
+        associated with the rule set and rule IDs (if given).
+
+        Refer to the syntax under --request-cookie-to-exclude.
+
+        This flag can be repeated to specify multiple request headers.
+
+     --request-query-param-to-exclude=[op=OP],[val=VAL]
+        Removes a request query parameter from the existing request field
+        exclusions associated with the rule set and rule IDs (if given).
+
+        Refer to the syntax under --request-cookie-to-exclude.
+
+        This flag can be repeated to specify multiple request query parameters.
+
+     --request-uri-to-exclude=[op=OP],[val=VAL]
+        Removes a request URI from the existing request field exclusions
+        associated with the rule set and rule IDs (if given).
+
+        Refer to the syntax under --request-cookie-to-exclude.
+
+        This flag can be repeated to specify multiple request URIs.
+
+     --security-policy=SECURITY_POLICY
+        The security policy that this rule belongs to.
+
+     --target-rule-ids=[RULE_ID,...]
+        A comma-separated list of target rule IDs under the WAF rule set from
+        where to remove the request field exclusions. If omitted, the removal
+        of request field exclusions is restricted to those associated with the
+        rule set only, without specific rule IDs.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha compute security-policies rules \
+            remove-preconfig-waf-exclusion
+
diff --git a/gcloud/beta/config/get b/gcloud/beta/config/get
index 0f19651ac..d227e72db 100644
--- a/gcloud/beta/config/get
+++ b/gcloud/beta/config/get
@@ -1044,6 +1044,11 @@ AVAILABLE PROPERTIES
          max_retry_delay
             Max second delay between retriable operations.
 
+         parallel_composite_upload_compatibility_check
+            Determines if the GET bucket call should be performed to check if
+            the default storage class and retention period for the destination
+            bucket meet the criteria for parallel composite upload.
+
          parallel_composite_upload_component_size
             Specifies the ideal size of a component in bytes, which will act as
             an upper bound to the size of the components if ceil(file_size /
@@ -1052,6 +1057,12 @@ AVAILABLE PROPERTIES
             provided either in bytes or as human-readable values (e.g., "150M"
             to represent 150 mebibytes).
 
+         parallel_composite_upload_enabled
+            Determines whether parallel composite upload should be used.
+            Default value is None which will use parallel composite upload and
+            log an appropriate warning for the user explaining that parallel
+            composite upload is being used by default.
+
          parallel_composite_upload_threshold
             Specifies the maximum size of a file to upload in a single stream.
             Files larger than this threshold will be partitioned into component
@@ -1059,8 +1070,8 @@ AVAILABLE PROPERTIES
             The number of components will be the smaller of ceil(file_size /
             parallel_composite_upload_component_size) and the maximum number of
             objects the API allows composing at once. For Cloud Storage this
-            limit is 32. If this property is set to 0, then automatic parallel
-            uploads will never occur.
+            limit is 32. This property has no effect if
+            parallel_composite_upload_enabled is set to False.
 
          process_count
             The maximum number of processes parallel execution should use. When
diff --git a/gcloud/beta/config/help b/gcloud/beta/config/help
index c6db09af2..f64b4465d 100644
--- a/gcloud/beta/config/help
+++ b/gcloud/beta/config/help
@@ -1076,6 +1076,11 @@ AVAILABLE PROPERTIES
          max_retry_delay
             Max second delay between retriable operations.
 
+         parallel_composite_upload_compatibility_check
+            Determines if the GET bucket call should be performed to check if
+            the default storage class and retention period for the destination
+            bucket meet the criteria for parallel composite upload.
+
          parallel_composite_upload_component_size
             Specifies the ideal size of a component in bytes, which will act as
             an upper bound to the size of the components if ceil(file_size /
@@ -1084,6 +1089,12 @@ AVAILABLE PROPERTIES
             provided either in bytes or as human-readable values (e.g., "150M"
             to represent 150 mebibytes).
 
+         parallel_composite_upload_enabled
+            Determines whether parallel composite upload should be used.
+            Default value is None which will use parallel composite upload and
+            log an appropriate warning for the user explaining that parallel
+            composite upload is being used by default.
+
          parallel_composite_upload_threshold
             Specifies the maximum size of a file to upload in a single stream.
             Files larger than this threshold will be partitioned into component
@@ -1091,8 +1102,8 @@ AVAILABLE PROPERTIES
             The number of components will be the smaller of ceil(file_size /
             parallel_composite_upload_component_size) and the maximum number of
             objects the API allows composing at once. For Cloud Storage this
-            limit is 32. If this property is set to 0, then automatic parallel
-            uploads will never occur.
+            limit is 32. This property has no effect if
+            parallel_composite_upload_enabled is set to False.
 
          process_count
             The maximum number of processes parallel execution should use. When
diff --git a/gcloud/beta/config/list b/gcloud/beta/config/list
index c15bb850e..90067607b 100644
--- a/gcloud/beta/config/list
+++ b/gcloud/beta/config/list
@@ -1082,6 +1082,11 @@ AVAILABLE PROPERTIES
          max_retry_delay
             Max second delay between retriable operations.
 
+         parallel_composite_upload_compatibility_check
+            Determines if the GET bucket call should be performed to check if
+            the default storage class and retention period for the destination
+            bucket meet the criteria for parallel composite upload.
+
          parallel_composite_upload_component_size
             Specifies the ideal size of a component in bytes, which will act as
             an upper bound to the size of the components if ceil(file_size /
@@ -1090,6 +1095,12 @@ AVAILABLE PROPERTIES
             provided either in bytes or as human-readable values (e.g., "150M"
             to represent 150 mebibytes).
 
+         parallel_composite_upload_enabled
+            Determines whether parallel composite upload should be used.
+            Default value is None which will use parallel composite upload and
+            log an appropriate warning for the user explaining that parallel
+            composite upload is being used by default.
+
          parallel_composite_upload_threshold
             Specifies the maximum size of a file to upload in a single stream.
             Files larger than this threshold will be partitioned into component
@@ -1097,8 +1108,8 @@ AVAILABLE PROPERTIES
             The number of components will be the smaller of ceil(file_size /
             parallel_composite_upload_component_size) and the maximum number of
             objects the API allows composing at once. For Cloud Storage this
-            limit is 32. If this property is set to 0, then automatic parallel
-            uploads will never occur.
+            limit is 32. This property has no effect if
+            parallel_composite_upload_enabled is set to False.
 
          process_count
             The maximum number of processes parallel execution should use. When
diff --git a/gcloud/beta/config/set b/gcloud/beta/config/set
index 079d3cfe2..78359c85a 100644
--- a/gcloud/beta/config/set
+++ b/gcloud/beta/config/set
@@ -1091,6 +1091,11 @@ AVAILABLE PROPERTIES
          max_retry_delay
             Max second delay between retriable operations.
 
+         parallel_composite_upload_compatibility_check
+            Determines if the GET bucket call should be performed to check if
+            the default storage class and retention period for the destination
+            bucket meet the criteria for parallel composite upload.
+
          parallel_composite_upload_component_size
             Specifies the ideal size of a component in bytes, which will act as
             an upper bound to the size of the components if ceil(file_size /
@@ -1099,6 +1104,12 @@ AVAILABLE PROPERTIES
             provided either in bytes or as human-readable values (e.g., "150M"
             to represent 150 mebibytes).
 
+         parallel_composite_upload_enabled
+            Determines whether parallel composite upload should be used.
+            Default value is None which will use parallel composite upload and
+            log an appropriate warning for the user explaining that parallel
+            composite upload is being used by default.
+
          parallel_composite_upload_threshold
             Specifies the maximum size of a file to upload in a single stream.
             Files larger than this threshold will be partitioned into component
@@ -1106,8 +1117,8 @@ AVAILABLE PROPERTIES
             The number of components will be the smaller of ceil(file_size /
             parallel_composite_upload_component_size) and the maximum number of
             objects the API allows composing at once. For Cloud Storage this
-            limit is 32. If this property is set to 0, then automatic parallel
-            uploads will never occur.
+            limit is 32. This property has no effect if
+            parallel_composite_upload_enabled is set to False.
 
          process_count
             The maximum number of processes parallel execution should use. When
diff --git a/gcloud/beta/config/unset b/gcloud/beta/config/unset
index 602582124..11213b1c6 100644
--- a/gcloud/beta/config/unset
+++ b/gcloud/beta/config/unset
@@ -1052,6 +1052,11 @@ AVAILABLE PROPERTIES
          max_retry_delay
             Max second delay between retriable operations.
 
+         parallel_composite_upload_compatibility_check
+            Determines if the GET bucket call should be performed to check if
+            the default storage class and retention period for the destination
+            bucket meet the criteria for parallel composite upload.
+
          parallel_composite_upload_component_size
             Specifies the ideal size of a component in bytes, which will act as
             an upper bound to the size of the components if ceil(file_size /
@@ -1060,6 +1065,12 @@ AVAILABLE PROPERTIES
             provided either in bytes or as human-readable values (e.g., "150M"
             to represent 150 mebibytes).
 
+         parallel_composite_upload_enabled
+            Determines whether parallel composite upload should be used.
+            Default value is None which will use parallel composite upload and
+            log an appropriate warning for the user explaining that parallel
+            composite upload is being used by default.
+
          parallel_composite_upload_threshold
             Specifies the maximum size of a file to upload in a single stream.
             Files larger than this threshold will be partitioned into component
@@ -1067,8 +1078,8 @@ AVAILABLE PROPERTIES
             The number of components will be the smaller of ceil(file_size /
             parallel_composite_upload_component_size) and the maximum number of
             objects the API allows composing at once. For Cloud Storage this
-            limit is 32. If this property is set to 0, then automatic parallel
-            uploads will never occur.
+            limit is 32. This property has no effect if
+            parallel_composite_upload_enabled is set to False.
 
          process_count
             The maximum number of processes parallel execution should use. When
diff --git a/gcloud/beta/dataproc/batches/list b/gcloud/beta/dataproc/batches/list
index 8ebf1098e..66cc6d1f0 100644
--- a/gcloud/beta/dataproc/batches/list
+++ b/gcloud/beta/dataproc/batches/list
@@ -3,7 +3,8 @@ NAME
 
 SYNOPSIS
     gcloud beta dataproc batches list [--region=REGION] [--limit=LIMIT]
-        [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
+        [--page-size=PAGE_SIZE; default=100] [--sort-by=[FIELD,...]]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (BETA) List batch jobs in a project. Page-size sets the maximum number of
@@ -27,12 +28,11 @@ LIST COMMAND FLAGS
         flag interacts with other flags that are applied in this order:
         --flatten, --sort-by, --filter, --limit.
 
-     --page-size=PAGE_SIZE
+     --page-size=PAGE_SIZE; default=100
         Some services group resource list output into pages. This flag
-        specifies the maximum number of resources per page. The default is
-        determined by the service if it supports paging, otherwise it is
-        unlimited (no paging). Paging may be applied before or after --filter
-        and --limit depending on the service.
+        specifies the maximum number of resources per page. The default is 100.
+        Paging may be applied before or after --filter and --limit depending on
+        the service.
 
      --sort-by=[FIELD,...]
         Comma-separated list of resource field key names to sort by. The
diff --git a/gcloud/beta/deploy/help b/gcloud/beta/deploy/help
index 8ce2e6da9..c554198ec 100644
--- a/gcloud/beta/deploy/help
+++ b/gcloud/beta/deploy/help
@@ -19,6 +19,9 @@ GROUPS
         (BETA) Create and manage Delivery Pipeline resources for Google Cloud
         Deploy.
 
+     job-runs
+        (BETA) Manages job runs resources for Google Cloud Deploy.
+
      releases
         (BETA) Create and manage Release resources for Google Cloud Deploy.
 
diff --git a/gcloud/beta/deploy/job-runs/describe b/gcloud/beta/deploy/job-runs/describe
new file mode 100644
index 000000000..815e4facb
--- /dev/null
+++ b/gcloud/beta/deploy/job-runs/describe
@@ -0,0 +1,95 @@
+NAME
+    gcloud beta deploy job-runs describe - show details for a job run
+
+SYNOPSIS
+    gcloud beta deploy job-runs describe
+        (JOB_RUN : --delivery-pipeline=DELIVERY_PIPELINE
+          --region=REGION --release=RELEASE --rollout=ROLLOUT)
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Show details for a specified job run.
+
+EXAMPLES
+    To show details about a job run 'test-jobrun', for delivery pipeline
+    'test-pipeline', release 'test-release', rollout 'test-rollout', in region
+    'us-central1', run:
+
+        $ gcloud beta deploy job-runs describe test-jobrun \
+            --delivery-pipeline=test-pipeline --release=test-release \
+            --rollout=test-rollout --region=us-central1
+
+POSITIONAL ARGUMENTS
+     Job run resource - The name of the job run you want to describe. The
+     arguments in this group can be used to specify the attributes of this
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways. To set the project attribute:
+      ◆ provide the argument job_run on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       JOB_RUN
+          ID of the job run or fully qualified identifier for the job run. To
+          set the job_run attribute:
+          ▸ provide the argument job_run on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --delivery-pipeline=DELIVERY_PIPELINE
+          The name of the Cloud Deploy delivery pipeline.
+
+          To set the delivery-pipeline attribute:
+          ▸ provide the argument job_run on the command line with a fully
+            specified name;
+          ▸ provide the argument --delivery-pipeline on the command line;
+          ▸ set the property deploy/delivery_pipeline.
+
+       --region=REGION
+          Location of the job run.
+
+          To set the region attribute:
+          ▸ provide the argument job_run on the command line with a fully
+            specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property deploy/region.
+
+       --release=RELEASE
+          The name of the Cloud Deploy release.
+
+          To set the release attribute:
+          ▸ provide the argument job_run on the command line with a fully
+            specified name;
+          ▸ provide the argument --release on the command line.
+
+       --rollout=ROLLOUT
+          The name of the Cloud Deploy rollout.
+
+          To set the rollout attribute:
+          ▸ provide the argument job_run on the command line with a fully
+            specified name;
+          ▸ provide the argument --rollout on the command line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the clouddeploy/v1 API. The full documentation for this
+    API can be found at: https://cloud.google.com/deploy/
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud deploy job-runs describe
+
+        $ gcloud alpha deploy job-runs describe
+
diff --git a/gcloud/beta/deploy/job-runs/help b/gcloud/beta/deploy/job-runs/help
new file mode 100644
index 000000000..a9106f406
--- /dev/null
+++ b/gcloud/beta/deploy/job-runs/help
@@ -0,0 +1,32 @@
+NAME
+    gcloud beta deploy job-runs - manages job runs resources for Google Cloud
+        Deploy
+
+SYNOPSIS
+    gcloud beta deploy job-runs COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Manages job runs resources for Google Cloud Deploy.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     describe
+        (BETA) Show details for a job run.
+
+     list
+        (BETA) List the job runs.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud deploy job-runs
+
+        $ gcloud alpha deploy job-runs
+
diff --git a/gcloud/beta/deploy/job-runs/list b/gcloud/beta/deploy/job-runs/list
new file mode 100644
index 000000000..290702807
--- /dev/null
+++ b/gcloud/beta/deploy/job-runs/list
@@ -0,0 +1,119 @@
+NAME
+    gcloud beta deploy job-runs list - list the job runs
+
+SYNOPSIS
+    gcloud beta deploy job-runs list
+        (--rollout=ROLLOUT : --delivery-pipeline=DELIVERY_PIPELINE
+          --region=REGION --release=RELEASE) [--filter=EXPRESSION]
+        [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) List the job runs for a specified delivery pipeline.
+
+EXAMPLES
+    To list the job runs for delivery pipeline 'test-pipeline', release
+    'test-release', and rollout 'test-rollout' in region 'us-central1', run:
+
+        $ gcloud beta deploy job-runs list \
+            --delivery-pipeline=test-pipeline --release=test-release \
+            --rollout=test-rollout --region=us-central1
+
+REQUIRED FLAGS
+     Rollout resource - The rollouts for which you want to list the job runs.
+     The arguments in this group can be used to specify the attributes of this
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways. To set the project attribute:
+      ◆ provide the argument --rollout on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       --rollout=ROLLOUT
+          ID of the rollout or fully qualified identifier for the rollout. To
+          set the rollout attribute:
+          ▸ provide the argument --rollout on the command line.
+
+          This flag argument must be specified if any of the other arguments in
+          this group are specified.
+
+       --delivery-pipeline=DELIVERY_PIPELINE
+          The name of the Cloud Deploy delivery pipeline.
+
+          To set the delivery-pipeline attribute:
+          ▸ provide the argument --rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --delivery-pipeline on the command line;
+          ▸ set the property deploy/delivery_pipeline.
+
+       --region=REGION
+          Location of the rollout.
+
+          To set the region attribute:
+          ▸ provide the argument --rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property deploy/region.
+
+       --release=RELEASE
+          The name of the Cloud Deploy release.
+
+          To set the release attribute:
+          ▸ provide the argument --rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --release on the command line.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the clouddeploy/v1 API. The full documentation for this
+    API can be found at: https://cloud.google.com/deploy/
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud deploy job-runs list
+
+        $ gcloud alpha deploy job-runs list
+
diff --git a/gcloud/beta/deploy/rollouts/help b/gcloud/beta/deploy/rollouts/help
index b4cc15578..13ce09c6b 100644
--- a/gcloud/beta/deploy/rollouts/help
+++ b/gcloud/beta/deploy/rollouts/help
@@ -28,6 +28,9 @@ COMMANDS
      reject
         (BETA) Rejects a rollout having an Approval state of "Required".
 
