gcloud: Thu Dec 14 10:23:57 UTC 2023

gcloud/container/aws/node-pools/help

@@ -28,6 +28,9 @@ COMMANDS
      list
         List node pools in an Anthos cluster on AWS.
 
+     rollback
+        Rollback a node pool in an Anthos cluster on AWS.
+
      update
         Update a node pool in an Anthos cluster on AWS.
 

gcloud/container/aws/node-pools/rollback

@@ -0,0 +1,81 @@
+NAME
+    gcloud container aws node-pools rollback - rollback a node pool in an
+        Anthos cluster on AWS
+
+SYNOPSIS
+    gcloud container aws node-pools rollback
+        (NODE_POOL : --cluster=CLUSTER --location=LOCATION) [--async]
+        [--respect-pdb] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Rollback a node pool in an Anthos cluster on AWS.
+
+EXAMPLES
+    To roll back a canceled or failed update in node pool named my-node-pool in
+    a cluster named my-cluster managed in location us-west1, run:
+
+        $ gcloud container aws node-pools rollback my-node-pool \
+            --cluster=my-cluster --location=us-west1
+
+POSITIONAL ARGUMENTS
+     Node pool resource - node pool to rollback. The arguments in this group
+     can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways.
+
+     To set the project attribute:
+      ◆ provide the argument node_pool on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       NODE_POOL
+          ID of the node_pool or fully qualified identifier for the node_pool.
+
+          To set the node_pool attribute:
+          ▸ provide the argument node_pool on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --cluster=CLUSTER
+          cluster of the node_pool.
+
+          To set the cluster attribute:
+          ▸ provide the argument node_pool on the command line with a fully
+            specified name;
+          ▸ provide the argument --cluster on the command line.
+
+       --location=LOCATION
+          Google Cloud location for the node_pool.
+
+          To set the location attribute:
+          ▸ provide the argument node_pool on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line;
+          ▸ set the property container_aws/location.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+     --respect-pdb
+        Indicates whether the node pool rollback should respect pod disruption
+        budget.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This variant is also available:
+
+        $ gcloud alpha container aws node-pools rollback
+

gcloud/container/clusters/create

@@ -10,6 +10,7 @@ SYNOPSIS
           max-shared-clients-per-gpu=MAX_SHARED_CLIENTS_PER_GPU],...]]
         [--additional-zones=ZONE,[ZONE,...]] [--addons=[ADDON,...]] [--async]
         [--autoprovisioning-network-tags=TAGS,[TAGS,...]]
+        [--autoprovisioning-resource-manager-tags=[KEY=VALUE,...]]
         [--autoscaling-profile=AUTOSCALING_PROFILE]
         [--boot-disk-kms-key=BOOT_DISK_KMS_KEY]
         [--cloud-run-config=[load-balancer-type=EXTERNAL,...]]
@@ -55,9 +56,9 @@ SYNOPSIS
         [--placement-policy=PLACEMENT_POLICY] [--placement-type=PLACEMENT_TYPE]
         [--preemptible] [--private-endpoint-subnetwork=NAME]
         [--private-ipv6-google-access-type=PRIVATE_IPV6_GOOGLE_ACCESS_TYPE]
-        [--release-channel=CHANNEL] [--security-group=SECURITY_GROUP]
-        [--security-posture=SECURITY_POSTURE] [--services-ipv4-cidr=CIDR]
-        [--services-secondary-range-name=NAME]
+        [--release-channel=CHANNEL] [--resource-manager-tags=[KEY=VALUE,...]]
+        [--security-group=SECURITY_GROUP] [--security-posture=SECURITY_POSTURE]
+        [--services-ipv4-cidr=CIDR] [--services-secondary-range-name=NAME]
         [--shielded-integrity-monitoring] [--shielded-secure-boot] [--spot]
         [--stack-type=STACK_TYPE] [--subnetwork=SUBNETWORK]
         [--system-config-from-file=SYSTEM_CONFIG_FROM_FILE]
@@ -225,6 +226,31 @@ FLAGS
         https://cloud.google.com/sdk/gcloud/reference/compute/firewall-rules/create
         for examples.
 
+     --autoprovisioning-resource-manager-tags=[KEY=VALUE,...]
+        Applies the specified comma-separated resource manager tags that has
+        the GCE_FIREWALL purpose to all nodes in the new Autopilot cluster or
+        all auto-provisioned nodes in the new Standard cluster.
+
+        Examples:
+
+            $ gcloud container clusters create example-cluster \
+                --autoprovisioning-resource-manager-tags=tagKeys/\
+            1234=tagValues/2345
+            $ gcloud container clusters create example-cluster \
+                --autoprovisioning-resource-manager-tags=my-project/key1=value1
+            $ gcloud container clusters create example-cluster \
+                --autoprovisioning-resource-manager-tags=12345/key1=value1,\
+            23456/key2=value2
+            $ gcloud container clusters create example-cluster \
+                --autoprovisioning-resource-manager-tags=
+
+        All nodes in an Autopilot cluster or all auto-provisioned nodes in a
+        Standard cluster, including nodes that are resized or re-created, will
+        have the specified tags on the corresponding Instance object in the
+        Compute Engine API. You can reference these tags in network firewall
+        policy rules. For instructions, see
+        https://cloud.google.com/firewall/docs/use-tags-for-firewalls.
+
      --autoscaling-profile=AUTOSCALING_PROFILE
         Set autoscaling behaviour, choices are 'optimize-utilization' and
         'balanced'. Default is 'balanced'.
@@ -954,6 +980,28 @@ FLAGS
             Clusters subscribed to 'stable' receive versions that are known to
             be stable and reliable in production.
 
