diff --git a/gcloud/_version b/gcloud/_version
index c43b1e716..fa1250df2 100644
--- a/gcloud/_version
+++ b/gcloud/_version
@@ -1,8 +1,8 @@
-Google Cloud SDK 519.0.0
-alpha 2025.04.18
-beta 2025.04.18
+Google Cloud SDK 520.0.0
+alpha 2025.04.25
+beta 2025.04.25
 bq 2.1.15
 bundled-python3-unix 3.12.8
-core 2025.04.18
+core 2025.04.25
 gcloud-crc32c 1.0.0
 gsutil 5.34
diff --git a/gcloud/alpha/backup-dr/backup-plan-associations/help b/gcloud/alpha/backup-dr/backup-plan-associations/help
index 88579383c..66db109d9 100644
--- a/gcloud/alpha/backup-dr/backup-plan-associations/help
+++ b/gcloud/alpha/backup-dr/backup-plan-associations/help
@@ -32,6 +32,9 @@ COMMANDS
      trigger-backup
         (ALPHA) Create an on-demand backup for a resource.
 
+     update
+        (ALPHA) Update a specific backup plan within a backup plan association.
+
 NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
diff --git a/gcloud/alpha/backup-dr/backup-plan-associations/update b/gcloud/alpha/backup-dr/backup-plan-associations/update
new file mode 100644
index 000000000..95bb73beb
--- /dev/null
+++ b/gcloud/alpha/backup-dr/backup-plan-associations/update
@@ -0,0 +1,130 @@
+NAME
+    gcloud alpha backup-dr backup-plan-associations update - update a specific
+        backup plan within a backup plan association
+
+SYNOPSIS
+    gcloud alpha backup-dr backup-plan-associations update
+        (BACKUP_PLAN_ASSOCIATION
+          : --location=LOCATION --workload-project=WORKLOAD_PROJECT)
+        --backup-plan=BACKUP_PLAN [--async] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Update a specific backup plan within a backup plan association.
+
+EXAMPLES
+    To update backup plan association sample-bpa in project sample-project and
+    location us-central1 with backup plan sample-backup-plan in the same
+    project and location, run:
+
+        $ gcloud alpha backup-dr backup-plan-associations update \
+            sample-bpa --project=sample-project --location=us-central1 \
+            --backup-plan=sample-backup-plan
+
+    To update backup plan association sample-bpa-uri with backup plan
+    sample-backup-plan-uri (using full URIs), run:
+
+        $ gcloud alpha backup-dr backup-plan-associations update \
+            sample-bpa-uri --backup-plan=sample-backup-plan-uri
+
+    To update backup plan association sample-bpa in location us-central1 with
+    backup plan sample-backup-plan-uri, run:
+
+        $ gcloud alpha backup-dr backup-plan-associations update \
+            sample-bpa --location=us-central1 \
+            --backup-plan=sample-backup-plan-uri
+
+    To update backup plan association sample-bpa in project workload-project
+    and location us-central1 with backup plan sample-backup-plan in project
+    sample-project, run:
+
+        $ gcloud alpha backup-dr backup-plan-associations update \
+            sample-bpa --workload-project=workload-project \
+            --location=us-central1 --backup-plan=sample-backup-plan \
+            --project=sample-project
+
+POSITIONAL ARGUMENTS
+     Backup Plan Association resource - Backup plan association to be updated.
+     To update backup plan associations in a project that's different from the
+     backup plan, use the --workload-project flag. The arguments in this group
+     can be used to specify the attributes of this resource.
+
+     This must be specified.
+
+       BACKUP_PLAN_ASSOCIATION
+          ID of the Backup Plan Association or fully qualified identifier for
+          the Backup Plan Association.
+
+          To set the name attribute:
+          ▸ provide the argument BACKUP_PLAN_ASSOCIATION on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location of the Backup Plan Association.
+
+          To set the location attribute:
+          ▸ provide the argument BACKUP_PLAN_ASSOCIATION on the command line
+            with a fully specified name;
+          ▸ provide the argument --location on the command line.
+
+       --workload-project=WORKLOAD_PROJECT
+          Cloud project id for the Backup Plan Association.
+
+          To set the workload-project attribute:
+          ▸ provide the argument BACKUP_PLAN_ASSOCIATION on the command line
+            with a fully specified name;
+          ▸ provide the argument --workload-project on the command line;
+          ▸ provide the argument --project on the command line;
+          ▸ set the property core/project.
+
+REQUIRED FLAGS
+     Backup Plan resource - Name of the specific backup plan to be applied to
+     the backup plan association. E.g.,
+     projects/sample-project/locations/us-central1/backupPlans/sample-backup-plan
+     This represents a Cloud resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument --backup-plan on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     To set the location attribute:
+      ◆ provide the argument --backup-plan on the command line with a fully
+        specified name;
+      ◆ provide the argument --location on the command line.
+
+     This must be specified.
+
+       --backup-plan=BACKUP_PLAN
+          ID of the Backup Plan or fully qualified identifier for the Backup
+          Plan.
+
+          To set the name attribute:
+          ▸ provide the argument --backup-plan on the command line.
+
+OPTIONAL FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete. The default is True. Enabled by default, use --no-async to
+        disable.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+BRIEF
+    Update a specific backup plan within a backup plan association.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/compute/commitments/create b/gcloud/alpha/compute/commitments/create
index 35196c9bb..0b634e8d8 100644
--- a/gcloud/alpha/compute/commitments/create
+++ b/gcloud/alpha/compute/commitments/create
@@ -108,14 +108,16 @@ OPTIONAL FLAGS
         for memory-optimized VMs. TYPE must be one of: accelerator-optimized,
         accelerator-optimized-a3, accelerator-optimized-a3-mega,
         accelerator-optimized-a3-ultra, accelerator-optimized-a4,
-        compute-optimized, compute-optimized-c2d, compute-optimized-c3,
-        compute-optimized-c3d, compute-optimized-h3, general-purpose,
-        general-purpose-c4, general-purpose-c4a, general-purpose-e2,
+        accelerator-optimized-a4x, compute-optimized, compute-optimized-c2d,
+        compute-optimized-c3, compute-optimized-c3d, compute-optimized-h3,
+        compute-optimized-h4d, general-purpose, general-purpose-c4,
+        general-purpose-c4a, general-purpose-c4d, general-purpose-e2,
         general-purpose-n2, general-purpose-n2d, general-purpose-n4,
         general-purpose-t2d, graphics-optimized, memory-optimized,
-        memory-optimized-m3, memory-optimized-m4, memory-optimized-x4,
-        memory-optimized-x4-16tb, memory-optimized-x4-24tb,
-        memory-optimized-x4-32tb, storage-optimized-z3.
+        memory-optimized-m3, memory-optimized-m4, memory-optimized-m4-6tb,
+        memory-optimized-x4, memory-optimized-x4-16tb,
+        memory-optimized-x4-24tb, memory-optimized-x4-32tb,
+        storage-optimized-z3.
 
      Manage the reservations to be created with the commitment.
 
diff --git a/gcloud/alpha/compute/interconnects/attachments/groups/add-members b/gcloud/alpha/compute/interconnects/attachments/groups/add-members
index 2bf272faa..f959ea066 100644
--- a/gcloud/alpha/compute/interconnects/attachments/groups/add-members
+++ b/gcloud/alpha/compute/interconnects/attachments/groups/add-members
@@ -43,5 +43,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. These variants are also available:
+
+        $ gcloud compute interconnects attachments groups add-members
+
+        $ gcloud beta compute interconnects attachments groups add-members
 
diff --git a/gcloud/alpha/compute/interconnects/attachments/groups/create b/gcloud/alpha/compute/interconnects/attachments/groups/create
index 2162e349b..25c3cb4d9 100644
--- a/gcloud/alpha/compute/interconnects/attachments/groups/create
+++ b/gcloud/alpha/compute/interconnects/attachments/groups/create
@@ -64,5 +64,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. These variants are also available:
+
+        $ gcloud compute interconnects attachments groups create
+
+        $ gcloud beta compute interconnects attachments groups create
 
diff --git a/gcloud/alpha/compute/interconnects/attachments/groups/delete b/gcloud/alpha/compute/interconnects/attachments/groups/delete
index 5b5eb8591..3da7b49d5 100644
--- a/gcloud/alpha/compute/interconnects/attachments/groups/delete
+++ b/gcloud/alpha/compute/interconnects/attachments/groups/delete
@@ -7,11 +7,19 @@ SYNOPSIS
         [NAME ...] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) gcloud alpha compute interconnects attachments groups delete
-    deletes Compute Engine interconnect attachment groups. Interconnect
-    attachment groups can be deleted even if they are referenced by
-    interconnect attachments. Each interconnect attachment in the group will be
-    updated to remove its reference to this group.
+    (ALPHA) gcloud alpha compute interconnects attachments groups delete is
+    used to delete interconnect attachment groups.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To delete an interconnect attachment group, run:
+
+        $ gcloud alpha compute interconnects attachments groups delete \
+            example-attachment-group"
+
+    Although not shown in this example, you can delete multiple interconnect
+    attachment groups in a single command.
 
 POSITIONAL ARGUMENTS
      NAME [NAME ...]
@@ -29,5 +37,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. These variants are also available:
+
+        $ gcloud compute interconnects attachments groups delete
+
+        $ gcloud beta compute interconnects attachments groups delete
 
diff --git a/gcloud/alpha/compute/interconnects/attachments/groups/describe b/gcloud/alpha/compute/interconnects/attachments/groups/describe
index 54f333271..db607a2c8 100644
--- a/gcloud/alpha/compute/interconnects/attachments/groups/describe
+++ b/gcloud/alpha/compute/interconnects/attachments/groups/describe
@@ -7,9 +7,16 @@ SYNOPSIS
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) gcloud alpha compute interconnects attachments groups describe
-    displays all data associated with Compute Engine interconnect attachment
-    group in a project.
+    (ALPHA) gcloud alpha compute interconnects attachments groups describe is
+    used to describe interconnect attachment groups.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To describe an interconnect attachment group, run:
+
+        $ gcloud alpha compute interconnects attachments groups describe \
+            example-attachment-group
 
 POSITIONAL ARGUMENTS
      NAME
@@ -27,5 +34,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. These variants are also available:
+
+        $ gcloud compute interconnects attachments groups describe
+
+        $ gcloud beta compute interconnects attachments groups describe
 
diff --git a/gcloud/alpha/compute/interconnects/attachments/groups/get-operational-status b/gcloud/alpha/compute/interconnects/attachments/groups/get-operational-status
index 88e9316c7..4b1c1ed39 100644
--- a/gcloud/alpha/compute/interconnects/attachments/groups/get-operational-status
+++ b/gcloud/alpha/compute/interconnects/attachments/groups/get-operational-status
@@ -9,8 +9,17 @@ SYNOPSIS
 
 DESCRIPTION
     (ALPHA) gcloud alpha compute interconnects attachments groups
-    get-operational-status gets the operational status of a Compute Engine
-    interconnect attachment group in a project.
+    get-operational-status is used to get the operational status of
+    interconnect attachment groups.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To get the operational status of interconnect attachment group
+    example-attachment-group, run:
+
+        $ gcloud alpha compute interconnects attachments groups \
+            get-operational-status example-attachment-group
 
 POSITIONAL ARGUMENTS
      NAME
@@ -28,5 +37,11 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. These variants are also available:
+
+        $ gcloud compute interconnects attachments groups \
+            get-operational-status
+
+        $ gcloud beta compute interconnects attachments groups \
+            get-operational-status
 
diff --git a/gcloud/alpha/compute/interconnects/attachments/groups/help b/gcloud/alpha/compute/interconnects/attachments/groups/help
index 0d6483890..ddc5ee3bf 100644
--- a/gcloud/alpha/compute/interconnects/attachments/groups/help
+++ b/gcloud/alpha/compute/interconnects/attachments/groups/help
@@ -35,7 +35,7 @@ COMMANDS
         attachment group.
 
      list
-        (ALPHA) List Google Compute Engine interconnect attachment groups.
+        (ALPHA) List interconnect attachment groups.
 
      remove-members
         (ALPHA) Remove member interconnect attachments from a Compute Engine
@@ -48,5 +48,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. These variants are also available:
+
+        $ gcloud compute interconnects attachments groups
+
+        $ gcloud beta compute interconnects attachments groups
 
diff --git a/gcloud/alpha/compute/interconnects/attachments/groups/list b/gcloud/alpha/compute/interconnects/attachments/groups/list
index a80644a50..4c6ebef56 100644
--- a/gcloud/alpha/compute/interconnects/attachments/groups/list
+++ b/gcloud/alpha/compute/interconnects/attachments/groups/list
@@ -1,6 +1,6 @@
 NAME
-    gcloud alpha compute interconnects attachments groups list - list Google
-        Compute Engine interconnect attachment groups
+    gcloud alpha compute interconnects attachments groups list - list
+        interconnect attachment groups
 
 SYNOPSIS
     gcloud alpha compute interconnects attachments groups list
@@ -8,18 +8,16 @@ SYNOPSIS
         [--sort-by=[FIELD,...]] [--uri] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) gcloud alpha compute interconnects attachments groups list displays
-    all Google Compute Engine interconnect attachment groups in a project.
+    (ALPHA) gcloud alpha compute interconnects attachments groups list is used
+    to list interconnect attachment groups.
+
+    For an example, refer to the EXAMPLES section below.
 
 EXAMPLES
-    To list all interconnect attachment groups in a project in table form, run:
+    To list interconnect attachment groups, run:
 
         $ gcloud alpha compute interconnects attachments groups list
 
-    To list the URIs of all interconnect attachment groups in a project, run:
-
-        $ gcloud alpha compute interconnects attachments groups list --uri
-
 LIST COMMAND FLAGS
      --filter=EXPRESSION
         Apply a Boolean filter EXPRESSION to each resource item to be listed.
@@ -64,5 +62,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. These variants are also available:
+
+        $ gcloud compute interconnects attachments groups list
+
+        $ gcloud beta compute interconnects attachments groups list
 
diff --git a/gcloud/alpha/compute/interconnects/attachments/groups/remove-members b/gcloud/alpha/compute/interconnects/attachments/groups/remove-members
index 432649514..e7bc3811f 100644
--- a/gcloud/alpha/compute/interconnects/attachments/groups/remove-members
+++ b/gcloud/alpha/compute/interconnects/attachments/groups/remove-members
@@ -43,5 +43,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. These variants are also available:
+
+        $ gcloud compute interconnects attachments groups remove-members
+
+        $ gcloud beta compute interconnects attachments groups remove-members
 
diff --git a/gcloud/alpha/compute/interconnects/attachments/groups/update b/gcloud/alpha/compute/interconnects/attachments/groups/update
index af96855da..ef087eff8 100644
--- a/gcloud/alpha/compute/interconnects/attachments/groups/update
+++ b/gcloud/alpha/compute/interconnects/attachments/groups/update
@@ -11,9 +11,35 @@ SYNOPSIS
 
 DESCRIPTION
     (ALPHA) gcloud alpha compute interconnects attachments groups update is
-    used to update interconnect attachment groups. An interconnect attachment
-    group connects a set of redundant interconnect attachments between Google
-    and the customer.
+    used to update interconnect attachment groups.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To update an interconnect attachment group example-attachment-group's
+    intended availability SLA to PRODUCTION_CRITICAL, run:
+
+        $ gcloud alpha compute interconnects attachments groups update \
+            example-attachment-group \
+            --intended-availability-sla=PRODUCTION_CRITICAL
+
+    To update an interconnect attachment group example-attachment-group's
+    description to "example attachment group description", run:
+
+        $ gcloud alpha compute interconnects attachments groups update \
+            example-attachment-group \
+            --description="example attachment group description"
+
+    To update an interconnect attachment group example-attachment-group's
+    member attachments to attachment-1 and attachment-2, run:
+
+        $ gcloud alpha compute interconnects attachments groups update \
+            example-attachment-group \
+            --attachments=region-1/attachment-1,region-2/attachment-2
+
+    Although you can add or remove member attachments using this command, it is
+    recommended to add or remove member attachments using the add-members and
+    remove-members commands.
 
 POSITIONAL ARGUMENTS
      NAME
@@ -42,5 +68,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. These variants are also available:
+
+        $ gcloud compute interconnects attachments groups update
+
+        $ gcloud beta compute interconnects attachments groups update
 
diff --git a/gcloud/alpha/compute/interconnects/groups/add-members b/gcloud/alpha/compute/interconnects/groups/add-members
index 3e20b710d..6333be015 100644
--- a/gcloud/alpha/compute/interconnects/groups/add-members
+++ b/gcloud/alpha/compute/interconnects/groups/add-members
@@ -40,5 +40,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. These variants are also available:
+
+        $ gcloud compute interconnects groups add-members
+
+        $ gcloud beta compute interconnects groups add-members
 
diff --git a/gcloud/alpha/compute/interconnects/groups/create b/gcloud/alpha/compute/interconnects/groups/create
index 7af588c7e..ad1b2a624 100644
--- a/gcloud/alpha/compute/interconnects/groups/create
+++ b/gcloud/alpha/compute/interconnects/groups/create
@@ -62,5 +62,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. These variants are also available:
+
+        $ gcloud compute interconnects groups create
+
+        $ gcloud beta compute interconnects groups create
 
diff --git a/gcloud/alpha/compute/interconnects/groups/create-members b/gcloud/alpha/compute/interconnects/groups/create-members
index 6f79fc3d7..2fa65006f 100644
--- a/gcloud/alpha/compute/interconnects/groups/create-members
+++ b/gcloud/alpha/compute/interconnects/groups/create-members
@@ -24,10 +24,9 @@ EXAMPLES
     group example-interconnect-group, run:
 
         $ gcloud alpha compute interconnects groups create-members \
-            example-interconnect-group --interconnect-type DEDICATED \
-            --link-speed LINK_TYPE_ETHERNET_10G_LR \
-            --requested-link-count 1 --facility iad-1 \
-            --interconnect="name=interconnect1" \
+            example-interconnect-group --interconnect-type=DEDICATED \
+            --link-type=LINK_TYPE_ETHERNET_10G_LR --requested-link-count=1 \
+            --facility=iad-1 --interconnect="name=interconnect1" \
             --interconnect="name=interconnect2"
 
 POSITIONAL ARGUMENTS
@@ -133,5 +132,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. These variants are also available:
+
+        $ gcloud compute interconnects groups create-members
+
+        $ gcloud beta compute interconnects groups create-members
 
diff --git a/gcloud/alpha/compute/interconnects/groups/delete b/gcloud/alpha/compute/interconnects/groups/delete
index 15deac382..ff4ab6499 100644
--- a/gcloud/alpha/compute/interconnects/groups/delete
+++ b/gcloud/alpha/compute/interconnects/groups/delete
@@ -7,10 +7,19 @@ SYNOPSIS
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) gcloud alpha compute interconnects groups delete deletes Compute
-    Engine interconnect groups. Interconnect groups can be deleted even if they
-    are referenced by interconnects. Each interconnect in the group will be
-    updated to remove its reference to this group.
+    (ALPHA) gcloud alpha compute interconnects groups delete is used to delete
+    interconnect groups.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To delete an interconnect group, run:
+
+        $ gcloud alpha compute interconnects groups delete \
+            example-interconnect-group"
+
+    Although not shown in this example, you can delete multiple interconnect
+    groups in a single command.
 
 POSITIONAL ARGUMENTS
      NAME [NAME ...]
@@ -28,5 +37,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. These variants are also available:
+
+        $ gcloud compute interconnects groups delete
+
+        $ gcloud beta compute interconnects groups delete
 
diff --git a/gcloud/alpha/compute/interconnects/groups/describe b/gcloud/alpha/compute/interconnects/groups/describe
index f8699f379..2c969009d 100644
--- a/gcloud/alpha/compute/interconnects/groups/describe
+++ b/gcloud/alpha/compute/interconnects/groups/describe
@@ -7,8 +7,16 @@ SYNOPSIS
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) gcloud alpha compute interconnects groups describe displays all
-    data associated with Compute Engine interconnect group in a project.
+    (ALPHA) gcloud alpha compute interconnects groups describe is used to
+    describe an interconnect group.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To describe interconnect group example-interconnect-group, run:
+
+        $ gcloud alpha compute interconnects groups describe \
+            example-interconnect-group
 
 POSITIONAL ARGUMENTS
      NAME
@@ -26,5 +34,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. These variants are also available:
+
+        $ gcloud compute interconnects groups describe
+
+        $ gcloud beta compute interconnects groups describe
 
diff --git a/gcloud/alpha/compute/interconnects/groups/get-operational-status b/gcloud/alpha/compute/interconnects/groups/get-operational-status
index 3229da30a..001a1bcc4 100644
--- a/gcloud/alpha/compute/interconnects/groups/get-operational-status
+++ b/gcloud/alpha/compute/interconnects/groups/get-operational-status
@@ -7,9 +7,17 @@ SYNOPSIS
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) gcloud alpha compute interconnects groups get-operational-status
-    gets the operational status of a Compute Engine interconnect group in a
-    project.
+    (ALPHA) gcloud alpha compute interconnects groups get-operational-status is
+    used to get the operational status of an interconnect group.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To get the operational status of interconnect group
+    example-interconnect-group, run:
+
+        $ gcloud alpha compute interconnects groups get-operational-status \
+            example-interconnect-group
 
 POSITIONAL ARGUMENTS
      NAME
@@ -27,5 +35,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. These variants are also available:
+
+        $ gcloud compute interconnects groups get-operational-status
+
+        $ gcloud beta compute interconnects groups get-operational-status
 
diff --git a/gcloud/alpha/compute/interconnects/groups/help b/gcloud/alpha/compute/interconnects/groups/help
index 1283337c1..c1bfd9a29 100644
--- a/gcloud/alpha/compute/interconnects/groups/help
+++ b/gcloud/alpha/compute/interconnects/groups/help
@@ -38,7 +38,7 @@ COMMANDS
         group.
 
      list
-        (ALPHA) List Google Compute Engine interconnect groups.
+        (ALPHA) List interconnect groups.
 
      remove-members
         (ALPHA) Remove member interconnects from a Compute Engine interconnect
@@ -51,5 +51,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. These variants are also available:
+
+        $ gcloud compute interconnects groups
+
+        $ gcloud beta compute interconnects groups
 
diff --git a/gcloud/alpha/compute/interconnects/groups/list b/gcloud/alpha/compute/interconnects/groups/list
index df17918a2..a4d9b5b5d 100644
--- a/gcloud/alpha/compute/interconnects/groups/list
+++ b/gcloud/alpha/compute/interconnects/groups/list
@@ -1,6 +1,5 @@
 NAME
-    gcloud alpha compute interconnects groups list - list Google Compute Engine
-        interconnect groups
+    gcloud alpha compute interconnects groups list - list interconnect groups
 
 SYNOPSIS
     gcloud alpha compute interconnects groups list [--filter=EXPRESSION]
@@ -8,18 +7,16 @@ SYNOPSIS
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) gcloud alpha compute interconnects groups list displays all Google
-    Compute Engine interconnect groups in a project.
+    (ALPHA) gcloud alpha compute interconnects groups list is used to list
+    interconnect groups.
+
+    For an example, refer to the EXAMPLES section below.
 