+     retry-job
+        (BETA) Retries a specified job, phase combination on a rollout.
+
 NOTES
     This command is currently in beta and might change without notice. These
     variants are also available:
diff --git a/gcloud/beta/deploy/rollouts/retry-job b/gcloud/beta/deploy/rollouts/retry-job
new file mode 100644
index 000000000..5dc54cdfe
--- /dev/null
+++ b/gcloud/beta/deploy/rollouts/retry-job
@@ -0,0 +1,90 @@
+NAME
+    gcloud beta deploy rollouts retry-job - retries a specified job, phase
+        combination on a rollout
+
+SYNOPSIS
+    gcloud beta deploy rollouts retry-job
+        (ROLLOUT : --delivery-pipeline=DELIVERY_PIPELINE
+          --region=REGION --release=RELEASE) --job-id=JOB_ID
+        --phase-id=PHASE_ID [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Retries a specified job, phase combination on a rollout.
+
+EXAMPLES
+    To retry a job 'test-job' in phase 'test-phase' on a rollout 'test-rollout'
+    for delivery pipeline 'test-pipeline', release 'test-release' in region
+    'us-central1', run:
+
+        $ gcloud beta deploy rollouts retry-job test-rollout \
+             --job-id=test-job --phase-id=test-phase \
+             --delivery-pipeline=test-pipeline --release=test-release \
+             --region=us-central1
+
+POSITIONAL ARGUMENTS
+     Rollout resource - The name of the Rollout. The arguments in this group
+     can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways. To set the project attribute:
+      ◆ provide the argument rollout on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       ROLLOUT
+          ID of the rollout or fully qualified identifier for the rollout. To
+          set the rollout attribute:
+          ▸ provide the argument rollout on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --delivery-pipeline=DELIVERY_PIPELINE
+          The delivery pipeline associated with the rollout. Alternatively, set
+          the property [deploy/delivery-pipeline]. To set the delivery-pipeline
+          attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --delivery-pipeline on the command line;
+          ▸ set the property deploy/delivery_pipeline.
+
+       --region=REGION
+          The Cloud region for the rollout. Alternatively, set the property
+          [deploy/region]. To set the region attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property deploy/region.
+
+       --release=RELEASE
+          The release associated with the rollout. To set the release
+          attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --release on the command line.
+
+REQUIRED FLAGS
+     --job-id=JOB_ID
+        Job ID on a rollout resource
+
+     --phase-id=PHASE_ID
+        Phase ID on a rollout resource
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud deploy rollouts retry-job
+
+        $ gcloud alpha deploy rollouts retry-job
+
diff --git a/gcloud/beta/deploy/targets/help b/gcloud/beta/deploy/targets/help
index 5d9fd7c36..120df286c 100644
--- a/gcloud/beta/deploy/targets/help
+++ b/gcloud/beta/deploy/targets/help
@@ -35,6 +35,9 @@ COMMANDS
      list
         (BETA) List Cloud Deploy targets.
 
+     redeploy
+        (BETA) Redeploy the last rollout to a target.
+
      remove-iam-policy-binding
         (BETA) Remove an IAM policy binding for a Cloud Deploy target.
 
diff --git a/gcloud/beta/deploy/targets/redeploy b/gcloud/beta/deploy/targets/redeploy
new file mode 100644
index 000000000..617b0d25c
--- /dev/null
+++ b/gcloud/beta/deploy/targets/redeploy
@@ -0,0 +1,98 @@
+NAME
+    gcloud beta deploy targets redeploy - redeploy the last rollout to a target
+
+SYNOPSIS
+    gcloud beta deploy targets redeploy (TARGET : --region=REGION)
+        --delivery-pipeline=DELIVERY_PIPELINE [--annotations=[KEY=VALUE,...]]
+        [--description=DESCRIPTION] [--labels=[KEY=VALUE,...]]
+        [--rollout-id=ROLLOUT_ID] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Redeploy the last rollout that has a state of SUCCESSFUL or FAILED
+    to a target. If rollout-id is not specified, a rollout ID will be
+    generated.
+
+EXAMPLES
+    To redeploy a target prod for delivery pipeline test-pipeline in region
+    us-central1, run:
+
+        $ gcloud beta deploy targets redeploy prod \
+            --delivery-pipeline=test-pipeline --region=us-central1
+
+POSITIONAL ARGUMENTS
+     Target resource - The name of the Target. The arguments in this group can
+     be used to specify the attributes of this resource. (NOTE) Some attributes
+     are not given arguments in this group but can be set in other ways. To set
+     the project attribute:
+      ◆ provide the argument target on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       TARGET
+          ID of the target or fully qualified identifier for the target. To set
+          the target attribute:
+          ▸ provide the argument target on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --region=REGION
+          The Cloud region for the target. Alternatively, set the property
+          [deploy/region]. To set the region attribute:
+          ▸ provide the argument target on the command line with a fully
+            specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property deploy/region.
+
+REQUIRED FLAGS
+     --delivery-pipeline=DELIVERY_PIPELINE
+        The name of the Cloud Deploy delivery pipeline
+
+OPTIONAL FLAGS
+     --annotations=[KEY=VALUE,...]
+        Annotations to apply to the rollout. Annotations take the form of
+        key/value string pairs.
+
+        Examples:
+
+        Add annotations:
+
+            $ gcloud beta deploy targets redeploy \
+                --annotations="from_target=test,status=stable"
+
+     --description=DESCRIPTION
+        Description of rollout created during a rollback.
+
+     --labels=[KEY=VALUE,...]
+        Labels to apply to the rollout. Labels take the form of key/value
+        string pairs.
+
+        Examples:
+
+        Add labels:
+
+            $ gcloud beta deploy targets redeploy \
+                --labels="commit=abc123,author=foo"
+
+     --rollout-id=ROLLOUT_ID
+        ID to assign to the generated rollout for promotion.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud deploy targets redeploy
+
+        $ gcloud alpha deploy targets redeploy
+
diff --git a/gcloud/beta/ids/endpoints/create b/gcloud/beta/ids/endpoints/create
index 8341ffebc..ce73c6956 100644
--- a/gcloud/beta/ids/endpoints/create
+++ b/gcloud/beta/ids/endpoints/create
@@ -42,17 +42,17 @@ POSITIONAL ARGUMENTS
           arguments in this group are specified.
 
        --zone=ZONE
-          The zone of the endpoint. To set the zone attribute:
+          Zone of the endpoint. To set the zone attribute:
           ▸ provide the argument endpoint on the command line with a fully
             specified name;
           ▸ provide the argument --zone on the command line.
 
 REQUIRED FLAGS
      --network=NETWORK
-        The name of the VPC network to monitor
+        Name of the VPC network to monitor
 
      --severity=SEVERITY
-        The minimum severity of threats to report on. SEVERITY must be one of:
+        Minimum severity of threats to report on. SEVERITY must be one of:
         INFORMATIONAL, LOW, MEDIUM, HIGH, CRITICAL.
 
 OPTIONAL FLAGS
diff --git a/gcloud/beta/ids/endpoints/delete b/gcloud/beta/ids/endpoints/delete
index 9b6332f93..899fbfc2d 100644
--- a/gcloud/beta/ids/endpoints/delete
+++ b/gcloud/beta/ids/endpoints/delete
@@ -41,7 +41,7 @@ POSITIONAL ARGUMENTS
           arguments in this group are specified.
 
        --zone=ZONE
-          The zone of the endpoint. To set the zone attribute:
+          Zone of the endpoint. To set the zone attribute:
           ▸ provide the argument endpoint on the command line with a fully
             specified name;
           ▸ provide the argument --zone on the command line.
diff --git a/gcloud/beta/ids/endpoints/describe b/gcloud/beta/ids/endpoints/describe
index 3f0e05593..954ac95f2 100644
--- a/gcloud/beta/ids/endpoints/describe
+++ b/gcloud/beta/ids/endpoints/describe
@@ -41,7 +41,7 @@ POSITIONAL ARGUMENTS
           arguments in this group are specified.
 
        --zone=ZONE
-          The zone of the endpoint. To set the zone attribute:
+          Zone of the endpoint. To set the zone attribute:
           ▸ provide the argument endpoint on the command line with a fully
             specified name;
           ▸ provide the argument --zone on the command line.
diff --git a/gcloud/compute/backend-services/add-iam-policy-binding b/gcloud/compute/backend-services/add-iam-policy-binding
new file mode 100644
index 000000000..d6bd16fa9
--- /dev/null
+++ b/gcloud/compute/backend-services/add-iam-policy-binding
@@ -0,0 +1,94 @@
+NAME
+    gcloud compute backend-services add-iam-policy-binding - add an IAM policy
+        binding to a Compute Engine backend service
+
+SYNOPSIS
+    gcloud compute backend-services add-iam-policy-binding
+        (BACKEND_SERVICE : --region=REGION) --member=PRINCIPAL --role=ROLE
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Add an IAM policy binding to a Compute Engine backend service.
+
+EXAMPLES
+    To add an IAM policy binding for the role of
+    'compute.loadBalancerServiceUser' for the user 'test-user@gmail.com' with
+    backend service 'my-backend-service' and region 'REGION', run:
+
+        $ gcloud compute backend-services add-iam-policy-binding \
+            my-backend-service --region=REGION \
+            --member='user:test-user@gmail.com' \
+            --role='roles/compute.loadBalancerServiceUser'
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of
+    policy role and member types.
+
+POSITIONAL ARGUMENTS
+     Backend service resource - The backend service for which to add the IAM
+     policy to. The arguments in this group can be used to specify the
+     attributes of this resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways. To set the project
+     attribute:
+      ◆ provide the argument backend_service on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       BACKEND_SERVICE
+          ID of the backend service or fully qualified identifier for the
+          backend service. To set the backend_service attribute:
+          ▸ provide the argument backend_service on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --region=REGION
+          The name of the Google Compute Engine region. To set the region
+          attribute:
+          ▸ provide the argument backend_service on the command line with a
+            fully specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property compute/region.
+
+REQUIRED FLAGS
+     --member=PRINCIPAL
+        The principal to add the binding for. Should be of the form
+        user|group|serviceAccount:email or domain:domain.
+
+        Examples: user:test-user@gmail.com, group:admins@example.com,
+        serviceAccount:test123@example.domain.com, or
+        domain:example.domain.com.
+
+        Some resources also accept the following special values:
+        ◆ allUsers - Special identifier that represents anyone who is on the
+          internet, with or without a Google account.
+        ◆ allAuthenticatedUsers - Special identifier that represents anyone
+          who is authenticated with a Google account or a service account.
+
+     --role=ROLE
+        Role name to assign to the principal. The role name is the complete
+        path of a predefined role, such as roles/logging.viewer, or the role ID
+        for a custom role, such as
+        organizations/{ORGANIZATION_ID}/roles/logging.viewer.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the compute/v1 API. The full documentation for this API
+    can be found at: https://cloud.google.com/compute/
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute backend-services add-iam-policy-binding
+
+        $ gcloud beta compute backend-services add-iam-policy-binding
+
diff --git a/gcloud/compute/backend-services/get-iam-policy b/gcloud/compute/backend-services/get-iam-policy
new file mode 100644
index 000000000..848316679
--- /dev/null
+++ b/gcloud/compute/backend-services/get-iam-policy
@@ -0,0 +1,97 @@
+NAME
+    gcloud compute backend-services get-iam-policy - get the IAM policy for a
+        Compute Engine backend service
+
+SYNOPSIS
+    gcloud compute backend-services get-iam-policy
+        (BACKEND_SERVICE : --region=REGION) [--filter=EXPRESSION]
+        [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud compute backend-services get-iam-policy displays the IAM policy
+    associated with a Compute Engine backend service in a project. If formatted
+    as JSON, the output can be edited and used as a policy file for
+    set-iam-policy. The output includes an "etag" field identifying the version
+    emitted and allowing detection of concurrent policy updates; see $ {parent}
+    set-iam-policy for additional details.
+
+EXAMPLES
+    To print the IAM policy for a given backend service, run:
+
+        $ gcloud compute backend-services get-iam-policy \
+            my-backend-service --region=REGION
+
+POSITIONAL ARGUMENTS
+     Backend service resource - The network to display the IAM policy for. The
+     arguments in this group can be used to specify the attributes of this
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways. To set the project attribute:
+      ◆ provide the argument backend_service on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       BACKEND_SERVICE
+          ID of the backend service or fully qualified identifier for the
+          backend service. To set the backend_service attribute:
+          ▸ provide the argument backend_service on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --region=REGION
+          The name of the Google Compute Engine region. To set the region
+          attribute:
+          ▸ provide the argument backend_service on the command line with a
+            fully specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property compute/region.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the compute/v1 API. The full documentation for this API
+    can be found at: https://cloud.google.com/compute/
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute backend-services get-iam-policy
+
+        $ gcloud beta compute backend-services get-iam-policy
+
diff --git a/gcloud/compute/backend-services/help b/gcloud/compute/backend-services/help
index 26b7b278d..250628b10 100644
--- a/gcloud/compute/backend-services/help
+++ b/gcloud/compute/backend-services/help
@@ -27,6 +27,9 @@ COMMANDS
      add-backend
         Add a backend to a backend service.
 
+     add-iam-policy-binding
+        Add an IAM policy binding to a Compute Engine backend service.
+
      add-service-bindings
         Add service bindings to a backend service.
 
@@ -54,6 +57,9 @@ COMMANDS
      get-health
         Get backend health statuses from a backend service.
 
+     get-iam-policy
+        Get the IAM policy for a Compute Engine backend service.
+
      import
         Import a backend service.
 
@@ -63,9 +69,15 @@ COMMANDS
      remove-backend
         Remove a backend from a backend service.
 
+     remove-iam-policy-binding
+        Remove an IAM policy binding from a Compute Engine backend service.
+
      remove-service-bindings
         Remove service bindings from a backend service.
 
+     set-iam-policy
+        Set the IAM policy binding for a Compute Engine backend service.
+
      update
         Update a backend service.
 
diff --git a/gcloud/compute/backend-services/remove-iam-policy-binding b/gcloud/compute/backend-services/remove-iam-policy-binding
new file mode 100644
index 000000000..1432cde14
--- /dev/null
+++ b/gcloud/compute/backend-services/remove-iam-policy-binding
@@ -0,0 +1,95 @@
+NAME
+    gcloud compute backend-services remove-iam-policy-binding - remove an IAM
+        policy binding from a Compute Engine backend service
+
+SYNOPSIS
+    gcloud compute backend-services remove-iam-policy-binding
+        (BACKEND_SERVICE : --region=REGION) --member=PRINCIPAL --role=ROLE
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Remove an IAM policy binding from a Compute Engine backend service.
+
+EXAMPLES
+    To remove an IAM policy binding for the role of
+    'roles/compute.loadBalancerServiceUser' for the user 'test-user@gmail.com'
+    with backend service 'my-backend-service' and region 'REGION', run:
+
+        $ gcloud compute backend-services remove-iam-policy-binding \
+            my-backend-service --region=REGION \
+            --member='user:test-user@gmail.com' \
+            --role='roles/compute.loadBalancerServiceUser'
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of
+    policy role and member types.
+
+POSITIONAL ARGUMENTS
+     Backend service resource - The backend service for which to remove the IAM
+     policy from. The arguments in this group can be used to specify the
+     attributes of this resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways. To set the project
+     attribute:
+      ◆ provide the argument backend_service on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       BACKEND_SERVICE
+          ID of the backend service or fully qualified identifier for the
+          backend service. To set the backend_service attribute:
+          ▸ provide the argument backend_service on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --region=REGION
+          The name of the Google Compute Engine region. To set the region
+          attribute:
+          ▸ provide the argument backend_service on the command line with a
+            fully specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property compute/region.
+
+REQUIRED FLAGS
+     --member=PRINCIPAL
+        The principal to remove the binding for. Should be of the form
+        user|group|serviceAccount:email or domain:domain.
+
+        Examples: user:test-user@gmail.com, group:admins@example.com,
+        serviceAccount:test123@example.domain.com, or
+        domain:example.domain.com.
+
+        Deleted principals have an additional deleted: prefix and a ?uid=UID
+        suffix, where UID is a unique identifier for the principal. Example:
+        deleted:user:test-user@gmail.com?uid=123456789012345678901.
+
+        Some resources also accept the following special values:
+        ◆ allUsers - Special identifier that represents anyone who is on the
+          internet, with or without a Google account.
+        ◆ allAuthenticatedUsers - Special identifier that represents anyone
+          who is authenticated with a Google account or a service account.
+
+     --role=ROLE
+        The role to remove the principal from.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the compute/v1 API. The full documentation for this API
+    can be found at: https://cloud.google.com/compute/
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute backend-services remove-iam-policy-binding
+
+        $ gcloud beta compute backend-services remove-iam-policy-binding
+
diff --git a/gcloud/compute/backend-services/set-iam-policy b/gcloud/compute/backend-services/set-iam-policy
new file mode 100644
index 000000000..c7ddc956c
--- /dev/null
+++ b/gcloud/compute/backend-services/set-iam-policy
@@ -0,0 +1,76 @@
+NAME
+    gcloud compute backend-services set-iam-policy - set the IAM policy binding
+        for a Compute Engine backend service
+
+SYNOPSIS
+    gcloud compute backend-services set-iam-policy
+        (BACKEND_SERVICE : --region=REGION) POLICY_FILE [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Sets the IAM policy for the given backend service as defined in a JSON or
+    YAML file.
+
+EXAMPLES
+    The following command will read am IAM policy defined in a JSON file
+    'policy.json' and set it for the backend service my-backend-service:
+
+        $ gcloud compute backend-services set-iam-policy \
+            my-backend-service policy.json --region=REGION
+
+    See https://cloud.google.com/iam/docs/managing-policies for details of the
+    policy file format and contents.
+
+POSITIONAL ARGUMENTS
+     Backend service resource - The backend service to set the IAM policy for.
+     The arguments in this group can be used to specify the attributes of this
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways. To set the project attribute:
+      ◆ provide the argument backend_service on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       BACKEND_SERVICE
+          ID of the backend service or fully qualified identifier for the
+          backend service. To set the backend_service attribute:
+          ▸ provide the argument backend_service on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --region=REGION
+          The name of the Google Compute Engine region. To set the region
+          attribute:
+          ▸ provide the argument backend_service on the command line with a
+            fully specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property compute/region.
+
+     POLICY_FILE
+        Path to a local JSON or YAML formatted file containing a valid policy.
+
+        The output of the get-iam-policy command is a valid file, as is any
+        JSON or YAML file conforming to the structure of a Policy
+        (https://cloud.google.com/iam/reference/rest/v1/Policy).
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the compute/v1 API. The full documentation for this API
+    can be found at: https://cloud.google.com/compute/
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute backend-services set-iam-policy
+
+        $ gcloud beta compute backend-services set-iam-policy
+
diff --git a/gcloud/compute/backend-services/update b/gcloud/compute/backend-services/update
index e26ad4921..0bbe4a46f 100644
--- a/gcloud/compute/backend-services/update
+++ b/gcloud/compute/backend-services/update
@@ -183,7 +183,8 @@ FLAGS
         service.
 