+     --resource-manager-tags=[KEY=VALUE,...]
+        Applies the specified comma-separated resource manager tags that has
+        the GCE_FIREWALL purpose to all nodes in the new default node pool(s)
+        of a new cluster.
+
+        Examples:
+
+            $ gcloud container clusters create example-cluster \
+                --resource-manager-tags=tagKeys/1234=tagValues/2345
+            $ gcloud container clusters create example-cluster \
+                --resource-manager-tags=my-project/key1=value1
+            $ gcloud container clusters create example-cluster \
+                --resource-manager-tags=12345/key1=value1,23456/key2=value2
+            $ gcloud container clusters create example-cluster \
+                --resource-manager-tags=
+
+        All nodes, including nodes that are resized or re-created, will have
+        the specified tags on the corresponding Instance object in the Compute
+        Engine API. You can reference these tags in network firewall policy
+        rules. For instructions, see
+        https://cloud.google.com/firewall/docs/use-tags-for-firewalls.
+
      --security-group=SECURITY_GROUP
         The name of the RBAC security group for use with Google security groups
         in Kubernetes RBAC

gcloud/container/clusters/create-auto

@@ -5,6 +5,7 @@ NAME
 SYNOPSIS
     gcloud container clusters create-auto NAME [--async]
         [--autoprovisioning-network-tags=TAGS,[TAGS,...]]
+        [--autoprovisioning-resource-manager-tags=[KEY=VALUE,...]]
         [--binauthz-evaluation-mode=BINAUTHZ_EVALUATION_MODE]
         [--boot-disk-kms-key=BOOT_DISK_KMS_KEY]
         [--cluster-ipv4-cidr=CLUSTER_IPV4_CIDR]
@@ -72,6 +73,31 @@ FLAGS
         https://cloud.google.com/sdk/gcloud/reference/compute/firewall-rules/create
         for examples.
 
+     --autoprovisioning-resource-manager-tags=[KEY=VALUE,...]
+        Applies the specified comma-separated resource manager tags that has
+        the GCE_FIREWALL purpose to all nodes in the new Autopilot cluster or
+        all auto-provisioned nodes in the new Standard cluster.
+
+        Examples:
+
+            $ gcloud container clusters create-auto example-cluster \
+                --autoprovisioning-resource-manager-tags=tagKeys/\
+            1234=tagValues/2345
+            $ gcloud container clusters create-auto example-cluster \
+                --autoprovisioning-resource-manager-tags=my-project/key1=value1
+            $ gcloud container clusters create-auto example-cluster \
+                --autoprovisioning-resource-manager-tags=12345/key1=value1,\
+            23456/key2=value2
+            $ gcloud container clusters create-auto example-cluster \
+                --autoprovisioning-resource-manager-tags=
+
+        All nodes in an Autopilot cluster or all auto-provisioned nodes in a
+        Standard cluster, including nodes that are resized or re-created, will
+        have the specified tags on the corresponding Instance object in the
+        Compute Engine API. You can reference these tags in network firewall
+        policy rules. For instructions, see
+        https://cloud.google.com/firewall/docs/use-tags-for-firewalls.
+
      Flags for Binary Authorization:
 
        --binauthz-evaluation-mode=BINAUTHZ_EVALUATION_MODE

gcloud/container/clusters/update

@@ -5,6 +5,7 @@ NAME
 SYNOPSIS
     gcloud container clusters update NAME
         (--autoprovisioning-network-tags=[TAGS,...]
+          | --autoprovisioning-resource-manager-tags=[KEY=VALUE,...]
           | --autoscaling-profile=AUTOSCALING_PROFILE | --clear-fleet-project
           | --complete-credential-rotation | --complete-ip-rotation
           | --database-encryption-key=DATABASE_ENCRYPTION_KEY
@@ -123,6 +124,39 @@ REQUIRED FLAGS
           https://cloud.google.com/sdk/gcloud/reference/compute/firewall-rules/create
           for examples.
 