 EXAMPLES
-    To list all interconnect groups in a project in table form, run:
+    To list interconnect groups, run:
 
         $ gcloud alpha compute interconnects groups list
 
-    To list the URIs of all interconnect groups in a project, run:
-
-        $ gcloud alpha compute interconnects groups list --uri
-
 LIST COMMAND FLAGS
      --filter=EXPRESSION
         Apply a Boolean filter EXPRESSION to each resource item to be listed.
@@ -64,5 +61,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. These variants are also available:
+
+        $ gcloud compute interconnects groups list
+
+        $ gcloud beta compute interconnects groups list
 
diff --git a/gcloud/alpha/compute/interconnects/groups/remove-members b/gcloud/alpha/compute/interconnects/groups/remove-members
index 3f79f565f..1b9c7f611 100644
--- a/gcloud/alpha/compute/interconnects/groups/remove-members
+++ b/gcloud/alpha/compute/interconnects/groups/remove-members
@@ -40,5 +40,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. These variants are also available:
+
+        $ gcloud compute interconnects groups remove-members
+
+        $ gcloud beta compute interconnects groups remove-members
 
diff --git a/gcloud/alpha/compute/interconnects/groups/update b/gcloud/alpha/compute/interconnects/groups/update
index 10e27f35e..59b545978 100644
--- a/gcloud/alpha/compute/interconnects/groups/update
+++ b/gcloud/alpha/compute/interconnects/groups/update
@@ -10,8 +10,35 @@ SYNOPSIS
 
 DESCRIPTION
     (ALPHA) gcloud alpha compute interconnects groups update is used to update
-    interconnect groups. An interconnect group represents a set of redundant
-    interconnects between Google and the customer.
+    interconnect groups.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To update an interconnect group example-interconnect-group's intended
+    topology capability to PRODUCTION_CRITICAL, run:
+
+        $ gcloud alpha compute interconnects groups update \
+            example-interconnect-group \
+            --intended-topology-capability=PRODUCTION_CRITICAL
+
+    To update an interconnect group example-interconnect-group's description to
+    "example interconnect group description", run:
+
+        $ gcloud alpha compute interconnects groups update \
+            example-interconnect-group \
+            --description="example interconnect group description"
+
+    To update an interconnect group example-interconnect-group's member
+    interconnects to interconnect-1 and interconnect-2, run:
+
+        $ gcloud alpha compute interconnects groups update \
+            example-interconnect-group \
+            --interconnects=interconnect-1,interconnect-2
+
+    Although you can add or remove member interconnects using this command, it
+    is recommended to add or remove member interconnects using the add-members
+    and remove-members commands.
 
 POSITIONAL ARGUMENTS
      NAME
@@ -40,5 +67,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. These variants are also available:
+
+        $ gcloud compute interconnects groups update
+
+        $ gcloud beta compute interconnects groups update
 
diff --git a/gcloud/alpha/compute/org-security-policies/rules/create b/gcloud/alpha/compute/org-security-policies/rules/create
index ad60c4607..4cbff18e5 100644
--- a/gcloud/alpha/compute/org-security-policies/rules/create
+++ b/gcloud/alpha/compute/org-security-policies/rules/create
@@ -48,6 +48,8 @@ REQUIRED FLAGS
          deny-502
             Denies the request from HTTP(S) Load Balancing, with an HTTP
             response status code of 502.
+         goto-next
+            Defers enforcement to the next policy in the hierarchy.
          redirect
             Redirects the request from HTTP(S) Load Balancing, based on
             redirect options.
diff --git a/gcloud/alpha/compute/org-security-policies/rules/update b/gcloud/alpha/compute/org-security-policies/rules/update
index 8e6a1c854..b09fd2a6e 100644
--- a/gcloud/alpha/compute/org-security-policies/rules/update
+++ b/gcloud/alpha/compute/org-security-policies/rules/update
@@ -54,6 +54,8 @@ OPTIONAL FLAGS
          deny-502
             Denies the request from HTTP(S) Load Balancing, with an HTTP
             response status code of 502.
+         goto-next
+            Defers enforcement to the next policy in the hierarchy.
          redirect
             Redirects the request from HTTP(S) Load Balancing, based on
             redirect options.
diff --git a/gcloud/alpha/compute/project-info/set-default-service-account b/gcloud/alpha/compute/project-info/set-default-service-account
index caeab99f4..50fe7d7e8 100644
--- a/gcloud/alpha/compute/project-info/set-default-service-account
+++ b/gcloud/alpha/compute/project-info/set-default-service-account
@@ -29,7 +29,7 @@ DESCRIPTION
 
     To remove the default service account from the project, issue the command:
 
-        $ gcloud compute project-info set-default-service-account \
+        $ gcloud alpha compute project-info set-default-service-account \
             --no-service-account
 
     The required permission to execute this command is
diff --git a/gcloud/alpha/compute/service-attachments/create b/gcloud/alpha/compute/service-attachments/create
index c9ded0ea5..eec198294 100644
--- a/gcloud/alpha/compute/service-attachments/create
+++ b/gcloud/alpha/compute/service-attachments/create
@@ -13,9 +13,11 @@ SYNOPSIS
         [--consumer-reject-list=[REJECT_LIST,...]] [--description=DESCRIPTION]
         [--domain-names=[DOMAIN_NAMES,...]] [--enable-proxy-protocol]
         [--nat-subnets-region=NAT_SUBNETS_REGION]
-        [--producer-forwarding-rule-region=PRODUCER_FORWARDING_RULE_REGION]
         [--propagated-connection-limit=PROPAGATED_CONNECTION_LIMIT]
-        [--reconcile-connections] [--region=REGION] [GCLOUD_WIDE_FLAG ...]
+        [--reconcile-connections] [--region=REGION]
+        [--global-producer-forwarding-rule
+          | --producer-forwarding-rule-region=PRODUCER_FORWARDING_RULE_REGION]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) gcloud alpha compute service-attachments create is used to create
@@ -114,26 +116,6 @@ OPTIONAL FLAGS
         set to the region of the service attachment. Overrides the default
         compute/region property value for this command invocation.
 
-     --producer-forwarding-rule-region=PRODUCER_FORWARDING_RULE_REGION
-        Region of the forwarding rule to operate on. If not specified, you
-        might be prompted to select a region (interactive mode only).
-
-        To avoid prompting when this flag is omitted, you can set the
-        compute/region property:
-
-            $ gcloud config set compute/region REGION
-
-        A list of regions can be fetched by running:
-
-            $ gcloud compute regions list
-
-        To unset the property, run:
-
-            $ gcloud config unset compute/region
-
-        Alternatively, the region can be stored in the environment variable
-        CLOUDSDK_COMPUTE_REGION.
-
      --propagated-connection-limit=PROPAGATED_CONNECTION_LIMIT
         The number of consumer spokes that connected Private Service Connect
         endpoints can be propagated to through Network Connectivity Center.
@@ -183,6 +165,31 @@ OPTIONAL FLAGS
         Alternatively, the region can be stored in the environment variable
         CLOUDSDK_COMPUTE_REGION.
 
+     At most one of these can be specified:
+
+       --global-producer-forwarding-rule
+          If set, the forwarding rule is global.
+
+       --producer-forwarding-rule-region=PRODUCER_FORWARDING_RULE_REGION
+          Region of the forwarding rule to operate on. If not specified, you
+          might be prompted to select a region (interactive mode only).
+
+          To avoid prompting when this flag is omitted, you can set the
+          compute/region property:
+
+              $ gcloud config set compute/region REGION
+
+          A list of regions can be fetched by running:
+
+              $ gcloud compute regions list
+
+          To unset the property, run:
+
+              $ gcloud config unset compute/region
+
+          Alternatively, the region can be stored in the environment variable
+          CLOUDSDK_COMPUTE_REGION.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/alpha/container/clusters/create b/gcloud/alpha/container/clusters/create
index 07f910e43..65037681b 100644
--- a/gcloud/alpha/container/clusters/create
+++ b/gcloud/alpha/container/clusters/create
@@ -20,6 +20,7 @@ SYNOPSIS
         [--cluster-ipv4-cidr=CLUSTER_IPV4_CIDR]
         [--cluster-secondary-range-name=NAME]
         [--cluster-version=CLUSTER_VERSION]
+        [--confidential-node-type=CONFIDENTIAL_NODE_TYPE]
         [--containerd-config-from-file=PATH_TO_FILE]
         [--create-subnetwork=[KEY=VALUE,...]]
         [--data-cache-count=DATA_CACHE_COUNT]
@@ -357,6 +358,12 @@ FLAGS
 
             $ gcloud container get-server-config
 
+     --confidential-node-type=CONFIDENTIAL_NODE_TYPE
+        Enable confidential nodes for the cluster. Enabling Confidential Nodes
+        will create nodes using Confidential VM
+        https://cloud.google.com/compute/confidential-vm/docs/about-cvm.
+        CONFIDENTIAL_NODE_TYPE must be one of: sev, sev_snp, tdx.
+
      --containerd-config-from-file=PATH_TO_FILE
         Path of the YAML file that contains containerd configuration entries
         like configuring access to private image registries.
diff --git a/gcloud/alpha/container/node-pools/create b/gcloud/alpha/container/node-pools/create
index 5f8863eb2..7304e09d4 100644
--- a/gcloud/alpha/container/node-pools/create
+++ b/gcloud/alpha/container/node-pools/create
@@ -15,6 +15,7 @@ SYNOPSIS
           pod-ipv4-range=SECONDARY_RANGE_NAME,
           [max-pods-per-node=NUM_PODS],...]] [--async]
         [--boot-disk-kms-key=BOOT_DISK_KMS_KEY] [--cluster=CLUSTER]
+        [--confidential-node-type=CONFIDENTIAL_NODE_TYPE]
         [--containerd-config-from-file=PATH_TO_FILE]
         [--data-cache-count=DATA_CACHE_COUNT]
         [--disable-pod-cidr-overprovision] [--disk-size=DISK_SIZE]
@@ -194,6 +195,12 @@ FLAGS
         The cluster to add the node pool to. Overrides the default
         container/cluster property value for this command invocation.
 
+     --confidential-node-type=CONFIDENTIAL_NODE_TYPE
+        Enable confidential nodes for the node pool. Enabling Confidential
+        Nodes will create nodes using Confidential VM
+        https://cloud.google.com/compute/confidential-vm/docs/about-cvm.
+        CONFIDENTIAL_NODE_TYPE must be one of: sev, sev_snp, tdx, disabled.
+
      --containerd-config-from-file=PATH_TO_FILE
         Path of the YAML file that contains containerd configuration entries
         like configuring access to private image registries.
diff --git a/gcloud/alpha/container/node-pools/update b/gcloud/alpha/container/node-pools/update
index 3a444a9dc..6aae99e3b 100644
--- a/gcloud/alpha/container/node-pools/update
+++ b/gcloud/alpha/container/node-pools/update
@@ -9,6 +9,7 @@ SYNOPSIS
           gpu-partition-size=GPU_PARTITION_SIZE,
           gpu-sharing-strategy=GPU_SHARING_STRATEGY,
           max-shared-clients-per-gpu=MAX_SHARED_CLIENTS_PER_GPU],...]
+          | --confidential-node-type=CONFIDENTIAL_NODE_TYPE
           | --containerd-config-from-file=PATH_TO_FILE
           | --enable-confidential-nodes | --enable-gvnic
           | --enable-image-streaming | --enable-insecure-kubelet-readonly-port
@@ -101,6 +102,11 @@ REQUIRED FLAGS
               on the node. This field is used together with
               gpu-sharing-strategy.
 
+       --confidential-node-type=CONFIDENTIAL_NODE_TYPE
+          Recreate all the nodes in the node pool to be confidential VM
+          https://cloud.google.com/compute/confidential-vm/docs/about-cvm.
+          CONFIDENTIAL_NODE_TYPE must be one of: sev, sev_snp, tdx, disabled.
+
        --containerd-config-from-file=PATH_TO_FILE
           Path of the YAML file that contains containerd configuration entries
           like configuring access to private image registries.
diff --git a/gcloud/alpha/emulators/firestore/start b/gcloud/alpha/emulators/firestore/start
index 66b685504..c5f01c2a2 100644
--- a/gcloud/alpha/emulators/firestore/start
+++ b/gcloud/alpha/emulators/firestore/start
@@ -4,7 +4,8 @@ NAME
 SYNOPSIS
     gcloud alpha emulators firestore start [--database-mode=DATABASE_MODE]
         [--export-on-exit=EXPORT_ON_EXIT] [--host-port=HOST_PORT]
-        [--import-data=IMPORT_DATA] [--rules=RULES] [GCLOUD_WIDE_FLAG ...]
+        [--import-data=IMPORT_DATA] [--licenses] [--rules=RULES]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) This command starts a local Firestore emulator.
@@ -64,6 +65,10 @@ FLAGS
         File path to the data to be loaded into the emulator upon start up.
         Example:/home/user/myexports/sampleExport/sampleExport.overall_export_metadata.
 
+     --licenses
+        If set, the emulator will print open-source dependencies and licenses,
+        then exit.
+
      --rules=RULES
         If set, all projects will use the security rules in this file. More
         information on Firebase Rules and the syntax for this file is available
diff --git a/gcloud/alpha/filestore/regions/help b/gcloud/alpha/filestore/regions/help
index f9ebd48d7..6d02adccf 100644
--- a/gcloud/alpha/filestore/regions/help
+++ b/gcloud/alpha/filestore/regions/help
@@ -16,7 +16,7 @@ COMMANDS
     COMMAND is one of the following:
 
      list
-        (ALPHA) List Filestore regions.
+        (ALPHA) List all Filestore regions.
 
 NOTES
     This command is currently in alpha and might change without notice. If this
diff --git a/gcloud/alpha/filestore/regions/list b/gcloud/alpha/filestore/regions/list
index 899036d79..1f42ddf36 100644
--- a/gcloud/alpha/filestore/regions/list
+++ b/gcloud/alpha/filestore/regions/list
@@ -1,20 +1,19 @@
 NAME
-    gcloud alpha filestore regions list - list Filestore regions
+    gcloud alpha filestore regions list - list all Filestore regions
 
 SYNOPSIS
     gcloud alpha filestore regions list [--filter=EXPRESSION] [--limit=LIMIT]
-        [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
+        [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) List all regions where Filestore API is available. The listed
-    regions only apply for Basic instances. High Scale is only available in a
-    more restricted set of regions. For details, please see
-    https://cloud.google.com/filestore/docs/regions.
+    (ALPHA) List all Filestore regions.
 
 EXAMPLES
-    To list all the regions where Filestore instances can be created, run:
+    The following command lists a maximum of five Filestore regions sorted
+    alphabetically by name in descending order:
 
-        $ gcloud alpha filestore regions list
+        $ gcloud alpha filestore regions list --limit=5 --sort-by=~name
 
 LIST COMMAND FLAGS
      --filter=EXPRESSION
@@ -42,6 +41,12 @@ LIST COMMAND FLAGS
         order on that field. This flag interacts with other flags that are
         applied in this order: --flatten, --sort-by, --filter, --limit.
 
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
@@ -50,10 +55,6 @@ GCLOUD WIDE FLAGS
 
     Run $ gcloud help for details.
 
-API REFERENCE
-    This command uses the file/v1 API. The full documentation for this API can
-    be found at: https://cloud.google.com/filestore/
-
 NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
diff --git a/gcloud/alpha/filestore/zones/help b/gcloud/alpha/filestore/zones/help
index cd17a190b..6cbac536a 100644
--- a/gcloud/alpha/filestore/zones/help
+++ b/gcloud/alpha/filestore/zones/help
@@ -16,7 +16,7 @@ COMMANDS
     COMMAND is one of the following:
 
      list
-        (ALPHA) List Filestore zones.
+        (ALPHA) List all Filestore zones.
 
 NOTES
     This command is currently in alpha and might change without notice. If this
diff --git a/gcloud/alpha/filestore/zones/list b/gcloud/alpha/filestore/zones/list
index 8b904a120..d62dcaf1c 100644
--- a/gcloud/alpha/filestore/zones/list
+++ b/gcloud/alpha/filestore/zones/list
@@ -1,20 +1,19 @@
 NAME
-    gcloud alpha filestore zones list - list Filestore zones
+    gcloud alpha filestore zones list - list all Filestore zones
 
 SYNOPSIS
     gcloud alpha filestore zones list [--filter=EXPRESSION] [--limit=LIMIT]
-        [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
+        [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) List all zones where Filestore API is available. The listed zones
-    only apply for Basic instances. High Scale is only available in a more
-    restricted set of zones. For details, please see
-    https://cloud.google.com/filestore/docs/regions.
+    (ALPHA) List all Filestore zones.
 
 EXAMPLES
-    To list all the zones where Filestore instances can be created, run:
+    The following command lists a maximum of five Filestore zones sorted
+    alphabetically by name in descending order:
 
-        $ gcloud alpha filestore zones list
+        $ gcloud alpha filestore zones list --limit=5 --sort-by=~name
 
 LIST COMMAND FLAGS
      --filter=EXPRESSION
@@ -42,6 +41,12 @@ LIST COMMAND FLAGS
         order on that field. This flag interacts with other flags that are
         applied in this order: --flatten, --sort-by, --filter, --limit.
 
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
@@ -50,10 +55,6 @@ GCLOUD WIDE FLAGS
 
     Run $ gcloud help for details.
 
-API REFERENCE
-    This command uses the file/v1 API. The full documentation for this API can
-    be found at: https://cloud.google.com/filestore/
-
 NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
diff --git a/gcloud/alpha/iam/workforce-pools/providers/create-oidc b/gcloud/alpha/iam/workforce-pools/providers/create-oidc
index 4f04ca76f..966c5c961 100644
--- a/gcloud/alpha/iam/workforce-pools/providers/create-oidc
+++ b/gcloud/alpha/iam/workforce-pools/providers/create-oidc
@@ -288,7 +288,7 @@ OPTIONAL FLAGS
 
             *--extra-attributes-type*=_EXTRA_ATTRIBUTES_TYPE_::
 
-            Represents the identity provider and type of claims that should be fetched. _EXTRA_ATTRIBUTES_TYPE_ must be one of: *attributes-type-unspecified*, *azure-ad-groups-id*, *azure-ad-groups-mail*.
+            Represents the identity provider and type of claims that should be fetched. _EXTRA_ATTRIBUTES_TYPE_ must be one of: *attributes-type-unspecified*, *azure-ad-groups-display-name*, *azure-ad-groups-id*, *azure-ad-groups-mail*.
 
             *--extra-attributes-filter*=_EXTRA_ATTRIBUTES_FILTER_::
 
diff --git a/gcloud/alpha/iam/workforce-pools/providers/update-oidc b/gcloud/alpha/iam/workforce-pools/providers/update-oidc
index 103d7bb1a..8d9f94b66 100644
--- a/gcloud/alpha/iam/workforce-pools/providers/update-oidc
+++ b/gcloud/alpha/iam/workforce-pools/providers/update-oidc
@@ -288,7 +288,7 @@ FLAGS
 
             *--extra-attributes-type*=_EXTRA_ATTRIBUTES_TYPE_:::
 
-            Represents the identity provider and type of claims that should be fetched. _EXTRA_ATTRIBUTES_TYPE_ must be one of: *attributes-type-unspecified*, *azure-ad-groups-id*, *azure-ad-groups-mail*.
+            Represents the identity provider and type of claims that should be fetched. _EXTRA_ATTRIBUTES_TYPE_ must be one of: *attributes-type-unspecified*, *azure-ad-groups-display-name*, *azure-ad-groups-id*, *azure-ad-groups-mail*.
 
 GCLOUD WIDE FLAGS
         These flags are available to all commands: --access-token-file, --account, --billing-project, --configuration, --flags-file, --flatten, --format, --help, --impersonate-service-account, --log-http, --project, --quiet, --trace-token, --user-output-enabled, --verbosity.
diff --git a/gcloud/alpha/lustre/instances/create b/gcloud/alpha/lustre/instances/create
index a5e97456d..bd58a80e0 100644
--- a/gcloud/alpha/lustre/instances/create
+++ b/gcloud/alpha/lustre/instances/create
@@ -5,8 +5,9 @@ SYNOPSIS
     gcloud alpha lustre instances create (INSTANCE : --location=LOCATION)
         --capacity-gib=CAPACITY_GIB --filesystem=FILESYSTEM --network=NETWORK
         [--async] [--description=DESCRIPTION] [--gke-support-enabled]
-        [--labels=[LABELS,...]] [--request-id=REQUEST_ID]
-        [GCLOUD_WIDE_FLAG ...]
+        [--labels=[LABELS,...]]
+        [--per-unit-storage-throughput=PER_UNIT_STORAGE_THROUGHPUT]
+        [--request-id=REQUEST_ID] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) Create an instance
@@ -112,6 +113,10 @@ OPTIONAL FLAGS
 
             --labels=path_to_file.(yaml|json)
 
+     --per-unit-storage-throughput=PER_UNIT_STORAGE_THROUGHPUT
+        The throughput of the instance in MB/s/TiB. Valid values are 250, 500,
+        1000. Default value is 1000.
+
      --request-id=REQUEST_ID
         An optional request ID to identify requests. Specify a unique request
         ID so that if you must retry your request, the server will know to
diff --git a/gcloud/alpha/lustre/instances/update b/gcloud/alpha/lustre/instances/update
index 8b19de8db..4bef8244c 100644
--- a/gcloud/alpha/lustre/instances/update
+++ b/gcloud/alpha/lustre/instances/update
@@ -4,7 +4,9 @@ NAME
 SYNOPSIS
     gcloud alpha lustre instances update (INSTANCE : --location=LOCATION)
         [--async] [--capacity-gib=CAPACITY_GIB] [--description=DESCRIPTION]
-        [--[no-]gke-support-enabled] [--request-id=REQUEST_ID]
+        [--[no-]gke-support-enabled]
+        [--per-unit-storage-throughput=PER_UNIT_STORAGE_THROUGHPUT]
+        [--request-id=REQUEST_ID]
         [--labels=[LABELS,...]
           | --update-labels=[UPDATE_LABELS,...] --clear-labels
           | --remove-labels=[__REMOVE_LABELS,...]] [GCLOUD_WIDE_FLAG ...]
@@ -65,6 +67,10 @@ FLAGS
         default, GKE clients are not supported. Use --gke-support-enabled to
         enable and --no-gke-support-enabled to disable.
 