      --no-health-checks
-        Removes all health checks for the backend service.
+        Removes all health checks for the backend service if the backend
+        service has no backends attached.
 
      --http-health-checks=HTTP_HEALTH_CHECK,[...]
         Specifies a list of legacy HTTP health check objects for checking the
diff --git a/gcloud/config/get b/gcloud/config/get
index 18e65d85c..45c5ab36d 100644
--- a/gcloud/config/get
+++ b/gcloud/config/get
@@ -1044,6 +1044,11 @@ AVAILABLE PROPERTIES
          max_retry_delay
             Max second delay between retriable operations.
 
+         parallel_composite_upload_compatibility_check
+            Determines if the GET bucket call should be performed to check if
+            the default storage class and retention period for the destination
+            bucket meet the criteria for parallel composite upload.
+
          parallel_composite_upload_component_size
             Specifies the ideal size of a component in bytes, which will act as
             an upper bound to the size of the components if ceil(file_size /
@@ -1052,6 +1057,12 @@ AVAILABLE PROPERTIES
             provided either in bytes or as human-readable values (e.g., "150M"
             to represent 150 mebibytes).
 
+         parallel_composite_upload_enabled
+            Determines whether parallel composite upload should be used.
+            Default value is None which will use parallel composite upload and
+            log an appropriate warning for the user explaining that parallel
+            composite upload is being used by default.
+
          parallel_composite_upload_threshold
             Specifies the maximum size of a file to upload in a single stream.
             Files larger than this threshold will be partitioned into component
@@ -1059,8 +1070,8 @@ AVAILABLE PROPERTIES
             The number of components will be the smaller of ceil(file_size /
             parallel_composite_upload_component_size) and the maximum number of
             objects the API allows composing at once. For Cloud Storage this
-            limit is 32. If this property is set to 0, then automatic parallel
-            uploads will never occur.
+            limit is 32. This property has no effect if
+            parallel_composite_upload_enabled is set to False.
 
          process_count
             The maximum number of processes parallel execution should use. When
diff --git a/gcloud/config/help b/gcloud/config/help
index f6724d033..1fac7dd18 100644
--- a/gcloud/config/help
+++ b/gcloud/config/help
@@ -1076,6 +1076,11 @@ AVAILABLE PROPERTIES
          max_retry_delay
             Max second delay between retriable operations.
 
+         parallel_composite_upload_compatibility_check
+            Determines if the GET bucket call should be performed to check if
+            the default storage class and retention period for the destination
+            bucket meet the criteria for parallel composite upload.
+
          parallel_composite_upload_component_size
             Specifies the ideal size of a component in bytes, which will act as
             an upper bound to the size of the components if ceil(file_size /
@@ -1084,6 +1089,12 @@ AVAILABLE PROPERTIES
             provided either in bytes or as human-readable values (e.g., "150M"
             to represent 150 mebibytes).
 
+         parallel_composite_upload_enabled
+            Determines whether parallel composite upload should be used.
+            Default value is None which will use parallel composite upload and
+            log an appropriate warning for the user explaining that parallel
+            composite upload is being used by default.
+
          parallel_composite_upload_threshold
             Specifies the maximum size of a file to upload in a single stream.
             Files larger than this threshold will be partitioned into component
@@ -1091,8 +1102,8 @@ AVAILABLE PROPERTIES
             The number of components will be the smaller of ceil(file_size /
             parallel_composite_upload_component_size) and the maximum number of
             objects the API allows composing at once. For Cloud Storage this
-            limit is 32. If this property is set to 0, then automatic parallel
-            uploads will never occur.
+            limit is 32. This property has no effect if
+            parallel_composite_upload_enabled is set to False.
 
          process_count
             The maximum number of processes parallel execution should use. When
diff --git a/gcloud/config/list b/gcloud/config/list
index cd28b33fc..a82aac6de 100644
--- a/gcloud/config/list
+++ b/gcloud/config/list
@@ -1081,6 +1081,11 @@ AVAILABLE PROPERTIES
          max_retry_delay
             Max second delay between retriable operations.
 
+         parallel_composite_upload_compatibility_check
+            Determines if the GET bucket call should be performed to check if
+            the default storage class and retention period for the destination
+            bucket meet the criteria for parallel composite upload.
+
          parallel_composite_upload_component_size
             Specifies the ideal size of a component in bytes, which will act as
             an upper bound to the size of the components if ceil(file_size /
@@ -1089,6 +1094,12 @@ AVAILABLE PROPERTIES
             provided either in bytes or as human-readable values (e.g., "150M"
             to represent 150 mebibytes).
 
+         parallel_composite_upload_enabled
+            Determines whether parallel composite upload should be used.
+            Default value is None which will use parallel composite upload and
+            log an appropriate warning for the user explaining that parallel
+            composite upload is being used by default.
+
          parallel_composite_upload_threshold
             Specifies the maximum size of a file to upload in a single stream.
             Files larger than this threshold will be partitioned into component
@@ -1096,8 +1107,8 @@ AVAILABLE PROPERTIES
             The number of components will be the smaller of ceil(file_size /
             parallel_composite_upload_component_size) and the maximum number of
             objects the API allows composing at once. For Cloud Storage this
-            limit is 32. If this property is set to 0, then automatic parallel
-            uploads will never occur.
+            limit is 32. This property has no effect if
+            parallel_composite_upload_enabled is set to False.
 
          process_count
             The maximum number of processes parallel execution should use. When
diff --git a/gcloud/config/set b/gcloud/config/set
index 90dc82748..a15c822be 100644
--- a/gcloud/config/set
+++ b/gcloud/config/set
@@ -1091,6 +1091,11 @@ AVAILABLE PROPERTIES
          max_retry_delay
             Max second delay between retriable operations.
 
+         parallel_composite_upload_compatibility_check
+            Determines if the GET bucket call should be performed to check if
+            the default storage class and retention period for the destination
+            bucket meet the criteria for parallel composite upload.
+
          parallel_composite_upload_component_size
             Specifies the ideal size of a component in bytes, which will act as
             an upper bound to the size of the components if ceil(file_size /
@@ -1099,6 +1104,12 @@ AVAILABLE PROPERTIES
             provided either in bytes or as human-readable values (e.g., "150M"
             to represent 150 mebibytes).
 
+         parallel_composite_upload_enabled
+            Determines whether parallel composite upload should be used.
+            Default value is None which will use parallel composite upload and
+            log an appropriate warning for the user explaining that parallel
+            composite upload is being used by default.
+
          parallel_composite_upload_threshold
             Specifies the maximum size of a file to upload in a single stream.
             Files larger than this threshold will be partitioned into component
@@ -1106,8 +1117,8 @@ AVAILABLE PROPERTIES
             The number of components will be the smaller of ceil(file_size /
             parallel_composite_upload_component_size) and the maximum number of
             objects the API allows composing at once. For Cloud Storage this
-            limit is 32. If this property is set to 0, then automatic parallel
-            uploads will never occur.
+            limit is 32. This property has no effect if
+            parallel_composite_upload_enabled is set to False.
 
          process_count
             The maximum number of processes parallel execution should use. When
diff --git a/gcloud/config/unset b/gcloud/config/unset
index 16317ad0b..c76f64236 100644
--- a/gcloud/config/unset
+++ b/gcloud/config/unset
@@ -1052,6 +1052,11 @@ AVAILABLE PROPERTIES
          max_retry_delay
             Max second delay between retriable operations.
 
+         parallel_composite_upload_compatibility_check
+            Determines if the GET bucket call should be performed to check if
+            the default storage class and retention period for the destination
+            bucket meet the criteria for parallel composite upload.
+
          parallel_composite_upload_component_size
             Specifies the ideal size of a component in bytes, which will act as
             an upper bound to the size of the components if ceil(file_size /
@@ -1060,6 +1065,12 @@ AVAILABLE PROPERTIES
             provided either in bytes or as human-readable values (e.g., "150M"
             to represent 150 mebibytes).
 
+         parallel_composite_upload_enabled
+            Determines whether parallel composite upload should be used.
+            Default value is None which will use parallel composite upload and
+            log an appropriate warning for the user explaining that parallel
+            composite upload is being used by default.
+
          parallel_composite_upload_threshold
             Specifies the maximum size of a file to upload in a single stream.
             Files larger than this threshold will be partitioned into component
@@ -1067,8 +1078,8 @@ AVAILABLE PROPERTIES
             The number of components will be the smaller of ceil(file_size /
             parallel_composite_upload_component_size) and the maximum number of
             objects the API allows composing at once. For Cloud Storage this
-            limit is 32. If this property is set to 0, then automatic parallel
-            uploads will never occur.
+            limit is 32. This property has no effect if
+            parallel_composite_upload_enabled is set to False.
 
          process_count
             The maximum number of processes parallel execution should use. When
diff --git a/gcloud/container/aws/node-pools/create b/gcloud/container/aws/node-pools/create
index 31ed22017..c75d4ca29 100644
--- a/gcloud/container/aws/node-pools/create
+++ b/gcloud/container/aws/node-pools/create
@@ -7,7 +7,8 @@ SYNOPSIS
         (NODE_POOL : --cluster=CLUSTER --location=LOCATION)
         --config-encryption-kms-key-arn=CONFIG_ENCRYPTION_KMS_KEY_ARN
         --iam-instance-profile=IAM_INSTANCE_PROFILE --node-version=NODE_VERSION
-        --subnet-id=SUBNET_ID [--async] [--instance-type=INSTANCE_TYPE]
+        --subnet-id=SUBNET_ID [--annotations=ANNOTATION,[ANNOTATION,...]]
+        [--async] [--instance-type=INSTANCE_TYPE]
         [--max-pods-per-node=MAX_PODS_PER_NODE]
         [--node-labels=NODE_LABEL,[NODE_LABEL,...]]
         [--node-taints=NODE_TAINT,[NODE_TAINT,...]]
@@ -82,6 +83,9 @@ REQUIRED FLAGS
         Subnet ID of an existing VNET to use for the node pool.
 
 OPTIONAL FLAGS
+     --annotations=ANNOTATION,[ANNOTATION,...]
+        Annotations for the node pool.
+
      --async
         Return immediately, without waiting for the operation in progress to
         complete.
diff --git a/gcloud/container/aws/node-pools/update b/gcloud/container/aws/node-pools/update
index 510de798a..16faace0b 100644
--- a/gcloud/container/aws/node-pools/update
+++ b/gcloud/container/aws/node-pools/update
@@ -11,6 +11,7 @@ SYNOPSIS
         [--root-volume-kms-key-arn=ROOT_VOLUME_KMS_KEY_ARN]
         [--root-volume-size=ROOT_VOLUME_SIZE]
         [--root-volume-type=ROOT_VOLUME_TYPE] [--validate-only]
+        [--annotations=ANNOTATION,[ANNOTATION,...] | --clear-annotations]
         [--clear-proxy-config | --proxy-secret-arn=PROXY_SECRET_ARN
           --proxy-secret-version-id=PROXY_SECRET_VERSION_ID]
         [--clear-security-group-ids
@@ -96,6 +97,16 @@ FLAGS
      --validate-only
         Validate the node pool to update, but don't actually perform it.
 
+     Annotations
+
+     At most one of these can be specified:
+
+       --annotations=ANNOTATION,[ANNOTATION,...]
+          Annotations for the node pool.
+
+       --clear-annotations
+          Clear the annotations for the node pool.
+
      Proxy config
 
      At most one of these can be specified:
diff --git a/gcloud/container/fleet/mesh/update b/gcloud/container/fleet/mesh/update
index ee6b1bec8..4338385c6 100644
--- a/gcloud/container/fleet/mesh/update
+++ b/gcloud/container/fleet/mesh/update
@@ -3,7 +3,8 @@ NAME
         Service Mesh Feature
 
 SYNOPSIS
-    gcloud container fleet mesh update --control-plane=CONTROL_PLANE
+    gcloud container fleet mesh update
+        (--control-plane=CONTROL_PLANE --management=MANAGEMENT)
         [--memberships=MEMBERSHIPS] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
@@ -18,9 +19,15 @@ EXAMPLES
             --control-plane=CONTROL_PLANE
 
 REQUIRED FLAGS
-     --control-plane=CONTROL_PLANE
-        Control plane management to update to. CONTROL_PLANE must be one of:
-        automatic, manual.
+     At least one of these must be specified:
+
+       --control-plane=CONTROL_PLANE
+          Control plane management to update to. CONTROL_PLANE must be one of:
+          automatic, manual.
+
+       --management=MANAGEMENT
+          The management mode to update to. MANAGEMENT must be one of:
+          automatic, manual.
 
 OPTIONAL FLAGS
      --memberships=MEMBERSHIPS
diff --git a/gcloud/container/hub/mesh/update b/gcloud/container/hub/mesh/update
index 2480bcc9e..9b393871d 100644
--- a/gcloud/container/hub/mesh/update
+++ b/gcloud/container/hub/mesh/update
@@ -3,7 +3,8 @@ NAME
         Mesh Feature
 
 SYNOPSIS
-    gcloud container hub mesh update --control-plane=CONTROL_PLANE
+    gcloud container hub mesh update
+        (--control-plane=CONTROL_PLANE --management=MANAGEMENT)
         [--memberships=MEMBERSHIPS] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
@@ -18,9 +19,15 @@ EXAMPLES
             --control-plane=CONTROL_PLANE
 
 REQUIRED FLAGS
-     --control-plane=CONTROL_PLANE
-        Control plane management to update to. CONTROL_PLANE must be one of:
-        automatic, manual.
+     At least one of these must be specified:
+
+       --control-plane=CONTROL_PLANE
+          Control plane management to update to. CONTROL_PLANE must be one of:
+          automatic, manual.
+
+       --management=MANAGEMENT
+          The management mode to update to. MANAGEMENT must be one of:
+          automatic, manual.
 
 OPTIONAL FLAGS
      --memberships=MEMBERSHIPS
diff --git a/gcloud/dataproc/batches/list b/gcloud/dataproc/batches/list
index 35921c8ba..51fb9be5a 100644
--- a/gcloud/dataproc/batches/list
+++ b/gcloud/dataproc/batches/list
@@ -3,7 +3,8 @@ NAME
 
 SYNOPSIS
     gcloud dataproc batches list [--region=REGION] [--limit=LIMIT]
-        [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
+        [--page-size=PAGE_SIZE; default=100] [--sort-by=[FIELD,...]]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     List batch jobs in a project. Page-size sets the maximum number of jobs
@@ -27,12 +28,11 @@ LIST COMMAND FLAGS
         flag interacts with other flags that are applied in this order:
         --flatten, --sort-by, --filter, --limit.
 
-     --page-size=PAGE_SIZE
+     --page-size=PAGE_SIZE; default=100
         Some services group resource list output into pages. This flag
-        specifies the maximum number of resources per page. The default is
-        determined by the service if it supports paging, otherwise it is
-        unlimited (no paging). Paging may be applied before or after --filter
-        and --limit depending on the service.
+        specifies the maximum number of resources per page. The default is 100.
+        Paging may be applied before or after --filter and --limit depending on
+        the service.
 
      --sort-by=[FIELD,...]
         Comma-separated list of resource field key names to sort by. The
diff --git a/gcloud/deploy/help b/gcloud/deploy/help
index 60549da14..27a08e561 100644
--- a/gcloud/deploy/help
+++ b/gcloud/deploy/help
@@ -18,6 +18,9 @@ GROUPS
      delivery-pipelines
         Create and manage Delivery Pipeline resources for Google Cloud Deploy.
 