+       --autoprovisioning-resource-manager-tags=[KEY=VALUE,...]
+          For an Autopilot cluster, the specified comma-separated resource
+          manager tags that has the GCP_FIREWALL purpose replace the existing
+          tags on all nodes in the cluster.
+
+          For a Standard cluster, the specified comma-separated resource
+          manager tags that has the GCE_FIREWALL purpose are applied to all
+          nodes in the new newly created auto-provisioned node pools. Existing
+          auto-provisioned node pools retain the tags that they had before the
+          update. To update tags on an existing auto-provisioned node pool, use
+          the node pool level flag '--resource-manager-tags'.
+
+          Examples:
+
+              $ gcloud container clusters update example-cluster \
+                  --autoprovisioning-resource-manager-tags=tagKeys/\
+              1234=tagValues/2345
+              $ gcloud container clusters update example-cluster \
+                  --autoprovisioning-resource-manager-tags=my-project/key1=value1
+              $ gcloud container clusters update example-cluster \
+                  --autoprovisioning-resource-manager-tags=12345/key1=value1,\
+              23456/key2=value2
+              $ gcloud container clusters update example-cluster \
+                  --autoprovisioning-resource-manager-tags=
+
+          All nodes in an Autopilot cluster or all newly created
+          auto-provisioned nodes in a Standard cluster, including nodes that
+          are resized or re-created, will have the specified tags on the
+          corresponding Instance object in the Compute Engine API. You can
+          reference these tags in network firewall policy rules. For
+          instructions, see
+          https://cloud.google.com/firewall/docs/use-tags-for-firewalls.
+
        --autoscaling-profile=AUTOSCALING_PROFILE
           Set autoscaling behaviour, choices are 'optimize-utilization' and
           'balanced'. Default is 'balanced'.

gcloud/container/fleet/clusterupgrade/create

@@ -0,0 +1,93 @@
+NAME
+    gcloud container fleet clusterupgrade create - create the clusterupgrade
+        feature for a fleet within a given project
+
+SYNOPSIS
+    gcloud container fleet clusterupgrade create
+        [--default-upgrade-soaking=DEFAULT_UPGRADE_SOAKING]
+        [--upstream-fleet=UPSTREAM_FLEET]
+        [--add-upgrade-soaking-override=ADD_UPGRADE_SOAKING_OVERRIDE
+          --upgrade-selector=[name=NAME],[version=VERSION]]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Create the clusterupgrade feature for a fleet within a given project.
+
+EXAMPLES
+    To create the clusterupgrade feature for the current fleet, run:
+
+        $ gcloud container fleet clusterupgrade create \
+            --default-upgrade-soaking=DEFAULT_UPGRADE_SOAKING
+
+FLAGS
+     --default-upgrade-soaking=DEFAULT_UPGRADE_SOAKING
+        Configures the default soaking duration for each upgrade propagating
+        through the current fleet to become "COMPLETE". Soaking begins after
+        all clusters in the fleet are on the target version, or after 30 days
+        if all cluster upgrades are not complete. Once an upgrade state becomes
+        "COMPLETE", it will automatically be propagated to the downstream
+        fleet. Max is 30 days.
+
+        To configure Rollout Sequencing for a fleet, this attribute must be
+        set. To do this while specifying a default soaking duration of 7 days,
+        run:
+
+            $ gcloud container fleet clusterupgrade create \
+                --default-upgrade-soaking=7d
+
+     --upstream-fleet=UPSTREAM_FLEET
+        The upstream fleet. GKE will finish upgrades on the upstream fleet
+        before applying the same upgrades to the current fleet.
+
+        To configure the upstream fleet, run:
+
+            $ gcloud container fleet clusterupgrade create             \
+                --upstream-fleet={upstream_fleet}
+
+     Upgrade soaking override.
+
+         Defines a specific soaking time override for a particular upgrade
+         propagating through the current fleet that supercedes the default
+         soaking duration configured by `--default-upgrade-soaking`.
+
+         To set an upgrade soaking override of 12 hours for the upgrade with
+         name, `k8s_control_plane`, and version, `1.23.1-gke.1000`, run:
+
+         $ gcloud container fleet clusterupgrade create               \
+         --add-upgrade-soaking-override=12h               \
+         --upgrade-selector=name="k8s_control_plane",\
+         version="1.23.1-gke.1000"
+
+       --add-upgrade-soaking-override=ADD_UPGRADE_SOAKING_OVERRIDE
+          Overrides the soaking time for a particular upgrade name and version
+          propagating through the current fleet. Set soaking to 0 days to
+          bypass soaking and fast-forward the upgrade to the downstream fleet.
+
+          See $ gcloud topic datetimes for information on duration formats.
+
+          This flag argument must be specified if any of the other arguments in
+          this group are specified.
+
+       --upgrade-selector=[name=NAME],[version=VERSION]
+          Name and version of the upgrade to be overridden where version is a
+          full GKE version. Currently, name can be either k8s_control_plane or
+          k8s_node.
+
+          This flag argument must be specified if any of the other arguments in
+          this group are specified.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha container fleet clusterupgrade create
+
+        $ gcloud beta container fleet clusterupgrade create
+

gcloud/container/fleet/clusterupgrade/describe

@@ -0,0 +1,47 @@
+NAME
+    gcloud container fleet clusterupgrade describe - describe the
+        clusterupgrade feature for a fleet within a given project
+
+SYNOPSIS
+    gcloud container fleet clusterupgrade describe
+        [--show-linked-cluster-upgrade] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Describe the Fleet clusterupgrade feature used for configuring fleet-based
+    rollout sequencing.
+
+EXAMPLES
+    To view the cluster upgrade feature information for the current fleet, run:
+
+        $ gcloud container fleet clusterupgrade describe
+
+FLAGS
+     --show-linked-cluster-upgrade
+        Shows the cluster upgrade feature information for the current fleet as
+        well as information for all other fleets linked in the same rollout
+        sequence (provided that the caller has permission to view the upstream
+        and downstream fleets). This displays cluster upgrade information for
+        fleets in the current fleet's rollout sequence in order of furthest
+        upstream to downstream.
+
+        To view the cluster upgrade feature information for the rollout
+        sequence containing the current fleet, run:
+
+            $ gcloud container fleet clusterupgrade describe \
+                --show-linked-cluster-upgrade
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha container fleet clusterupgrade describe
+
+        $ gcloud beta container fleet clusterupgrade describe
+

