gcloud: Wed Mar 15 11:22:01 UTC 2023

gcloud/alpha/auth/enterprise-certificate-config/create/help

@@ -0,0 +1,44 @@
+NAME
+    gcloud alpha auth enterprise-certificate-config create - create enterprise
+        certificate configurations
+
+SYNOPSIS
+    gcloud alpha auth enterprise-certificate-config create COMMAND
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) The gcloud alpha auth enterprise-certificate-config create group
+    lets you create enterprise certificate configurations. This configuration
+    will be used by gcloud to communicate with the
+    enterprise-certificate-proxy.
+
+    See more details at gcloud topic client-certificate.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     linux
+        (ALPHA) Create an enterprise-certificate configuration file for Linux.
+
+     macos
+        (ALPHA) Create an enterprise-certificate configuration file for MacOS.
+
+     windows
+        (ALPHA) Create an enterprise-certificate configuration file for
+        Windows.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. These variants are also available:
+
+        $ gcloud auth enterprise-certificate-config create
+
+        $ gcloud beta auth enterprise-certificate-config create
+

gcloud/alpha/auth/enterprise-certificate-config/create/linux

@@ -0,0 +1,72 @@
+NAME
+    gcloud alpha auth enterprise-certificate-config create linux - create an
+        enterprise-certificate configuration file for Linux
+
+SYNOPSIS
+    gcloud alpha auth enterprise-certificate-config create linux --label=LABEL
+        --module=MODULE --slot=SLOT [--ecp=ECP] [--ecp-client=ECP_CLIENT]
+        [--output-file=OUTPUT_FILE] [--tls-offload=TLS_OFFLOAD]
+        [--user-pin=USER_PIN] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) This command creates a configuration file used by gcloud to use the
+    enterprise-certificate-proxy component for mTLS.
+
+EXAMPLES
+    To create a credential configuration run:
+
+        $ gcloud alpha auth enterprise-certificate-config create linux \
+            --module=$PATH_TO_PKCS11_MODULE --slot=$PKCS11_SLOT_ID \
+            --label=$PKCS11_OBJECT_LABEL --user-pin=$PKCS11_USER_PIN
+
+REQUIRED FLAGS
+     --label=LABEL
+        The PKCS #11 label for the target credentials. The certificate, public
+        key, and private key MUST have the same label.
+        enterprise-certificate-proxy will use all three objects.
+
+     --module=MODULE
+        The full file path to the PKCS #11 module.
+
+     --slot=SLOT
+        The PKCS #11 slot containing the target credentials.
+
+OPTIONAL FLAGS
+     --ecp=ECP
+        Provide a custom path to the enterprise-certificate-proxy binary. This
+        flag must be the full path to the binary.
+
+     --ecp-client=ECP_CLIENT
+        Provide a custom path to the enterprise-certificate-proxy shared client
+        library. This flag must be the full path to the shared library.
+
+     --output-file=OUTPUT_FILE
+        Override the file path that the enterprise-certificate-proxy
+        configuration is written to.
+
+     --tls-offload=TLS_OFFLOAD
+        Provide a custom path to the enterprise-certificate-proxy shared tls
+        offload library. This flag must be the full path to the shared library.
+
+     --user-pin=USER_PIN
+        The user pin used to login to the PKCS #11 module. If there is no user
+        pin leave this field empty.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. These variants are also available:
+
+        $ gcloud auth enterprise-certificate-config create linux
+
+        $ gcloud beta auth enterprise-certificate-config create linux
+

gcloud/alpha/auth/enterprise-certificate-config/create/macos

@@ -0,0 +1,59 @@
+NAME
+    gcloud alpha auth enterprise-certificate-config create macos - create an
+        enterprise-certificate configuration file for MacOS
+
+SYNOPSIS
+    gcloud alpha auth enterprise-certificate-config create macos
+        --issuer=ISSUER [--ecp=ECP] [--ecp-client=ECP_CLIENT]
+        [--output-file=OUTPUT_FILE] [--tls-offload=TLS_OFFLOAD]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) This command creates a configuration file used by gcloud to use the
+    enterprise-certificate-proxy component for mTLS.
+
+EXAMPLES
+    To create a credential configuration run:
+
+        $ gcloud alpha auth enterprise-certificate-config create macos \
+            --issuer=$CERT_ISSUER
+
+REQUIRED FLAGS
+     --issuer=ISSUER
+        The certificate issuer.
+
+OPTIONAL FLAGS
+     --ecp=ECP
+        Provide a custom path to the enterprise-certificate-proxy binary. This
+        flag must be the full path to the binary.
+
+     --ecp-client=ECP_CLIENT
+        Provide a custom path to the enterprise-certificate-proxy shared client
+        library. This flag must be the full path to the shared library.
+
+     --output-file=OUTPUT_FILE
+        Override the file path that the enterprise-certificate-proxy
+        configuration is written to.
+
+     --tls-offload=TLS_OFFLOAD
+        Provide a custom path to the enterprise-certificate-proxy shared tls
+        offload library. This flag must be the full path to the shared library.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. These variants are also available:
+
+        $ gcloud auth enterprise-certificate-config create macos
+
+        $ gcloud beta auth enterprise-certificate-config create macos
+