+     job-runs
+        Manages job runs resources for Google Cloud Deploy.
+
      releases
         Create and manage Release resources for Google Cloud Deploy.
 
diff --git a/gcloud/deploy/job-runs/describe b/gcloud/deploy/job-runs/describe
new file mode 100644
index 000000000..7bd4d16e5
--- /dev/null
+++ b/gcloud/deploy/job-runs/describe
@@ -0,0 +1,94 @@
+NAME
+    gcloud deploy job-runs describe - show details for a job run
+
+SYNOPSIS
+    gcloud deploy job-runs describe
+        (JOB_RUN : --delivery-pipeline=DELIVERY_PIPELINE
+          --region=REGION --release=RELEASE --rollout=ROLLOUT)
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Show details for a specified job run.
+
+EXAMPLES
+    To show details about a job run 'test-jobrun', for delivery pipeline
+    'test-pipeline', release 'test-release', rollout 'test-rollout', in region
+    'us-central1', run:
+
+        $ gcloud deploy job-runs describe test-jobrun \
+            --delivery-pipeline=test-pipeline --release=test-release \
+            --rollout=test-rollout --region=us-central1
+
+POSITIONAL ARGUMENTS
+     Job run resource - The name of the job run you want to describe. The
+     arguments in this group can be used to specify the attributes of this
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways. To set the project attribute:
+      ◆ provide the argument job_run on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       JOB_RUN
+          ID of the job run or fully qualified identifier for the job run. To
+          set the job_run attribute:
+          ▸ provide the argument job_run on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --delivery-pipeline=DELIVERY_PIPELINE
+          The name of the Cloud Deploy delivery pipeline.
+
+          To set the delivery-pipeline attribute:
+          ▸ provide the argument job_run on the command line with a fully
+            specified name;
+          ▸ provide the argument --delivery-pipeline on the command line;
+          ▸ set the property deploy/delivery_pipeline.
+
+       --region=REGION
+          Location of the job run.
+
+          To set the region attribute:
+          ▸ provide the argument job_run on the command line with a fully
+            specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property deploy/region.
+
+       --release=RELEASE
+          The name of the Cloud Deploy release.
+
+          To set the release attribute:
+          ▸ provide the argument job_run on the command line with a fully
+            specified name;
+          ▸ provide the argument --release on the command line.
+
+       --rollout=ROLLOUT
+          The name of the Cloud Deploy rollout.
+
+          To set the rollout attribute:
+          ▸ provide the argument job_run on the command line with a fully
+            specified name;
+          ▸ provide the argument --rollout on the command line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the clouddeploy/v1 API. The full documentation for this
+    API can be found at: https://cloud.google.com/deploy/
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha deploy job-runs describe
+
+        $ gcloud beta deploy job-runs describe
+
diff --git a/gcloud/deploy/job-runs/help b/gcloud/deploy/job-runs/help
new file mode 100644
index 000000000..849f4f366
--- /dev/null
+++ b/gcloud/deploy/job-runs/help
@@ -0,0 +1,30 @@
+NAME
+    gcloud deploy job-runs - manages job runs resources for Google Cloud Deploy
+
+SYNOPSIS
+    gcloud deploy job-runs COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Manages job runs resources for Google Cloud Deploy.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     describe
+        Show details for a job run.
+
+     list
+        List the job runs.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha deploy job-runs
+
+        $ gcloud beta deploy job-runs
+
diff --git a/gcloud/deploy/job-runs/list b/gcloud/deploy/job-runs/list
new file mode 100644
index 000000000..50e79d7f9
--- /dev/null
+++ b/gcloud/deploy/job-runs/list
@@ -0,0 +1,118 @@
+NAME
+    gcloud deploy job-runs list - list the job runs
+
+SYNOPSIS
+    gcloud deploy job-runs list
+        (--rollout=ROLLOUT : --delivery-pipeline=DELIVERY_PIPELINE
+          --region=REGION --release=RELEASE) [--filter=EXPRESSION]
+        [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    List the job runs for a specified delivery pipeline.
+
+EXAMPLES
+    To list the job runs for delivery pipeline 'test-pipeline', release
+    'test-release', and rollout 'test-rollout' in region 'us-central1', run:
+
+        $ gcloud deploy job-runs list --delivery-pipeline=test-pipeline \
+            --release=test-release --rollout=test-rollout \
+            --region=us-central1
+
+REQUIRED FLAGS
+     Rollout resource - The rollouts for which you want to list the job runs.
+     The arguments in this group can be used to specify the attributes of this
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways. To set the project attribute:
+      ◆ provide the argument --rollout on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       --rollout=ROLLOUT
+          ID of the rollout or fully qualified identifier for the rollout. To
+          set the rollout attribute:
+          ▸ provide the argument --rollout on the command line.
+
+          This flag argument must be specified if any of the other arguments in
+          this group are specified.
+
+       --delivery-pipeline=DELIVERY_PIPELINE
+          The name of the Cloud Deploy delivery pipeline.
+
+          To set the delivery-pipeline attribute:
+          ▸ provide the argument --rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --delivery-pipeline on the command line;
+          ▸ set the property deploy/delivery_pipeline.
+
+       --region=REGION
+          Location of the rollout.
+
+          To set the region attribute:
+          ▸ provide the argument --rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property deploy/region.
+
+       --release=RELEASE
+          The name of the Cloud Deploy release.
+
+          To set the release attribute:
+          ▸ provide the argument --rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --release on the command line.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the clouddeploy/v1 API. The full documentation for this
+    API can be found at: https://cloud.google.com/deploy/
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha deploy job-runs list
+
+        $ gcloud beta deploy job-runs list
+
diff --git a/gcloud/deploy/rollouts/help b/gcloud/deploy/rollouts/help
index 6f9c6aace..d4081cb37 100644
--- a/gcloud/deploy/rollouts/help
+++ b/gcloud/deploy/rollouts/help
@@ -28,6 +28,9 @@ COMMANDS
      reject
         Rejects a rollout having an Approval state of "Required".
 
+     retry-job
+        Retries a specified job, phase combination on a rollout.
+
 NOTES
     These variants are also available:
 
diff --git a/gcloud/deploy/rollouts/retry-job b/gcloud/deploy/rollouts/retry-job
new file mode 100644
index 000000000..cb831cbbc
--- /dev/null
+++ b/gcloud/deploy/rollouts/retry-job
@@ -0,0 +1,88 @@
+NAME
+    gcloud deploy rollouts retry-job - retries a specified job, phase
+        combination on a rollout
+
+SYNOPSIS
+    gcloud deploy rollouts retry-job
+        (ROLLOUT : --delivery-pipeline=DELIVERY_PIPELINE
+          --region=REGION --release=RELEASE) --job-id=JOB_ID
+        --phase-id=PHASE_ID [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Retries a specified job, phase combination on a rollout.
+
+EXAMPLES
+    To retry a job 'test-job' in phase 'test-phase' on a rollout 'test-rollout'
+    for delivery pipeline 'test-pipeline', release 'test-release' in region
+    'us-central1', run:
+
+        $ gcloud deploy rollouts retry-job test-rollout --job-id=test-job \
+             --phase-id=test-phase --delivery-pipeline=test-pipeline \
+             --release=test-release --region=us-central1
+
+POSITIONAL ARGUMENTS
+     Rollout resource - The name of the Rollout. The arguments in this group
+     can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways. To set the project attribute:
+      ◆ provide the argument rollout on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       ROLLOUT
+          ID of the rollout or fully qualified identifier for the rollout. To
+          set the rollout attribute:
+          ▸ provide the argument rollout on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --delivery-pipeline=DELIVERY_PIPELINE
+          The delivery pipeline associated with the rollout. Alternatively, set
+          the property [deploy/delivery-pipeline]. To set the delivery-pipeline
+          attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --delivery-pipeline on the command line;
+          ▸ set the property deploy/delivery_pipeline.
+
+       --region=REGION
+          The Cloud region for the rollout. Alternatively, set the property
+          [deploy/region]. To set the region attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property deploy/region.
+
+       --release=RELEASE
+          The release associated with the rollout. To set the release
+          attribute:
+          ▸ provide the argument rollout on the command line with a fully
+            specified name;
+          ▸ provide the argument --release on the command line.
+
+REQUIRED FLAGS
+     --job-id=JOB_ID
+        Job ID on a rollout resource
+
+     --phase-id=PHASE_ID
+        Phase ID on a rollout resource
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha deploy rollouts retry-job
+
+        $ gcloud beta deploy rollouts retry-job
+
diff --git a/gcloud/deploy/targets/help b/gcloud/deploy/targets/help
index 8764c4884..f775d57fa 100644
--- a/gcloud/deploy/targets/help
+++ b/gcloud/deploy/targets/help
@@ -35,6 +35,9 @@ COMMANDS
      list
         List Cloud Deploy targets.
 
+     redeploy
+        Redeploy the last rollout to a target.
+
      remove-iam-policy-binding
         Remove an IAM policy binding for a Cloud Deploy target.
 
diff --git a/gcloud/deploy/targets/redeploy b/gcloud/deploy/targets/redeploy
new file mode 100644
index 000000000..ff6cef3fc
--- /dev/null
+++ b/gcloud/deploy/targets/redeploy
@@ -0,0 +1,95 @@
+NAME
+    gcloud deploy targets redeploy - redeploy the last rollout to a target
+
+SYNOPSIS
+    gcloud deploy targets redeploy (TARGET : --region=REGION)
+        --delivery-pipeline=DELIVERY_PIPELINE [--annotations=[KEY=VALUE,...]]
+        [--description=DESCRIPTION] [--labels=[KEY=VALUE,...]]
+        [--rollout-id=ROLLOUT_ID] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Redeploy the last rollout that has a state of SUCCESSFUL or FAILED to a
+    target. If rollout-id is not specified, a rollout ID will be generated.
+
+EXAMPLES
+    To redeploy a target prod for delivery pipeline test-pipeline in region
+    us-central1, run:
+
+        $ gcloud deploy targets redeploy prod \
+            --delivery-pipeline=test-pipeline --region=us-central1
+
+POSITIONAL ARGUMENTS
+     Target resource - The name of the Target. The arguments in this group can
+     be used to specify the attributes of this resource. (NOTE) Some attributes
+     are not given arguments in this group but can be set in other ways. To set
+     the project attribute:
+      ◆ provide the argument target on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       TARGET
+          ID of the target or fully qualified identifier for the target. To set
+          the target attribute:
+          ▸ provide the argument target on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --region=REGION
+          The Cloud region for the target. Alternatively, set the property
+          [deploy/region]. To set the region attribute:
+          ▸ provide the argument target on the command line with a fully
+            specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property deploy/region.
+
+REQUIRED FLAGS
+     --delivery-pipeline=DELIVERY_PIPELINE
+        The name of the Cloud Deploy delivery pipeline
+
+OPTIONAL FLAGS
+     --annotations=[KEY=VALUE,...]
+        Annotations to apply to the rollout. Annotations take the form of
+        key/value string pairs.
+
+        Examples:
+
+        Add annotations:
+
+            $ gcloud deploy targets redeploy \
+                --annotations="from_target=test,status=stable"
+
+     --description=DESCRIPTION
+        Description of rollout created during a rollback.
+
+     --labels=[KEY=VALUE,...]
+        Labels to apply to the rollout. Labels take the form of key/value
+        string pairs.
+
+        Examples:
+
+        Add labels:
+
+            $ gcloud deploy targets redeploy --labels="commit=abc123,author=foo"
+
+     --rollout-id=ROLLOUT_ID
+        ID to assign to the generated rollout for promotion.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha deploy targets redeploy
+
+        $ gcloud beta deploy targets redeploy
+
diff --git a/gcloud/ids/endpoints/create b/gcloud/ids/endpoints/create
index 0fc85d70f..ab11f5a37 100644
--- a/gcloud/ids/endpoints/create
+++ b/gcloud/ids/endpoints/create
@@ -42,17 +42,17 @@ POSITIONAL ARGUMENTS
           arguments in this group are specified.
 
        --zone=ZONE
-          The zone of the endpoint. To set the zone attribute:
+          Zone of the endpoint. To set the zone attribute:
           ▸ provide the argument endpoint on the command line with a fully
             specified name;
           ▸ provide the argument --zone on the command line.
 
 REQUIRED FLAGS
      --network=NETWORK
-        The name of the VPC network to monitor
+        Name of the VPC network to monitor
 
      --severity=SEVERITY
-        The minimum severity of threats to report on. SEVERITY must be one of:
+        Minimum severity of threats to report on. SEVERITY must be one of:
         INFORMATIONAL, LOW, MEDIUM, HIGH, CRITICAL.
 
 OPTIONAL FLAGS
diff --git a/gcloud/ids/endpoints/delete b/gcloud/ids/endpoints/delete
index 0cc5cdb13..c7e0756ce 100644
--- a/gcloud/ids/endpoints/delete
+++ b/gcloud/ids/endpoints/delete
@@ -41,7 +41,7 @@ POSITIONAL ARGUMENTS
           arguments in this group are specified.
 
        --zone=ZONE
-          The zone of the endpoint. To set the zone attribute:
+          Zone of the endpoint. To set the zone attribute:
           ▸ provide the argument endpoint on the command line with a fully
             specified name;
           ▸ provide the argument --zone on the command line.
diff --git a/gcloud/ids/endpoints/describe b/gcloud/ids/endpoints/describe
index cbceabe44..37b35e566 100644
--- a/gcloud/ids/endpoints/describe
+++ b/gcloud/ids/endpoints/describe
@@ -41,7 +41,7 @@ POSITIONAL ARGUMENTS
           arguments in this group are specified.
 