+     --per-unit-storage-throughput=PER_UNIT_STORAGE_THROUGHPUT
+        The throughput of the instance in MB/s/TiB. Valid values are 250, 500,
+        1000. Default value is 1000.
+
      --request-id=REQUEST_ID
         An optional request ID to identify requests. Specify a unique request
         ID so that if you must retry your request, the server will know to
diff --git a/gcloud/alpha/managed-kafka/acls/add-acl-entry b/gcloud/alpha/managed-kafka/acls/add-acl-entry
new file mode 100644
index 000000000..c2a3b2003
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/acls/add-acl-entry
@@ -0,0 +1,128 @@
+NAME
+    gcloud alpha managed-kafka acls add-acl-entry - add an acl entry to a
+        Managed Service for Apache Kafka acl
+
+SYNOPSIS
+    gcloud alpha managed-kafka acls add-acl-entry
+        (ACL : --cluster=CLUSTER --location=LOCATION) --operation=OPERATION
+        --principal=PRINCIPAL [--host=HOST; default="*"]
+        [--permission-type=PERMISSION_TYPE; default="ALLOW"]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Add an acl entry to a Managed Service for Apache Kafka acl.
+
+EXAMPLES
+    To add an acl entry for the Kafka cluster resource pattern (acl ID =
+    cluster), in a cluster named mycluster located in us-central1, run the
+    following:
+
+        $ gcloud alpha managed-kafka acls add-acl-entry cluster \
+            --cluster=mycluster --location=us-central1 \
+            --principal='User:admin@project.iam.gserviceaccount.com' \
+            --operation=ALL --permission-type=ALLOW --host='*'
+
+POSITIONAL ARGUMENTS
+     Acl resource - Identifies the acl that this command updates.
+
+     The structure of the acl ID defines the Resource Pattern for which the acl
+     entries apply in the Kafka cluster. The acl ID must be structured like one
+     of the following:
+
+         For acls on the cluster:
+           cluster
+
+         For acls on a single resource within the cluster:
+           topic/{resource_name}
+           consumerGroup/{resource_name}
+           transactionalId/{resource_name}
+
+         For acls on all resources that match a prefix:
+           topicPrefixed/{resource_name}
+           consumerGroupPrefixed/{resource_name}
+           transactionalIdPrefixed/{resource_name}
+
+         For acls on all resources of a given type (i.e. the wildcard literal "*"):
+           allTopics (represents topic/*)
+           allConsumerGroups (represents consumerGroup/*)
+           allTransactionalIds (represents transactionalId/*)
+         The arguments in this group can be used to specify the attributes of this resource. (NOTE) Some attributes are not given arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument acl on the command line with a fully specified
+        name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       ACL
+          ID of the acl or fully qualified identifier for the acl.
+
+          To set the acl attribute:
+          ▸ provide the argument acl on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --cluster=CLUSTER
+          The cluster name.
+
+          To set the cluster attribute:
+          ▸ provide the argument acl on the command line with a fully
+            specified name;
+          ▸ provide the argument --cluster on the command line.
+
+       --location=LOCATION
+          ID of the location of the Managed Service for Apache Kafka resource.
+          See
+          https://cloud.google.com/managed-service-for-apache-kafka/docs/locations
+          for a list of supported locations.
+
+          To set the location attribute:
+          ▸ provide the argument acl on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+REQUIRED FLAGS
+     --operation=OPERATION
+        The operation type. Allowed values are: ALL, READ, WRITE, CREATE,
+        DELETE, ALTER, DESCRIBE, CLUSTER_ACTION, DESCRIBE_CONFIGS,
+        ALTER_CONFIGS, IDEMPOTENT_WRITE.
+
+        See
+        https://kafka.apache.org/documentation/#operations_resources_and_protocols
+        for the mapping of operations to Kafka protocols.
+
+     --principal=PRINCIPAL
+        The principal. Specified as Google Cloud account, with the Kafka
+        StandardAuthorizer prefix "User:". For example:
+        "User:admin@project.iam.gserviceaccount.com". Can be the wildcard
+        "User:*" to refer to all users.
+
+OPTIONAL FLAGS
+     --host=HOST; default="*"
+        The host. Must be set to "*" for Managed Service for Apache Kafka.
+
+     --permission-type=PERMISSION_TYPE; default="ALLOW"
+        The permission type. Allowed values are: ALLOW, DENY.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the managedkafka/v1 API. The full documentation for this
+    API can be found at:
+    https://cloud.google.com/managed-service-for-apache-kafka/docs
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/managed-kafka/acls/create b/gcloud/alpha/managed-kafka/acls/create
new file mode 100644
index 000000000..c7d842b06
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/acls/create
@@ -0,0 +1,143 @@
+NAME
+    gcloud alpha managed-kafka acls create - create a Managed Service for
+        Apache Kafka acl
+
+SYNOPSIS
+    gcloud alpha managed-kafka acls create
+        (ACL : --cluster=CLUSTER --location=LOCATION)
+        (--acl-entries-from-file=PATH_TO_FILE
+          | --acl-entry=[host=HOST],[operation=OPERATION],
+          [permission-type=PERMISSION-TYPE],[principal=PRINCIPAL])
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Create a Managed Service for Apache Kafka acl.
+
+EXAMPLES
+    To create an acl for the Kafka cluster resource pattern (acl ID = cluster),
+    in a cluster named mycluster located in us-central1, run the following:
+
+        $ gcloud alpha managed-kafka acls create cluster \
+          --cluster=mycluster --location=us-central1 \
+          --acl-entry=principal='User:admin@project.iam.gserviceaccount.co\
+        m',operation=ALL,permission-type=ALLOW,host='*' \
+            --acl-entry=principal='User:reader@project.iam.gserviceaccount.c\
+        om',operation=DESCRIBE,permission-type=ALLOW,host='*' \
+            --acl-entry=principal='User:reader@project.iam.gserviceaccount.c\
+        om',operation=DESCRIBE_CONFIGS,permission-type=ALLOW,host='*'
+
+    This acl grants an "admin" service account access to ALL cluster-level
+    operations, and grants a "reader" service account access to cluster-level
+    DESCRIBE and DESCRIBE_CONFIGS operations.
+
+POSITIONAL ARGUMENTS
+     Acl resource - Identifies the name of the acl that this command creates.
+
+     The structure of the acl ID defines the Resource Pattern for which the acl
+     entries apply in the Kafka cluster. The acl ID must be structured like one
+     of the following:
+
+         For acls on the cluster:
+           cluster
+
+         For acls on a single resource within the cluster:
+           topic/{resource_name}
+           consumerGroup/{resource_name}
+           transactionalId/{resource_name}
+
+         For acls on all resources that match a prefix:
+           topicPrefixed/{resource_name}
+           consumerGroupPrefixed/{resource_name}
+           transactionalIdPrefixed/{resource_name}
+
+         For acls on all resources of a given type (i.e. the wildcard literal "*"):
+           allTopics (represents topic/*)
+           allConsumerGroups (represents consumerGroup/*)
+           allTransactionalIds (represents transactionalId/*)
+         The arguments in this group can be used to specify the attributes of this resource. (NOTE) Some attributes are not given arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument acl on the command line with a fully specified
+        name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       ACL
+          ID of the acl or fully qualified identifier for the acl.
+
+          To set the acl attribute:
+          ▸ provide the argument acl on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --cluster=CLUSTER
+          The cluster name.
+
+          To set the cluster attribute:
+          ▸ provide the argument acl on the command line with a fully
+            specified name;
+          ▸ provide the argument --cluster on the command line.
+
+       --location=LOCATION
+          ID of the location of the Managed Service for Apache Kafka resource.
+          See
+          https://cloud.google.com/managed-service-for-apache-kafka/docs/locations
+          for a list of supported locations.
+
+          To set the location attribute:
+          ▸ provide the argument acl on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+REQUIRED FLAGS
+     Exactly one of these must be specified:
+
+       --acl-entries-from-file=PATH_TO_FILE
+          Path to a JSON or YAML file containing the acl entries to use in the
+          acl. Use a full or relative path to a local file containing the value
+          of acl_entries.
+
+       --acl-entry=[host=HOST],[operation=OPERATION],[permission-type=PERMISSION-TYPE],[principal=PRINCIPAL]
+          An acl entry that configures access for a principal, for a specific
+          operation on the acl's resource pattern. This flag can be repeated.
+
+          PRINCIPAL is the principal. Specified as Google Cloud account, with
+          the Kafka StandardAuthorizer prefix "User:". For example:
+          "User:admin@project.iam.gserviceaccount.com". Can be the wildcard
+          "User:*" to refer to all users.
+
+          OPERATION is the operation type. Allowed values are: ALL, READ,
+          WRITE, CREATE, DELETE, ALTER, DESCRIBE, CLUSTER_ACTION,
+          DESCRIBE_CONFIGS, ALTER_CONFIGS, IDEMPOTENT_WRITE.
+
+          PERMISSION-TYPE is the permission type. Allowed values are: ALLOW,
+          DENY.
+
+          HOST is the host. Must be set to "*" for Managed Service for Apache
+          Kafka.
+
+          Example acl-entry:
+          "principal=User:admin@project.iam.gserviceaccount.com,operation=ALL,permission-type=ALLOW,host=*"
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the managedkafka/v1 API. The full documentation for this
+    API can be found at:
+    https://cloud.google.com/managed-service-for-apache-kafka/docs
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/managed-kafka/acls/delete b/gcloud/alpha/managed-kafka/acls/delete
new file mode 100644
index 000000000..ba02277a1
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/acls/delete
@@ -0,0 +1,99 @@
+NAME
+    gcloud alpha managed-kafka acls delete - delete a Managed Service for
+        Apache Kafka ACL
+
+SYNOPSIS
+    gcloud alpha managed-kafka acls delete
+        (ACL : --cluster=CLUSTER --location=LOCATION) [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Delete a Managed Service for Apache Kafka ACL.
+
+EXAMPLES
+    To delete an acl for all topics, in a cluster named mycluster located in
+    us-central1, run the following:
+
+        $ gcloud alpha managed-kafka acls delete allTopics \
+            --cluster=mycluster --location=us-central1
+
+POSITIONAL ARGUMENTS
+     Acl resource - Identifies the acl for deletion.
+
+     The structure of the acl ID defines the Resource Pattern for which the acl
+     entries apply in the Kafka cluster. The acl ID must be structured like one
+     of the following:
+
+         For acls on the cluster:
+           cluster
+
+         For acls on a single resource within the cluster:
+           topic/{resource_name}
+           consumerGroup/{resource_name}
+           transactionalId/{resource_name}
+
+         For acls on all resources that match a prefix:
+           topicPrefixed/{resource_name}
+           consumerGroupPrefixed/{resource_name}
+           transactionalIdPrefixed/{resource_name}
+
+         For acls on all resources of a given type (i.e. the wildcard literal "*"):
+           allTopics (represents topic/*)
+           allConsumerGroups (represents consumerGroup/*)
+           allTransactionalIds (represents transactionalId/*)
+         The arguments in this group can be used to specify the attributes of this resource. (NOTE) Some attributes are not given arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument acl on the command line with a fully specified
+        name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       ACL
+          ID of the acl or fully qualified identifier for the acl.
+
+          To set the acl attribute:
+          ▸ provide the argument acl on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --cluster=CLUSTER
+          The cluster name.
+
+          To set the cluster attribute:
+          ▸ provide the argument acl on the command line with a fully
+            specified name;
+          ▸ provide the argument --cluster on the command line.
+
+       --location=LOCATION
+          ID of the location of the Managed Service for Apache Kafka resource.
+          See
+          https://cloud.google.com/managed-service-for-apache-kafka/docs/locations
+          for a list of supported locations.
+
+          To set the location attribute:
+          ▸ provide the argument acl on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the managedkafka/v1 API. The full documentation for this
+    API can be found at:
+    https://cloud.google.com/managed-service-for-apache-kafka/docs
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/managed-kafka/acls/describe b/gcloud/alpha/managed-kafka/acls/describe
new file mode 100644
index 000000000..534e1d816
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/acls/describe
@@ -0,0 +1,79 @@
+NAME
+    gcloud alpha managed-kafka acls describe - describe a Managed Service for
+        Apache Kafka acl
+
+SYNOPSIS
+    gcloud alpha managed-kafka acls describe
+        (ACL : --cluster=CLUSTER --location=LOCATION) [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Describe a Managed Service for Apache Kafka acl.
+
+EXAMPLES
+    To describe an acl for the consumer group mygroup, in a cluster named
+    mycluster located in us-central1, run the following:
+
+        $ gcloud alpha managed-kafka acls describe consumerGroup/mygroup \
+            --cluster=mycluster --location=us-central1
+
+POSITIONAL ARGUMENTS
+     Acl resource - The describe command displays properties of the acl
+     specified by this parameter. The arguments in this group can be used to
+     specify the attributes of this resource. (NOTE) Some attributes are not
+     given arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument acl on the command line with a fully specified
+        name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       ACL
+          ID of the acl or fully qualified identifier for the acl.
+
+          To set the acl attribute:
+          ▸ provide the argument acl on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --cluster=CLUSTER
+          The cluster name.
+
+          To set the cluster attribute:
+          ▸ provide the argument acl on the command line with a fully
+            specified name;
+          ▸ provide the argument --cluster on the command line.
+
+       --location=LOCATION
+          ID of the location of the Managed Service for Apache Kafka resource.
+          See
+          https://cloud.google.com/managed-service-for-apache-kafka/docs/locations
+          for a list of supported locations.
+
+          To set the location attribute:
+          ▸ provide the argument acl on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the managedkafka/v1 API. The full documentation for this
+    API can be found at:
+    https://cloud.google.com/managed-service-for-apache-kafka/docs
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/managed-kafka/acls/help b/gcloud/alpha/managed-kafka/acls/help
new file mode 100644
index 000000000..1fd3e931b
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/acls/help
@@ -0,0 +1,47 @@
+NAME
+    gcloud alpha managed-kafka acls - administer Managed Service for Apache
+        Kafka acls
+
+SYNOPSIS
+    gcloud alpha managed-kafka acls COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Administer Managed Service for Apache Kafka acls.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     add-acl-entry
+        (ALPHA) Add an acl entry to a Managed Service for Apache Kafka acl.
+
+     create
+        (ALPHA) Create a Managed Service for Apache Kafka acl.
+
+     delete
+        (ALPHA) Delete a Managed Service for Apache Kafka ACL.
+
+     describe
+        (ALPHA) Describe a Managed Service for Apache Kafka acl.
+
+     list
+        (ALPHA) List all Managed Service for Apache Kafka acls in a given
+        cluster.
+
+     remove-acl-entry
+        (ALPHA) Remove an acl entry from a Managed Service for Apache Kafka
+        acl.
+
+     update
+        (ALPHA) Update a Managed Service for Apache Kafka acl.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/managed-kafka/acls/list b/gcloud/alpha/managed-kafka/acls/list
new file mode 100644
index 000000000..26c9eabe8
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/acls/list
@@ -0,0 +1,99 @@
+NAME
+    gcloud alpha managed-kafka acls list - list all Managed Service for Apache
+        Kafka acls in a given cluster
+
+SYNOPSIS
+    gcloud alpha managed-kafka acls list (CLUSTER : --location=LOCATION)
+        [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
+        [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) List all Managed Service for Apache Kafka acls in a given cluster.
+    To specify the maximum number of acls to list, use the --limit flag.
+
+EXAMPLES
+    To list acls in a cluster named mycluster located in us-central1, run the
+    following:
+
+        $ gcloud alpha managed-kafka acls list mycluster \
+            --location=us-central1
+
+POSITIONAL ARGUMENTS
+     Cluster resource - Identifies the cluster which contains all the acls to
+     be listed. The arguments in this group can be used to specify the
+     attributes of this resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument cluster on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       CLUSTER
+          ID of the cluster or fully qualified identifier for the cluster.
+
+          To set the cluster attribute:
+          ▸ provide the argument cluster on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          ID of the location of the Managed Service for Apache Kafka resource.
+          See
+          https://cloud.google.com/managed-service-for-apache-kafka/docs/locations
+          for a list of supported locations.
+
+          To set the location attribute:
+          ▸ provide the argument cluster on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the managedkafka/v1 API. The full documentation for this
+    API can be found at:
+    https://cloud.google.com/managed-service-for-apache-kafka/docs
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/managed-kafka/acls/remove-acl-entry b/gcloud/alpha/managed-kafka/acls/remove-acl-entry
new file mode 100644
index 000000000..f7a47e959
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/acls/remove-acl-entry
@@ -0,0 +1,108 @@
+NAME
+    gcloud alpha managed-kafka acls remove-acl-entry - remove an acl entry from
+        a Managed Service for Apache Kafka acl
+
+SYNOPSIS
+    gcloud alpha managed-kafka acls remove-acl-entry
+        (ACL : --cluster=CLUSTER --location=LOCATION) --operation=OPERATION
+        --principal=PRINCIPAL [--host=HOST; default="*"]
+        [--permission-type=PERMISSION_TYPE; default="ALLOW"]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Remove an acl entry from a Managed Service for Apache Kafka acl.
+
+EXAMPLES
+    To remove an acl entry for the Kafka cluster resource pattern
+    (acl_id=cluster), in a cluster named mycluster located in us-central1, run
+    the following:
+
+        $ gcloud alpha managed-kafka acls remove-acl-entry cluster \
+            --cluster=mycluster --location=us-central1 \
+            --principal='User:admin@project.iam.gserviceaccount.com' \
+            --operation=ALL --permission-type=ALLOW --host='*'
+
+POSITIONAL ARGUMENTS
+     Acl resource - Identifies the name of the acl that this command updates.
+     The arguments in this group can be used to specify the attributes of this
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument acl on the command line with a fully specified
+        name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       ACL
+          ID of the acl or fully qualified identifier for the acl.
+
+          To set the acl attribute:
+          ▸ provide the argument acl on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --cluster=CLUSTER
+          The cluster name.
+
+          To set the cluster attribute:
+          ▸ provide the argument acl on the command line with a fully
+            specified name;
+          ▸ provide the argument --cluster on the command line.
+
+       --location=LOCATION
+          ID of the location of the Managed Service for Apache Kafka resource.
+          See
+          https://cloud.google.com/managed-service-for-apache-kafka/docs/locations
+          for a list of supported locations.
+
+          To set the location attribute:
+          ▸ provide the argument acl on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+REQUIRED FLAGS
+     --operation=OPERATION
+        The operation type. Allowed values are: ALL, READ, WRITE, CREATE,
+        DELETE, ALTER, DESCRIBE, CLUSTER_ACTION, DESCRIBE_CONFIGS,
+        ALTER_CONFIGS, IDEMPOTENT_WRITE.
+
+        See
+        https://kafka.apache.org/documentation/#operations_resources_and_protocols
+        for the mapping of operations to Kafka protocols.
+
+     --principal=PRINCIPAL
+        The principal. Specified as Google Cloud account, with the Kafka
+        StandardAuthorizer prefix "User:". For example:
+        "User:admin@project.iam.gserviceaccount.com". Can be the wildcard
+        "User:*" to refer to all users.
+
+OPTIONAL FLAGS
+     --host=HOST; default="*"
+        The host. Must be set to "*" for Managed Service for Apache Kafka.
+
+     --permission-type=PERMISSION_TYPE; default="ALLOW"
+        The permission type. Allowed values are: ALLOW, DENY.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the managedkafka/v1 API. The full documentation for this
+    API can be found at:
+    https://cloud.google.com/managed-service-for-apache-kafka/docs
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/managed-kafka/acls/update b/gcloud/alpha/managed-kafka/acls/update
new file mode 100644
index 000000000..e44e04991
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/acls/update
@@ -0,0 +1,119 @@
+NAME
+    gcloud alpha managed-kafka acls update - update a Managed Service for
+        Apache Kafka acl
+
+SYNOPSIS
+    gcloud alpha managed-kafka acls update
+        (ACL : --cluster=CLUSTER --location=LOCATION)
+        (--acl-entry=[host=HOST],[operation=OPERATION],
+          [permission-type=PERMISSION-TYPE],[principal=PRINCIPAL] --etag=ETAG)
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Update a Managed Service for Apache Kafka acl.
+
+    NOTE: update performs a FULL REPLACEMENT of acl entries. For incremental
+    updates, use add-acl-entry and remove-acl-entry commands.
+
+EXAMPLES
+    To update an acl for the Kafka cluster resource pattern, with etag W/XYZ123
+    returned from a previous create or describe command, in a cluster named
+    mycluster located in us-central1, run the following:
+
+        $ gcloud alpha managed-kafka acls update cluster \
+            --cluster=mycluster --location=us-central1 \
+            --acl-entry=principal='User:admin@project.iam.gserviceaccount.co\
+        m',operation=ALL,permission-type=ALLOW,host='*' --etag=W/XYZ123
+
+POSITIONAL ARGUMENTS
+     Acl resource - Identifies the name of the acl that this command updates.
+     The arguments in this group can be used to specify the attributes of this
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument acl on the command line with a fully specified
+        name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       ACL
+          ID of the acl or fully qualified identifier for the acl.
+
+          To set the acl attribute:
+          ▸ provide the argument acl on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --cluster=CLUSTER
+          The cluster name.
+
+          To set the cluster attribute:
+          ▸ provide the argument acl on the command line with a fully
+            specified name;
+          ▸ provide the argument --cluster on the command line.
+
+       --location=LOCATION
+          ID of the location of the Managed Service for Apache Kafka resource.
+          See
+          https://cloud.google.com/managed-service-for-apache-kafka/docs/locations
+          for a list of supported locations.
+
+          To set the location attribute:
+          ▸ provide the argument acl on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+REQUIRED FLAGS
+     At least one of these must be specified:
+
+       --acl-entry=[host=HOST],[operation=OPERATION],[permission-type=PERMISSION-TYPE],[principal=PRINCIPAL]
+          An acl entry that configures access for a principal, for a specific
+          operation on the acl's resource pattern. This flag can be repeated.
+
+          PRINCIPAL is the principal. Specified as Google Cloud account, with
+          the Kafka StandardAuthorizer prefix "User:". For example:
+          "User:admin@project.iam.gserviceaccount.com". Can be the wildcard
+          "User:*" to refer to all users.
+
+          OPERATION is the operation type. Allowed values are: ALL, READ,
+          WRITE, CREATE, DELETE, ALTER, DESCRIBE, CLUSTER_ACTION,
+          DESCRIBE_CONFIGS, ALTER_CONFIGS, IDEMPOTENT_WRITE.
+
+          PERMISSION-TYPE is the permission type. Allowed values are: ALLOW,
+          DENY.
+
+          HOST is the host. Must be set to "*" for Managed Service for Apache
+          Kafka.
+
+          Example acl-entry:
+          "principal=User:admin@project.iam.gserviceaccount.com,operation=ALL,permission-type=ALLOW,host=*"
+
+       --etag=ETAG
+          etag returned in the response to a previous create or describe
+          command. The etag is used for concurrency control, to ensure that the
+          client and server agree on the current set of acl entries in the
+          Kafka cluster, before full replacement in the update command.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the managedkafka/v1 API. The full documentation for this
+    API can be found at:
+    https://cloud.google.com/managed-service-for-apache-kafka/docs
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/managed-kafka/help b/gcloud/alpha/managed-kafka/help
index dc593decc..0c3e4531c 100644
--- a/gcloud/alpha/managed-kafka/help
+++ b/gcloud/alpha/managed-kafka/help
@@ -17,6 +17,9 @@ GCLOUD WIDE FLAGS
 GROUPS
     GROUP is one of the following:
 
+     acls
+        (ALPHA) Administer Managed Service for Apache Kafka acls.
+
      clusters
         (ALPHA) Administer Managed Service for Apache Kafka clusters.
 
diff --git a/gcloud/alpha/pubsub/message-transforms/help b/gcloud/alpha/pubsub/message-transforms/help
index 0df315b6d..0c36340d6 100644
--- a/gcloud/alpha/pubsub/message-transforms/help
+++ b/gcloud/alpha/pubsub/message-transforms/help
@@ -26,5 +26,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. These variants are also available:
+
+        $ gcloud pubsub message-transforms
+
+        $ gcloud beta pubsub message-transforms
 
diff --git a/gcloud/alpha/pubsub/message-transforms/test b/gcloud/alpha/pubsub/message-transforms/test
index e16d62162..bd8c8618a 100644
--- a/gcloud/alpha/pubsub/message-transforms/test
+++ b/gcloud/alpha/pubsub/message-transforms/test
@@ -84,5 +84,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. These variants are also available:
+
+        $ gcloud pubsub message-transforms test
+
+        $ gcloud beta pubsub message-transforms test
 
diff --git a/gcloud/alpha/pubsub/message-transforms/validate b/gcloud/alpha/pubsub/message-transforms/validate
index 8b3a92153..8c213428a 100644
--- a/gcloud/alpha/pubsub/message-transforms/validate
+++ b/gcloud/alpha/pubsub/message-transforms/validate
@@ -25,5 +25,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. These variants are also available:
+
+        $ gcloud pubsub message-transforms validate
+
+        $ gcloud beta pubsub message-transforms validate
 
diff --git a/gcloud/alpha/run/deploy b/gcloud/alpha/run/deploy
index 5cf367022..7f198d60c 100644
--- a/gcloud/alpha/run/deploy
+++ b/gcloud/alpha/run/deploy
@@ -12,7 +12,7 @@ SYNOPSIS
         [--[no-]gpu-zonal-redundancy] [--[no-]iap]
         [--ingress=INGRESS; default="all"] [--[no-]invoker-iam-check]
         [--max=MAX] [--max-instances=MAX_INSTANCES] [--mesh=MESH] [--min=MIN]
-        [--min-instances=MIN_INSTANCES] [--region=REGION]
+        [--min-instances=MIN_INSTANCES] [--region=REGION] [--regions=REGIONS]
         [--remove-containers=[CONTAINER,...]]
         [--revision-suffix=REVISION_SUFFIX] [--scaling=SCALING]
         [--service-account=SERVICE_ACCOUNT] [--[no-]session-affinity]
@@ -258,6 +258,10 @@ FLAGS
         Region in which the resource can be found. Alternatively, set the
         property [run/region].
 