gcloud/container/fleet/clusterupgrade/help

@@ -0,0 +1,34 @@
+NAME
+    gcloud container fleet clusterupgrade - configure the Fleet clusterupgrade
+        feature
+
+SYNOPSIS
+    gcloud container fleet clusterupgrade COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    This fleet feature is used to configure fleet-based rollout sequencing.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     create
+        Create the clusterupgrade feature for a fleet within a given project.
+
+     describe
+        Describe the clusterupgrade feature for a fleet within a given project.
+
+     update
+        Update the clusterupgrade feature for a fleet within a given project.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha container fleet clusterupgrade
+
+        $ gcloud beta container fleet clusterupgrade
+

gcloud/container/fleet/clusterupgrade/update

@@ -0,0 +1,120 @@
+NAME
+    gcloud container fleet clusterupgrade update - update the clusterupgrade
+        feature for a fleet within a given project
+
+SYNOPSIS
+    gcloud container fleet clusterupgrade update
+        [--default-upgrade-soaking=DEFAULT_UPGRADE_SOAKING]
+        [--remove-upgrade-soaking-overrides
+          | --add-upgrade-soaking-override=ADD_UPGRADE_SOAKING_OVERRIDE
+          --upgrade-selector=[name=NAME],[version=VERSION]]
+        [--reset-upstream-fleet | --upstream-fleet=UPSTREAM_FLEET]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Update the clusterupgrade feature for a fleet within a given project.
+
+EXAMPLES
+    To update the clusterupgrade feature for the current fleet, run:
+
+        $ gcloud container fleet clusterupgrade update \
+            --default-upgrade-soaking=DEFAULT_UPGRADE_SOAKING
+
+FLAGS
+     --default-upgrade-soaking=DEFAULT_UPGRADE_SOAKING
+        Configures the default soaking duration for each upgrade propagating
+        through the current fleet to become "COMPLETE". Soaking begins after
+        all clusters in the fleet are on the target version, or after 30 days
+        if all cluster upgrades are not complete. Once an upgrade state becomes
+        "COMPLETE", it will automatically be propagated to the downstream
+        fleet. Max is 30 days.
+
+        To configure Rollout Sequencing for a fleet, this attribute must be
+        set. To do this while specifying a default soaking duration of 7 days,
+        run:
+
+            $ gcloud container fleet clusterupgrade update \
+                --default-upgrade-soaking=7d
+
+     At most one of these can be specified:
+
+       --remove-upgrade-soaking-overrides
+          Removes soaking time overrides for all upgrades propagating through
+          the current fleet. Consequently, all upgrades will follow the soak
+          time configured by --default-upgrade-soaking until new overrides are
+          configured with --add_upgrade_soaking_override and
+          --upgrade_selector.
+
+          To remove all configured soaking time overrides, run:
+
+              $ gcloud container fleet clusterupgrade update \
+                  --remove-upgrade-soaking-overrides
+
+       Upgrade soaking override.
+
+           Defines a specific soaking time override for a particular upgrade
+           propagating through the current fleet that supercedes the default
+           soaking duration configured by `--default-upgrade-soaking`.
+
+           To set an upgrade soaking override of 12 hours for the upgrade with
+           name, `k8s_control_plane`, and version, `1.23.1-gke.1000`, run:
+
+           $ gcloud container fleet clusterupgrade update               \
+           --add-upgrade-soaking-override=12h               \
+           --upgrade-selector=name="k8s_control_plane",\
+           version="1.23.1-gke.1000"
+
+         --add-upgrade-soaking-override=ADD_UPGRADE_SOAKING_OVERRIDE
+            Overrides the soaking time for a particular upgrade name and
+            version propagating through the current fleet. Set soaking to 0
+            days to bypass soaking and fast-forward the upgrade to the
+            downstream fleet.
+
+            See $ gcloud topic datetimes for information on duration formats.
+
+            This flag argument must be specified if any of the other arguments
+            in this group are specified.
+
+         --upgrade-selector=[name=NAME],[version=VERSION]
+            Name and version of the upgrade to be overridden where version is a
+            full GKE version. Currently, name can be either k8s_control_plane
+            or k8s_node.
+
+            This flag argument must be specified if any of the other arguments
+            in this group are specified.
+
+     At most one of these can be specified:
+
+       --reset-upstream-fleet
+          Clears the relationship between the current fleet and its upstream
+          fleet in the rollout sequence.
+
+          To remove the link between the current fleet and its upstream fleet,
+          run:
+
+              $ gcloud container fleet clusterupgrade update --reset-upstream-fleet
+
+       --upstream-fleet=UPSTREAM_FLEET
+          The upstream fleet. GKE will finish upgrades on the upstream fleet
+          before applying the same upgrades to the current fleet.
+
+          To configure the upstream fleet, run:
+
+              $ gcloud container fleet clusterupgrade update             \
+                  --upstream-fleet={upstream_fleet}
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha container fleet clusterupgrade update
+
+        $ gcloud beta container fleet clusterupgrade update
+