        --zone=ZONE
-          The zone of the endpoint. To set the zone attribute:
+          Zone of the endpoint. To set the zone attribute:
           ▸ provide the argument endpoint on the command line with a fully
             specified name;
           ▸ provide the argument --zone on the command line.
diff --git a/gcloud/storage/buckets/create b/gcloud/storage/buckets/create
new file mode 100644
index 000000000..3c2fadf77
--- /dev/null
+++ b/gcloud/storage/buckets/create
@@ -0,0 +1,84 @@
+NAME
+    gcloud storage buckets create - create buckets for storing objects
+
+SYNOPSIS
+    gcloud storage buckets create URL
+        [--default-encryption-key=DEFAULT_ENCRYPTION_KEY,
+          -k DEFAULT_ENCRYPTION_KEY]
+        [--default-storage-class=DEFAULT_STORAGE_CLASS,
+          -c DEFAULT_STORAGE_CLASS, -s DEFAULT_STORAGE_CLASS]
+        [--location=LOCATION, -l LOCATION]
+        [--[no-]pap, --[no-]public-access-prevention]
+        [--retention-period=RETENTION_PERIOD]
+        [--[no-]uniform-bucket-level-access, -b] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Create a new bucket.
+
+EXAMPLES
+    The following command creates a Cloud Storage bucket named my-bucket:
+
+        $ gcloud storage buckets create gs://my-bucket
+
+    The following command creates a bucket with the nearline default storage
+    class (https://cloud.google.com/storage/docs/storage-classes) in the asia
+    location (https://cloud.google.com/storage/docs/locations):
+
+        $ gcloud storage buckets create gs://my-bucket \
+            --default-storage-class=nearline --location=asia
+
+POSITIONAL ARGUMENTS
+     URL
+        The URL of the bucket to create.
+
+FLAGS
+     --default-encryption-key=DEFAULT_ENCRYPTION_KEY, -k DEFAULT_ENCRYPTION_KEY
+        Set the default KMS key using the full path to the key, which has the
+        following form:
+        projects/[project-id]/locations/[location]/keyRings/[key-ring]/cryptoKeys/[my-key].
+
+     --default-storage-class=DEFAULT_STORAGE_CLASS, -c DEFAULT_STORAGE_CLASS, -s DEFAULT_STORAGE_CLASS
+        Default storage class
+        (https://cloud.google.com/storage/docs/storage-classes) for the bucket.
+        If not specified, the default storage class used by Cloud Storage is
+        "Standard".
+
+     --location=LOCATION, -l LOCATION
+        Location (https://cloud.google.com/storage/docs/locations) for the
+        bucket. If not specified, the location used by Cloud Storage is us. A
+        bucket's location cannot be changed after creation.
+
+     --[no-]pap, --[no-]public-access-prevention
+        Sets public access prevention to "enforced". For details on how exactly
+        public access is blocked, see:
+        http://cloud/storage/docs/public-access-prevention. Use
+        --public-access-prevention to enable and --no-public-access-prevention
+        to disable.
+
+     --retention-period=RETENTION_PERIOD
+        Minimum retention period
+        (https://cloud.google.com/storage/docs/bucket-lock#retention-periods)
+        for objects stored in the bucket, for example
+        --retention-period=1Y1M1D5S. Objects added to the bucket cannot be
+        deleted until they've been stored for the specified length of time.
+        Default is no retention period. Only available for Cloud Storage using
+        the JSON API.
+
+     --[no-]uniform-bucket-level-access, -b
+        Turns on uniform bucket-level access setting. Default is False. Use
+        --uniform-bucket-level-access to enable and
+        --no-uniform-bucket-level-access to disable.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha storage buckets create
+
diff --git a/gcloud/storage/buckets/delete b/gcloud/storage/buckets/delete
new file mode 100644
index 000000000..5cd6e170c
--- /dev/null
+++ b/gcloud/storage/buckets/delete
@@ -0,0 +1,43 @@
+NAME
+    gcloud storage buckets delete - deletes Cloud Storage buckets
+
+SYNOPSIS
+    gcloud storage buckets delete URLS [URLS ...] [--continue-on-error, -c]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Deletes one or more Cloud Storage buckets.
+
+EXAMPLES
+    Delete a Google Cloud Storage bucket named "my-bucket":
+
+        $ gcloud storage buckets delete gs://my-bucket
+
+    Delete two buckets:
+
+        $ gcloud storage buckets delete gs://my-bucket gs://my-other-bucket
+
+POSITIONAL ARGUMENTS
+     URLS [URLS ...]
+        Specifies the URLs of the buckets to delete.
+
+FLAGS
+     --continue-on-error, -c
+        If any operations are unsuccessful, the command will exit with a
+        non-zero exit status after completing the remaining operations. This
+        flag takes effect only in sequential execution mode (i.e. processor and
+        thread count are set to 1). Parallelism is default.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha storage buckets delete
+
diff --git a/gcloud/storage/buckets/describe b/gcloud/storage/buckets/describe
new file mode 100644
index 000000000..7ff1d55b2
--- /dev/null
+++ b/gcloud/storage/buckets/describe
@@ -0,0 +1,36 @@
+NAME
+    gcloud storage buckets describe - describes Cloud Storage buckets
+
+SYNOPSIS
+    gcloud storage buckets describe URL [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Describe a Cloud Storage bucket.
+
+EXAMPLES
+    Describe a Google Cloud Storage bucket named "my-bucket":
+
+        $ gcloud storage buckets describe gs://my-bucket
+
+    Describe bucket with JSON formatting, only returning the "name" key:
+
+        $ gcloud storage buckets describe gs://my-bucket \
+            --format="json(name)"
+
+POSITIONAL ARGUMENTS
+     URL
+        Specifies URL of bucket to describe.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha storage buckets describe
+
diff --git a/gcloud/storage/buckets/help b/gcloud/storage/buckets/help
new file mode 100644
index 000000000..3722a2c8b
--- /dev/null
+++ b/gcloud/storage/buckets/help
@@ -0,0 +1,43 @@
+NAME
+    gcloud storage buckets - manage Cloud Storage buckets
+
+SYNOPSIS
+    gcloud storage buckets GROUP | COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Manage Cloud Storage buckets.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+GROUPS
+    GROUP is one of the following:
+
+     notifications
+        Manage Cloud Storage bucket notifications.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     create
+        Create buckets for storing objects.
+
+     delete
+        Deletes Cloud Storage buckets.
+
+     describe
+        Describes Cloud Storage buckets.
+
+     list
+        Lists Cloud Storage buckets.
+
+     update
+        Update bucket settings.
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha storage buckets
+
diff --git a/gcloud/storage/buckets/list b/gcloud/storage/buckets/list
new file mode 100644
index 000000000..e5538a4d4
--- /dev/null
+++ b/gcloud/storage/buckets/list
@@ -0,0 +1,73 @@
+NAME
+    gcloud storage buckets list - lists Cloud Storage buckets
+
+SYNOPSIS
+    gcloud storage buckets list [URLS ...] [--filter=EXPRESSION]
+        [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    List Cloud Storage buckets.
+
+EXAMPLES
+    List all Google Cloud Storage buckets in default project:
+
+        $ gcloud storage buckets list
+
+    List buckets beginning with "b":
+
+        $ gcloud storage buckets list gs://b*
+
+    List buckets with JSON formatting, only returning the "name" key:
+
+        $ gcloud storage buckets list --format="json(name)"
+
+POSITIONAL ARGUMENTS
+     [URLS ...]
+        Specifies URL of buckets to List.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha storage buckets list
+
diff --git a/gcloud/storage/buckets/notifications/create b/gcloud/storage/buckets/notifications/create
new file mode 100644
index 000000000..6b8582c1f
--- /dev/null
+++ b/gcloud/storage/buckets/notifications/create
@@ -0,0 +1,137 @@
+NAME
+    gcloud storage buckets notifications create - create a notification
+        configuration on a bucket
+
+SYNOPSIS
+    gcloud storage buckets notifications create URL
+        [--custom-attributes=[KEY=VALUE,...], -m [KEY=VALUE,...]]
+        [--event-types=[NOTIFICATION_EVENT_TYPE,...],
+          -e [NOTIFICATION_EVENT_TYPE,...]]
+        [--object-prefix=OBJECT_PREFIX, -p OBJECT_PREFIX]
+        [--payload-format=PAYLOAD_FORMAT, -f PAYLOAD_FORMAT; default="json"]
+        [--skip-topic-setup, -s] [--topic=TOPIC, -t TOPIC]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud storage buckets notifications create creates a notification
+    configuration on a bucket, establishing a flow of event notifications from
+    Cloud Storage to a Cloud Pub/Sub topic. As part of creating this flow, it
+    also verifies that the destination Cloud Pub/Sub topic exists, creating it
+    if necessary, and verifies that the Cloud Storage bucket has permission to
+    publish events to that topic, granting the permission if necessary.
+
+    If a destination Cloud Pub/Sub topic is not specified with the -t flag,
+    Cloud Storage chooses a topic name in the default project whose ID is the
+    same as the bucket name. For example, if the default project ID specified
+    is default-project and the bucket being configured is gs://example-bucket,
+    the create command uses the Cloud Pub/Sub topic
+    projects/default-project/topics/example-bucket.
+
+    In order to enable notifications, your project's [Cloud Storage service
+    agent] (https://cloud.google.com/storage/docs/projects#service-accounts)
+    must have the IAM permission "pubsub.topics.publish". This command checks
+    to see if the destination Cloud Pub/Sub topic grants the service agent this
+    permission. If not, the create command attempts to grant it.
+
+    A bucket can have up to 100 total notification configurations and up to 10
+    notification configurations set to trigger for a specific event.
+
+EXAMPLES
+    Send notifications of all changes to the bucket example-bucket to the Cloud
+    Pub/Sub topic projects/default-project/topics/example-bucket:
+
+        $ gcloud storage buckets notifications create gs://example-bucket
+
+    The same as the above but sends no notification payload:
+
+        $ gcloud storage buckets notifications create \
+            --payload-format=none gs://example-bucket
+
+    Include custom metadata in notification payloads:
+
+        $ gcloud storage buckets notifications create \
+            --custom-attributes=key1:value1,key2:value2 gs://example-bucket
+
+    Create a notification configuration that only sends an event when a new
+    object has been created or an object is deleted:
+
+        $ gcloud storage buckets notifications create \
+            --event-types=OBJECT_FINALIZE,OBJECT_DELETE gs://example-bucket
+
+    Create a topic and notification configuration that sends events only when
+    they affect objects with the prefix photos/:
+
+        $ gcloud storage buckets notifications create \
+            --object-prefix=photos/ gs://example-bucket
+
+    Specifies the destination topic ID files-to-process in the default project:
+
+        $ gcloud storage buckets notifications create \
+            --topic=files-to-process gs://example-bucket
+
+    The same as above but specifies a Cloud Pub/Sub topic belonging to the
+    specific cloud project example-project:
+
+        $ gcloud storage buckets notifications create \
+            --topic=projects/example-project/topics/files-to-process \
+            gs://example-bucket
+
+    Skip creating a topic when creating the notification configuraiton:
+
+        $ gcloud storage buckets notifications create \
+            --skip-topic-setup gs://example-bucket
+
+POSITIONAL ARGUMENTS
+     URL
+        URL of the bucket to create the notification configuration on.
+
+FLAGS
+     --custom-attributes=[KEY=VALUE,...], -m [KEY=VALUE,...]
+        Specifies key:value attributes that are appended to the set of
+        attributes sent to Cloud Pub/Sub for all events associated with this
+        notification configuration.
+
+     --event-types=[NOTIFICATION_EVENT_TYPE,...], -e [NOTIFICATION_EVENT_TYPE,...]
+        Specify event type filters for this notification configuration. Cloud
+        Storage will send notifications of only these types. By default, Cloud
+        Storage sends notifications for all event types. * OBJECT_FINALIZE: An
+        object has been created. * OBJECT_METADATA_UPDATE: The metadata of an
+        object has changed. * OBJECT_DELETE: An object has been permanently
+        deleted. * OBJECT_ARCHIVE: A live version of an object has become a
+        noncurrent version. NOTIFICATION_EVENT_TYPE must be one of:
+        OBJECT_ARCHIVE, OBJECT_DELETE, OBJECT_FINALIZE, OBJECT_METADATA_UPDATE.
+
+     --object-prefix=OBJECT_PREFIX, -p OBJECT_PREFIX
+        Specifies a prefix path for this notification configuration. Cloud
+        Storage will send notifications for only objects in the bucket whose
+        names begin with the prefix.
+
+     --payload-format=PAYLOAD_FORMAT, -f PAYLOAD_FORMAT; default="json"
+        Specifies the payload format of notification messages. Notification
+        details are available in the message attributes. 'none' sends no
+        payload. PAYLOAD_FORMAT must be one of: json, none.
+
+     --skip-topic-setup, -s
+        Skips creation and permission assignment of the Cloud Pub/Sub topic.
+        This is useful if the caller does not have permission to access the
+        topic in question, or if the topic already exists and has the
+        appropriate publish permission assigned.
+
+     --topic=TOPIC, -t TOPIC
+        Specifies the Cloud Pub/Sub topic to send notifications to. If not
+        specified, this command chooses a topic whose project is your default
+        project and whose ID is the same as the Cloud Storage bucket name.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha storage buckets notifications create
+
diff --git a/gcloud/storage/buckets/notifications/delete b/gcloud/storage/buckets/notifications/delete
new file mode 100644
index 000000000..df781ddd6
--- /dev/null
+++ b/gcloud/storage/buckets/notifications/delete
@@ -0,0 +1,47 @@
+NAME
+    gcloud storage buckets notifications delete - delete notification
+        configurations from a bucket
+
+SYNOPSIS
+    gcloud storage buckets notifications delete URLS [URLS ...]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud storage buckets notifications delete deletes notification
+    configurations from a bucket. If a notification configuration name is
+    passed as a parameter, that configuration alone is deleted. If a bucket
+    name is passed, all notification configurations associated with the bucket
+    are deleted.
+
+    Cloud Pub/Sub topics associated with this notification configuration are
+    not deleted by this command. Those must be deleted separately, for example
+    with the command "gcloud pubsub topics delete".
+
+EXAMPLES
+    Delete a single notification configuration (with ID 3) in the bucket
+    example-bucket:
+
+        $ gcloud storage buckets notifications delete \
+            b/example-bucket/notificationConfigs/3
+
+    Delete all notification configurations in the bucket example-bucket:
+
+        $ gcloud storage buckets notifications delete gs://example-bucket
+
+POSITIONAL ARGUMENTS
+     URLS [URLS ...]
+        Specifies notification configuration names or buckets.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha storage buckets notifications delete
+
diff --git a/gcloud/storage/buckets/notifications/describe b/gcloud/storage/buckets/notifications/describe
new file mode 100644
index 000000000..3251ad28d
--- /dev/null
+++ b/gcloud/storage/buckets/notifications/describe
@@ -0,0 +1,35 @@
+NAME
+    gcloud storage buckets notifications describe - show metadata for a
+        notification configuration
+
+SYNOPSIS
+    gcloud storage buckets notifications describe URL [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud storage buckets notifications describe prints populated metadata for
+    a notification configuration.
+
+EXAMPLES
+    Describe a single notification configuration (with ID 3) in the bucket
+    example-bucket:
+
+        $ gcloud storage buckets notifications describe \
+            b/example-bucket/notificationConfigs/3
+
+POSITIONAL ARGUMENTS
+     URL
+        The url of the notification configuration
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha storage buckets notifications describe
+
diff --git a/gcloud/storage/buckets/notifications/help b/gcloud/storage/buckets/notifications/help
new file mode 100644
index 000000000..4725b2e1b
--- /dev/null
+++ b/gcloud/storage/buckets/notifications/help
@@ -0,0 +1,35 @@
+NAME
+    gcloud storage buckets notifications - manage Cloud Storage bucket
+        notifications
+
+SYNOPSIS
+    gcloud storage buckets notifications COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Manage Cloud Storage bucket notifications.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     create
+        Create a notification configuration on a bucket.
+
+     delete
+        Delete notification configurations from a bucket.
+
+     describe
+        Show metadata for a notification configuration.
+
+     list
+        List the notification configurations belonging to a given bucket.
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha storage buckets notifications
+
diff --git a/gcloud/storage/buckets/notifications/list b/gcloud/storage/buckets/notifications/list
new file mode 100644
index 000000000..4472eb310
--- /dev/null
+++ b/gcloud/storage/buckets/notifications/list
@@ -0,0 +1,78 @@
+NAME
+    gcloud storage buckets notifications list - list the notification
+        configurations belonging to a given bucket
+
+SYNOPSIS
+    gcloud storage buckets notifications list [URLS ...] [--filter=EXPRESSION]
+        [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud storage buckets notifications list provides a list of notification
+    configurations belonging to a given bucket. The listed name of each
+    configuration can be used with the delete sub-command to delete that
+    specific notification config.
+
+EXAMPLES
+    Fetch the list of notification configs for the bucket example-bucket:
+
+        $ gcloud storage buckets notifications list gs://example-bucket
+
+    Fetch the notification configs in all buckets matching a wildcard:
+
+        $ gcloud storage buckets notifications list gs://example-*
+
+    Fetch all of the notification configs for buckets in the default project:
+
+        $ gcloud storage buckets notifications list
+
+POSITIONAL ARGUMENTS
+     [URLS ...]
+        Google Cloud Storage bucket paths. The path must begin with gs:// and
+        may contain wildcard characters.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha storage buckets notifications list
+
diff --git a/gcloud/storage/buckets/update b/gcloud/storage/buckets/update
new file mode 100644
index 000000000..c6adeada2
--- /dev/null
+++ b/gcloud/storage/buckets/update
@@ -0,0 +1,197 @@
+NAME
+    gcloud storage buckets update - update bucket settings
+
+SYNOPSIS
+    gcloud storage buckets update URL [URL ...] [--continue-on-error, -c]
+        [--default-storage-class=DEFAULT_STORAGE_CLASS] [--[no-]requester-pays]
+        [--[no-]versioning] [--clear-cors | --cors-file=CORS_FILE]
+        [--clear-default-encryption-key
+          | --default-encryption-key=DEFAULT_ENCRYPTION_KEY]
+        [--clear-labels | --labels-file=LABELS_FILE
+          | --remove-labels=[LABEL_KEYS,...]
+          --update-labels=[LABEL_KEYS_AND_VALUES,...]]
+        [--clear-lifecycle | --lifecycle-file=LIFECYCLE_FILE]
+        [--clear-log-bucket | --log-bucket=LOG_BUCKET]
+        [--clear-log-object-prefix | --log-object-prefix=LOG_OBJECT_PREFIX]
+        [--clear-pap, --clear-public-access-prevention
+          | --[no-]pap, --[no-]public-access-prevention]
+        [--clear-web-error-page | --web-error-page=WEB_ERROR_PAGE]
+        [--clear-web-main-page-suffix
+          | --web-main-page-suffix=WEB_MAIN_PAGE_SUFFIX] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Update a bucket.
+
+EXAMPLES
+    The following command updates the default storage class of a Cloud Storage
+    bucket named "my-bucket" to NEARLINE and sets requester pays to true:
+
+        $ gcloud storage buckets update gs://my-bucket \
+            --default-storage-class=NEARLINE --requester-pays
+
+POSITIONAL ARGUMENTS
+     URL [URL ...]
+        URLs of the buckets to update.
+
+FLAGS
+     --continue-on-error, -c
+        If any operations are unsuccessful, the command will exit with a
+        non-zero exit status after completing the remaining operations. This
+        flag takes effect only in sequential execution mode (i.e. processor and
+        thread count are set to 1). Parallelism is default.
+
+     --default-storage-class=DEFAULT_STORAGE_CLASS
+        Sets the default storage class for the bucket.