+     --regions=REGIONS
+        Comma-separated list of regions in which the multi-region Service can
+        be found.
+
      --remove-containers=[CONTAINER,...]
         List of containers to remove.
 
diff --git a/gcloud/alpha/run/multi-region-services/replace b/gcloud/alpha/run/multi-region-services/replace
index 95c00a4cc..c5873e752 100644
--- a/gcloud/alpha/run/multi-region-services/replace
+++ b/gcloud/alpha/run/multi-region-services/replace
@@ -4,7 +4,7 @@ NAME
 
 SYNOPSIS
     gcloud alpha run multi-region-services replace FILE [--async] [--dry-run]
-        [--region=REGION] [GCLOUD_WIDE_FLAG ...]
+        [--region=REGION] [--regions=REGIONS] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) Creates or replaces a service from a YAML service specification.
@@ -32,6 +32,10 @@ FLAGS
         Region in which the resource can be found. Alternatively, set the
         property [run/region].
 
+     --regions=REGIONS
+        Comma-separated list of regions in which the multi-region Service can
+        be found.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/alpha/run/revisions/describe b/gcloud/alpha/run/revisions/describe
index 95416e55d..06103f7a6 100644
--- a/gcloud/alpha/run/revisions/describe
+++ b/gcloud/alpha/run/revisions/describe
@@ -9,9 +9,10 @@ DESCRIPTION
     (ALPHA) Obtain details about revisions.
 
 EXAMPLES
-    To describe all revisions of service default in us-central1:
+    To describe a revision my-service-00001-abc`in us-central1:
 
-        $ gcloud alpha run revisions describe --region=us-central1 default
+        $ gcloud alpha run revisions describe --region=us-central1 \
+          my-service-00001-abc
 
 POSITIONAL ARGUMENTS
      Revision resource - Revision to describe. The arguments in this group can
diff --git a/gcloud/alpha/scc/notifications/list b/gcloud/alpha/scc/notifications/list
index dbf80decc..520b1fce5 100644
--- a/gcloud/alpha/scc/notifications/list
+++ b/gcloud/alpha/scc/notifications/list
@@ -4,9 +4,10 @@ NAME
 
 SYNOPSIS
     gcloud alpha scc notifications list [PARENT]
-        [--location=LOCATION; default="global"] [--filter=EXPRESSION]
-        [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]]
-        [GCLOUD_WIDE_FLAG ...]
+        [--location=LOCATION; default="global"]
+        [--folder=FOLDER | --organization=ORGANIZATION | --project=PROJECT]
+        [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
+        [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) List Security Command Center notification configs.
@@ -62,6 +63,20 @@ FLAGS
         notificationConfig resources that were created by using the Security
         Command Center API v2 and the only valid location is global.
 
+     At most one of these can be specified:
+
+       --folder=FOLDER
+          Folder where the notification config resides. Formatted as
+          folders/456 or just 456.
+
+       --organization=ORGANIZATION
+          Organization where the notification config resides. Formatted as
+          organizations/123 or just 123.
+
+       --project=PROJECT
+          Project (ID or number) where the notification config resides.
+          Formatted as projects/789 or just 789.
+
 LIST COMMAND FLAGS
      --filter=EXPRESSION
         Apply a Boolean filter EXPRESSION to each resource item to be listed.
diff --git a/gcloud/alpha/storage/buckets/create b/gcloud/alpha/storage/buckets/create
index 8201491be..e676d56d8 100644
--- a/gcloud/alpha/storage/buckets/create
+++ b/gcloud/alpha/storage/buckets/create
@@ -135,7 +135,7 @@ FLAGS
         Minimum retention period
         (https://cloud.google.com/storage/docs/bucket-lock#retention-periods)
         for objects stored in the bucket, for example
-        --retention-period=1Y1M1D5S. Objects added to the bucket cannot be
+        --retention-period=P1Y1M1DT5S. Objects added to the bucket cannot be
         deleted until they've been stored for the specified length of time.
         Default is no retention period. Only available for Cloud Storage using
         the JSON API.
diff --git a/gcloud/alpha/storage/buckets/update b/gcloud/alpha/storage/buckets/update
index 4c9509d53..aabc5878e 100644
--- a/gcloud/alpha/storage/buckets/update
+++ b/gcloud/alpha/storage/buckets/update
@@ -300,7 +300,7 @@ FLAGS
           Minimum retention period
           (https://cloud.google.com/storage/docs/bucket-lock#retention-periods)
           for objects stored in the bucket, for example
-          --retention-period=1Y1M1D5S. Objects added to the bucket cannot be
+          --retention-period=P1Y1M1DT5S. Objects added to the bucket cannot be
           deleted until they've been stored for the specified length of time.
           Default is no retention period. Only available for Cloud Storage
           using the JSON API.
diff --git a/gcloud/beta/compute/commitments/create b/gcloud/beta/compute/commitments/create
index f84f06b31..8c7023eda 100644
--- a/gcloud/beta/compute/commitments/create
+++ b/gcloud/beta/compute/commitments/create
@@ -109,11 +109,12 @@ OPTIONAL FLAGS
         accelerator-optimized-a3, accelerator-optimized-a3-mega,
         accelerator-optimized-a3-ultra, accelerator-optimized-a4,
         compute-optimized, compute-optimized-c2d, compute-optimized-c3,
-        compute-optimized-c3d, compute-optimized-h3, general-purpose,
-        general-purpose-c4, general-purpose-c4a, general-purpose-e2,
-        general-purpose-n2, general-purpose-n2d, general-purpose-n4,
-        general-purpose-t2d, graphics-optimized, memory-optimized,
-        memory-optimized-m3, memory-optimized-m4, memory-optimized-x4-16tb,
+        compute-optimized-c3d, compute-optimized-h3, compute-optimized-h4d,
+        general-purpose, general-purpose-c4, general-purpose-c4a,
+        general-purpose-c4d, general-purpose-e2, general-purpose-n2,
+        general-purpose-n2d, general-purpose-n4, general-purpose-t2d,
+        graphics-optimized, memory-optimized, memory-optimized-m3,
+        memory-optimized-m4, memory-optimized-x4-16tb,
         memory-optimized-x4-24tb, memory-optimized-x4-32tb,
         storage-optimized-z3.
 
diff --git a/gcloud/beta/compute/disks/create b/gcloud/beta/compute/disks/create
index 2da296fca..1ec64bc5e 100644
--- a/gcloud/beta/compute/disks/create
+++ b/gcloud/beta/compute/disks/create
@@ -102,10 +102,10 @@ FLAGS
         Enables one or more features for VM instances that use the image for
         their boot disks. See the descriptions of supported features at:
         https://cloud.google.com/compute/docs/images/create-delete-deprecate-private-images#guest-os-features.
-        GUEST_OS_FEATURE must be one of: GVNIC, IDPF, MULTI_IP_SUBNET,
-        SEV_CAPABLE, SEV_LIVE_MIGRATABLE, SEV_LIVE_MIGRATABLE_V2,
-        SEV_SNP_CAPABLE, TDX_CAPABLE, UEFI_COMPATIBLE, VIRTIO_SCSI_MULTIQUEUE,
-        WINDOWS.
+        GUEST_OS_FEATURE must be one of: BARE_METAL_LINUX_COMPATIBLE, GVNIC,
+        IDPF, MULTI_IP_SUBNET, SEV_CAPABLE, SEV_LIVE_MIGRATABLE,
+        SEV_LIVE_MIGRATABLE_V2, SEV_SNP_CAPABLE, SNP_SVSM_CAPABLE, TDX_CAPABLE,
+        UEFI_COMPATIBLE, VIRTIO_SCSI_MULTIQUEUE, WINDOWS.
 
      --interface=INTERFACE
         Specifies the disk interface to use for attaching this disk. Valid
diff --git a/gcloud/beta/compute/images/create b/gcloud/beta/compute/images/create
index fcae690f4..d2b58ca39 100644
--- a/gcloud/beta/compute/images/create
+++ b/gcloud/beta/compute/images/create
@@ -151,10 +151,10 @@ OPTIONAL FLAGS
         Enables one or more features for VM instances that use the image for
         their boot disks. See the descriptions of supported features at:
         https://cloud.google.com/compute/docs/images/create-delete-deprecate-private-images#guest-os-features.
-        GUEST_OS_FEATURE must be one of: GVNIC, IDPF, MULTI_IP_SUBNET,
-        SEV_CAPABLE, SEV_LIVE_MIGRATABLE, SEV_LIVE_MIGRATABLE_V2,
-        SEV_SNP_CAPABLE, TDX_CAPABLE, UEFI_COMPATIBLE, VIRTIO_SCSI_MULTIQUEUE,
-        WINDOWS.
+        GUEST_OS_FEATURE must be one of: BARE_METAL_LINUX_COMPATIBLE, GVNIC,
+        IDPF, MULTI_IP_SUBNET, SEV_CAPABLE, SEV_LIVE_MIGRATABLE,
+        SEV_LIVE_MIGRATABLE_V2, SEV_SNP_CAPABLE, SNP_SVSM_CAPABLE, TDX_CAPABLE,
+        UEFI_COMPATIBLE, VIRTIO_SCSI_MULTIQUEUE, WINDOWS.
 
      --key-exchange-key-file=[KEK_VALUE,...]
         Comma-separated list of file paths that point to X.509 certificates in
diff --git a/gcloud/beta/compute/interconnects/attachments/groups/add-members b/gcloud/beta/compute/interconnects/attachments/groups/add-members
new file mode 100644
index 000000000..308a055ca
--- /dev/null
+++ b/gcloud/beta/compute/interconnects/attachments/groups/add-members
@@ -0,0 +1,49 @@
+NAME
+    gcloud beta compute interconnects attachments groups add-members - add
+        member interconnect attachments to a Compute Engine interconnect
+        attachment group
+
+SYNOPSIS
+    gcloud beta compute interconnects attachments groups add-members NAME
+        --attachments=[INTERCONNECT_ATTACHMENT,...] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) gcloud beta compute interconnects attachments groups add-members is
+    used to add member interconnect attachments to an interconnect attachment
+    group.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To add attachment-1 and attachment-2 to interconnect attachment group
+    example-attachment-group, run:
+
+        $ gcloud beta compute interconnects attachments groups add-members \
+            example-attachment-group \
+            --attachments=region-1/attachment-1,region-2/attachment-2
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect attachment group to update.
+
+REQUIRED FLAGS
+     --attachments=[INTERCONNECT_ATTACHMENT,...]
+        Member interconnect attachments to add to or remove from the
+        interconnect attachment group.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute interconnects attachments groups add-members
+
+        $ gcloud alpha compute interconnects attachments groups add-members
+
diff --git a/gcloud/beta/compute/interconnects/attachments/groups/create b/gcloud/beta/compute/interconnects/attachments/groups/create
new file mode 100644
index 000000000..03ad23951
--- /dev/null
+++ b/gcloud/beta/compute/interconnects/attachments/groups/create
@@ -0,0 +1,70 @@
+NAME
+    gcloud beta compute interconnects attachments groups create - create a
+        Compute Engine interconnect attachment group
+
+SYNOPSIS
+    gcloud beta compute interconnects attachments groups create NAME
+        --intended-availability-sla=INTENDED_AVAILABILITY_SLA
+        [--attachments=[INTERCONNECT_ATTACHMENT,...]]
+        [--description=DESCRIPTION] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) gcloud beta compute interconnects attachments groups create is used
+    to create interconnect attachment groups. An interconnect attachment group
+    connects a set of redundant interconnect attachments between Google and the
+    customer.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To create an interconnect attachment group capable of PRODUCTION_CRITICAL,
+    run:
+
+        $ gcloud beta compute interconnects attachments groups create \
+            example-attachment-group \
+            --intended-availability-sla=PRODUCTION_CRITICAL \
+            --description="Example interconnect attachment group"
+
+    It is easy to add members to an existing interconnect attachment group
+    after creation using the add-members command.
+
+    To create an interconnect attachment group capable of
+    PRODUCTION_NON_CRITICAL, with two members at creation time, run:
+
+        $ gcloud beta compute interconnects attachments groups create \
+            example-attachment-group \
+            --intended-availability-sla=PRODUCTION_NON_CRITICAL \
+            --attachments=region-1/attachment-1,region-2/attachment-2
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect attachment group to create.
+
+REQUIRED FLAGS
+     --intended-availability-sla=INTENDED_AVAILABILITY_SLA
+        The availability SLA that the user intends this group to support.
+
+OPTIONAL FLAGS
+     --attachments=[INTERCONNECT_ATTACHMENT,...]
+        Member interconnect attachments to add to the interconnect attachment
+        group initially.
+
+     --description=DESCRIPTION
+        An optional, textual description for the interconnect attachment group.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute interconnects attachments groups create
+
+        $ gcloud alpha compute interconnects attachments groups create
+
diff --git a/gcloud/beta/compute/interconnects/attachments/groups/delete b/gcloud/beta/compute/interconnects/attachments/groups/delete
new file mode 100644
index 000000000..558a5597d
--- /dev/null
+++ b/gcloud/beta/compute/interconnects/attachments/groups/delete
@@ -0,0 +1,43 @@
+NAME
+    gcloud beta compute interconnects attachments groups delete - delete
+        Compute Engine interconnect attachment groups
+
+SYNOPSIS
+    gcloud beta compute interconnects attachments groups delete NAME [NAME ...]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) gcloud beta compute interconnects attachments groups delete is used
+    to delete interconnect attachment groups.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To delete an interconnect attachment group, run:
+
+        $ gcloud beta compute interconnects attachments groups delete \
+            example-attachment-group"
+
+    Although not shown in this example, you can delete multiple interconnect
+    attachment groups in a single command.
+
+POSITIONAL ARGUMENTS
+     NAME [NAME ...]
+        Names of the interconnect attachment groups to delete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute interconnects attachments groups delete
+
+        $ gcloud alpha compute interconnects attachments groups delete
+
diff --git a/gcloud/beta/compute/interconnects/attachments/groups/describe b/gcloud/beta/compute/interconnects/attachments/groups/describe
new file mode 100644
index 000000000..05df414c4
--- /dev/null
+++ b/gcloud/beta/compute/interconnects/attachments/groups/describe
@@ -0,0 +1,40 @@
+NAME
+    gcloud beta compute interconnects attachments groups describe - describe a
+        Compute Engine interconnect attachment group
+
+SYNOPSIS
+    gcloud beta compute interconnects attachments groups describe NAME
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) gcloud beta compute interconnects attachments groups describe is
+    used to describe interconnect attachment groups.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To describe an interconnect attachment group, run:
+
+        $ gcloud beta compute interconnects attachments groups describe \
+            example-attachment-group
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect attachment group to describe.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute interconnects attachments groups describe
+
+        $ gcloud alpha compute interconnects attachments groups describe
+
diff --git a/gcloud/beta/compute/interconnects/attachments/groups/get-operational-status b/gcloud/beta/compute/interconnects/attachments/groups/get-operational-status
new file mode 100644
index 000000000..fd74a10b4
--- /dev/null
+++ b/gcloud/beta/compute/interconnects/attachments/groups/get-operational-status
@@ -0,0 +1,45 @@
+NAME
+    gcloud beta compute interconnects attachments groups get-operational-status
+        - get the operational status of a Compute Engine interconnect
+        attachment group
+
+SYNOPSIS
+    gcloud beta compute interconnects attachments groups get-operational-status
+        NAME [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) gcloud beta compute interconnects attachments groups
+    get-operational-status is used to get the operational status of
+    interconnect attachment groups.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To get the operational status of interconnect attachment group
+    example-attachment-group, run:
+
+        $ gcloud beta compute interconnects attachments groups \
+            get-operational-status example-attachment-group
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect attachment group to get operational status.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute interconnects attachments groups \
+            get-operational-status
+
+        $ gcloud alpha compute interconnects attachments groups \
+            get-operational-status
+
diff --git a/gcloud/beta/compute/interconnects/attachments/groups/help b/gcloud/beta/compute/interconnects/attachments/groups/help
new file mode 100644
index 000000000..e4fa92855
--- /dev/null
+++ b/gcloud/beta/compute/interconnects/attachments/groups/help
@@ -0,0 +1,54 @@
+NAME
+    gcloud beta compute interconnects attachments groups - create or manipulate
+        interconnect attachment groups
+
+SYNOPSIS
+    gcloud beta compute interconnects attachments groups COMMAND
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Create or manipulate interconnect attachment groups.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     add-members
+        (BETA) Add member interconnect attachments to a Compute Engine
+        interconnect attachment group.
+
+     create
+        (BETA) Create a Compute Engine interconnect attachment group.
+
+     delete
+        (BETA) Delete Compute Engine interconnect attachment groups.
+
+     describe
+        (BETA) Describe a Compute Engine interconnect attachment group.
+
+     get-operational-status
+        (BETA) Get the operational status of a Compute Engine interconnect
+        attachment group.
+
+     list
+        (BETA) List interconnect attachment groups.
+
+     remove-members
+        (BETA) Remove member interconnect attachments from a Compute Engine
+        interconnect attachment group.
+
+     update
+        (BETA) Update a Compute Engine interconnect attachment group.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute interconnects attachments groups
+
+        $ gcloud alpha compute interconnects attachments groups
+
diff --git a/gcloud/beta/compute/interconnects/attachments/groups/list b/gcloud/beta/compute/interconnects/attachments/groups/list
new file mode 100644
index 000000000..832350670
--- /dev/null
+++ b/gcloud/beta/compute/interconnects/attachments/groups/list
@@ -0,0 +1,68 @@
+NAME
+    gcloud beta compute interconnects attachments groups list - list
+        interconnect attachment groups
+
+SYNOPSIS
+    gcloud beta compute interconnects attachments groups list
+        [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
+        [--sort-by=[FIELD,...]] [--uri] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) gcloud beta compute interconnects attachments groups list is used to
+    list interconnect attachment groups.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To list interconnect attachment groups, run:
+
+        $ gcloud beta compute interconnects attachments groups list
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute interconnects attachments groups list
+
+        $ gcloud alpha compute interconnects attachments groups list
+
diff --git a/gcloud/beta/compute/interconnects/attachments/groups/remove-members b/gcloud/beta/compute/interconnects/attachments/groups/remove-members
new file mode 100644
index 000000000..0a1bf45b8
--- /dev/null
+++ b/gcloud/beta/compute/interconnects/attachments/groups/remove-members
@@ -0,0 +1,50 @@
+NAME
+    gcloud beta compute interconnects attachments groups remove-members -
+        remove member interconnect attachments from a Compute Engine
+        interconnect attachment group
+
+SYNOPSIS
+    gcloud beta compute interconnects attachments groups remove-members NAME
+        --attachments=[INTERCONNECT_ATTACHMENT,...] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) gcloud beta compute interconnects attachments groups remove-members
+    is used to remove member interconnect attachments from an interconnect
+    attachment group.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To remove attachment-1 and attachment-2 from interconnect attachment group
+    example-attachment-group, run:
+
+        $ gcloud beta compute interconnects attachments groups \
+            remove-members example-attachment-group \
+            --attachments=region-1/attachment-1,region-2/attachment-2
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect attachment group to update.
+
+REQUIRED FLAGS
+     --attachments=[INTERCONNECT_ATTACHMENT,...]
+        Member interconnect attachments to add to or remove from the
+        interconnect attachment group.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute interconnects attachments groups remove-members
+
+        $ gcloud alpha compute interconnects attachments groups \
+            remove-members
+
diff --git a/gcloud/beta/compute/interconnects/attachments/groups/update b/gcloud/beta/compute/interconnects/attachments/groups/update
new file mode 100644
index 000000000..706ab22f4
--- /dev/null
+++ b/gcloud/beta/compute/interconnects/attachments/groups/update
@@ -0,0 +1,74 @@
+NAME
+    gcloud beta compute interconnects attachments groups update - update a
+        Compute Engine interconnect attachment group
+
+SYNOPSIS
+    gcloud beta compute interconnects attachments groups update NAME
+        [--attachments=[INTERCONNECT_ATTACHMENT,...]]
+        [--description=DESCRIPTION]
+        [--intended-availability-sla=INTENDED_AVAILABILITY_SLA]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) gcloud beta compute interconnects attachments groups update is used
+    to update interconnect attachment groups.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To update an interconnect attachment group example-attachment-group's
+    intended availability SLA to PRODUCTION_CRITICAL, run:
+
+        $ gcloud beta compute interconnects attachments groups update \
+            example-attachment-group \
+            --intended-availability-sla=PRODUCTION_CRITICAL
+
+    To update an interconnect attachment group example-attachment-group's
+    description to "example attachment group description", run:
+
+        $ gcloud beta compute interconnects attachments groups update \
+            example-attachment-group \
+            --description="example attachment group description"
+
+    To update an interconnect attachment group example-attachment-group's
+    member attachments to attachment-1 and attachment-2, run:
+
+        $ gcloud beta compute interconnects attachments groups update \
+            example-attachment-group \
+            --attachments=region-1/attachment-1,region-2/attachment-2
+
+    Although you can add or remove member attachments using this command, it is
+    recommended to add or remove member attachments using the add-members and
+    remove-members commands.
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect attachment group to update.
+
+FLAGS
+     --attachments=[INTERCONNECT_ATTACHMENT,...]
+        Member interconnect attachments to add to the interconnect attachment
+        group initially.
+
+     --description=DESCRIPTION
+        An optional, textual description for the interconnect attachment group.
+
+     --intended-availability-sla=INTENDED_AVAILABILITY_SLA
+        The availability SLA that the user intends this group to support.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute interconnects attachments groups update
+
+        $ gcloud alpha compute interconnects attachments groups update
+
diff --git a/gcloud/beta/compute/interconnects/attachments/help b/gcloud/beta/compute/interconnects/attachments/help
index 021fe61e9..f5a629b24 100644
--- a/gcloud/beta/compute/interconnects/attachments/help
+++ b/gcloud/beta/compute/interconnects/attachments/help
@@ -20,6 +20,9 @@ GROUPS
      dedicated
         (BETA) Create or manipulate dedicated interconnect attachments.
 