gcloud/container/fleet/create

@@ -5,7 +5,7 @@ SYNOPSIS
     gcloud container fleet create [--async] [--display-name=DISPLAY_NAME]
         [--labels=[KEY=VALUE,...]]
         [--binauthz-evaluation-mode=BINAUTHZ_EVALUATION_MODE
-          --binauthz-policy-bindings=[name=BINAUTHZ_POLICY,...]
+          --binauthz-policy-bindings=[name=BINAUTHZ_POLICY]
           --security-posture=SECURITY_POSTURE
           --workload-vulnerability-scanning=WORKLOAD_VULNERABILITY_SCANNING]
         [GCLOUD_WIDE_FLAG ...]
@@ -50,11 +50,11 @@ FLAGS
             fleet,
 
                 $ gcloud container fleet create \
-                    --binauthz-evaluation-mode=POLICY_BINDINGS
+                    --binauthz-evaluation-mode=policy-bindings
 
-            BINAUTHZ_EVALUATION_MODE must be one of: DISABLED, POLICY_BINDINGS.
+            BINAUTHZ_EVALUATION_MODE must be one of: disabled, policy-bindings.
 
-         --binauthz-policy-bindings=[name=BINAUTHZ_POLICY,...]
+         --binauthz-policy-bindings=[name=BINAUTHZ_POLICY]
             The relative resource name of the Binary Authorization policy to
             audit and/or enforce. GKE policies have the following format:
             projects/{project_number}/platforms/gke/policies/{policy_id}.

gcloud/container/fleet/help

@@ -48,6 +48,9 @@ GROUPS
      cloudrun
         Manage the CloudRun feature.
 
+     clusterupgrade
+        Configure the Fleet clusterupgrade feature.
+
      dataplane-v2-encryption
         Manage Dataplane V2 Encryption Feature.
 

gcloud/container/fleet/update

@@ -5,7 +5,7 @@ SYNOPSIS
     gcloud container fleet update [--async] [--display-name=DISPLAY_NAME]
         [--update-labels=[KEY=VALUE,...]]
         [--binauthz-evaluation-mode=BINAUTHZ_EVALUATION_MODE
-          --binauthz-policy-bindings=[name=BINAUTHZ_POLICY,...]
+          --binauthz-policy-bindings=[name=BINAUTHZ_POLICY]
           --security-posture=SECURITY_POSTURE
           --workload-vulnerability-scanning=WORKLOAD_VULNERABILITY_SCANNING]
         [--clear-labels | --remove-labels=[KEY,...]] [GCLOUD_WIDE_FLAG ...]
@@ -51,11 +51,11 @@ FLAGS
             fleet,
 
                 $ gcloud container fleet update \
-                    --binauthz-evaluation-mode=POLICY_BINDINGS
+                    --binauthz-evaluation-mode=policy-bindings
 
-            BINAUTHZ_EVALUATION_MODE must be one of: DISABLED, POLICY_BINDINGS.
+            BINAUTHZ_EVALUATION_MODE must be one of: disabled, policy-bindings.
 
-         --binauthz-policy-bindings=[name=BINAUTHZ_POLICY,...]
+         --binauthz-policy-bindings=[name=BINAUTHZ_POLICY]
             The relative resource name of the Binary Authorization policy to
             audit and/or enforce. GKE policies have the following format:
             projects/{project_number}/platforms/gke/policies/{policy_id}.