+
+     --[no-]requester-pays
+        Allows you to configure a Cloud Storage bucket so that the requester
+        pays all costs related to accessing the bucket and its objects. Use
+        --requester-pays to enable and --no-requester-pays to disable.
+
+     --[no-]versioning
+        Allows you to configure a Cloud Storage bucket to keep old versions of
+        objects. Use --versioning to enable and --no-versioning to disable.
+
+     At most one of these can be specified:
+
+       --clear-cors
+          Clears the bucket's CORS settings.
+
+       --cors-file=CORS_FILE
+          Sets the Cross-Origin Resource Sharing (CORS) configuration on a
+          bucket. An example CORS JSON document looks like the following:
+
+              [
+                {
+                  "origin": ["http://origin1.example.com"],
+                  "responseHeader": ["Content-Type"],
+                  "method": ["GET"],
+                  "maxAgeSeconds": 3600
+                }
+              ]
+
+          For more information about supported endpoints for CORS, see [Cloud
+          Storage CORS support]
+          (https://cloud.google.com/storage/docs/cross-origin#server-side-support).
+
+     At most one of these can be specified:
+
+       --clear-default-encryption-key
+          Clears the bucket's default encryption key.
+
+       --default-encryption-key=DEFAULT_ENCRYPTION_KEY
+          Set the default KMS key for the bucket.
+
+     At most one of these can be specified:
+
+       --clear-labels
+          Clear all labels associated with a bucket.
+
+       --labels-file=LABELS_FILE
+          Sets the label configuration for the bucket. An example label JSON
+          document looks like the following:
+
+              {
+                "your_label_key": "your_label_value",
+                "your_other_label_key": "your_other_label_value"
+              }
+
+       --remove-labels=[LABEL_KEYS,...]
+          Remove labels by their key names.
+
+       --update-labels=[LABEL_KEYS_AND_VALUES,...]
+          Add or update labels. Example:
+          --update-labels=key1=value1,key2=value2
+
+     At most one of these can be specified:
+
+       --clear-lifecycle
+          Removes all lifecycle configuration for the bucket.
+
+       --lifecycle-file=LIFECYCLE_FILE
+          Sets the lifecycle management configuration on a bucket. For example,
+          The following lifecycle management configuration JSON document
+          specifies that all objects in this bucket that are more than 365 days
+          old are deleted automatically:
+
+              {
+                "rule":
+                [
+                  {
+                    "action": {"type": "Delete"},
+                    "condition": {"age": 365}
+                  }
+                ]
+              }
+
+     At most one of these can be specified:
+
+       --clear-log-bucket
+          Clears logging bucket receiving the usage current bucket's data.
+
+       --log-bucket=LOG_BUCKET
+          Enables usage logging of the bucket, outputting log files to the
+          specified logging_bucket in this flag. Cloud Storage doesn't validate
+          the existence of the bucket receiving logs. In addition to enabling
+          logging on your bucket, you will also need to grant
+          cloud-storage-analytics@google.com write access to the log bucket.
+
+     At most one of these can be specified:
+
+       --clear-log-object-prefix
+          Clears prefix used to determine what usage data to send to logging
+          bucket.
+
+       --log-object-prefix=LOG_OBJECT_PREFIX
+          Specifies the object prefix for logging activity to the log bucket.
+          The default prefix is the bucket name. All read and write activity to
+          objects in the bucket will be logged for objects matching the prefix.
+
+     At most one of these can be specified:
+
+       --clear-pap, --clear-public-access-prevention
+          Unsets the public access prevention setting on a bucket.
+
+       --[no-]pap, --[no-]public-access-prevention
+          If True, sets public access prevention to "enforced". If False, sets
+          public access prevention to "inherited". For details on how exactly
+          public access is blocked, see:
+          http://cloud/storage/docs/public-access-prevention. Use
+          --public-access-prevention to enable and
+          --no-public-access-prevention to disable.
+
+     At most one of these can be specified:
+
+       --clear-web-error-page
+          Clear website error page if bucket is hosting website.
+
+       --web-error-page=WEB_ERROR_PAGE
+          Cloud Storage allows you to configure a bucket to behave like a
+          static website. A subsequent GET bucket request through a custom
+          domain for a non-existent object serves the specified error page
+          instead of the standard Cloud Storage error.
+
+     At most one of these can be specified:
+
+       --clear-web-main-page-suffix
+          Clear website main page suffix if bucket is hosting website.
+
+       --web-main-page-suffix=WEB_MAIN_PAGE_SUFFIX
+          Cloud Storage allows you to configure a bucket to behave like a
+          static website. A subsequent GET bucket request through a custom
+          domain serves the specified "main" page instead of performing the
+          usual bucket listing.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha storage buckets update
+
diff --git a/gcloud/storage/cat b/gcloud/storage/cat
new file mode 100644
index 000000000..b831318f6
--- /dev/null
+++ b/gcloud/storage/cat
@@ -0,0 +1,76 @@
+NAME
+    gcloud storage cat - outputs the contents of one or more URLs to stdout
+
+SYNOPSIS
+    gcloud storage cat URL [URL ...] [--display-url, -d]
+        [--range=RANGE, -r RANGE] [--decryption-keys=[DECRYPTION_KEY,...]]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    The cat command outputs the contents of one or more URLs to stdout. While
+    the cat command does not compute a checksum, it is otherwise equivalent to
+    doing:
+
+        $ gcloud storage cp url... -
+
+    (The final '-' causes gcloud to stream the output to stdout.)
+
+EXAMPLES
+    The following command writes all text files in a bucket to stdout:
+
+        $ gcloud storage cat gs://bucket/*.txt
+
+    The following command outputs a short header describing file.txt, along
+    with its contents:
+
+        $ gcloud storage cat -d gs://my-bucket/file.txt
+
+    The following command outputs bytes 256-939 of file.txt:
+
+        $ gcloud storage cat -r 256-939 gs://my-bucket/file.txt
+
+    The following command outputs the last 5 bytes of file.txt:
+
+        $ gcloud storage cat -r -5 gs://my-bucket/file.txt
+
+POSITIONAL ARGUMENTS
+     URL [URL ...]
+        The url of objects to list.
+
+FLAGS
+     --display-url, -d
+        Prints the header before each object.
+
+     --range=RANGE, -r RANGE
+        Causes gcloud storage to output just the specified byte range of the
+        object. In a case where "start" = 'x', and "end" = 'y', ranges take the
+        form: x-y (e.g., -r 256-5939), x- (e.g., -r 256-), -y (e.g., -r -5)
+
+        When offsets start at 0, x-y means to return bytes x through y
+        (inclusive), x- means to return bytes x through the end of the object,
+        and -y changes the role of y. If -y is present, then it returns the
+        last y bytes of the object.
+
+        If the bytes are out of range of the object, then nothing is printed
+
+ENCRYPTION FLAGS
+     --decryption-keys=[DECRYPTION_KEY,...]
+        A comma-separated list of customer-supplied encryption keys (RFC 4648
+        section 4 base64-encoded AES256 strings) that will be used to decrypt
+        Google Cloud Storage objects. Data encrypted with a customer-managed
+        encryption key (CMEK) is decrypted automatically, so CMEKs do not need
+        to be listed here.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha storage cat
+
diff --git a/gcloud/storage/cp b/gcloud/storage/cp
new file mode 100644
index 000000000..5946ebee0
--- /dev/null
+++ b/gcloud/storage/cp
@@ -0,0 +1,330 @@
+NAME
+    gcloud storage cp - upload, download, and copy Cloud Storage objects
+
+SYNOPSIS
+    gcloud storage cp [SOURCE ...] DESTINATION [--all-versions, -A]
+        [--no-clobber, -n] [--continue-on-error, -c] [--daisy-chain, -D]
+        [--do-not-decompress] [--ignore-symlinks]
+        [--manifest-path=MANIFEST_PATH, -L MANIFEST_PATH]
+        [--preserve-posix, -P] [--print-created-message, -v]
+        [--read-paths-from-stdin, -I] [--recursive, -R, -r]
+        [--skip-unsupported, -U]
+        [--storage-class=STORAGE_CLASS, -s STORAGE_CLASS]
+        [--canned-acl=PREDEFINED_ACL,
+          --predefined-acl=PREDEFINED_ACL, -a PREDEFINED_ACL
+          | --preserve-acl, -p]
+        [--gzip-in-flight=[FILE_EXTENSIONS,...], -j [FILE_EXTENSIONS,...]
+          | --gzip-in-flight-all, -J
+          | --gzip-local=[FILE_EXTENSIONS,...], -z [FILE_EXTENSIONS,...]
+          | --gzip-local-all, -Z]
+        [--decryption-keys=[DECRYPTION_KEY,...]
+          --encryption-key=ENCRYPTION_KEY]
+        [--cache-control=CACHE_CONTROL
+          --content-disposition=CONTENT_DISPOSITION
+          --content-encoding=CONTENT_ENCODING
+          --content-language=CONTENT_LANGUAGE --content-md5=MD5_DIGEST
+          --content-type=CONTENT_TYPE
+          --custom-time=CUSTOM_TIME --clear-custom-metadata
+          | --custom-metadata=[CUSTOM_METADATA_KEYS_AND_VALUES,...]
+          | --remove-custom-metadata=[METADATA_KEYS,...]
+          --update-custom-metadata=[CUSTOM_METADATA_KEYS_AND_VALUES,...]]
+        [--if-generation-match=GENERATION
+          --if-metageneration-match=METAGENERATION] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Copy data between your local file system and the cloud, within the cloud,
+    and between cloud storage providers.
+
+EXAMPLES
+    The following command uploads all text files from the local directory to a
+    bucket:
+
+        $ gcloud storage cp *.txt gs://my-bucket
+
+    The following command downloads all text files from a bucket to your
+    current directory:
+
+        $ gcloud storage cp gs://my-bucket/*.txt .
+
+    The following command transfers all text files from a bucket to a different
+    cloud storage provider:
+
+        $ gcloud storage cp gs://my-bucket/*.txt s3://my-bucket
+
+    Use the --recursive option to copy an entire directory tree. The following
+    command uploads the directory tree dir:
+
+        $ gcloud storage cp --recursive dir gs://my-bucket
+
+    Recursive listings are similar to adding ** to a query, except ** matches
+    only cloud objects and will not match prefixes. For example, the following
+    would not match gs://my-bucket/dir/log.txt
+
+        $ gcloud storage cp gs://my-bucket/**/dir dir
+
+    ** retrieves a flat list of objects in a single API call. However, **
+    matches folders for non-cloud queries. For example, a folder dir would be
+    copied in the following.
+
+        $ gcloud storage cp ~/Downloads/**/dir gs://my-bucket
+
+POSITIONAL ARGUMENTS
+     [SOURCE ...]
+        The source path(s) to copy.
+
+     DESTINATION
+        The destination path.
+
+FLAGS
+     --all-versions, -A
+        Copy all source versions from a source bucket or folder. If not set,
+        only the live version of each source object is copied.
+
+        Note: This option is only useful when the destination bucket has Object
+        Versioning enabled. Additionally, the generation numbers of copied
+        versions do not necessarily match the order of the original generation
+        numbers.
+
+     --no-clobber, -n
+        Do not overwrite existing files or objects at the destination. Skipped
+        items will be printed. This option performs an additional GET request
+        for cloud objects before attempting an upload.
+
+     --continue-on-error, -c
+        If any operations are unsuccessful, the command will exit with a
+        non-zero exit status after completing the remaining operations. This
+        flag takes effect only in sequential execution mode (i.e. processor and
+        thread count are set to 1). Parallelism is default.
+
+     --daisy-chain, -D
+        Copy in "daisy chain" mode, which means copying an object by first
+        downloading it to the machine where the command is run, then uploading
+        it to the destination bucket. The default mode is a "copy in the
+        cloud," where data is copied without uploading or downloading. During a
+        copy in the cloud, a source composite object remains composite at its
+        destination. However, you can use daisy chain mode to change a
+        composite object into a non-composite object. Note: Daisy chain mode is
+        automatically used when copying between providers.
+
+     --do-not-decompress
+        Do not automatically decompress downloaded gzip files.
+
+     --ignore-symlinks
+        Ignore file symlinks instead of copying what they point to. Symlinks
+        pointing to directories will always be ignored.
+
+     --manifest-path=MANIFEST_PATH, -L MANIFEST_PATH
+        Outputs a manifest log file with detailed information about each item
+        that was copied. This manifest contains the following information for
+        each item:
+
+        ◆ Source path.
+        ◆ Destination path.
+        ◆ Source size.
+        ◆ Bytes transferred.
+        ◆ MD5 hash.
+        ◆ Transfer start time and date in UTC and ISO 8601 format.
+        ◆ Transfer completion time and date in UTC and ISO 8601 format.
+        ◆ Final result of the attempted transfer: OK, error, or skipped.
+        ◆ Details, if any.
+
+        If the manifest file already exists, gcloud storage appends log items
+        to the existing file.
+
+        Objects that are marked as "OK" or "skipped" in the existing manifest
+        file are not retried by future commands. Objects marked as "error" are
+        retried.
+
+     --preserve-posix, -P
+        Causes POSIX attributes to be preserved when objects are copied. With
+        this feature enabled, gcloud storage will copy several fields provided
+        by the stat command: access time, modification time, owner UID, owner
+        group GID, and the mode (permissions) of the file.
+
+        For uploads, these attributes are read off of local files and stored in
+        the cloud as custom metadata. For downloads, custom cloud metadata is
+        set as POSIX attributes on files after they are downloaded.
+
+        On Windows, this flag will only set and restore access time and
+        modification time because Windows doesn't have a notion of POSIX UID,
+        GID, and mode.
+
+     --print-created-message, -v
+        Prints the version-specific URL for each copied object.
+
+     --read-paths-from-stdin, -I
+        Read the list of resources to copy from stdin. No need to enter a
+        source argument if this flag is present. Example: "storage cp -I
+        gs://bucket/destination" Note: To copy the contents of one file
+        directly from stdin, use "-" as the source argument without the "-I"
+        flag.
+
+     --recursive, -R, -r
+        Recursively copy the contents of any directories that match the source
+        path expression.
+
+     --skip-unsupported, -U
+        Skip objects with unsupported object types.
+
+     --storage-class=STORAGE_CLASS, -s STORAGE_CLASS
+        Specify the storage class of the destination object. If not specified,
+        the default storage class of the destination bucket is used. This
+        option is not valid for copying to non-cloud destinations.
+
+     At most one of these can be specified:
+
+       --canned-acl=PREDEFINED_ACL, --predefined-acl=PREDEFINED_ACL, -a PREDEFINED_ACL
+          Applies predefined, or "canned," ACLs to a copied object. See docs
+          for a list of predefined ACL constants:
+          https://cloud.google.com/storage/docs/access-control/lists#predefined-acl
+
+       --preserve-acl, -p
+          Preserves ACLs when copying in the cloud. This option is Google Cloud
+          Storage-only, and you need OWNER access to all copied objects. If all
+          objects in the destination bucket should have the same ACL, you can
+          also set a default object ACL on that bucket instead of using this
+          flag.
+
+     At most one of these can be specified:
+
+       --gzip-in-flight=[FILE_EXTENSIONS,...], -j [FILE_EXTENSIONS,...]
+          Applies gzip transport encoding to any file upload whose extension
+          matches the input extension list. This is useful when uploading files
+          with compressible content such as .js, .css, or .html files. This
+          also saves network bandwidth while leaving the data uncompressed in
+          Cloud Storage.
+
+          When you specify the --gzip-in-flight option, files being uploaded
+          are compressed in-memory and on-the-wire only. Both the local files
+          and Cloud Storage objects remain uncompressed. The uploaded objects
+          retain the Content-Type and name of the original files.
+
+       --gzip-in-flight-all, -J
+          Applies gzip transport encoding to file uploads. This option works
+          like the --gzip-in-flight option described above, but it applies to
+          all uploaded files, regardless of extension.
+
+          CAUTION: If some of the source files don't compress well, such as
+          binary data, using this option may result in longer uploads.
+
+       --gzip-local=[FILE_EXTENSIONS,...], -z [FILE_EXTENSIONS,...]
+          Applies gzip content encoding to any file upload whose extension
+          matches the input extension list. This is useful when uploading files
+          with compressible content such as .js, .css, or .html files. This
+          saves network bandwidth and space in Cloud Storage.
+
+          When you specify the --gzip-local option, the data from files is
+          compressed before it is uploaded, but the original files are left
+          uncompressed on the local disk. The uploaded objects retain the
+          Content-Type and name of the original files. However, the
+          Content-Encoding metadata is set to gzip and the Cache-Control
+          metadata set to no-transform. The data remains compressed on Cloud
+          Storage servers and will not be decompressed on download by gcloud
+          stroage because of the no-transform field.
+
+          Since the local gzip option compresses data prior to upload, it is
+          not subject to the same compression buffer bottleneck of the
+          in-flight gzip option.
+
+       --gzip-local-all, -Z
+          Applies gzip content encoding to file uploads. This option works like
+          the --gzip-local option described above, but it applies to all
+          uploaded files, regardless of extension.
+
+          CAUTION: If some of the source files don't compress well, such as
+          binary data, using this option may result in files taking up more
+          space in the cloud than they would if left uncompressed.
+
+ENCRYPTION FLAGS
+     --decryption-keys=[DECRYPTION_KEY,...]
+        A comma-separated list of customer-supplied encryption keys (RFC 4648
+        section 4 base64-encoded AES256 strings) that will be used to decrypt
+        Google Cloud Storage objects. Data encrypted with a customer-managed
+        encryption key (CMEK) is decrypted automatically, so CMEKs do not need
+        to be listed here.
+
+     --encryption-key=ENCRYPTION_KEY
+        The encryption key to use for encrypting target objects. The specified
+        encryption key can be a customer-supplied encryption key (An RFC 4648
+        section 4 base64-encoded AES256 string), or a customer-managed
+        encryption key of the form
+        projects/{project}/locations/{location}/keyRings/
+        {key-ring}/cryptoKeys/{crypto-key}. The specified key also acts as a
+        decryption key, which is useful when copying or moving encryted data to
+        a new location. Using this flag in an objects update command triggers a
+        rewrite of target objects.
+
+OBJECT METADATA FLAGS
+     --cache-control=CACHE_CONTROL
+        How caches should handle requests and responses.
+
+     --content-disposition=CONTENT_DISPOSITION
+        How content should be displayed.
+
+     --content-encoding=CONTENT_ENCODING
+        How content is encoded (e.g. gzip).
+
+     --content-language=CONTENT_LANGUAGE
+        Content's language (e.g. en signifies "English").
+
+     --content-md5=MD5_DIGEST
+        Manually specified MD5 hash digest for the contents of an uploaded
+        file. This flag cannot be used when uploading multiple files. The
+        custom digest is used by the cloud provider for validation.
+
+     --content-type=CONTENT_TYPE