+     groups
+        (BETA) Create or manipulate interconnect attachment groups.
+
      partner
         (BETA) Create or manipulate partner interconnect attachments.
 
diff --git a/gcloud/beta/compute/interconnects/groups/add-members b/gcloud/beta/compute/interconnects/groups/add-members
new file mode 100644
index 000000000..186869d07
--- /dev/null
+++ b/gcloud/beta/compute/interconnects/groups/add-members
@@ -0,0 +1,46 @@
+NAME
+    gcloud beta compute interconnects groups add-members - add member
+        interconnects to a Compute Engine interconnect group
+
+SYNOPSIS
+    gcloud beta compute interconnects groups add-members NAME
+        --interconnects=[INTERCONNECT,...] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) gcloud beta compute interconnects groups add-members is used to add
+    member interconnects to an interconnect group.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To add interconnects interconnect1 and interconnect2 to interconnect group
+    example-interconnect-group, run:
+
+        $ gcloud beta compute interconnects groups add-members \
+            example-interconnect-group \
+            --interconnects=interconnect1,interconnect2
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect group to update.
+
+REQUIRED FLAGS
+     --interconnects=[INTERCONNECT,...]
+        Member interconnects to add to or remove from the interconnect group.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute interconnects groups add-members
+
+        $ gcloud alpha compute interconnects groups add-members
+
diff --git a/gcloud/beta/compute/interconnects/groups/create b/gcloud/beta/compute/interconnects/groups/create
new file mode 100644
index 000000000..398ad9b0f
--- /dev/null
+++ b/gcloud/beta/compute/interconnects/groups/create
@@ -0,0 +1,68 @@
+NAME
+    gcloud beta compute interconnects groups create - create a Compute Engine
+        interconnect group
+
+SYNOPSIS
+    gcloud beta compute interconnects groups create NAME
+        --intended-topology-capability=INTENDED_TOPOLOGY_CAPABILITY
+        [--description=DESCRIPTION] [--interconnects=[INTERCONNECT,...]]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) gcloud beta compute interconnects groups create is used to create
+    interconnect groups. An interconnect group connects a set of redundant
+    interconnects between Google and the customer.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To create an interconnect group capable of PRODUCTION_CRITICAL, run:
+
+        $ gcloud beta compute interconnects groups create \
+            example-interconnect-group \
+            --intended-topology-capability=PRODUCTION_CRITICAL \
+            --description="Example interconnect group"
+
+    It is easy to add members to an existing interconnect group after creation
+    using the add-members command.
+
+    To create an interconnect group capable of PRODUCTION_NON_CRITICAL, with
+    two members at creation time, run:
+
+        $ gcloud beta compute interconnects groups create \
+            example-interconnect-group \
+            --intended-topology-capability=PRODUCTION_NON_CRITICAL \
+            --interconnects=interconnect-1,interconnect-2
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect group to create.
+
+REQUIRED FLAGS
+     --intended-topology-capability=INTENDED_TOPOLOGY_CAPABILITY
+        The reliability the user intends this group to be capable of, in terms
+        of the Interconnect product SLAs.
+
+OPTIONAL FLAGS
+     --description=DESCRIPTION
+        An optional, textual description for the interconnect group.
+
+     --interconnects=[INTERCONNECT,...]
+        Member interconnects to add to the interconnect group initially.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute interconnects groups create
+
+        $ gcloud alpha compute interconnects groups create
+
diff --git a/gcloud/beta/compute/interconnects/groups/create-members b/gcloud/beta/compute/interconnects/groups/create-members
new file mode 100644
index 000000000..1a4d72394
--- /dev/null
+++ b/gcloud/beta/compute/interconnects/groups/create-members
@@ -0,0 +1,138 @@
+NAME
+    gcloud beta compute interconnects groups create-members - create new member
+        interconnects in a Compute Engine interconnect group
+
+SYNOPSIS
+    gcloud beta compute interconnects groups create-members NAME
+        --interconnect=[INTERCONNECT,...] [--admin-enabled]
+        [--customer-name=CUSTOMER_NAME] [--description=DESCRIPTION]
+        [--facility=FACILITY]
+        [--intent-mismatch-behavior=INTENT_MISMATCH_BEHAVIOR]
+        [--interconnect-type=INTERCONNECT_TYPE] [--link-type=LINK_TYPE]
+        [--noc-contact-email=NOC_CONTACT_EMAIL]
+        [--requested-features=[FEATURES,...]]
+        [--requested-link-count=REQUESTED_LINK_COUNT] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) gcloud beta compute interconnects groups create-members is used to
+    create new member interconnects in an interconnect group.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To create interconnects interconnect1 and interconnect2 in interconnect
+    group example-interconnect-group, run:
+
+        $ gcloud beta compute interconnects groups create-members \
+            example-interconnect-group --interconnect-type=DEDICATED \
+            --link-type=LINK_TYPE_ETHERNET_10G_LR --requested-link-count=1 \
+            --facility=iad-1 --interconnect="name=interconnect1" \
+            --interconnect="name=interconnect2"
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect group to create members.
+
+REQUIRED FLAGS
+     --interconnect=[INTERCONNECT,...]
+        New member interconnects to create in the interconnect group. To create
+        multiple interconnects, this flag should be specified multiple times.
+
+        Each interconnect takes in the same set of flags as the gcloud compute
+        interconnects create command, except instead of a location, a facility
+        must be specified. These flags are defined as a comma separated list of
+        flag=value pairs.
+
+        Example: --interconnect
+        name=interconnect1,facility=iad-1,description="my
+        interconnect",link-type=LINK_TYPE_ETHERNET_10G_LR,requested-link-count=1,
+        interconnect-type=DEDICATED,admin-enabled,
+        noc-contact-email=noc@google.com,customer-name=customer-name
+        requested-features=MACSEC:CROSS_SITE_NETWORK
+
+        Note that for multiple requested-features, use a colon (:) as the
+        delimiter, as the comma is used to separate the flags. Similarly, if
+        you need to use a comma in another flag value, you should set an
+        alternative delimiter for the --interconnect flag. Run gcloud topic
+        escaping for more information.
+
+OPTIONAL FLAGS
+     --admin-enabled
+        Administrative status of the interconnect. If not provided on creation,
+        defaults to enabled. When this is enabled, the interconnect is
+        operational and will carry traffic across any functioning linked
+        interconnect attachments. Use --no-admin-enabled to disable it.
+
+     --customer-name=CUSTOMER_NAME
+        Customer name to put in the Letter of Authorization as the party
+        authorized to request an interconnect. This field is required for most
+        interconnects, however it is prohibited when creating a Cross-Cloud
+        Interconnect.
+
+     --description=DESCRIPTION
+        An optional, textual description for the interconnect.
+
+     --facility=FACILITY
+        The facility (zone free location) to create the interconnect in.
+
+     --intent-mismatch-behavior=INTENT_MISMATCH_BEHAVIOR
+        The behavior when the intent of the interconnect group does not match
+        the topology capability of the member interconnects.
+        INTENT_MISMATCH_BEHAVIOR must be one of: REJECT, CREATE.
+
+     --interconnect-type=INTERCONNECT_TYPE
+        Type of the interconnect. INTERCONNECT_TYPE must be one of:
+
+         DEDICATED
+            Dedicated private interconnect.
+         PARTNER
+            Partner interconnect. Only available to approved partners.
+
+     --link-type=LINK_TYPE
+        Type of the link for the interconnect. LINK_TYPE must be one of:
+
+         LINK_TYPE_ETHERNET_100G_LR
+            100Gbps Ethernet, LR Optics.
+         LINK_TYPE_ETHERNET_10G_LR
+            10Gbps Ethernet, LR Optics.
+         LINK_TYPE_ETHERNET_400G_LR4
+            400Gbps Ethernet, LR4 Optics.
+
+     --noc-contact-email=NOC_CONTACT_EMAIL
+        Email address to contact the customer NOC for operations and
+        maintenance notifications regarding this interconnect.
+
+     --requested-features=[FEATURES,...]
+        List of features requested for this interconnect. FEATURES must be one
+        of:
+
+         CROSS_SITE_NETWORK
+            If specified then the interconnect is created on Cross-Site Network
+            capable hardware ports. This parameter can only be provided during
+            interconnect INSERT and cannot be changed using interconnect PATCH.
+         MACSEC
+            If specified then the interconnect is created on MACsec capable
+            hardware ports. If not specified, the interconnect is created on
+            non-MACsec capable ports first, if available. This parameter can
+            only be provided during interconnect INSERT and cannot be changed
+            using interconnect PATCH.
+
+     --requested-link-count=REQUESTED_LINK_COUNT
+        Target number of physical links in the link bundle.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute interconnects groups create-members
+
+        $ gcloud alpha compute interconnects groups create-members
+
diff --git a/gcloud/beta/compute/interconnects/groups/delete b/gcloud/beta/compute/interconnects/groups/delete
new file mode 100644
index 000000000..478c84efe
--- /dev/null
+++ b/gcloud/beta/compute/interconnects/groups/delete
@@ -0,0 +1,43 @@
+NAME
+    gcloud beta compute interconnects groups delete - delete Compute Engine
+        interconnect groups
+
+SYNOPSIS
+    gcloud beta compute interconnects groups delete NAME [NAME ...]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) gcloud beta compute interconnects groups delete is used to delete
+    interconnect groups.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To delete an interconnect group, run:
+
+        $ gcloud beta compute interconnects groups delete \
+            example-interconnect-group"
+
+    Although not shown in this example, you can delete multiple interconnect
+    groups in a single command.
+
+POSITIONAL ARGUMENTS
+     NAME [NAME ...]
+        Names of the interconnect groups to delete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute interconnects groups delete
+
+        $ gcloud alpha compute interconnects groups delete
+
diff --git a/gcloud/beta/compute/interconnects/groups/describe b/gcloud/beta/compute/interconnects/groups/describe
new file mode 100644
index 000000000..417531ea6
--- /dev/null
+++ b/gcloud/beta/compute/interconnects/groups/describe
@@ -0,0 +1,40 @@
+NAME
+    gcloud beta compute interconnects groups describe - describe a Compute
+        Engine interconnect group
+
+SYNOPSIS
+    gcloud beta compute interconnects groups describe NAME
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) gcloud beta compute interconnects groups describe is used to
+    describe an interconnect group.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To describe interconnect group example-interconnect-group, run:
+
+        $ gcloud beta compute interconnects groups describe \
+            example-interconnect-group
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect group to describe.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute interconnects groups describe
+
+        $ gcloud alpha compute interconnects groups describe
+
diff --git a/gcloud/beta/compute/interconnects/groups/get-operational-status b/gcloud/beta/compute/interconnects/groups/get-operational-status
new file mode 100644
index 000000000..86d8c1e44
--- /dev/null
+++ b/gcloud/beta/compute/interconnects/groups/get-operational-status
@@ -0,0 +1,41 @@
+NAME
+    gcloud beta compute interconnects groups get-operational-status - get the
+        operational status of a Compute Engine interconnect group
+
+SYNOPSIS
+    gcloud beta compute interconnects groups get-operational-status NAME
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) gcloud beta compute interconnects groups get-operational-status is
+    used to get the operational status of an interconnect group.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To get the operational status of interconnect group
+    example-interconnect-group, run:
+
+        $ gcloud beta compute interconnects groups get-operational-status \
+            example-interconnect-group
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect group to get operational status.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute interconnects groups get-operational-status
+
+        $ gcloud alpha compute interconnects groups get-operational-status
+
diff --git a/gcloud/beta/compute/interconnects/groups/help b/gcloud/beta/compute/interconnects/groups/help
new file mode 100644
index 000000000..d74ce969b
--- /dev/null
+++ b/gcloud/beta/compute/interconnects/groups/help
@@ -0,0 +1,56 @@
+NAME
+    gcloud beta compute interconnects groups - create or manipulate
+        interconnect groups
+
+SYNOPSIS
+    gcloud beta compute interconnects groups COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Create or manipulate interconnect groups.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     add-members
+        (BETA) Add member interconnects to a Compute Engine interconnect group.
+
+     create
+        (BETA) Create a Compute Engine interconnect group.
+
+     create-members
+        (BETA) Create new member interconnects in a Compute Engine interconnect
+        group.
+
+     delete
+        (BETA) Delete Compute Engine interconnect groups.
+
+     describe
+        (BETA) Describe a Compute Engine interconnect group.
+
+     get-operational-status
+        (BETA) Get the operational status of a Compute Engine interconnect
+        group.
+
+     list
+        (BETA) List interconnect groups.
+
+     remove-members
+        (BETA) Remove member interconnects from a Compute Engine interconnect
+        group.
+
+     update
+        (BETA) Update a Compute Engine interconnect group.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute interconnects groups
+
+        $ gcloud alpha compute interconnects groups
+
diff --git a/gcloud/beta/compute/interconnects/groups/list b/gcloud/beta/compute/interconnects/groups/list
new file mode 100644
index 000000000..064bbba1a
--- /dev/null
+++ b/gcloud/beta/compute/interconnects/groups/list
@@ -0,0 +1,67 @@
+NAME
+    gcloud beta compute interconnects groups list - list interconnect groups
+
+SYNOPSIS
+    gcloud beta compute interconnects groups list [--filter=EXPRESSION]
+        [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) gcloud beta compute interconnects groups list is used to list
+    interconnect groups.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To list interconnect groups, run:
+
+        $ gcloud beta compute interconnects groups list
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute interconnects groups list
+
+        $ gcloud alpha compute interconnects groups list
+
diff --git a/gcloud/beta/compute/interconnects/groups/remove-members b/gcloud/beta/compute/interconnects/groups/remove-members
new file mode 100644
index 000000000..2af6e2356
--- /dev/null
+++ b/gcloud/beta/compute/interconnects/groups/remove-members
@@ -0,0 +1,46 @@
+NAME
+    gcloud beta compute interconnects groups remove-members - remove member
+        interconnects from a Compute Engine interconnect group
+
+SYNOPSIS
+    gcloud beta compute interconnects groups remove-members NAME
+        --interconnects=[INTERCONNECT,...] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) gcloud beta compute interconnects groups remove-members is used to
+    remove member interconnects from an interconnect group.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To remove interconnects interconnect1 and interconnect2 from interconnect
+    group example-interconnect-group, run:
+
+        $ gcloud beta compute interconnects groups remove-members \
+            example-interconnect-group \
+            --interconnects=interconnect1,interconnect2
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect group to update.
+
+REQUIRED FLAGS
+     --interconnects=[INTERCONNECT,...]
+        Member interconnects to add to or remove from the interconnect group.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute interconnects groups remove-members
+
+        $ gcloud alpha compute interconnects groups remove-members
+
diff --git a/gcloud/beta/compute/interconnects/groups/update b/gcloud/beta/compute/interconnects/groups/update
new file mode 100644
index 000000000..9f8c4a5e3
--- /dev/null
+++ b/gcloud/beta/compute/interconnects/groups/update
@@ -0,0 +1,73 @@
+NAME
+    gcloud beta compute interconnects groups update - update a Compute Engine
+        interconnect group
+
+SYNOPSIS
+    gcloud beta compute interconnects groups update NAME
+        [--description=DESCRIPTION]
+        [--intended-topology-capability=INTENDED_TOPOLOGY_CAPABILITY]
+        [--interconnects=[INTERCONNECT,...]] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) gcloud beta compute interconnects groups update is used to update
+    interconnect groups.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To update an interconnect group example-interconnect-group's intended
+    topology capability to PRODUCTION_CRITICAL, run:
+
+        $ gcloud beta compute interconnects groups update \
+            example-interconnect-group \
+            --intended-topology-capability=PRODUCTION_CRITICAL
+
+    To update an interconnect group example-interconnect-group's description to
+    "example interconnect group description", run:
+
+        $ gcloud beta compute interconnects groups update \
+            example-interconnect-group \
+            --description="example interconnect group description"
+
+    To update an interconnect group example-interconnect-group's member
+    interconnects to interconnect-1 and interconnect-2, run:
+
+        $ gcloud beta compute interconnects groups update \
+            example-interconnect-group \
+            --interconnects=interconnect-1,interconnect-2
+
+    Although you can add or remove member interconnects using this command, it
+    is recommended to add or remove member interconnects using the add-members
+    and remove-members commands.
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect group to update.
+
+FLAGS
+     --description=DESCRIPTION
+        An optional, textual description for the interconnect group.
+
+     --intended-topology-capability=INTENDED_TOPOLOGY_CAPABILITY
+        The reliability the user intends this group to be capable of, in terms
+        of the Interconnect product SLAs.
+
+     --interconnects=[INTERCONNECT,...]
+        Member interconnects to set the interconnect group to contain.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute interconnects groups update
+
+        $ gcloud alpha compute interconnects groups update
+
diff --git a/gcloud/beta/compute/interconnects/help b/gcloud/beta/compute/interconnects/help
index d9c4fbc5b..5f2045827 100644
--- a/gcloud/beta/compute/interconnects/help
+++ b/gcloud/beta/compute/interconnects/help
@@ -29,6 +29,9 @@ GROUPS
      cross-site-networks
         (BETA) Create or manipulate cross site networks.
 
+     groups
+        (BETA) Create or manipulate interconnect groups.
+
      locations
         (BETA) Read and manipulate Compute Engine interconnect locations.
 
diff --git a/gcloud/beta/compute/org-security-policies/rules/create b/gcloud/beta/compute/org-security-policies/rules/create
index a52edc805..e18dcdabd 100644
--- a/gcloud/beta/compute/org-security-policies/rules/create
+++ b/gcloud/beta/compute/org-security-policies/rules/create
@@ -47,6 +47,8 @@ REQUIRED FLAGS
          deny-502
             Denies the request from HTTP(S) Load Balancing, with an HTTP
             response status code of 502.
+         goto-next
+            Defers enforcement to the next policy in the hierarchy.
          redirect
             Redirects the request from HTTP(S) Load Balancing, based on
             redirect options.
diff --git a/gcloud/beta/compute/org-security-policies/rules/update b/gcloud/beta/compute/org-security-policies/rules/update
index ee61c7609..c9ba36497 100644
--- a/gcloud/beta/compute/org-security-policies/rules/update
+++ b/gcloud/beta/compute/org-security-policies/rules/update
@@ -54,6 +54,8 @@ OPTIONAL FLAGS
          deny-502
             Denies the request from HTTP(S) Load Balancing, with an HTTP
             response status code of 502.
+         goto-next
+            Defers enforcement to the next policy in the hierarchy.
          redirect
             Redirects the request from HTTP(S) Load Balancing, based on
             redirect options.
diff --git a/gcloud/beta/compute/resource-policies/create-snapshot-schedule b/gcloud/beta/compute/resource-policies/create-snapshot-schedule
index 6f1f572a9..56764c74a 100644
--- a/gcloud/beta/compute/resource-policies/create-snapshot-schedule
+++ b/gcloud/beta/compute/resource-policies/create-snapshot-schedule
@@ -10,8 +10,8 @@ SYNOPSIS
           | --weekly-schedule=WEEKLY_CYCLE)) [--description=DESCRIPTION]
         [--on-source-disk-delete=ON_SOURCE_DISK_DELETE] [--region=REGION]
         [--guest-flush
-          --snapshot-labels=[KEY=VALUE,...] --storage-location=LOCATION]
-        [GCLOUD_WIDE_FLAG ...]
+          --snapshot-labels=[KEY=VALUE,...] --snapshot-region=SNAPSHOT_REGION
+          | --storage-location=LOCATION] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (BETA) (DEPRECATED) create-snapshot-schedule is deprecated. Use compute
@@ -128,10 +128,15 @@ OPTIONAL FLAGS
 
           The label is added to each snapshot created by the schedule.
 
-       --storage-location=LOCATION
-          Google Cloud Storage location, either regional or multi-regional,
-          where snapshot content is to be stored. If absent, a nearby regional
-          or multi-regional location is chosen automatically.
+       At most one of these can be specified:
+
+         --snapshot-region=SNAPSHOT_REGION
+            Region where the snapshot is scoped to.
+
+         --storage-location=LOCATION
+            Google Cloud Storage location, either regional or multi-regional,
+            where snapshot content is to be stored. If absent, a nearby
+            regional or multi-regional location is chosen automatically.
 