gcloud/container/hub/clusterupgrade/create

@@ -0,0 +1,93 @@
+NAME
+    gcloud container hub clusterupgrade create - create the clusterupgrade
+        feature for a fleet within a given project
+
+SYNOPSIS
+    gcloud container hub clusterupgrade create
+        [--default-upgrade-soaking=DEFAULT_UPGRADE_SOAKING]
+        [--upstream-fleet=UPSTREAM_FLEET]
+        [--add-upgrade-soaking-override=ADD_UPGRADE_SOAKING_OVERRIDE
+          --upgrade-selector=[name=NAME],[version=VERSION]]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Create the clusterupgrade feature for a fleet within a given project.
+
+EXAMPLES
+    To create the clusterupgrade feature for the current fleet, run:
+
+        $ gcloud container hub clusterupgrade create \
+            --default-upgrade-soaking=DEFAULT_UPGRADE_SOAKING
+
+FLAGS
+     --default-upgrade-soaking=DEFAULT_UPGRADE_SOAKING
+        Configures the default soaking duration for each upgrade propagating
+        through the current fleet to become "COMPLETE". Soaking begins after
+        all clusters in the fleet are on the target version, or after 30 days
+        if all cluster upgrades are not complete. Once an upgrade state becomes
+        "COMPLETE", it will automatically be propagated to the downstream
+        fleet. Max is 30 days.
+
+        To configure Rollout Sequencing for a fleet, this attribute must be
+        set. To do this while specifying a default soaking duration of 7 days,
+        run:
+
+            $ gcloud container hub clusterupgrade create \
+                --default-upgrade-soaking=7d
+
+     --upstream-fleet=UPSTREAM_FLEET
+        The upstream fleet. GKE will finish upgrades on the upstream fleet
+        before applying the same upgrades to the current fleet.
+
+        To configure the upstream fleet, run:
+
+            $ gcloud container hub clusterupgrade create             \
+                --upstream-fleet={upstream_fleet}
+
+     Upgrade soaking override.
+
+         Defines a specific soaking time override for a particular upgrade
+         propagating through the current fleet that supercedes the default
+         soaking duration configured by `--default-upgrade-soaking`.
+
+         To set an upgrade soaking override of 12 hours for the upgrade with
+         name, `k8s_control_plane`, and version, `1.23.1-gke.1000`, run:
+
+         $ gcloud container hub clusterupgrade create               \
+         --add-upgrade-soaking-override=12h               \
+         --upgrade-selector=name="k8s_control_plane",\
+         version="1.23.1-gke.1000"
+
+       --add-upgrade-soaking-override=ADD_UPGRADE_SOAKING_OVERRIDE
+          Overrides the soaking time for a particular upgrade name and version
+          propagating through the current fleet. Set soaking to 0 days to
+          bypass soaking and fast-forward the upgrade to the downstream fleet.
+
+          See $ gcloud topic datetimes for information on duration formats.
+
+          This flag argument must be specified if any of the other arguments in
+          this group are specified.
+
+       --upgrade-selector=[name=NAME],[version=VERSION]
+          Name and version of the upgrade to be overridden where version is a
+          full GKE version. Currently, name can be either k8s_control_plane or
+          k8s_node.
+
+          This flag argument must be specified if any of the other arguments in
+          this group are specified.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha container hub clusterupgrade create
+
+        $ gcloud beta container hub clusterupgrade create
+

gcloud/container/hub/clusterupgrade/describe

@@ -0,0 +1,47 @@
+NAME
+    gcloud container hub clusterupgrade describe - describe the clusterupgrade
+        feature for a fleet within a given project
+
+SYNOPSIS
+    gcloud container hub clusterupgrade describe
+        [--show-linked-cluster-upgrade] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Describe the Fleet clusterupgrade feature used for configuring fleet-based
+    rollout sequencing.
+
+EXAMPLES
+    To view the cluster upgrade feature information for the current fleet, run:
+
+        $ gcloud container hub clusterupgrade describe
+
+FLAGS
+     --show-linked-cluster-upgrade
+        Shows the cluster upgrade feature information for the current fleet as
+        well as information for all other fleets linked in the same rollout
+        sequence (provided that the caller has permission to view the upstream
+        and downstream fleets). This displays cluster upgrade information for
+        fleets in the current fleet's rollout sequence in order of furthest
+        upstream to downstream.
+
+        To view the cluster upgrade feature information for the rollout
+        sequence containing the current fleet, run:
+
+            $ gcloud container hub clusterupgrade describe \
+                --show-linked-cluster-upgrade
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha container hub clusterupgrade describe
+
+        $ gcloud beta container hub clusterupgrade describe
+

gcloud/container/hub/clusterupgrade/help

@@ -0,0 +1,34 @@
+NAME
+    gcloud container hub clusterupgrade - configure the Fleet clusterupgrade
+        feature
+
+SYNOPSIS
+    gcloud container hub clusterupgrade COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    This fleet feature is used to configure fleet-based rollout sequencing.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     create
+        Create the clusterupgrade feature for a fleet within a given project.
+
+     describe
+        Describe the clusterupgrade feature for a fleet within a given project.
+
+     update
+        Update the clusterupgrade feature for a fleet within a given project.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha container hub clusterupgrade
+
+        $ gcloud beta container hub clusterupgrade
+