+        Type of data contained in the object (e.g. text/html).
+
+     --custom-time=CUSTOM_TIME
+        Custom time for Google Cloud Storage objects in RFC 3339 format.
+
+     At most one of these can be specified:
+
+       --clear-custom-metadata
+          Clears all custom metadata on objects. When used with
+          --preserve-posix, POSIX attributes will still be stored in custom
+          metadata.
+
+       --custom-metadata=[CUSTOM_METADATA_KEYS_AND_VALUES,...]
+          Sets custom metadata on objects. When used with --preserve-posix,
+          POSIX attributes are also stored in custom metadata.
+
+       Flags that preserve unspecified existing metadata cannot be used with
+       --custom-metadata or --clear-custom-metadata, but can be specified
+       together:
+
+         --remove-custom-metadata=[METADATA_KEYS,...]
+            Removes individual custom metadata keys from objects. This flag can
+            be used with --update-custom-metadata. When used with
+            --preserve-posix, POSIX attributes specified by this flag are not
+            preserved.
+
+         --update-custom-metadata=[CUSTOM_METADATA_KEYS_AND_VALUES,...]
+            Adds or sets individual custom metadata key value pairs on objects.
+            Existing custom metadata not specified with this flag is not
+            changed. This flag can be used with --remove-custom-metadata. When
+            keys overlap with those provided by --preserve-posix, values
+            specified by this flag are used.
+
+PRECONDITION FLAGS
+     --if-generation-match=GENERATION
+        Execute only if the generation matches the generation of the requested
+        object.
+
+     --if-metageneration-match=METAGENERATION
+        Execute only if the metageneration matches the metageneration of the
+        requested object.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha storage cp
+
diff --git a/gcloud/storage/help b/gcloud/storage/help
new file mode 100644
index 000000000..79568cced
--- /dev/null
+++ b/gcloud/storage/help
@@ -0,0 +1,55 @@
+NAME
+    gcloud storage - create and manage Cloud Storage buckets and objects
+
+SYNOPSIS
+    gcloud storage GROUP | COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    The gcloud storage command group lets you create and manage Cloud Storage
+    resources such as buckets and objects.
+
+    More information on Cloud Storage can be found here:
+    https://cloud.google.com/storage, and detailed documentation can be found
+    here: https://cloud.google.com/storage/docs/
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+GROUPS
+    GROUP is one of the following:
+
+     buckets
+        Manage Cloud Storage buckets.
+
+     objects
+        Manage Cloud Storage objects.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     cat
+        Outputs the contents of one or more URLs to stdout.
+
+     cp
+        Upload, download, and copy Cloud Storage objects.
+
+     ls
+        List Cloud Storage buckets and objects.
+
+     mv
+        Moves or renames objects.
+
+     rm
+        Delete objects and buckets.
+
+     service-agent
+        Manage a project's Cloud Storage service agent, which is used to
+        perform Cloud KMS operations.
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha storage
+
diff --git a/gcloud/storage/ls b/gcloud/storage/ls
new file mode 100644
index 000000000..c790e82ab
--- /dev/null
+++ b/gcloud/storage/ls
@@ -0,0 +1,136 @@
+NAME
+    gcloud storage ls - list Cloud Storage buckets and objects
+
+SYNOPSIS
+    gcloud storage ls [PATH ...] [--all-versions, -a] [--buckets, -b]
+        [--etag, -e] [--format=FORMAT] [--readable-sizes] [--recursive, -R, -r]
+        [--full, -L | --json, -j | --long, -l]
+        [--decryption-keys=[DECRYPTION_KEY,...]] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    List your Cloud Storage buckets in a project and objects in a bucket. This
+    command treats forward slashes in object names as directories. See below
+    for examples of how to use wildcards to get the listing behavior you want.
+
+EXAMPLES
+    The following command lists the buckets in the default project:
+
+        $ gcloud storage ls
+
+    The following command lists the buckets in the specified project:
+
+        $ gcloud storage ls --project=my-project
+
+    The following command lists the contents of a bucket:
+
+        $ gcloud storage ls gs://my-bucket
+
+    You can use wildcards to match multiple paths (including multiple buckets).
+    Bucket wildcards are expanded to match only buckets contained in your
+    current project. The following command matches .txt objects that begin with
+    log and that are stored in buckets in your project that begin with my-b:
+
+        $ gcloud storage ls gs://my-b*/log*.txt
+
+    The following wildcards are valid and match only within the current
+    directory:
+
+        *: Matches zero or more characters
+        ?: Matches zero or one characters
+        []: Matches a character range (ex. [a-z] or [0-9])
+
+    You can use double-star wildcards to match zero or more directory levels in
+    a path. The following command matches all .txt objects in a bucket.
+
+        $ gcloud storage ls gs://my-bucket/**/*.txt
+
+    ** retrieves a flat list of objects in a single API call and will not match
+    prefixes. The following command would not match gs://my-bucket/dir/log.txt:
+
+        $ gcloud storage ls gs://my-bucket/**/dir
+
+    Double-star expansion also can not be combined with other expressions in a
+    given path segment and operates as a single star in that context. For
+    example:
+
+        gs://my-bucket/dir**/log.txt      is treated as:
+
+        gs://my-bucket/dir*/log.txt       and instead should be written as:
+
+        gs://my-bucket/dir*/**/log.txt    to get the recursive behavior.
+
+    The following command lists all items recursively with formatting by using
+    --recursive:
+
+        $ gcloud storage ls --recursive gs://bucket
+
+    Recursive listings are similar to ** except recursive listings include line
+    breaks and header formatting for each subdirectory.
+
+POSITIONAL ARGUMENTS
+     [PATH ...]
+        The path of objects and directories to list. The path must begin with
+        gs:// and is allowed to contain wildcard characters.
+
+FLAGS
+     --all-versions, -a
+        Include non-current object versions in the listing. This flag is
+        typically only useful for buckets with object versioning
+        (https://cloud.google.com/storage/docs/object-versioning) enabled. If
+        combined with the --long option, the metageneration for each listed
+        object is also included.
+
+     --buckets, -b
+        When given a bucket URL, only return buckets. Useful for avoiding the
+        rule that prints the top-level objects of buckets matching a query.
+        Typically used in combination with --full to get the full metadata of
+        buckets.
+
+     --etag, -e
+        Include ETag metadata in listings that use the --long flag.
+
+     --format=FORMAT
+        Use "gsutil" to get the style of the older gsutil CLI. (e.g.
+        "--format=gsutil"). Other format values (e.g. "json") do not work. See
+        different ls flags and commands for alternative formatting.
+
+     --readable-sizes
+        When used with --long, print object sizes in human readable format,
+        such as 1 KiB, 234 MiB, or 2 GiB.
+
+     --recursive, -R, -r
+        Recursively list the contents of any directories that match the path
+        expression.
+
+     At most one of these can be specified:
+
+       --full, -L
+          List all available metadata about items in rows.
+
+       --json, -j
+          List all available metadata about items as a JSON dump.
+
+       --long, -l
+          For objects only. List size in bytes, creation time, and URL.
+
+ENCRYPTION FLAGS
+     --decryption-keys=[DECRYPTION_KEY,...]
+        A comma-separated list of customer-supplied encryption keys (RFC 4648
+        section 4 base64-encoded AES256 strings) that will be used to decrypt
+        Google Cloud Storage objects. Data encrypted with a customer-managed
+        encryption key (CMEK) is decrypted automatically, so CMEKs do not need
+        to be listed here.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha storage ls
+
diff --git a/gcloud/storage/mv b/gcloud/storage/mv
new file mode 100644
index 000000000..b23359e06
--- /dev/null
+++ b/gcloud/storage/mv
@@ -0,0 +1,336 @@
+NAME
+    gcloud storage mv - moves or renames objects
+
+SYNOPSIS
+    gcloud storage mv [SOURCE ...] DESTINATION [--all-versions, -A]
+        [--no-clobber, -n] [--continue-on-error, -c] [--daisy-chain, -D]
+        [--do-not-decompress] [--ignore-symlinks]
+        [--manifest-path=MANIFEST_PATH, -L MANIFEST_PATH]
+        [--preserve-posix, -P] [--print-created-message, -v]
+        [--read-paths-from-stdin, -I] [--skip-unsupported, -U]
+        [--storage-class=STORAGE_CLASS, -s STORAGE_CLASS]
+        [--canned-acl=PREDEFINED_ACL,
+          --predefined-acl=PREDEFINED_ACL, -a PREDEFINED_ACL
+          | --preserve-acl, -p]
+        [--gzip-in-flight=[FILE_EXTENSIONS,...], -j [FILE_EXTENSIONS,...]
+          | --gzip-in-flight-all, -J
+          | --gzip-local=[FILE_EXTENSIONS,...], -z [FILE_EXTENSIONS,...]
+          | --gzip-local-all, -Z]
+        [--decryption-keys=[DECRYPTION_KEY,...]
+          --encryption-key=ENCRYPTION_KEY]
+        [--cache-control=CACHE_CONTROL
+          --content-disposition=CONTENT_DISPOSITION
+          --content-encoding=CONTENT_ENCODING
+          --content-language=CONTENT_LANGUAGE --content-md5=MD5_DIGEST
+          --content-type=CONTENT_TYPE
+          --custom-time=CUSTOM_TIME --clear-custom-metadata
+          | --custom-metadata=[CUSTOM_METADATA_KEYS_AND_VALUES,...]
+          | --remove-custom-metadata=[METADATA_KEYS,...]
+          --update-custom-metadata=[CUSTOM_METADATA_KEYS_AND_VALUES,...]]
+        [--if-generation-match=GENERATION
+          --if-metageneration-match=METAGENERATION] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    The mv command allows you to move data between your local file system and
+    the cloud, move data within the cloud, and move data between cloud storage
+    providers
+
+    Renaming Groups Of Objects
+
+    You can use the mv command to rename all objects with a given prefix to
+    have a new prefix. For example, the following command renames all objects
+    under gs://my_bucket/oldprefix to be under gs://my_bucket/newprefix,
+    otherwise preserving the naming structure:
+
+        $ gcloud storage mv  mv gs://my_bucket/oldprefix \
+            gs://my_bucket/newprefix
+
+    Note that when using mv to rename groups of objects with a common prefix,
+    you cannot specify the source URL using wildcards; you must spell out the
+    complete name.
+
+    If you do a rename as specified above and you want to preserve ACLs.
+
+    Non-Atomic Operation
+
+    Unlike the case with many file systems, the mv command does not perform a
+    single atomic operation. Rather, it performs a copy from source to
+    destination followed by removing the source for each object.
+
+    A consequence of this is that, in addition to normal network and operation
+    charges, if you move a Nearline Storage, Coldline Storage, or Archive
+    Storage object, deletion and data retrieval charges apply. See the
+    documentation for pricing details.
+
+EXAMPLES
+    To move all objects from a bucket to a local directory you could use:
+
+        $ gcloud storage mv gs://my_bucket/* dir
+
+    Similarly, to move all objects from a local directory to a bucket you could
+    use:
+
+        $ gcloud storage mv ./dir gs://my_bucket
+
+    The following command renames all objects under gs://my_bucket/oldprefix to
+    be under gs://my_bucket/newprefix, otherwise preserving the naming
+    structure:
+
+        $ gcloud storage mv gs://my_bucket/oldprefix gs://my_bucket/newprefix
+
+POSITIONAL ARGUMENTS
+     [SOURCE ...]
+        The source path(s) to copy.
+
+     DESTINATION
+        The destination path.
+
+FLAGS
+     --all-versions, -A
+        Copy all source versions from a source bucket or folder. If not set,
+        only the live version of each source object is copied.
+
+        Note: This option is only useful when the destination bucket has Object
+        Versioning enabled. Additionally, the generation numbers of copied
+        versions do not necessarily match the order of the original generation
+        numbers.
+
+     --no-clobber, -n
+        Do not overwrite existing files or objects at the destination. Skipped
+        items will be printed. This option performs an additional GET request
+        for cloud objects before attempting an upload.
+
+     --continue-on-error, -c
+        If any operations are unsuccessful, the command will exit with a
+        non-zero exit status after completing the remaining operations. This
+        flag takes effect only in sequential execution mode (i.e. processor and
+        thread count are set to 1). Parallelism is default.
+
+     --daisy-chain, -D
+        Copy in "daisy chain" mode, which means copying an object by first
+        downloading it to the machine where the command is run, then uploading
+        it to the destination bucket. The default mode is a "copy in the
+        cloud," where data is copied without uploading or downloading. During a
+        copy in the cloud, a source composite object remains composite at its
+        destination. However, you can use daisy chain mode to change a
+        composite object into a non-composite object. Note: Daisy chain mode is
+        automatically used when copying between providers.
+
+     --do-not-decompress
+        Do not automatically decompress downloaded gzip files.
+
+     --ignore-symlinks
+        Ignore file symlinks instead of copying what they point to. Symlinks
+        pointing to directories will always be ignored.
+
+     --manifest-path=MANIFEST_PATH, -L MANIFEST_PATH
+        Outputs a manifest log file with detailed information about each item
+        that was copied. This manifest contains the following information for
+        each item:
+
+        ◆ Source path.
+        ◆ Destination path.
+        ◆ Source size.
+        ◆ Bytes transferred.
+        ◆ MD5 hash.
+        ◆ Transfer start time and date in UTC and ISO 8601 format.
+        ◆ Transfer completion time and date in UTC and ISO 8601 format.
+        ◆ Final result of the attempted transfer: OK, error, or skipped.
+        ◆ Details, if any.
+
+        If the manifest file already exists, gcloud storage appends log items
+        to the existing file.
+
+        Objects that are marked as "OK" or "skipped" in the existing manifest
+        file are not retried by future commands. Objects marked as "error" are
+        retried.
+
+     --preserve-posix, -P
+        Causes POSIX attributes to be preserved when objects are copied. With
+        this feature enabled, gcloud storage will copy several fields provided
+        by the stat command: access time, modification time, owner UID, owner
+        group GID, and the mode (permissions) of the file.
+
+        For uploads, these attributes are read off of local files and stored in
+        the cloud as custom metadata. For downloads, custom cloud metadata is
+        set as POSIX attributes on files after they are downloaded.
+
+        On Windows, this flag will only set and restore access time and
+        modification time because Windows doesn't have a notion of POSIX UID,
+        GID, and mode.
+
+     --print-created-message, -v
+        Prints the version-specific URL for each copied object.
+
+     --read-paths-from-stdin, -I
+        Read the list of resources to copy from stdin. No need to enter a
+        source argument if this flag is present. Example: "storage cp -I
+        gs://bucket/destination" Note: To copy the contents of one file
+        directly from stdin, use "-" as the source argument without the "-I"
+        flag.
+
+     --skip-unsupported, -U
+        Skip objects with unsupported object types.
+
+     --storage-class=STORAGE_CLASS, -s STORAGE_CLASS
+        Specify the storage class of the destination object. If not specified,
+        the default storage class of the destination bucket is used. This
+        option is not valid for copying to non-cloud destinations.
+
+     At most one of these can be specified:
+
+       --canned-acl=PREDEFINED_ACL, --predefined-acl=PREDEFINED_ACL, -a PREDEFINED_ACL
+          Applies predefined, or "canned," ACLs to a copied object. See docs
+          for a list of predefined ACL constants:
+          https://cloud.google.com/storage/docs/access-control/lists#predefined-acl
+
+       --preserve-acl, -p
+          Preserves ACLs when copying in the cloud. This option is Google Cloud
+          Storage-only, and you need OWNER access to all copied objects. If all
+          objects in the destination bucket should have the same ACL, you can
+          also set a default object ACL on that bucket instead of using this
+          flag.
+
+     At most one of these can be specified:
+
+       --gzip-in-flight=[FILE_EXTENSIONS,...], -j [FILE_EXTENSIONS,...]
+          Applies gzip transport encoding to any file upload whose extension
+          matches the input extension list. This is useful when uploading files
+          with compressible content such as .js, .css, or .html files. This
+          also saves network bandwidth while leaving the data uncompressed in
+          Cloud Storage.
+
+          When you specify the --gzip-in-flight option, files being uploaded
+          are compressed in-memory and on-the-wire only. Both the local files
+          and Cloud Storage objects remain uncompressed. The uploaded objects
+          retain the Content-Type and name of the original files.
+
+       --gzip-in-flight-all, -J
+          Applies gzip transport encoding to file uploads. This option works
+          like the --gzip-in-flight option described above, but it applies to
+          all uploaded files, regardless of extension.
+
+          CAUTION: If some of the source files don't compress well, such as
+          binary data, using this option may result in longer uploads.
+
+       --gzip-local=[FILE_EXTENSIONS,...], -z [FILE_EXTENSIONS,...]
+          Applies gzip content encoding to any file upload whose extension
+          matches the input extension list. This is useful when uploading files
+          with compressible content such as .js, .css, or .html files. This
+          saves network bandwidth and space in Cloud Storage.
+
+          When you specify the --gzip-local option, the data from files is
+          compressed before it is uploaded, but the original files are left
+          uncompressed on the local disk. The uploaded objects retain the
+          Content-Type and name of the original files. However, the
+          Content-Encoding metadata is set to gzip and the Cache-Control
+          metadata set to no-transform. The data remains compressed on Cloud
+          Storage servers and will not be decompressed on download by gcloud
+          stroage because of the no-transform field.
+
+          Since the local gzip option compresses data prior to upload, it is
+          not subject to the same compression buffer bottleneck of the
+          in-flight gzip option.
+
+       --gzip-local-all, -Z
+          Applies gzip content encoding to file uploads. This option works like
+          the --gzip-local option described above, but it applies to all
+          uploaded files, regardless of extension.
+
+          CAUTION: If some of the source files don't compress well, such as
+          binary data, using this option may result in files taking up more
+          space in the cloud than they would if left uncompressed.
+
+ENCRYPTION FLAGS
+     --decryption-keys=[DECRYPTION_KEY,...]
+        A comma-separated list of customer-supplied encryption keys (RFC 4648
+        section 4 base64-encoded AES256 strings) that will be used to decrypt
+        Google Cloud Storage objects. Data encrypted with a customer-managed
+        encryption key (CMEK) is decrypted automatically, so CMEKs do not need
+        to be listed here.
+
+     --encryption-key=ENCRYPTION_KEY
+        The encryption key to use for encrypting target objects. The specified
+        encryption key can be a customer-supplied encryption key (An RFC 4648
+        section 4 base64-encoded AES256 string), or a customer-managed
+        encryption key of the form
+        projects/{project}/locations/{location}/keyRings/
+        {key-ring}/cryptoKeys/{crypto-key}. The specified key also acts as a
+        decryption key, which is useful when copying or moving encryted data to
+        a new location. Using this flag in an objects update command triggers a