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
diff --git a/gcloud/beta/compute/resource-policies/create/snapshot-schedule b/gcloud/beta/compute/resource-policies/create/snapshot-schedule
index da9046b05..1cbb4b26e 100644
--- a/gcloud/beta/compute/resource-policies/create/snapshot-schedule
+++ b/gcloud/beta/compute/resource-policies/create/snapshot-schedule
@@ -10,8 +10,8 @@ SYNOPSIS
           | --weekly-schedule=WEEKLY_CYCLE)) [--description=DESCRIPTION]
         [--on-source-disk-delete=ON_SOURCE_DISK_DELETE] [--region=REGION]
         [--guest-flush
-          --snapshot-labels=[KEY=VALUE,...] --storage-location=LOCATION]
-        [GCLOUD_WIDE_FLAG ...]
+          --snapshot-labels=[KEY=VALUE,...] --snapshot-region=SNAPSHOT_REGION
+          | --storage-location=LOCATION] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (BETA) Create a Compute Engine Snapshot Schedule Resource Policy.
@@ -126,10 +126,15 @@ OPTIONAL FLAGS
 
           The label is added to each snapshot created by the schedule.
 
-       --storage-location=LOCATION
-          Google Cloud Storage location, either regional or multi-regional,
-          where snapshot content is to be stored. If absent, a nearby regional
-          or multi-regional location is chosen automatically.
+       At most one of these can be specified:
+
+         --snapshot-region=SNAPSHOT_REGION
+            Region where the snapshot is scoped to.
+
+         --storage-location=LOCATION
+            Google Cloud Storage location, either regional or multi-regional,
+            where snapshot content is to be stored. If absent, a nearby
+            regional or multi-regional location is chosen automatically.
 
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
diff --git a/gcloud/beta/compute/service-attachments/create b/gcloud/beta/compute/service-attachments/create
index 3b9de9222..727eb978e 100644
--- a/gcloud/beta/compute/service-attachments/create
+++ b/gcloud/beta/compute/service-attachments/create
@@ -13,9 +13,11 @@ SYNOPSIS
         [--consumer-reject-list=[REJECT_LIST,...]] [--description=DESCRIPTION]
         [--domain-names=[DOMAIN_NAMES,...]] [--enable-proxy-protocol]
         [--nat-subnets-region=NAT_SUBNETS_REGION]
-        [--producer-forwarding-rule-region=PRODUCER_FORWARDING_RULE_REGION]
         [--propagated-connection-limit=PROPAGATED_CONNECTION_LIMIT]
-        [--reconcile-connections] [--region=REGION] [GCLOUD_WIDE_FLAG ...]
+        [--reconcile-connections] [--region=REGION]
+        [--global-producer-forwarding-rule
+          | --producer-forwarding-rule-region=PRODUCER_FORWARDING_RULE_REGION]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (BETA) gcloud beta compute service-attachments create is used to create
@@ -114,26 +116,6 @@ OPTIONAL FLAGS
         set to the region of the service attachment. Overrides the default
         compute/region property value for this command invocation.
 
-     --producer-forwarding-rule-region=PRODUCER_FORWARDING_RULE_REGION
-        Region of the forwarding rule to operate on. If not specified, you
-        might be prompted to select a region (interactive mode only).
-
-        To avoid prompting when this flag is omitted, you can set the
-        compute/region property:
-
-            $ gcloud config set compute/region REGION
-
-        A list of regions can be fetched by running:
-
-            $ gcloud compute regions list
-
-        To unset the property, run:
-
-            $ gcloud config unset compute/region
-
-        Alternatively, the region can be stored in the environment variable
-        CLOUDSDK_COMPUTE_REGION.
-
      --propagated-connection-limit=PROPAGATED_CONNECTION_LIMIT
         The number of consumer spokes that connected Private Service Connect
         endpoints can be propagated to through Network Connectivity Center.
@@ -183,6 +165,31 @@ OPTIONAL FLAGS
         Alternatively, the region can be stored in the environment variable
         CLOUDSDK_COMPUTE_REGION.
 
+     At most one of these can be specified:
+
+       --global-producer-forwarding-rule
+          If set, the forwarding rule is global.
+
+       --producer-forwarding-rule-region=PRODUCER_FORWARDING_RULE_REGION
+          Region of the forwarding rule to operate on. If not specified, you
+          might be prompted to select a region (interactive mode only).
+
+          To avoid prompting when this flag is omitted, you can set the
+          compute/region property:
+
+              $ gcloud config set compute/region REGION
+
+          A list of regions can be fetched by running:
+
+              $ gcloud compute regions list
+
+          To unset the property, run:
+
+              $ gcloud config unset compute/region
+
+          Alternatively, the region can be stored in the environment variable
+          CLOUDSDK_COMPUTE_REGION.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/beta/container/clusters/create b/gcloud/beta/container/clusters/create
index 76fb7ff93..e89d8e69d 100644
--- a/gcloud/beta/container/clusters/create
+++ b/gcloud/beta/container/clusters/create
@@ -20,6 +20,7 @@ SYNOPSIS
         [--cluster-ipv4-cidr=CLUSTER_IPV4_CIDR]
         [--cluster-secondary-range-name=NAME]
         [--cluster-version=CLUSTER_VERSION]
+        [--confidential-node-type=CONFIDENTIAL_NODE_TYPE]
         [--containerd-config-from-file=PATH_TO_FILE]
         [--create-subnetwork=[KEY=VALUE,...]]
         [--data-cache-count=DATA_CACHE_COUNT]
@@ -351,6 +352,12 @@ FLAGS
 
             $ gcloud container get-server-config
 
+     --confidential-node-type=CONFIDENTIAL_NODE_TYPE
+        Enable confidential nodes for the cluster. Enabling Confidential Nodes
+        will create nodes using Confidential VM
+        https://cloud.google.com/compute/confidential-vm/docs/about-cvm.
+        CONFIDENTIAL_NODE_TYPE must be one of: sev, sev_snp, tdx.
+
      --containerd-config-from-file=PATH_TO_FILE
         Path of the YAML file that contains containerd configuration entries
         like configuring access to private image registries.
diff --git a/gcloud/beta/container/node-pools/create b/gcloud/beta/container/node-pools/create
index 40f24d54e..56025c2a7 100644
--- a/gcloud/beta/container/node-pools/create
+++ b/gcloud/beta/container/node-pools/create
@@ -15,6 +15,7 @@ SYNOPSIS
           pod-ipv4-range=SECONDARY_RANGE_NAME,
           [max-pods-per-node=NUM_PODS],...]] [--async]
         [--boot-disk-kms-key=BOOT_DISK_KMS_KEY] [--cluster=CLUSTER]
+        [--confidential-node-type=CONFIDENTIAL_NODE_TYPE]
         [--containerd-config-from-file=PATH_TO_FILE]
         [--data-cache-count=DATA_CACHE_COUNT]
         [--disable-pod-cidr-overprovision] [--disk-size=DISK_SIZE]
@@ -191,6 +192,12 @@ FLAGS
         The cluster to add the node pool to. Overrides the default
         container/cluster property value for this command invocation.
 
+     --confidential-node-type=CONFIDENTIAL_NODE_TYPE
+        Enable confidential nodes for the node pool. Enabling Confidential
+        Nodes will create nodes using Confidential VM
+        https://cloud.google.com/compute/confidential-vm/docs/about-cvm.
+        CONFIDENTIAL_NODE_TYPE must be one of: sev, sev_snp, tdx, disabled.
+
      --containerd-config-from-file=PATH_TO_FILE
         Path of the YAML file that contains containerd configuration entries
         like configuring access to private image registries.
diff --git a/gcloud/beta/container/node-pools/update b/gcloud/beta/container/node-pools/update
index 032920e63..75e524803 100644
--- a/gcloud/beta/container/node-pools/update
+++ b/gcloud/beta/container/node-pools/update
@@ -9,6 +9,7 @@ SYNOPSIS
           gpu-partition-size=GPU_PARTITION_SIZE,
           gpu-sharing-strategy=GPU_SHARING_STRATEGY,
           max-shared-clients-per-gpu=MAX_SHARED_CLIENTS_PER_GPU],...]
+          | --confidential-node-type=CONFIDENTIAL_NODE_TYPE
           | --containerd-config-from-file=PATH_TO_FILE
           | --enable-confidential-nodes | --enable-gvnic
           | --enable-image-streaming | --enable-insecure-kubelet-readonly-port
@@ -101,6 +102,11 @@ REQUIRED FLAGS
               on the node. This field is used together with
               gpu-sharing-strategy.
 
+       --confidential-node-type=CONFIDENTIAL_NODE_TYPE
+          Recreate all the nodes in the node pool to be confidential VM
+          https://cloud.google.com/compute/confidential-vm/docs/about-cvm.
+          CONFIDENTIAL_NODE_TYPE must be one of: sev, sev_snp, tdx, disabled.
+
        --containerd-config-from-file=PATH_TO_FILE
           Path of the YAML file that contains containerd configuration entries
           like configuring access to private image registries.
diff --git a/gcloud/beta/emulators/firestore/start b/gcloud/beta/emulators/firestore/start
index f8d2f214c..fcec2e63d 100644
--- a/gcloud/beta/emulators/firestore/start
+++ b/gcloud/beta/emulators/firestore/start
@@ -4,7 +4,8 @@ NAME
 SYNOPSIS
     gcloud beta emulators firestore start [--database-mode=DATABASE_MODE]
         [--export-on-exit=EXPORT_ON_EXIT] [--host-port=HOST_PORT]
-        [--import-data=IMPORT_DATA] [--rules=RULES] [GCLOUD_WIDE_FLAG ...]
+        [--import-data=IMPORT_DATA] [--licenses] [--rules=RULES]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (BETA) This command starts a local Firestore emulator.
@@ -64,6 +65,10 @@ FLAGS
         File path to the data to be loaded into the emulator upon start up.
         Example:/home/user/myexports/sampleExport/sampleExport.overall_export_metadata.
 
+     --licenses
+        If set, the emulator will print open-source dependencies and licenses,
+        then exit.
+
      --rules=RULES
         If set, all projects will use the security rules in this file. More
         information on Firebase Rules and the syntax for this file is available
diff --git a/gcloud/beta/filestore/regions/help b/gcloud/beta/filestore/regions/help
index e0dd9685f..032b6e142 100644
--- a/gcloud/beta/filestore/regions/help
+++ b/gcloud/beta/filestore/regions/help
@@ -16,7 +16,7 @@ COMMANDS
     COMMAND is one of the following:
 
      list
-        (BETA) List Filestore regions.
+        (BETA) List all Filestore regions.
 
 NOTES
     This command is currently in beta and might change without notice. These
diff --git a/gcloud/beta/filestore/regions/list b/gcloud/beta/filestore/regions/list
index bca33ded8..028fabd58 100644
--- a/gcloud/beta/filestore/regions/list
+++ b/gcloud/beta/filestore/regions/list
@@ -1,20 +1,19 @@
 NAME
-    gcloud beta filestore regions list - list Filestore regions
+    gcloud beta filestore regions list - list all Filestore regions
 
 SYNOPSIS
     gcloud beta filestore regions list [--filter=EXPRESSION] [--limit=LIMIT]
-        [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
+        [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (BETA) List all regions where Filestore API is available. The listed
-    regions only apply for Basic instances. High Scale is only available in a
-    more restricted set of regions. For details, please see
-    https://cloud.google.com/filestore/docs/regions.
+    (BETA) List all Filestore regions.
 
 EXAMPLES
-    To list all the regions where Filestore instances can be created, run:
+    The following command lists a maximum of five Filestore regions sorted
+    alphabetically by name in descending order:
 
-        $ gcloud beta filestore regions list
+        $ gcloud beta filestore regions list --limit=5 --sort-by=~name
 
 LIST COMMAND FLAGS
      --filter=EXPRESSION
@@ -42,6 +41,12 @@ LIST COMMAND FLAGS
         order on that field. This flag interacts with other flags that are
         applied in this order: --flatten, --sort-by, --filter, --limit.
 
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
@@ -50,10 +55,6 @@ GCLOUD WIDE FLAGS
 
     Run $ gcloud help for details.
 
-API REFERENCE
-    This command uses the file/v1 API. The full documentation for this API can
-    be found at: https://cloud.google.com/filestore/
-
 NOTES
     This command is currently in beta and might change without notice. These
     variants are also available:
diff --git a/gcloud/beta/filestore/zones/help b/gcloud/beta/filestore/zones/help
index f9ecb643e..a7d115d14 100644
--- a/gcloud/beta/filestore/zones/help
+++ b/gcloud/beta/filestore/zones/help
@@ -16,7 +16,7 @@ COMMANDS
     COMMAND is one of the following:
 
      list
-        (BETA) List Filestore zones.
+        (BETA) List all Filestore zones.
 
 NOTES
     This command is currently in beta and might change without notice. These
diff --git a/gcloud/beta/filestore/zones/list b/gcloud/beta/filestore/zones/list
index bb4c4d339..a9100bc89 100644
--- a/gcloud/beta/filestore/zones/list
+++ b/gcloud/beta/filestore/zones/list
@@ -1,20 +1,19 @@
 NAME
-    gcloud beta filestore zones list - list Filestore zones
+    gcloud beta filestore zones list - list all Filestore zones
 
 SYNOPSIS
     gcloud beta filestore zones list [--filter=EXPRESSION] [--limit=LIMIT]
-        [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
+        [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (BETA) List all zones where Filestore API is available. The listed zones
-    only apply for Basic instances. High Scale is only available in a more
-    restricted set of zones. For details, please see
-    https://cloud.google.com/filestore/docs/regions.
+    (BETA) List all Filestore zones.
 
 EXAMPLES
-    To list all the zones where Filestore instances can be created, run:
+    The following command lists a maximum of five Filestore zones sorted
+    alphabetically by name in descending order:
 
-        $ gcloud beta filestore zones list
+        $ gcloud beta filestore zones list --limit=5 --sort-by=~name
 
 LIST COMMAND FLAGS
      --filter=EXPRESSION
@@ -42,6 +41,12 @@ LIST COMMAND FLAGS
         order on that field. This flag interacts with other flags that are
         applied in this order: --flatten, --sort-by, --filter, --limit.
 
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
@@ -50,10 +55,6 @@ GCLOUD WIDE FLAGS
 
     Run $ gcloud help for details.
 
-API REFERENCE
-    This command uses the file/v1 API. The full documentation for this API can
-    be found at: https://cloud.google.com/filestore/
-
 NOTES
     This command is currently in beta and might change without notice. These
     variants are also available:
diff --git a/gcloud/beta/iam/workforce-pools/providers/create-oidc b/gcloud/beta/iam/workforce-pools/providers/create-oidc
index e9a3d7441..4e578edb8 100644
--- a/gcloud/beta/iam/workforce-pools/providers/create-oidc
+++ b/gcloud/beta/iam/workforce-pools/providers/create-oidc
@@ -288,7 +288,7 @@ OPTIONAL FLAGS
 
             *--extra-attributes-type*=_EXTRA_ATTRIBUTES_TYPE_::
 
-            Represents the identity provider and type of claims that should be fetched. _EXTRA_ATTRIBUTES_TYPE_ must be one of: *attributes-type-unspecified*, *azure-ad-groups-id*, *azure-ad-groups-mail*.
+            Represents the identity provider and type of claims that should be fetched. _EXTRA_ATTRIBUTES_TYPE_ must be one of: *attributes-type-unspecified*, *azure-ad-groups-display-name*, *azure-ad-groups-id*, *azure-ad-groups-mail*.
 
             *--extra-attributes-filter*=_EXTRA_ATTRIBUTES_FILTER_::
 
diff --git a/gcloud/beta/iam/workforce-pools/providers/update-oidc b/gcloud/beta/iam/workforce-pools/providers/update-oidc
index ef6fc36aa..e9c368702 100644
--- a/gcloud/beta/iam/workforce-pools/providers/update-oidc
+++ b/gcloud/beta/iam/workforce-pools/providers/update-oidc
@@ -288,7 +288,7 @@ FLAGS
 
             *--extra-attributes-type*=_EXTRA_ATTRIBUTES_TYPE_:::
 
-            Represents the identity provider and type of claims that should be fetched. _EXTRA_ATTRIBUTES_TYPE_ must be one of: *attributes-type-unspecified*, *azure-ad-groups-id*, *azure-ad-groups-mail*.
+            Represents the identity provider and type of claims that should be fetched. _EXTRA_ATTRIBUTES_TYPE_ must be one of: *attributes-type-unspecified*, *azure-ad-groups-display-name*, *azure-ad-groups-id*, *azure-ad-groups-mail*.
 
 GCLOUD WIDE FLAGS
         These flags are available to all commands: --access-token-file, --account, --billing-project, --configuration, --flags-file, --flatten, --format, --help, --impersonate-service-account, --log-http, --project, --quiet, --trace-token, --user-output-enabled, --verbosity.
diff --git a/gcloud/beta/pubsub/help b/gcloud/beta/pubsub/help
index 4691c55e3..b8d44727c 100644
--- a/gcloud/beta/pubsub/help
+++ b/gcloud/beta/pubsub/help
@@ -28,6 +28,9 @@ GROUPS
      lite-topics
         (BETA) Manage Pub/Sub Lite topics.
 
+     message-transforms
+        (BETA) Manage Cloud Pub/Sub message transforms.
+
      schemas
         (BETA) Manage Pub/Sub schemas.
 
diff --git a/gcloud/beta/pubsub/message-transforms/help b/gcloud/beta/pubsub/message-transforms/help
new file mode 100644
index 000000000..cbe3be8c7
--- /dev/null
+++ b/gcloud/beta/pubsub/message-transforms/help
@@ -0,0 +1,32 @@
+NAME
+    gcloud beta pubsub message-transforms - manage Cloud Pub/Sub message
+        transforms
+
+SYNOPSIS
+    gcloud beta pubsub message-transforms COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Manage Cloud Pub/Sub message transforms.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     test
+        (BETA) Tests message transforms against a given message.
+
+     validate
+        (BETA) Validates a message transform.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud pubsub message-transforms
+
+        $ gcloud alpha pubsub message-transforms
+
diff --git a/gcloud/beta/pubsub/message-transforms/test b/gcloud/beta/pubsub/message-transforms/test
new file mode 100644
index 000000000..cac497c55
--- /dev/null
+++ b/gcloud/beta/pubsub/message-transforms/test
@@ -0,0 +1,90 @@
+NAME
+    gcloud beta pubsub message-transforms test - tests message transforms
+        against a given message
+
+SYNOPSIS
+    gcloud beta pubsub message-transforms test
+        (--attribute=[ATTRIBUTE,...] --message=MESSAGE)
+        (--message-transforms-file=MESSAGE_TRANSFORMS_FILE
+          | --subscription=SUBSCRIPTION
+          | [--topic=TOPIC : --topic-project=TOPIC_PROJECT])
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Tests message transforms against a given message.
+
+REQUIRED FLAGS
+     Message to test the message transforms against.
+
+     At least one of these must be specified:
+
+       --attribute=[ATTRIBUTE,...]
+          Comma-separated list of attributes to attach to the message. Each
+          ATTRIBUTE has the form name="value". You can specify up to 100
+          attributes.
+
+       --message=MESSAGE
+          Message body to test the message transforms against.
+
+     Exactly one of these must be specified:
+
+       --message-transforms-file=MESSAGE_TRANSFORMS_FILE
+          Path to YAML or JSON file containing message transforms.
+
+       Subscription resource - Name of the subscription from which the message
+       transforms are taken to be applied to the message. This represents a
+       Cloud resource. (NOTE) Some attributes are not given arguments in this
+       group but can be set in other ways.
+
+       To set the project attribute:
+        ▸ provide the argument --subscription on the command line with a
+          fully specified name;
+        ▸ provide the argument --project on the command line;
+        ▸ set the property core/project.
+
+         --subscription=SUBSCRIPTION
+            ID of the subscription or fully qualified identifier for the
+            subscription.
+
+            To set the subscription attribute:
+            ▫ provide the argument --subscription on the command line.
+
+       Topic resource - Name of the topic from which the message transforms are
+       taken to be applied to the message. The arguments in this group can be
+       used to specify the attributes of this resource.
+
+         --topic=TOPIC
+            ID of the topic or fully qualified identifier for the topic.
+
+            To set the topic attribute:
+            ▫ provide the argument --topic on the command line.
+
+            This flag argument must be specified if any of the other arguments
+            in this group are specified.
+
+         --topic-project=TOPIC_PROJECT
+            Project ID of the Google Cloud project for the topic.
+
+            To set the project attribute:
+            ▫ provide the argument --topic on the command line with a fully
+              specified name;
+            ▫ provide the argument --topic-project on the command line;
+            ▫ provide the argument --project on the command line;
+            ▫ set the property core/project.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud pubsub message-transforms test
+
+        $ gcloud alpha pubsub message-transforms test
+
diff --git a/gcloud/beta/pubsub/message-transforms/validate b/gcloud/beta/pubsub/message-transforms/validate
new file mode 100644
index 000000000..61fdde210
--- /dev/null
+++ b/gcloud/beta/pubsub/message-transforms/validate
@@ -0,0 +1,31 @@
+NAME
+    gcloud beta pubsub message-transforms validate - validates a message
+        transform
+
+SYNOPSIS
+    gcloud beta pubsub message-transforms validate
+        --message-transform-file=MESSAGE_TRANSFORM_FILE [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Validates a message transform.
+
+REQUIRED FLAGS
+     --message-transform-file=MESSAGE_TRANSFORM_FILE
+        Path to YAML or JSON file containing a message transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud pubsub message-transforms validate
+
+        $ gcloud alpha pubsub message-transforms validate
+
diff --git a/gcloud/beta/pubsub/subscriptions/create b/gcloud/beta/pubsub/subscriptions/create
index dd56cfe83..7f06e08e9 100644
--- a/gcloud/beta/pubsub/subscriptions/create
+++ b/gcloud/beta/pubsub/subscriptions/create
@@ -9,6 +9,7 @@ SYNOPSIS
         [--enable-message-ordering] [--expiration-period=EXPIRATION_PERIOD]
         [--labels=[KEY=VALUE,...]] [--message-filter=MESSAGE_FILTER]
         [--message-retention-duration=MESSAGE_RETENTION_DURATION]
+        [--message-transforms-file=MESSAGE_TRANSFORMS_FILE]
         [--retain-acked-messages]
         [[--bigquery-table=BIGQUERY_TABLE
           : --bigquery-service-account-email=BIGQUERY_SERVICE_ACCOUNT_EMAIL
@@ -128,6 +129,9 @@ OPTIONAL FLAGS
         seconds, minutes, hours, and days, respectively. If the unit is
         omitted, seconds is assumed.
 