gcloud/container/hub/clusterupgrade/update

@@ -0,0 +1,120 @@
+NAME
+    gcloud container hub clusterupgrade update - update the clusterupgrade
+        feature for a fleet within a given project
+
+SYNOPSIS
+    gcloud container hub clusterupgrade update
+        [--default-upgrade-soaking=DEFAULT_UPGRADE_SOAKING]
+        [--remove-upgrade-soaking-overrides
+          | --add-upgrade-soaking-override=ADD_UPGRADE_SOAKING_OVERRIDE
+          --upgrade-selector=[name=NAME],[version=VERSION]]
+        [--reset-upstream-fleet | --upstream-fleet=UPSTREAM_FLEET]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Update the clusterupgrade feature for a fleet within a given project.
+
+EXAMPLES
+    To update the clusterupgrade feature for the current fleet, run:
+
+        $ gcloud container hub clusterupgrade update \
+            --default-upgrade-soaking=DEFAULT_UPGRADE_SOAKING
+
+FLAGS
+     --default-upgrade-soaking=DEFAULT_UPGRADE_SOAKING
+        Configures the default soaking duration for each upgrade propagating
+        through the current fleet to become "COMPLETE". Soaking begins after
+        all clusters in the fleet are on the target version, or after 30 days
+        if all cluster upgrades are not complete. Once an upgrade state becomes
+        "COMPLETE", it will automatically be propagated to the downstream
+        fleet. Max is 30 days.
+
+        To configure Rollout Sequencing for a fleet, this attribute must be
+        set. To do this while specifying a default soaking duration of 7 days,
+        run:
+
+            $ gcloud container hub clusterupgrade update \
+                --default-upgrade-soaking=7d
+
+     At most one of these can be specified:
+
+       --remove-upgrade-soaking-overrides
+          Removes soaking time overrides for all upgrades propagating through
+          the current fleet. Consequently, all upgrades will follow the soak
+          time configured by --default-upgrade-soaking until new overrides are
+          configured with --add_upgrade_soaking_override and
+          --upgrade_selector.
+
+          To remove all configured soaking time overrides, run:
+
+              $ gcloud container hub clusterupgrade update \
+                  --remove-upgrade-soaking-overrides
+
+       Upgrade soaking override.
+
+           Defines a specific soaking time override for a particular upgrade
+           propagating through the current fleet that supercedes the default
+           soaking duration configured by `--default-upgrade-soaking`.
+
+           To set an upgrade soaking override of 12 hours for the upgrade with
+           name, `k8s_control_plane`, and version, `1.23.1-gke.1000`, run:
+
+           $ gcloud container hub clusterupgrade update               \
+           --add-upgrade-soaking-override=12h               \
+           --upgrade-selector=name="k8s_control_plane",\
+           version="1.23.1-gke.1000"
+
+         --add-upgrade-soaking-override=ADD_UPGRADE_SOAKING_OVERRIDE
+            Overrides the soaking time for a particular upgrade name and
+            version propagating through the current fleet. Set soaking to 0
+            days to bypass soaking and fast-forward the upgrade to the
+            downstream fleet.
+
+            See $ gcloud topic datetimes for information on duration formats.
+
+            This flag argument must be specified if any of the other arguments
+            in this group are specified.
+
+         --upgrade-selector=[name=NAME],[version=VERSION]
+            Name and version of the upgrade to be overridden where version is a
+            full GKE version. Currently, name can be either k8s_control_plane
+            or k8s_node.
+
+            This flag argument must be specified if any of the other arguments
+            in this group are specified.
+
+     At most one of these can be specified:
+
+       --reset-upstream-fleet
+          Clears the relationship between the current fleet and its upstream
+          fleet in the rollout sequence.
+
+          To remove the link between the current fleet and its upstream fleet,
+          run:
+
+              $ gcloud container hub clusterupgrade update --reset-upstream-fleet
+
+       --upstream-fleet=UPSTREAM_FLEET
+          The upstream fleet. GKE will finish upgrades on the upstream fleet
+          before applying the same upgrades to the current fleet.
+
+          To configure the upstream fleet, run:
+
+              $ gcloud container hub clusterupgrade update             \
+                  --upstream-fleet={upstream_fleet}
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha container hub clusterupgrade update
+
+        $ gcloud beta container hub clusterupgrade update
+

gcloud/container/hub/create

@@ -5,7 +5,7 @@ SYNOPSIS
     gcloud container hub create [--async] [--display-name=DISPLAY_NAME]
         [--labels=[KEY=VALUE,...]]
         [--binauthz-evaluation-mode=BINAUTHZ_EVALUATION_MODE
-          --binauthz-policy-bindings=[name=BINAUTHZ_POLICY,...]
+          --binauthz-policy-bindings=[name=BINAUTHZ_POLICY]
           --security-posture=SECURITY_POSTURE
           --workload-vulnerability-scanning=WORKLOAD_VULNERABILITY_SCANNING]
         [GCLOUD_WIDE_FLAG ...]
@@ -50,11 +50,11 @@ FLAGS
             fleet,
 
                 $ gcloud container hub create \
-                    --binauthz-evaluation-mode=POLICY_BINDINGS
+                    --binauthz-evaluation-mode=policy-bindings
 
-            BINAUTHZ_EVALUATION_MODE must be one of: DISABLED, POLICY_BINDINGS.
+            BINAUTHZ_EVALUATION_MODE must be one of: disabled, policy-bindings.
 
-         --binauthz-policy-bindings=[name=BINAUTHZ_POLICY,...]
+         --binauthz-policy-bindings=[name=BINAUTHZ_POLICY]
             The relative resource name of the Binary Authorization policy to
             audit and/or enforce. GKE policies have the following format:
             projects/{project_number}/platforms/gke/policies/{policy_id}.

gcloud/container/hub/help

@@ -48,6 +48,9 @@ GROUPS
      cloudrun
         Manage the CloudRun feature.
 
+     clusterupgrade
+        Configure the Fleet clusterupgrade feature.
+
      dataplane-v2-encryption
         Manage Dataplane V2 Encryption Feature.
 

gcloud/container/hub/update

@@ -5,7 +5,7 @@ SYNOPSIS
     gcloud container hub update [--async] [--display-name=DISPLAY_NAME]
         [--update-labels=[KEY=VALUE,...]]
         [--binauthz-evaluation-mode=BINAUTHZ_EVALUATION_MODE
-          --binauthz-policy-bindings=[name=BINAUTHZ_POLICY,...]
+          --binauthz-policy-bindings=[name=BINAUTHZ_POLICY]
           --security-posture=SECURITY_POSTURE
           --workload-vulnerability-scanning=WORKLOAD_VULNERABILITY_SCANNING]
         [--clear-labels | --remove-labels=[KEY,...]] [GCLOUD_WIDE_FLAG ...]
@@ -51,11 +51,11 @@ FLAGS
             fleet,
 
                 $ gcloud container hub update \
-                    --binauthz-evaluation-mode=POLICY_BINDINGS
+                    --binauthz-evaluation-mode=policy-bindings
 
-            BINAUTHZ_EVALUATION_MODE must be one of: DISABLED, POLICY_BINDINGS.
+            BINAUTHZ_EVALUATION_MODE must be one of: disabled, policy-bindings.
 