+        rewrite of target objects.
+
+OBJECT METADATA FLAGS
+     --cache-control=CACHE_CONTROL
+        How caches should handle requests and responses.
+
+     --content-disposition=CONTENT_DISPOSITION
+        How content should be displayed.
+
+     --content-encoding=CONTENT_ENCODING
+        How content is encoded (e.g. gzip).
+
+     --content-language=CONTENT_LANGUAGE
+        Content's language (e.g. en signifies "English").
+
+     --content-md5=MD5_DIGEST
+        Manually specified MD5 hash digest for the contents of an uploaded
+        file. This flag cannot be used when uploading multiple files. The
+        custom digest is used by the cloud provider for validation.
+
+     --content-type=CONTENT_TYPE
+        Type of data contained in the object (e.g. text/html).
+
+     --custom-time=CUSTOM_TIME
+        Custom time for Google Cloud Storage objects in RFC 3339 format.
+
+     At most one of these can be specified:
+
+       --clear-custom-metadata
+          Clears all custom metadata on objects. When used with
+          --preserve-posix, POSIX attributes will still be stored in custom
+          metadata.
+
+       --custom-metadata=[CUSTOM_METADATA_KEYS_AND_VALUES,...]
+          Sets custom metadata on objects. When used with --preserve-posix,
+          POSIX attributes are also stored in custom metadata.
+
+       Flags that preserve unspecified existing metadata cannot be used with
+       --custom-metadata or --clear-custom-metadata, but can be specified
+       together:
+
+         --remove-custom-metadata=[METADATA_KEYS,...]
+            Removes individual custom metadata keys from objects. This flag can
+            be used with --update-custom-metadata. When used with
+            --preserve-posix, POSIX attributes specified by this flag are not
+            preserved.
+
+         --update-custom-metadata=[CUSTOM_METADATA_KEYS_AND_VALUES,...]
+            Adds or sets individual custom metadata key value pairs on objects.
+            Existing custom metadata not specified with this flag is not
+            changed. This flag can be used with --remove-custom-metadata. When
+            keys overlap with those provided by --preserve-posix, values
+            specified by this flag are used.
+
+PRECONDITION FLAGS
+     --if-generation-match=GENERATION
+        Execute only if the generation matches the generation of the requested
+        object.
+
+     --if-metageneration-match=METAGENERATION
+        Execute only if the metageneration matches the metageneration of the
+        requested object.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha storage mv
+
diff --git a/gcloud/storage/objects/compose b/gcloud/storage/objects/compose
new file mode 100644
index 000000000..1ecfa767a
--- /dev/null
+++ b/gcloud/storage/objects/compose
@@ -0,0 +1,55 @@
+NAME
+    gcloud storage objects compose - concatenate a sequence of objects into a
+        new composite object
+
+SYNOPSIS
+    gcloud storage objects compose SOURCE [SOURCE ...] DESTINATION
+        [--if-generation-match=GENERATION
+          --if-metageneration-match=METAGENERATION] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud storage objects compose creates a new object whose content is the
+    concatenation of a given sequence of source objects in the same bucket. For
+    more information, please see: composite objects documentation
+    (https://cloud.google.com/storage/docs/composite-objects).
+
+    There is a limit (currently 32) to the number of components that can be
+    composed in a single operation.
+
+EXAMPLES
+    The following command creates a new object target.txt by concatenating
+    a.txt and b.txt:
+
+        $ gcloud storage objects compose gs://bucket/a.txt \
+            gs://bucket/b.txt gs://bucket/target.txt
+
+POSITIONAL ARGUMENTS
+     SOURCE [SOURCE ...]
+        The list of source objects that will be concatenated into a single
+        object.
+
+     DESTINATION
+        The destination object.
+
+PRECONDITION FLAGS
+     --if-generation-match=GENERATION
+        Execute only if the generation matches the generation of the requested
+        object.
+
+     --if-metageneration-match=METAGENERATION
+        Execute only if the metageneration matches the metageneration of the
+        requested object.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha storage objects compose
+
diff --git a/gcloud/storage/objects/describe b/gcloud/storage/objects/describe
new file mode 100644
index 000000000..753aa234b
--- /dev/null
+++ b/gcloud/storage/objects/describe
@@ -0,0 +1,46 @@
+NAME
+    gcloud storage objects describe - describe a Cloud Storage object
+
+SYNOPSIS
+    gcloud storage objects describe URL
+        [--decryption-keys=[DECRYPTION_KEY,...]] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Describe a Cloud Storage object.
+
+EXAMPLES
+    Describe a Google Cloud Storage object with the url
+    "gs://bucket/my-object":
+
+        $ gcloud storage objects describe gs://bucket/my-object
+
+    Describe object with JSON formatting, only returning the "name" key:
+
+        $ gcloud storage objects describe gs://bucket/my-object \
+            --format="json(name)"
+
+POSITIONAL ARGUMENTS
+     URL
+        Specifies URL of object to describe.
+
+ENCRYPTION FLAGS
+     --decryption-keys=[DECRYPTION_KEY,...]
+        A comma-separated list of customer-supplied encryption keys (RFC 4648
+        section 4 base64-encoded AES256 strings) that will be used to decrypt
+        Google Cloud Storage objects. Data encrypted with a customer-managed
+        encryption key (CMEK) is decrypted automatically, so CMEKs do not need
+        to be listed here.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha storage objects describe
+
diff --git a/gcloud/storage/objects/help b/gcloud/storage/objects/help
new file mode 100644
index 000000000..11dc3654c
--- /dev/null
+++ b/gcloud/storage/objects/help
@@ -0,0 +1,34 @@
+NAME
+    gcloud storage objects - manage Cloud Storage objects
+
+SYNOPSIS
+    gcloud storage objects COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Manage Cloud Storage objects.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     compose
+        Concatenate a sequence of objects into a new composite object.
+
+     describe
+        Describe a Cloud Storage object.
+
+     list
+        Lists Cloud Storage objects.
+
+     update
+        Update Cloud Storage objects.
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha storage objects
+
diff --git a/gcloud/storage/objects/list b/gcloud/storage/objects/list
new file mode 100644
index 000000000..4fdbc25a2
--- /dev/null
+++ b/gcloud/storage/objects/list
@@ -0,0 +1,91 @@
+NAME
+    gcloud storage objects list - lists Cloud Storage objects
+
+SYNOPSIS
+    gcloud storage objects list URLS [URLS ...] [--stat]
+        [--decryption-keys=[DECRYPTION_KEY,...]] [--filter=EXPRESSION]
+        [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    List Cloud Storage objects.
+
+    Bucket URLs like "gs://bucket" will match all the objects inside a bucket,
+    but "gs://b" will error because it matches a list of buckets.
+
+EXAMPLES
+    List all objects in bucket "my-bucket":
+
+        $ gcloud storage objects list gs://my-bucket
+
+    List all objects in bucket beginning with "o":
+
+        $ gcloud storage objects list gs://my-bucket/o*
+
+    List all objects in bucket with JSON formatting, only returning the value
+    of the "name" metadata field:
+
+        $ gcloud storage objects list gs://my-bucket --format="json(name)"
+
+POSITIONAL ARGUMENTS
+     URLS [URLS ...]
+        Specifies URL of objects to list.
+
+FLAGS
+     --stat
+        Emulates gsutil stat-style behavior. Does not show past object versions
+        and changes output format.
+
+ENCRYPTION FLAGS
+     --decryption-keys=[DECRYPTION_KEY,...]
+        A comma-separated list of customer-supplied encryption keys (RFC 4648
+        section 4 base64-encoded AES256 strings) that will be used to decrypt
+        Google Cloud Storage objects. Data encrypted with a customer-managed
+        encryption key (CMEK) is decrypted automatically, so CMEKs do not need
+        to be listed here.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha storage objects list
+
diff --git a/gcloud/storage/objects/update b/gcloud/storage/objects/update
new file mode 100644
index 000000000..3c1eb7061
--- /dev/null
+++ b/gcloud/storage/objects/update
@@ -0,0 +1,194 @@
+NAME
+    gcloud storage objects update - update Cloud Storage objects
+
+SYNOPSIS
+    gcloud storage objects update [URL ...] [--continue-on-error, -c]
+        [--preserve-acl, -p] [--read-paths-from-stdin, -I]
+        [--recursive, -R, -r] [--storage-class=STORAGE_CLASS, -s STORAGE_CLASS]
+        [--clear-encryption-key --decryption-keys=[DECRYPTION_KEY,...]
+          --encryption-key=ENCRYPTION_KEY]
+        [--cache-control=CACHE_CONTROL --clear-cache-control
+          --clear-content-disposition --clear-content-encoding
+          --clear-content-language --clear-content-md5 --clear-content-type
+          --clear-custom-time --content-disposition=CONTENT_DISPOSITION
+          --content-encoding=CONTENT_ENCODING
+          --content-language=CONTENT_LANGUAGE --content-md5=MD5_DIGEST
+          --content-type=CONTENT_TYPE
+          --custom-time=CUSTOM_TIME --clear-custom-metadata
+          | --custom-metadata=[CUSTOM_METADATA_KEYS_AND_VALUES,...]
+          | --remove-custom-metadata=[METADATA_KEYS,...]
+          --update-custom-metadata=[CUSTOM_METADATA_KEYS_AND_VALUES,...]]
+        [--if-generation-match=GENERATION
+          --if-metageneration-match=METAGENERATION] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Update Cloud Storage objects.
+
+EXAMPLES
+    Update a Google Cloud Storage object's custom-metadata:
+
+        $ gcloud storage objects update gs://bucket/my-object \
+            --custom-metadata=key1=value1,key2=value2
+
+    Rewrite all JPEG images to the NEARLINE storage class:
+
+        $ gcloud storage objects update gs://bucket/*.jpg \
+            --storage-class=NEARLINE
+
+        You can also provide a precondition on an object's metageneration in
+        order to avoid potential race conditions:
+
+        $ gcloud storage objects update gs://bucket/*.jpg \
+            --storage-class=NEARLINE --if-metageneration-match=123456789
+
+POSITIONAL ARGUMENTS
+     [URL ...]
+        Specifies URLs of objects to update.
+
+FLAGS
+     --continue-on-error, -c
+        If any operations are unsuccessful, the command will exit with a
+        non-zero exit status after completing the remaining operations. This
+        flag takes effect only in sequential execution mode (i.e. processor and
+        thread count are set to 1). Parallelism is default.
+
+     --preserve-acl, -p
+        Preserves ACLs when copying in the cloud. This feature is supported for
+        only Google Cloud Storage and requires OWNER access to all copied
+        objects. To use the destination bucket's default policy (necessary for
+        uniform bucket-level access), use --no-preserve-acl. Enabled by
+        default, use -p to disable.
+
+     --read-paths-from-stdin, -I
+        Read the list of objects to update from stdin. No need to enter a
+        source argument if this flag is present. Example: "storage objects
+        update -I --content-type=new-type"
+
+     --recursive, -R, -r
+        Recursively update objects under any buckets or directories that match
+        the URL expression.
+
+     --storage-class=STORAGE_CLASS, -s STORAGE_CLASS
+        Specify the storage class of the object. Using this flag triggers a
+        rewrite of underlying object data.
+
+ENCRYPTION FLAGS
+     --clear-encryption-key
+        Clears the encryption key associated with an object. Using this flag
+        triggers a rewrite of affected objects, which are then encrypted using
+        the default encryption key set on the bucket, if one exists, or else
+        with a Google-managed encryption key.
+
+     --decryption-keys=[DECRYPTION_KEY,...]
+        A comma-separated list of customer-supplied encryption keys (RFC 4648
+        section 4 base64-encoded AES256 strings) that will be used to decrypt
+        Google Cloud Storage objects. Data encrypted with a customer-managed
+        encryption key (CMEK) is decrypted automatically, so CMEKs do not need
+        to be listed here.
+
+     --encryption-key=ENCRYPTION_KEY
+        The encryption key to use for encrypting target objects. The specified
+        encryption key can be a customer-supplied encryption key (An RFC 4648
+        section 4 base64-encoded AES256 string), or a customer-managed
+        encryption key of the form
+        projects/{project}/locations/{location}/keyRings/
+        {key-ring}/cryptoKeys/{crypto-key}. The specified key also acts as a
+        decryption key, which is useful when copying or moving encryted data to
+        a new location. Using this flag in an objects update command triggers a
+        rewrite of target objects.
+
+OBJECT METADATA FLAGS
+     --cache-control=CACHE_CONTROL
+        How caches should handle requests and responses.
+
+     --clear-cache-control
+        Clears object cache control.
+
+     --clear-content-disposition
+        Clears object content disposition.
+
+     --clear-content-encoding
+        Clears content encoding.
+
+     --clear-content-language
+        Clears object content language.
+
+     --clear-content-md5
+        Clears object content MD5.
+
+     --clear-content-type
+        Clears object content type.
+
+     --clear-custom-time
+        Clears object custom time.
+
+     --content-disposition=CONTENT_DISPOSITION
+        How content should be displayed.
+
+     --content-encoding=CONTENT_ENCODING
+        How content is encoded (e.g. gzip).
+
+     --content-language=CONTENT_LANGUAGE
+        Content's language (e.g. en signifies "English").
+
+     --content-md5=MD5_DIGEST
+        Manually specified MD5 hash digest for the contents of an uploaded
+        file. This flag cannot be used when uploading multiple files. The
+        custom digest is used by the cloud provider for validation.
+
+     --content-type=CONTENT_TYPE
+        Type of data contained in the object (e.g. text/html).
+
+     --custom-time=CUSTOM_TIME
+        Custom time for Google Cloud Storage objects in RFC 3339 format.
+
+     At most one of these can be specified:
+
+       --clear-custom-metadata
+          Clears all custom metadata on objects. When used with
+          --preserve-posix, POSIX attributes will still be stored in custom
+          metadata.
+
+       --custom-metadata=[CUSTOM_METADATA_KEYS_AND_VALUES,...]
+          Sets custom metadata on objects. When used with --preserve-posix,
+          POSIX attributes are also stored in custom metadata.
+
+       Flags that preserve unspecified existing metadata cannot be used with
+       --custom-metadata or --clear-custom-metadata, but can be specified
+       together:
+
+         --remove-custom-metadata=[METADATA_KEYS,...]
+            Removes individual custom metadata keys from objects. This flag can
+            be used with --update-custom-metadata. When used with
+            --preserve-posix, POSIX attributes specified by this flag are not
+            preserved.
+
+         --update-custom-metadata=[CUSTOM_METADATA_KEYS_AND_VALUES,...]
+            Adds or sets individual custom metadata key value pairs on objects.
+            Existing custom metadata not specified with this flag is not
+            changed. This flag can be used with --remove-custom-metadata. When
+            keys overlap with those provided by --preserve-posix, values
+            specified by this flag are used.
+
+PRECONDITION FLAGS
+     --if-generation-match=GENERATION
+        Execute only if the generation matches the generation of the requested
+        object.
+
+     --if-metageneration-match=METAGENERATION
+        Execute only if the metageneration matches the metageneration of the
+        requested object.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha storage objects update
+
diff --git a/gcloud/storage/rm b/gcloud/storage/rm
new file mode 100644
index 000000000..f8e832a9f
--- /dev/null
+++ b/gcloud/storage/rm
@@ -0,0 +1,95 @@
+NAME
+    gcloud storage rm - delete objects and buckets
+
+SYNOPSIS
+    gcloud storage rm [URLS ...] [--all-versions, -a] [--continue-on-error, -c]
+        [--read-paths-from-stdin, -I] [--recursive, -R, -r]
+        [--if-generation-match=GENERATION
+          --if-metageneration-match=METAGENERATION] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Delete objects and buckets.
+
+EXAMPLES
+    The following command deletes a Cloud Storage object named my-object from
+    the bucket my-bucket:
+
+        $ gcloud storage rm gs://my-bucket/my-object
+
+    The following command deletes all objects directly within the directory
+    my-dir but no objects within subdirectories:
+
+        $ gcloud storage rm gs://my-bucket/my-dir/*
+
+    The following command deletes all objects and subdirectories within the
+    directory my-dir:
+
+        $ gcloud storage rm gs://my-bucket/my-dir/**
+
+    Note that for buckets that contain versioned objects
+    (https://cloud.google.com/storage/docs/object-versioning), the above
+    command only affects live versions. Use the --recursive flag instead to
+    delete all versions.
+
+    The following command deletes all versions of all resources in my-bucket
+    and then deletes the bucket.
+
+        $ gcloud storage rm --recursive gs://my-bucket/
+
+    The following command deletes all text files in the top-level of my-bucket,
+    but not text files in subdirectories:
+
+        $ gcloud storage rm -recursive gs://my-bucket/*.txt
+
+    The following command deletes one wildcard expression per line passed in by
+    stdin:
+
+        $ some_program | gcloud storage rm -I
+
+POSITIONAL ARGUMENTS
+     [URLS ...]
+        The URLs of the resources to delete.
+
+FLAGS
+     --all-versions, -a
+        Delete all versions
+        (https://cloud.google.com/storage/docs/object-versioning) of an object.
+
+     --continue-on-error, -c
+        If any operations are unsuccessful, the command will exit with a
+        non-zero exit status after completing the remaining operations. This
+        flag takes effect only in sequential execution mode (i.e. processor and
+        thread count are set to 1). Parallelism is default.
+
+     --read-paths-from-stdin, -I
+        Read the list of resources to remove from stdin.
+
+     --recursive, -R, -r
+        Recursively delete the contents of buckets or directories that match
+        the path expression. If the path is set to a bucket, like gs://bucket,
+        the bucket is also deleted. This option implies the --all-versions
+        option. If you want to delete only live object versions, use the ``**''
+        wildcard instead.
+
+PRECONDITION FLAGS
+     --if-generation-match=GENERATION
+        Execute only if the generation matches the generation of the requested
+        object.
+
+     --if-metageneration-match=METAGENERATION
+        Execute only if the metageneration matches the metageneration of the
+        requested object.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha storage rm
+
diff --git a/gcloud/storage/service-agent b/gcloud/storage/service-agent
new file mode 100644
index 000000000..faa4c66cd
--- /dev/null
+++ b/gcloud/storage/service-agent
@@ -0,0 +1,49 @@
+NAME
+    gcloud storage service-agent - manage a project's Cloud Storage service
+        agent, which is used to perform Cloud KMS operations
+
+SYNOPSIS
+    gcloud storage service-agent [--authorize-cmek=AUTHORIZE_CMEK]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud storage service-agent displays the Cloud Storage service agent,
+    which is used to perform Cloud KMS operations against your a default or
+    supplied project. If the project does not yet have a service agent, gcloud
+    storage service-agent creates one.
+
+EXAMPLES
+    To show the service agent for your default project:
+
+        $ gcloud storage service-agent
+
+    To show the service account for my-project:
+
+        $ gcloud storage service-agent --project=my-project
+
+    To authorize your default project to use a Cloud KMS key:
+
+        $ gcloud storage service-agent \
+            --authorize-cmek=projects/key-project/locations/us-east1/\
+        keyRings/key-ring/cryptoKeys/my-key
+
+FLAGS
+     --authorize-cmek=AUTHORIZE_CMEK
+        Adds appropriate encrypt/decrypt permissions to the specified Cloud KMS
+        key. This allows the Cloud Storage service agent to write and read
+        Cloud KMS-encrypted objects in buckets associated with the service
+        agent's project.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha storage service-agent
+