+     --message-transforms-file=MESSAGE_TRANSFORMS_FILE
+        Path to YAML or JSON file containing message transforms.
+
      --retain-acked-messages
         Whether or not to retain acknowledged messages. If true, messages are
         not expunged from the subscription's backlog until they fall out of the
diff --git a/gcloud/beta/pubsub/subscriptions/update b/gcloud/beta/pubsub/subscriptions/update
index bbbc6d067..8908093fb 100644
--- a/gcloud/beta/pubsub/subscriptions/update
+++ b/gcloud/beta/pubsub/subscriptions/update
@@ -19,6 +19,8 @@ SYNOPSIS
           [--dead-letter-topic=DEAD_LETTER_TOPIC
           : --dead-letter-topic-project=DEAD_LETTER_TOPIC_PROJECT]]
         [--clear-labels | --remove-labels=[KEY,...]]
+        [--clear-message-transforms
+          | --message-transforms-file=MESSAGE_TRANSFORMS_FILE]
         [--clear-retry-policy | --max-retry-delay=MAX_RETRY_DELAY
           --min-retry-delay=MIN_RETRY_DELAY]
         [--push-auth-service-account=SERVICE_ACCOUNT_EMAIL
@@ -307,6 +309,15 @@ FLAGS
           silently ignored. If --update-labels is also specified then
           --update-labels is applied first.
 
+     At most one of these can be specified:
+
+       --clear-message-transforms
+          If set, clears the message transforms field. Use
+          --no-clear-message-transforms to disable this flag.
+
+       --message-transforms-file=MESSAGE_TRANSFORMS_FILE
+          Path to YAML or JSON file containing message transforms.
+
      At most one of these can be specified:
 
        --clear-retry-policy
diff --git a/gcloud/beta/pubsub/topics/create b/gcloud/beta/pubsub/topics/create
index 3402ad949..4d88185b9 100644
--- a/gcloud/beta/pubsub/topics/create
+++ b/gcloud/beta/pubsub/topics/create
@@ -5,6 +5,7 @@ SYNOPSIS
     gcloud beta pubsub topics create TOPIC [TOPIC ...]
         [--labels=[KEY=VALUE,...]]
         [--message-retention-duration=MESSAGE_RETENTION_DURATION]
+        [--message-transforms-file=MESSAGE_TRANSFORMS_FILE]
         [--ingestion-log-severity=INGESTION_LOG_SEVERITY
           --aws-msk-ingestion-aws-role-arn=AWS_MSK_INGESTION_AWS_ROLE_ARN
           --aws-msk-ingestion-cluster-arn=AWS_MSK_INGESTION_CLUSTER_ARN
@@ -71,6 +72,9 @@ FLAGS
         is one of "s", "m", "h", and "d" for seconds, minutes, hours, and days,
         respectively. If the unit is omitted, seconds is assumed.
 
+     --message-transforms-file=MESSAGE_TRANSFORMS_FILE
+        Path to YAML or JSON file containing message transforms.
+
      Following flags are for specifying the data source settings for an import
      topic
 
diff --git a/gcloud/beta/pubsub/topics/update b/gcloud/beta/pubsub/topics/update
index 7d9d33ea0..e6e94e89d 100644
--- a/gcloud/beta/pubsub/topics/update
+++ b/gcloud/beta/pubsub/topics/update
@@ -13,6 +13,8 @@ SYNOPSIS
         [--clear-labels | --remove-labels=[KEY,...]]
         [--clear-message-retention-duration
           | --message-retention-duration=MESSAGE_RETENTION_DURATION]
+        [--clear-message-transforms
+          | --message-transforms-file=MESSAGE_TRANSFORMS_FILE]
         [--clear-schema-settings
           | [--message-encoding=ENCODING (--schema=SCHEMA
           : --schema-project=SCHEMA_PROJECT)
@@ -356,6 +358,15 @@ FLAGS
           seconds, minutes, hours, and days, respectively. If the unit is
           omitted, seconds is assumed.
 
+     At most one of these can be specified:
+
+       --clear-message-transforms
+          If set, clears the message transforms field. Use
+          --no-clear-message-transforms to disable this flag.
+
+       --message-transforms-file=MESSAGE_TRANSFORMS_FILE
+          Path to YAML or JSON file containing message transforms.
+
      At most one of these can be specified:
 
        --clear-schema-settings
diff --git a/gcloud/beta/run/deploy b/gcloud/beta/run/deploy
index d7b3a38fe..e1b593452 100644
--- a/gcloud/beta/run/deploy
+++ b/gcloud/beta/run/deploy
@@ -12,7 +12,7 @@ SYNOPSIS
         [--[no-]gpu-zonal-redundancy] [--[no-]iap]
         [--ingress=INGRESS; default="all"] [--[no-]invoker-iam-check]
         [--max-instances=MAX_INSTANCES] [--mesh=MESH] [--min=MIN]
-        [--min-instances=MIN_INSTANCES] [--region=REGION]
+        [--min-instances=MIN_INSTANCES] [--region=REGION] [--regions=REGIONS]
         [--remove-containers=[CONTAINER,...]]
         [--revision-suffix=REVISION_SUFFIX] [--scaling=SCALING]
         [--service-account=SERVICE_ACCOUNT] [--[no-]session-affinity]
@@ -247,6 +247,10 @@ FLAGS
         Region in which the resource can be found. Alternatively, set the
         property [run/region].
 
+     --regions=REGIONS
+        Comma-separated list of regions in which the multi-region Service can
+        be found.
+
      --remove-containers=[CONTAINER,...]
         List of containers to remove.
 
diff --git a/gcloud/beta/run/multi-region-services/replace b/gcloud/beta/run/multi-region-services/replace
index 768b92e06..444a3688a 100644
--- a/gcloud/beta/run/multi-region-services/replace
+++ b/gcloud/beta/run/multi-region-services/replace
@@ -4,7 +4,7 @@ NAME
 
 SYNOPSIS
     gcloud beta run multi-region-services replace FILE [--async] [--dry-run]
-        [--region=REGION] [GCLOUD_WIDE_FLAG ...]
+        [--region=REGION] [--regions=REGIONS] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (BETA) Creates or replaces a service from a YAML service specification.
@@ -32,6 +32,10 @@ FLAGS
         Region in which the resource can be found. Alternatively, set the
         property [run/region].
 
+     --regions=REGIONS
+        Comma-separated list of regions in which the multi-region Service can
+        be found.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/beta/run/revisions/describe b/gcloud/beta/run/revisions/describe
index 566f55df3..31c0fcc35 100644
--- a/gcloud/beta/run/revisions/describe
+++ b/gcloud/beta/run/revisions/describe
@@ -9,9 +9,10 @@ DESCRIPTION
     (BETA) Obtain details about revisions.
 
 EXAMPLES
-    To describe all revisions of service default in us-central1:
+    To describe a revision my-service-00001-abc`in us-central1:
 
-        $ gcloud beta run revisions describe --region=us-central1 default
+        $ gcloud beta run revisions describe --region=us-central1 \
+          my-service-00001-abc
 
 POSITIONAL ARGUMENTS
      Revision resource - Revision to describe. The arguments in this group can
diff --git a/gcloud/beta/scc/notifications/list b/gcloud/beta/scc/notifications/list
index 634f49673..4244ff803 100644
--- a/gcloud/beta/scc/notifications/list
+++ b/gcloud/beta/scc/notifications/list
@@ -4,9 +4,10 @@ NAME
 
 SYNOPSIS
     gcloud beta scc notifications list [PARENT]
-        [--location=LOCATION; default="global"] [--filter=EXPRESSION]
-        [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]]
-        [GCLOUD_WIDE_FLAG ...]
+        [--location=LOCATION; default="global"]
+        [--folder=FOLDER | --organization=ORGANIZATION | --project=PROJECT]
+        [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
+        [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (BETA) List Security Command Center notification configs.
@@ -62,6 +63,20 @@ FLAGS
         notificationConfig resources that were created by using the Security
         Command Center API v2 and the only valid location is global.
 
+     At most one of these can be specified:
+
+       --folder=FOLDER
+          Folder where the notification config resides. Formatted as
+          folders/456 or just 456.
+
+       --organization=ORGANIZATION
+          Organization where the notification config resides. Formatted as
+          organizations/123 or just 123.
+
+       --project=PROJECT
+          Project (ID or number) where the notification config resides.
+          Formatted as projects/789 or just 789.
+
 LIST COMMAND FLAGS
      --filter=EXPRESSION
         Apply a Boolean filter EXPRESSION to each resource item to be listed.
diff --git a/gcloud/compute/disks/create b/gcloud/compute/disks/create
index e2247794b..9f358f92a 100644
--- a/gcloud/compute/disks/create
+++ b/gcloud/compute/disks/create
@@ -93,10 +93,10 @@ FLAGS
         Enables one or more features for VM instances that use the image for
         their boot disks. See the descriptions of supported features at:
         https://cloud.google.com/compute/docs/images/create-delete-deprecate-private-images#guest-os-features.
-        GUEST_OS_FEATURE must be one of: GVNIC, IDPF, MULTI_IP_SUBNET,
-        SEV_CAPABLE, SEV_LIVE_MIGRATABLE, SEV_LIVE_MIGRATABLE_V2,
-        SEV_SNP_CAPABLE, TDX_CAPABLE, UEFI_COMPATIBLE, VIRTIO_SCSI_MULTIQUEUE,
-        WINDOWS.
+        GUEST_OS_FEATURE must be one of: BARE_METAL_LINUX_COMPATIBLE, GVNIC,
+        IDPF, MULTI_IP_SUBNET, SEV_CAPABLE, SEV_LIVE_MIGRATABLE,
+        SEV_LIVE_MIGRATABLE_V2, SEV_SNP_CAPABLE, SNP_SVSM_CAPABLE, TDX_CAPABLE,
+        UEFI_COMPATIBLE, VIRTIO_SCSI_MULTIQUEUE, WINDOWS.
 
      --labels=[KEY=VALUE,...]
         List of label KEY=VALUE pairs to add.
diff --git a/gcloud/compute/images/create b/gcloud/compute/images/create
index 60f5cb410..359b83b69 100644
--- a/gcloud/compute/images/create
+++ b/gcloud/compute/images/create
@@ -143,10 +143,10 @@ OPTIONAL FLAGS
         Enables one or more features for VM instances that use the image for
         their boot disks. See the descriptions of supported features at:
         https://cloud.google.com/compute/docs/images/create-delete-deprecate-private-images#guest-os-features.
-        GUEST_OS_FEATURE must be one of: GVNIC, IDPF, MULTI_IP_SUBNET,
-        SEV_CAPABLE, SEV_LIVE_MIGRATABLE, SEV_LIVE_MIGRATABLE_V2,
-        SEV_SNP_CAPABLE, TDX_CAPABLE, UEFI_COMPATIBLE, VIRTIO_SCSI_MULTIQUEUE,
-        WINDOWS.
+        GUEST_OS_FEATURE must be one of: BARE_METAL_LINUX_COMPATIBLE, GVNIC,
+        IDPF, MULTI_IP_SUBNET, SEV_CAPABLE, SEV_LIVE_MIGRATABLE,
+        SEV_LIVE_MIGRATABLE_V2, SEV_SNP_CAPABLE, SNP_SVSM_CAPABLE, TDX_CAPABLE,
+        UEFI_COMPATIBLE, VIRTIO_SCSI_MULTIQUEUE, WINDOWS.
 
      --key-exchange-key-file=[KEK_VALUE,...]
         Comma-separated list of file paths that point to X.509 certificates in
diff --git a/gcloud/compute/interconnects/attachments/groups/add-members b/gcloud/compute/interconnects/attachments/groups/add-members
new file mode 100644
index 000000000..9b4f09a32
--- /dev/null
+++ b/gcloud/compute/interconnects/attachments/groups/add-members
@@ -0,0 +1,47 @@
+NAME
+    gcloud compute interconnects attachments groups add-members - add member
+        interconnect attachments to a Compute Engine interconnect attachment
+        group
+
+SYNOPSIS
+    gcloud compute interconnects attachments groups add-members NAME
+        --attachments=[INTERCONNECT_ATTACHMENT,...] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud compute interconnects attachments groups add-members is used to add
+    member interconnect attachments to an interconnect attachment group.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To add attachment-1 and attachment-2 to interconnect attachment group
+    example-attachment-group, run:
+
+        $ gcloud compute interconnects attachments groups add-members \
+            example-attachment-group \
+            --attachments=region-1/attachment-1,region-2/attachment-2
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect attachment group to update.
+
+REQUIRED FLAGS
+     --attachments=[INTERCONNECT_ATTACHMENT,...]
+        Member interconnect attachments to add to or remove from the
+        interconnect attachment group.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute interconnects attachments groups add-members
+
+        $ gcloud beta compute interconnects attachments groups add-members
+
diff --git a/gcloud/compute/interconnects/attachments/groups/create b/gcloud/compute/interconnects/attachments/groups/create
new file mode 100644
index 000000000..b25d9167f
--- /dev/null
+++ b/gcloud/compute/interconnects/attachments/groups/create
@@ -0,0 +1,68 @@
+NAME
+    gcloud compute interconnects attachments groups create - create a Compute
+        Engine interconnect attachment group
+
+SYNOPSIS
+    gcloud compute interconnects attachments groups create NAME
+        --intended-availability-sla=INTENDED_AVAILABILITY_SLA
+        [--attachments=[INTERCONNECT_ATTACHMENT,...]]
+        [--description=DESCRIPTION] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud compute interconnects attachments groups create is used to create
+    interconnect attachment groups. An interconnect attachment group connects a
+    set of redundant interconnect attachments between Google and the customer.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To create an interconnect attachment group capable of PRODUCTION_CRITICAL,
+    run:
+
+        $ gcloud compute interconnects attachments groups create \
+            example-attachment-group \
+            --intended-availability-sla=PRODUCTION_CRITICAL \
+            --description="Example interconnect attachment group"
+
+    It is easy to add members to an existing interconnect attachment group
+    after creation using the add-members command.
+
+    To create an interconnect attachment group capable of
+    PRODUCTION_NON_CRITICAL, with two members at creation time, run:
+
+        $ gcloud compute interconnects attachments groups create \
+            example-attachment-group \
+            --intended-availability-sla=PRODUCTION_NON_CRITICAL \
+            --attachments=region-1/attachment-1,region-2/attachment-2
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect attachment group to create.
+
+REQUIRED FLAGS
+     --intended-availability-sla=INTENDED_AVAILABILITY_SLA
+        The availability SLA that the user intends this group to support.
+
+OPTIONAL FLAGS
+     --attachments=[INTERCONNECT_ATTACHMENT,...]
+        Member interconnect attachments to add to the interconnect attachment
+        group initially.
+
+     --description=DESCRIPTION
+        An optional, textual description for the interconnect attachment group.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute interconnects attachments groups create
+
+        $ gcloud beta compute interconnects attachments groups create
+
diff --git a/gcloud/compute/interconnects/attachments/groups/delete b/gcloud/compute/interconnects/attachments/groups/delete
new file mode 100644
index 000000000..3ab19a58f
--- /dev/null
+++ b/gcloud/compute/interconnects/attachments/groups/delete
@@ -0,0 +1,42 @@
+NAME
+    gcloud compute interconnects attachments groups delete - delete Compute
+        Engine interconnect attachment groups
+
+SYNOPSIS
+    gcloud compute interconnects attachments groups delete NAME [NAME ...]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud compute interconnects attachments groups delete is used to delete
+    interconnect attachment groups.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To delete an interconnect attachment group, run:
+
+        $ gcloud compute interconnects attachments groups delete \
+            example-attachment-group"
+
+    Although not shown in this example, you can delete multiple interconnect
+    attachment groups in a single command.
+
+POSITIONAL ARGUMENTS
+     NAME [NAME ...]
+        Names of the interconnect attachment groups to delete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute interconnects attachments groups delete
+
+        $ gcloud beta compute interconnects attachments groups delete
+
diff --git a/gcloud/compute/interconnects/attachments/groups/describe b/gcloud/compute/interconnects/attachments/groups/describe
new file mode 100644
index 000000000..4fd3197c2
--- /dev/null
+++ b/gcloud/compute/interconnects/attachments/groups/describe
@@ -0,0 +1,39 @@
+NAME
+    gcloud compute interconnects attachments groups describe - describe a
+        Compute Engine interconnect attachment group
+
+SYNOPSIS
+    gcloud compute interconnects attachments groups describe NAME
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud compute interconnects attachments groups describe is used to
+    describe interconnect attachment groups.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To describe an interconnect attachment group, run:
+
+        $ gcloud compute interconnects attachments groups describe \
+            example-attachment-group
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect attachment group to describe.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute interconnects attachments groups describe
+
+        $ gcloud beta compute interconnects attachments groups describe
+
diff --git a/gcloud/compute/interconnects/attachments/groups/get-operational-status b/gcloud/compute/interconnects/attachments/groups/get-operational-status
new file mode 100644
index 000000000..719dcd46f
--- /dev/null
+++ b/gcloud/compute/interconnects/attachments/groups/get-operational-status
@@ -0,0 +1,43 @@
+NAME
+    gcloud compute interconnects attachments groups get-operational-status -
+        get the operational status of a Compute Engine interconnect attachment
+        group
+
+SYNOPSIS
+    gcloud compute interconnects attachments groups get-operational-status NAME
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud compute interconnects attachments groups get-operational-status is
+    used to get the operational status of interconnect attachment groups.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To get the operational status of interconnect attachment group
+    example-attachment-group, run:
+
+        $ gcloud compute interconnects attachments groups \
+            get-operational-status example-attachment-group
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect attachment group to get operational status.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute interconnects attachments groups \
+            get-operational-status
+
+        $ gcloud beta compute interconnects attachments groups \
+            get-operational-status
+
diff --git a/gcloud/compute/interconnects/attachments/groups/help b/gcloud/compute/interconnects/attachments/groups/help
new file mode 100644
index 000000000..e4a95d7ea
--- /dev/null
+++ b/gcloud/compute/interconnects/attachments/groups/help
@@ -0,0 +1,53 @@
+NAME
+    gcloud compute interconnects attachments groups - create or manipulate
+        interconnect attachment groups
+
+SYNOPSIS
+    gcloud compute interconnects attachments groups COMMAND
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Create or manipulate interconnect attachment groups.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     add-members
+        Add member interconnect attachments to a Compute Engine interconnect
+        attachment group.
+
+     create
+        Create a Compute Engine interconnect attachment group.
+
+     delete
+        Delete Compute Engine interconnect attachment groups.
+
+     describe
+        Describe a Compute Engine interconnect attachment group.
+
+     get-operational-status
+        Get the operational status of a Compute Engine interconnect attachment
+        group.
+
+     list
+        List interconnect attachment groups.
+
+     remove-members
+        Remove member interconnect attachments from a Compute Engine
+        interconnect attachment group.
+
+     update
+        Update a Compute Engine interconnect attachment group.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute interconnects attachments groups
+
+        $ gcloud beta compute interconnects attachments groups
+
diff --git a/gcloud/compute/interconnects/attachments/groups/list b/gcloud/compute/interconnects/attachments/groups/list
new file mode 100644
index 000000000..8e3f45eee
--- /dev/null
+++ b/gcloud/compute/interconnects/attachments/groups/list
@@ -0,0 +1,67 @@
+NAME
+    gcloud compute interconnects attachments groups list - list interconnect
+        attachment groups
+
+SYNOPSIS
+    gcloud compute interconnects attachments groups list [--filter=EXPRESSION]
+        [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud compute interconnects attachments groups list is used to list
+    interconnect attachment groups.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To list interconnect attachment groups, run:
+
+        $ gcloud compute interconnects attachments groups list
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute interconnects attachments groups list
+
+        $ gcloud beta compute interconnects attachments groups list
+
diff --git a/gcloud/compute/interconnects/attachments/groups/remove-members b/gcloud/compute/interconnects/attachments/groups/remove-members
new file mode 100644
index 000000000..1cdd45eb6
--- /dev/null
+++ b/gcloud/compute/interconnects/attachments/groups/remove-members
@@ -0,0 +1,49 @@
+NAME
+    gcloud compute interconnects attachments groups remove-members - remove
+        member interconnect attachments from a Compute Engine interconnect
+        attachment group
+
+SYNOPSIS
+    gcloud compute interconnects attachments groups remove-members NAME
+        --attachments=[INTERCONNECT_ATTACHMENT,...] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud compute interconnects attachments groups remove-members is used to
+    remove member interconnect attachments from an interconnect attachment
+    group.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To remove attachment-1 and attachment-2 from interconnect attachment group
+    example-attachment-group, run:
+
+        $ gcloud compute interconnects attachments groups remove-members \
+            example-attachment-group \
+            --attachments=region-1/attachment-1,region-2/attachment-2
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect attachment group to update.
+
+REQUIRED FLAGS
+     --attachments=[INTERCONNECT_ATTACHMENT,...]
+        Member interconnect attachments to add to or remove from the
+        interconnect attachment group.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute interconnects attachments groups \
+            remove-members
+
+        $ gcloud beta compute interconnects attachments groups remove-members
+
diff --git a/gcloud/compute/interconnects/attachments/groups/update b/gcloud/compute/interconnects/attachments/groups/update
new file mode 100644
index 000000000..4dfca801d
--- /dev/null
+++ b/gcloud/compute/interconnects/attachments/groups/update
@@ -0,0 +1,73 @@
+NAME
+    gcloud compute interconnects attachments groups update - update a Compute
+        Engine interconnect attachment group
+
+SYNOPSIS
+    gcloud compute interconnects attachments groups update NAME
+        [--attachments=[INTERCONNECT_ATTACHMENT,...]]
+        [--description=DESCRIPTION]
+        [--intended-availability-sla=INTENDED_AVAILABILITY_SLA]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud compute interconnects attachments groups update is used to update
+    interconnect attachment groups.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To update an interconnect attachment group example-attachment-group's
+    intended availability SLA to PRODUCTION_CRITICAL, run:
+
+        $ gcloud compute interconnects attachments groups update \
+            example-attachment-group \
+            --intended-availability-sla=PRODUCTION_CRITICAL
+
+    To update an interconnect attachment group example-attachment-group's
+    description to "example attachment group description", run:
+
+        $ gcloud compute interconnects attachments groups update \
+            example-attachment-group \
+            --description="example attachment group description"
+
+    To update an interconnect attachment group example-attachment-group's
+    member attachments to attachment-1 and attachment-2, run:
+
+        $ gcloud compute interconnects attachments groups update \
+            example-attachment-group \
+            --attachments=region-1/attachment-1,region-2/attachment-2
+
+    Although you can add or remove member attachments using this command, it is
+    recommended to add or remove member attachments using the add-members and
+    remove-members commands.
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect attachment group to update.
+
+FLAGS
+     --attachments=[INTERCONNECT_ATTACHMENT,...]
+        Member interconnect attachments to add to the interconnect attachment
+        group initially.
+
+     --description=DESCRIPTION
+        An optional, textual description for the interconnect attachment group.
+
+     --intended-availability-sla=INTENDED_AVAILABILITY_SLA
+        The availability SLA that the user intends this group to support.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute interconnects attachments groups update
+
+        $ gcloud beta compute interconnects attachments groups update
+
diff --git a/gcloud/compute/interconnects/attachments/help b/gcloud/compute/interconnects/attachments/help
index e64b6bd7a..57bf023d1 100644
--- a/gcloud/compute/interconnects/attachments/help
+++ b/gcloud/compute/interconnects/attachments/help
@@ -20,6 +20,9 @@ GROUPS
      dedicated
         Create or manipulate dedicated interconnect attachments.
 