-         --binauthz-policy-bindings=[name=BINAUTHZ_POLICY,...]
+         --binauthz-policy-bindings=[name=BINAUTHZ_POLICY]
             The relative resource name of the Binary Authorization policy to
             audit and/or enforce. GKE policies have the following format:
             projects/{project_number}/platforms/gke/policies/{policy_id}.

gcloud/container/node-pools/create

@@ -36,8 +36,9 @@ SYNOPSIS
         [--node-taints=[NODE_TAINT,...]] [--node-version=NODE_VERSION]
         [--num-nodes=NUM_NODES; default=3]
         [--placement-policy=PLACEMENT_POLICY] [--placement-type=PLACEMENT_TYPE]
-        [--preemptible] [--sandbox=[type=TYPE]]
-        [--shielded-integrity-monitoring] [--shielded-secure-boot]
+        [--preemptible] [--resource-manager-tags=[KEY=VALUE,...]]
+        [--sandbox=[type=TYPE]] [--shielded-integrity-monitoring]
+        [--shielded-secure-boot]
         [--sole-tenant-node-affinity-file=SOLE_TENANT_NODE_AFFINITY_FILE]
         [--spot]
         [--standard-rollout-policy=[batch-node-count=BATCH_NODE_COUNT,
@@ -511,6 +512,27 @@ FLAGS
         https://cloud.google.com/kubernetes-engine/docs/preemptible-vm for more
         information on how to use Preemptible VMs with Kubernetes Engine.
 
+     --resource-manager-tags=[KEY=VALUE,...]
+        Applies the specified comma-separated resource manager tags that has
+        the GCE_FIREWALL purpose to all nodes in the new node pool.
+
+        Examples:
+
+            $ gcloud container node-pools create example-node-pool \
+                --resource-manager-tags=tagKeys/1234=tagValues/2345
+            $ gcloud container node-pools create example-node-pool \
+                --resource-manager-tags=my-project/key1=value1
+            $ gcloud container node-pools create example-node-pool \
+                --resource-manager-tags=12345/key1=value1,23456/key2=value2
+            $ gcloud container node-pools create example-node-pool \
+                --resource-manager-tags=
+
+        All nodes, including nodes that are resized or re-created, will have
+        the specified tags on the corresponding Instance object in the Compute
+        Engine API. You can reference these tags in network firewall policy
+        rules. For instructions, see
+        https://cloud.google.com/firewall/docs/use-tags-for-firewalls.
+
      --sandbox=[type=TYPE]
         Enables the requested sandbox on all nodes in the node pool.
 

gcloud/container/node-pools/update

@@ -10,6 +10,7 @@ SYNOPSIS
           | --network-performance-configs=[PROPERTY=VALUE,...]
           | --node-labels=[NODE_LABEL,...] | --node-locations=ZONE,[ZONE,...]
           | --node-taints=[NODE_TAINT,...]
+          | --resource-manager-tags=[KEY=VALUE,...]
           | --system-config-from-file=SYSTEM_CONFIG_FROM_FILE
           | --tags=[TAG,...] | --windows-os-version=WINDOWS_OS_VERSION
           | --workload-metadata=WORKLOAD_METADATA | --disk-size=DISK_SIZE
@@ -147,6 +148,29 @@ REQUIRED FLAGS
           To read more about node-taints, see
           https://cloud.google.com/kubernetes-engine/docs/node-taints.
 
+       --resource-manager-tags=[KEY=VALUE,...]
+          Replaces all the user specified resource manager tags on all nodes in
+          an existing node pool in a Standard cluster with the given
+          comma-separated resource manager tags that has the GCE_FIREWALL
+          purpose.
+
+          Examples:
+
+              $ gcloud container node-pools update example-node-pool \
+                  --resource-manager-tags=tagKeys/1234=tagValues/2345
+              $ gcloud container node-pools update example-node-pool \
+                  --resource-manager-tags=my-project/key1=value1
+              $ gcloud container node-pools update example-node-pool \
+                  --resource-manager-tags=12345/key1=value1,23456/key2=value2
+              $ gcloud container node-pools update example-node-pool \
+                  --resource-manager-tags=
+
+          All nodes, including nodes that are resized or re-created, will have
+          the specified tags on the corresponding Instance object in the
+          Compute Engine API. You can reference these tags in network firewall
+          policy rules. For instructions, see
+          https://cloud.google.com/firewall/docs/use-tags-for-firewalls.
+
        --system-config-from-file=SYSTEM_CONFIG_FROM_FILE
           Path of the YAML/JSON file that contains the node configuration,
           including Linux kernel parameters (sysctls) and kubelet configs.