gcloud/alpha/auth/enterprise-certificate-config/create/windows

@@ -0,0 +1,65 @@
+NAME
+    gcloud alpha auth enterprise-certificate-config create windows - create an
+        enterprise-certificate configuration file for Windows
+
+SYNOPSIS
+    gcloud alpha auth enterprise-certificate-config create windows
+        --issuer=ISSUER --provider=PROVIDER --store=STORE [--ecp=ECP]
+        [--ecp-client=ECP_CLIENT] [--output-file=OUTPUT_FILE]
+        [--tls-offload=TLS_OFFLOAD] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) This command creates a configuration file used by gcloud to use the
+    enterprise-certificate-proxy component for mTLS.
+
+EXAMPLES
+    To create a credential configuration run:
+
+        $ gcloud alpha auth enterprise-certificate-config create windows \
+            --issuer=$CERT_ISSUER --store=$STORE --provider=$PROVIDER
+
+REQUIRED FLAGS
+     --issuer=ISSUER
+        The certificate issuer.
+
+     --provider=PROVIDER
+        The Windows secure store provider.
+
+     --store=STORE
+        The Windows secure store.
+
+OPTIONAL FLAGS
+     --ecp=ECP
+        Provide a custom path to the enterprise-certificate-proxy binary. This
+        flag must be the full path to the binary.
+
+     --ecp-client=ECP_CLIENT
+        Provide a custom path to the enterprise-certificate-proxy shared client
+        library. This flag must be the full path to the shared library.
+
+     --output-file=OUTPUT_FILE
+        Override the file path that the enterprise-certificate-proxy
+        configuration is written to.
+
+     --tls-offload=TLS_OFFLOAD
+        Provide a custom path to the enterprise-certificate-proxy shared tls
+        offload library. This flag must be the full path to the shared library.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. These variants are also available:
+
+        $ gcloud auth enterprise-certificate-config create windows
+
+        $ gcloud beta auth enterprise-certificate-config create windows
+

gcloud/alpha/auth/enterprise-certificate-config/help

@@ -0,0 +1,38 @@
+NAME
+    gcloud alpha auth enterprise-certificate-config - manage enterprise
+        certificate configurations
+
+SYNOPSIS
+    gcloud alpha auth enterprise-certificate-config GROUP
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Currently only create is implemented.
+
+    The gcloud alpha auth enterprise-certificate-config group lets you create
+    enterprise certificate configurations. This configuration will be used by
+    gcloud to communicate with the enterprise-certificate-proxy.
+
+    See more details at gcloud topic client-certificate.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+GROUPS
+    GROUP is one of the following:
+
+     create
+        (ALPHA) Create enterprise certificate configurations.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. These variants are also available:
+
+        $ gcloud auth enterprise-certificate-config
+
+        $ gcloud beta auth enterprise-certificate-config
+

gcloud/alpha/auth/help

@@ -52,6 +52,9 @@ GROUPS
      application-default
         (ALPHA) Manage your active Application Default Credentials.
 
+     enterprise-certificate-config
+        (ALPHA) Manage enterprise certificate configurations.
+
 COMMANDS
     COMMAND is one of the following:
 

gcloud/alpha/auth/login

@@ -26,16 +26,23 @@ DESCRIPTION
     gcloud auth activate-service-account with the corresponding JSON key file.
 
     In addition to Google user credentials, authorization using workload
-    identity federation or service account keys is also supported.
+    identity federation, workforce identity federation, or service account keys
+    is also supported.
+
+    For authorization with external accounts or service accounts, the
+    --cred-file flag must be specified with the path to the workload identity
+    credential configuration file or service account key file (JSON).
+
+    Login with workload and workforce identity federation is also supported in
+    both gsutil and bq. This command is the recommended way of using external
+    accounts.
 
-    For authorization with external accounts (workload identity pools) or
-    service accounts, the --cred-file flag must be specified with the path to
-    the workload identity credential configuration file or service account key
-    file (JSON). Login with workload identity federation is also supported in
-    gsutil and this command is the recommended way of using external accounts.
     For more information on workload identity federation, see:
     https://cloud.google.com/iam/docs/workload-identity-federation.
 
+    For more information on workforce identity federation, see:
+    https://cloud.google.com/iam/docs/workforce-identity-federation.
+
     For more information on authorization and credential types, see:
     https://cloud.google.com/sdk/docs/authorizing.
 
@@ -44,10 +51,15 @@ EXAMPLES
 
         $ gcloud alpha auth login
 
-    To obtain access credentials using workload identity federation, run:
+    To obtain access credentials using workload or workforce identity
+    federation, run:
 
-        $ gcloud alpha auth login \
-            --cred-file=/path/to/workload/configuration/file
+        $ gcloud alpha auth login --cred-file=/path/to/configuration/file
+
+    To obtain access credentials using a browser-based sign-in flow with
+    workforce identity federation, run:
+
+        $ gcloud alpha auth login --login-config=/path/to/configuration/file
 
 POSITIONAL ARGUMENTS
      [ACCOUNT]
@@ -125,10 +137,10 @@ FLAGS
         Enabled by default, use --no-launch-browser to disable.
 
      --login-config=LOGIN_CONFIG
-        Path to the login configuration file (workforce pool, generated by the
-        Cloud Console or gcloud iam workforce-pools create-login-config).
-        Overrides the default auth/login_config_file property value for this
-        command invocation.
+        Path to the workforce identity federation login configuration file
+        which can be generated using the gcloud iam workforce-pools
+        create-login-config command. Overrides the default
+        auth/login_config_file property value for this command invocation.
 
      --update-adc
         Write the obtained credentials to the well-known location for