+     groups
+        Create or manipulate interconnect attachment groups.
+
      partner
         Create or manipulate partner interconnect attachments.
 
diff --git a/gcloud/compute/interconnects/groups/add-members b/gcloud/compute/interconnects/groups/add-members
new file mode 100644
index 000000000..006497728
--- /dev/null
+++ b/gcloud/compute/interconnects/groups/add-members
@@ -0,0 +1,45 @@
+NAME
+    gcloud compute interconnects groups add-members - add member interconnects
+        to a Compute Engine interconnect group
+
+SYNOPSIS
+    gcloud compute interconnects groups add-members NAME
+        --interconnects=[INTERCONNECT,...] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud compute interconnects groups add-members is used to add member
+    interconnects to an interconnect group.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To add interconnects interconnect1 and interconnect2 to interconnect group
+    example-interconnect-group, run:
+
+        $ gcloud compute interconnects groups add-members \
+            example-interconnect-group \
+            --interconnects=interconnect1,interconnect2
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect group to update.
+
+REQUIRED FLAGS
+     --interconnects=[INTERCONNECT,...]
+        Member interconnects to add to or remove from the interconnect group.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute interconnects groups add-members
+
+        $ gcloud beta compute interconnects groups add-members
+
diff --git a/gcloud/compute/interconnects/groups/create b/gcloud/compute/interconnects/groups/create
new file mode 100644
index 000000000..698c5c8e3
--- /dev/null
+++ b/gcloud/compute/interconnects/groups/create
@@ -0,0 +1,67 @@
+NAME
+    gcloud compute interconnects groups create - create a Compute Engine
+        interconnect group
+
+SYNOPSIS
+    gcloud compute interconnects groups create NAME
+        --intended-topology-capability=INTENDED_TOPOLOGY_CAPABILITY
+        [--description=DESCRIPTION] [--interconnects=[INTERCONNECT,...]]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud compute interconnects groups create is used to create interconnect
+    groups. An interconnect group connects a set of redundant interconnects
+    between Google and the customer.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To create an interconnect group capable of PRODUCTION_CRITICAL, run:
+
+        $ gcloud compute interconnects groups create \
+            example-interconnect-group \
+            --intended-topology-capability=PRODUCTION_CRITICAL \
+            --description="Example interconnect group"
+
+    It is easy to add members to an existing interconnect group after creation
+    using the add-members command.
+
+    To create an interconnect group capable of PRODUCTION_NON_CRITICAL, with
+    two members at creation time, run:
+
+        $ gcloud compute interconnects groups create \
+            example-interconnect-group \
+            --intended-topology-capability=PRODUCTION_NON_CRITICAL \
+            --interconnects=interconnect-1,interconnect-2
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect group to create.
+
+REQUIRED FLAGS
+     --intended-topology-capability=INTENDED_TOPOLOGY_CAPABILITY
+        The reliability the user intends this group to be capable of, in terms
+        of the Interconnect product SLAs.
+
+OPTIONAL FLAGS
+     --description=DESCRIPTION
+        An optional, textual description for the interconnect group.
+
+     --interconnects=[INTERCONNECT,...]
+        Member interconnects to add to the interconnect group initially.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute interconnects groups create
+
+        $ gcloud beta compute interconnects groups create
+
diff --git a/gcloud/compute/interconnects/groups/create-members b/gcloud/compute/interconnects/groups/create-members
new file mode 100644
index 000000000..016017d26
--- /dev/null
+++ b/gcloud/compute/interconnects/groups/create-members
@@ -0,0 +1,137 @@
+NAME
+    gcloud compute interconnects groups create-members - create new member
+        interconnects in a Compute Engine interconnect group
+
+SYNOPSIS
+    gcloud compute interconnects groups create-members NAME
+        --interconnect=[INTERCONNECT,...] [--admin-enabled]
+        [--customer-name=CUSTOMER_NAME] [--description=DESCRIPTION]
+        [--facility=FACILITY]
+        [--intent-mismatch-behavior=INTENT_MISMATCH_BEHAVIOR]
+        [--interconnect-type=INTERCONNECT_TYPE] [--link-type=LINK_TYPE]
+        [--noc-contact-email=NOC_CONTACT_EMAIL]
+        [--requested-features=[FEATURES,...]]
+        [--requested-link-count=REQUESTED_LINK_COUNT] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud compute interconnects groups create-members is used to create new
+    member interconnects in an interconnect group.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To create interconnects interconnect1 and interconnect2 in interconnect
+    group example-interconnect-group, run:
+
+        $ gcloud compute interconnects groups create-members \
+            example-interconnect-group --interconnect-type=DEDICATED \
+            --link-type=LINK_TYPE_ETHERNET_10G_LR --requested-link-count=1 \
+            --facility=iad-1 --interconnect="name=interconnect1" \
+            --interconnect="name=interconnect2"
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect group to create members.
+
+REQUIRED FLAGS
+     --interconnect=[INTERCONNECT,...]
+        New member interconnects to create in the interconnect group. To create
+        multiple interconnects, this flag should be specified multiple times.
+
+        Each interconnect takes in the same set of flags as the gcloud compute
+        interconnects create command, except instead of a location, a facility
+        must be specified. These flags are defined as a comma separated list of
+        flag=value pairs.
+
+        Example: --interconnect
+        name=interconnect1,facility=iad-1,description="my
+        interconnect",link-type=LINK_TYPE_ETHERNET_10G_LR,requested-link-count=1,
+        interconnect-type=DEDICATED,admin-enabled,
+        noc-contact-email=noc@google.com,customer-name=customer-name
+        requested-features=MACSEC:CROSS_SITE_NETWORK
+
+        Note that for multiple requested-features, use a colon (:) as the
+        delimiter, as the comma is used to separate the flags. Similarly, if
+        you need to use a comma in another flag value, you should set an
+        alternative delimiter for the --interconnect flag. Run gcloud topic
+        escaping for more information.
+
+OPTIONAL FLAGS
+     --admin-enabled
+        Administrative status of the interconnect. If not provided on creation,
+        defaults to enabled. When this is enabled, the interconnect is
+        operational and will carry traffic across any functioning linked
+        interconnect attachments. Use --no-admin-enabled to disable it.
+
+     --customer-name=CUSTOMER_NAME
+        Customer name to put in the Letter of Authorization as the party
+        authorized to request an interconnect. This field is required for most
+        interconnects, however it is prohibited when creating a Cross-Cloud
+        Interconnect.
+
+     --description=DESCRIPTION
+        An optional, textual description for the interconnect.
+
+     --facility=FACILITY
+        The facility (zone free location) to create the interconnect in.
+
+     --intent-mismatch-behavior=INTENT_MISMATCH_BEHAVIOR
+        The behavior when the intent of the interconnect group does not match
+        the topology capability of the member interconnects.
+        INTENT_MISMATCH_BEHAVIOR must be one of: REJECT, CREATE.
+
+     --interconnect-type=INTERCONNECT_TYPE
+        Type of the interconnect. INTERCONNECT_TYPE must be one of:
+
+         DEDICATED
+            Dedicated private interconnect.
+         PARTNER
+            Partner interconnect. Only available to approved partners.
+
+     --link-type=LINK_TYPE
+        Type of the link for the interconnect. LINK_TYPE must be one of:
+
+         LINK_TYPE_ETHERNET_100G_LR
+            100Gbps Ethernet, LR Optics.
+         LINK_TYPE_ETHERNET_10G_LR
+            10Gbps Ethernet, LR Optics.
+         LINK_TYPE_ETHERNET_400G_LR4
+            400Gbps Ethernet, LR4 Optics.
+
+     --noc-contact-email=NOC_CONTACT_EMAIL
+        Email address to contact the customer NOC for operations and
+        maintenance notifications regarding this interconnect.
+
+     --requested-features=[FEATURES,...]
+        List of features requested for this interconnect. FEATURES must be one
+        of:
+
+         CROSS_SITE_NETWORK
+            If specified then the interconnect is created on Cross-Site Network
+            capable hardware ports. This parameter can only be provided during
+            interconnect INSERT and cannot be changed using interconnect PATCH.
+         MACSEC
+            If specified then the interconnect is created on MACsec capable
+            hardware ports. If not specified, the interconnect is created on
+            non-MACsec capable ports first, if available. This parameter can
+            only be provided during interconnect INSERT and cannot be changed
+            using interconnect PATCH.
+
+     --requested-link-count=REQUESTED_LINK_COUNT
+        Target number of physical links in the link bundle.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute interconnects groups create-members
+
+        $ gcloud beta compute interconnects groups create-members
+
diff --git a/gcloud/compute/interconnects/groups/delete b/gcloud/compute/interconnects/groups/delete
new file mode 100644
index 000000000..cb0dfd69b
--- /dev/null
+++ b/gcloud/compute/interconnects/groups/delete
@@ -0,0 +1,42 @@
+NAME
+    gcloud compute interconnects groups delete - delete Compute Engine
+        interconnect groups
+
+SYNOPSIS
+    gcloud compute interconnects groups delete NAME [NAME ...]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud compute interconnects groups delete is used to delete interconnect
+    groups.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To delete an interconnect group, run:
+
+        $ gcloud compute interconnects groups delete \
+            example-interconnect-group"
+
+    Although not shown in this example, you can delete multiple interconnect
+    groups in a single command.
+
+POSITIONAL ARGUMENTS
+     NAME [NAME ...]
+        Names of the interconnect groups to delete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute interconnects groups delete
+
+        $ gcloud beta compute interconnects groups delete
+
diff --git a/gcloud/compute/interconnects/groups/describe b/gcloud/compute/interconnects/groups/describe
new file mode 100644
index 000000000..e63c047bc
--- /dev/null
+++ b/gcloud/compute/interconnects/groups/describe
@@ -0,0 +1,38 @@
+NAME
+    gcloud compute interconnects groups describe - describe a Compute Engine
+        interconnect group
+
+SYNOPSIS
+    gcloud compute interconnects groups describe NAME [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud compute interconnects groups describe is used to describe an
+    interconnect group.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To describe interconnect group example-interconnect-group, run:
+
+        $ gcloud compute interconnects groups describe \
+            example-interconnect-group
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect group to describe.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute interconnects groups describe
+
+        $ gcloud beta compute interconnects groups describe
+
diff --git a/gcloud/compute/interconnects/groups/get-operational-status b/gcloud/compute/interconnects/groups/get-operational-status
new file mode 100644
index 000000000..bb41907fc
--- /dev/null
+++ b/gcloud/compute/interconnects/groups/get-operational-status
@@ -0,0 +1,40 @@
+NAME
+    gcloud compute interconnects groups get-operational-status - get the
+        operational status of a Compute Engine interconnect group
+
+SYNOPSIS
+    gcloud compute interconnects groups get-operational-status NAME
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud compute interconnects groups get-operational-status is used to get
+    the operational status of an interconnect group.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To get the operational status of interconnect group
+    example-interconnect-group, run:
+
+        $ gcloud compute interconnects groups get-operational-status \
+            example-interconnect-group
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect group to get operational status.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute interconnects groups get-operational-status
+
+        $ gcloud beta compute interconnects groups get-operational-status
+
diff --git a/gcloud/compute/interconnects/groups/help b/gcloud/compute/interconnects/groups/help
new file mode 100644
index 000000000..9c3f61061
--- /dev/null
+++ b/gcloud/compute/interconnects/groups/help
@@ -0,0 +1,52 @@
+NAME
+    gcloud compute interconnects groups - create or manipulate interconnect
+        groups
+
+SYNOPSIS
+    gcloud compute interconnects groups COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Create or manipulate interconnect groups.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     add-members
+        Add member interconnects to a Compute Engine interconnect group.
+
+     create
+        Create a Compute Engine interconnect group.
+
+     create-members
+        Create new member interconnects in a Compute Engine interconnect group.
+
+     delete
+        Delete Compute Engine interconnect groups.
+
+     describe
+        Describe a Compute Engine interconnect group.
+
+     get-operational-status
+        Get the operational status of a Compute Engine interconnect group.
+
+     list
+        List interconnect groups.
+
+     remove-members
+        Remove member interconnects from a Compute Engine interconnect group.
+
+     update
+        Update a Compute Engine interconnect group.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute interconnects groups
+
+        $ gcloud beta compute interconnects groups
+
diff --git a/gcloud/compute/interconnects/groups/list b/gcloud/compute/interconnects/groups/list
new file mode 100644
index 000000000..6ce369b23
--- /dev/null
+++ b/gcloud/compute/interconnects/groups/list
@@ -0,0 +1,66 @@
+NAME
+    gcloud compute interconnects groups list - list interconnect groups
+
+SYNOPSIS
+    gcloud compute interconnects groups list [--filter=EXPRESSION]
+        [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud compute interconnects groups list is used to list interconnect
+    groups.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To list interconnect groups, run:
+
+        $ gcloud compute interconnects groups list
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute interconnects groups list
+
+        $ gcloud beta compute interconnects groups list
+
diff --git a/gcloud/compute/interconnects/groups/remove-members b/gcloud/compute/interconnects/groups/remove-members
new file mode 100644
index 000000000..2e4c319e7
--- /dev/null
+++ b/gcloud/compute/interconnects/groups/remove-members
@@ -0,0 +1,45 @@
+NAME
+    gcloud compute interconnects groups remove-members - remove member
+        interconnects from a Compute Engine interconnect group
+
+SYNOPSIS
+    gcloud compute interconnects groups remove-members NAME
+        --interconnects=[INTERCONNECT,...] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud compute interconnects groups remove-members is used to remove member
+    interconnects from an interconnect group.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To remove interconnects interconnect1 and interconnect2 from interconnect
+    group example-interconnect-group, run:
+
+        $ gcloud compute interconnects groups remove-members \
+            example-interconnect-group \
+            --interconnects=interconnect1,interconnect2
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect group to update.
+
+REQUIRED FLAGS
+     --interconnects=[INTERCONNECT,...]
+        Member interconnects to add to or remove from the interconnect group.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute interconnects groups remove-members
+
+        $ gcloud beta compute interconnects groups remove-members
+
diff --git a/gcloud/compute/interconnects/groups/update b/gcloud/compute/interconnects/groups/update
new file mode 100644
index 000000000..78e53f416
--- /dev/null
+++ b/gcloud/compute/interconnects/groups/update
@@ -0,0 +1,71 @@
+NAME
+    gcloud compute interconnects groups update - update a Compute Engine
+        interconnect group
+
+SYNOPSIS
+    gcloud compute interconnects groups update NAME [--description=DESCRIPTION]
+        [--intended-topology-capability=INTENDED_TOPOLOGY_CAPABILITY]
+        [--interconnects=[INTERCONNECT,...]] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud compute interconnects groups update is used to update interconnect
+    groups.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To update an interconnect group example-interconnect-group's intended
+    topology capability to PRODUCTION_CRITICAL, run:
+
+        $ gcloud compute interconnects groups update \
+            example-interconnect-group \
+            --intended-topology-capability=PRODUCTION_CRITICAL
+
+    To update an interconnect group example-interconnect-group's description to
+    "example interconnect group description", run:
+
+        $ gcloud compute interconnects groups update \
+            example-interconnect-group \
+            --description="example interconnect group description"
+
+    To update an interconnect group example-interconnect-group's member
+    interconnects to interconnect-1 and interconnect-2, run:
+
+        $ gcloud compute interconnects groups update \
+            example-interconnect-group \
+            --interconnects=interconnect-1,interconnect-2
+
+    Although you can add or remove member interconnects using this command, it
+    is recommended to add or remove member interconnects using the add-members
+    and remove-members commands.
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect group to update.
+
+FLAGS
+     --description=DESCRIPTION
+        An optional, textual description for the interconnect group.
+
+     --intended-topology-capability=INTENDED_TOPOLOGY_CAPABILITY
+        The reliability the user intends this group to be capable of, in terms
+        of the Interconnect product SLAs.
+
+     --interconnects=[INTERCONNECT,...]
+        Member interconnects to set the interconnect group to contain.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute interconnects groups update
+
+        $ gcloud beta compute interconnects groups update
+
diff --git a/gcloud/compute/interconnects/help b/gcloud/compute/interconnects/help
index 0f026d2d3..52b29e14b 100644
--- a/gcloud/compute/interconnects/help
+++ b/gcloud/compute/interconnects/help
@@ -26,6 +26,9 @@ GROUPS
      attachments
         Read and manipulate Compute Engine interconnect attachments.
 
+     groups
+        Create or manipulate interconnect groups.
+
      locations
         Read and manipulate Compute Engine interconnect locations.
 
diff --git a/gcloud/compute/service-attachments/create b/gcloud/compute/service-attachments/create
index 4fc9dedd8..0d396b143 100644
--- a/gcloud/compute/service-attachments/create
+++ b/gcloud/compute/service-attachments/create
@@ -13,9 +13,11 @@ SYNOPSIS
         [--consumer-reject-list=[REJECT_LIST,...]] [--description=DESCRIPTION]
         [--domain-names=[DOMAIN_NAMES,...]] [--enable-proxy-protocol]
         [--nat-subnets-region=NAT_SUBNETS_REGION]
-        [--producer-forwarding-rule-region=PRODUCER_FORWARDING_RULE_REGION]
         [--propagated-connection-limit=PROPAGATED_CONNECTION_LIMIT]
-        [--reconcile-connections] [--region=REGION] [GCLOUD_WIDE_FLAG ...]
+        [--reconcile-connections] [--region=REGION]
+        [--global-producer-forwarding-rule
+          | --producer-forwarding-rule-region=PRODUCER_FORWARDING_RULE_REGION]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     gcloud compute service-attachments create is used to create service
@@ -114,26 +116,6 @@ OPTIONAL FLAGS
         set to the region of the service attachment. Overrides the default
         compute/region property value for this command invocation.
 
-     --producer-forwarding-rule-region=PRODUCER_FORWARDING_RULE_REGION
-        Region of the forwarding rule to operate on. If not specified, you
-        might be prompted to select a region (interactive mode only).
-
-        To avoid prompting when this flag is omitted, you can set the
-        compute/region property:
-
-            $ gcloud config set compute/region REGION
-
-        A list of regions can be fetched by running:
-
-            $ gcloud compute regions list
-
-        To unset the property, run:
-
-            $ gcloud config unset compute/region
-
-        Alternatively, the region can be stored in the environment variable
-        CLOUDSDK_COMPUTE_REGION.
-
      --propagated-connection-limit=PROPAGATED_CONNECTION_LIMIT
         The number of consumer spokes that connected Private Service Connect
         endpoints can be propagated to through Network Connectivity Center.
@@ -183,6 +165,31 @@ OPTIONAL FLAGS
         Alternatively, the region can be stored in the environment variable
         CLOUDSDK_COMPUTE_REGION.
 
+     At most one of these can be specified:
+
+       --global-producer-forwarding-rule
+          If set, the forwarding rule is global.
+
+       --producer-forwarding-rule-region=PRODUCER_FORWARDING_RULE_REGION
+          Region of the forwarding rule to operate on. If not specified, you
+          might be prompted to select a region (interactive mode only).
+
+          To avoid prompting when this flag is omitted, you can set the
+          compute/region property:
+
+              $ gcloud config set compute/region REGION
+
+          A list of regions can be fetched by running:
+
+              $ gcloud compute regions list
+
+          To unset the property, run:
+
+              $ gcloud config unset compute/region
+
+          Alternatively, the region can be stored in the environment variable
+          CLOUDSDK_COMPUTE_REGION.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/container/clusters/create b/gcloud/container/clusters/create
index 036fe9665..b630aa21b 100644
--- a/gcloud/container/clusters/create
+++ b/gcloud/container/clusters/create
@@ -20,6 +20,7 @@ SYNOPSIS
         [--cluster-ipv4-cidr=CLUSTER_IPV4_CIDR]
         [--cluster-secondary-range-name=NAME]
         [--cluster-version=CLUSTER_VERSION]
+        [--confidential-node-type=CONFIDENTIAL_NODE_TYPE]
         [--containerd-config-from-file=PATH_TO_FILE]
         [--create-subnetwork=[KEY=VALUE,...]]
         [--data-cache-count=DATA_CACHE_COUNT]
@@ -349,6 +350,12 @@ FLAGS
 
             $ gcloud container get-server-config
 
+     --confidential-node-type=CONFIDENTIAL_NODE_TYPE
+        Enable confidential nodes for the cluster. Enabling Confidential Nodes
+        will create nodes using Confidential VM
+        https://cloud.google.com/compute/confidential-vm/docs/about-cvm.
+        CONFIDENTIAL_NODE_TYPE must be one of: sev, sev_snp, tdx.
+
      --containerd-config-from-file=PATH_TO_FILE
         Path of the YAML file that contains containerd configuration entries
         like configuring access to private image registries.
diff --git a/gcloud/container/node-pools/create b/gcloud/container/node-pools/create
index 26bcb1c21..8dcaebc1d 100644
--- a/gcloud/container/node-pools/create
+++ b/gcloud/container/node-pools/create
@@ -15,6 +15,7 @@ SYNOPSIS
           pod-ipv4-range=SECONDARY_RANGE_NAME,
           [max-pods-per-node=NUM_PODS],...]] [--async]
         [--boot-disk-kms-key=BOOT_DISK_KMS_KEY] [--cluster=CLUSTER]
+        [--confidential-node-type=CONFIDENTIAL_NODE_TYPE]
         [--containerd-config-from-file=PATH_TO_FILE]
         [--data-cache-count=DATA_CACHE_COUNT] [--disk-size=DISK_SIZE]
         [--disk-type=DISK_TYPE] [--enable-autoprovisioning]
@@ -188,6 +189,12 @@ FLAGS
         The cluster to add the node pool to. Overrides the default
         container/cluster property value for this command invocation.
 
+     --confidential-node-type=CONFIDENTIAL_NODE_TYPE
+        Enable confidential nodes for the node pool. Enabling Confidential
+        Nodes will create nodes using Confidential VM
+        https://cloud.google.com/compute/confidential-vm/docs/about-cvm.
+        CONFIDENTIAL_NODE_TYPE must be one of: sev, sev_snp, tdx, disabled.
+
      --containerd-config-from-file=PATH_TO_FILE
         Path of the YAML file that contains containerd configuration entries
         like configuring access to private image registries.
diff --git a/gcloud/container/node-pools/update b/gcloud/container/node-pools/update
index 2431b09d0..f8fd1b2a3 100644
--- a/gcloud/container/node-pools/update
+++ b/gcloud/container/node-pools/update
@@ -9,6 +9,7 @@ SYNOPSIS
           gpu-partition-size=GPU_PARTITION_SIZE,
           gpu-sharing-strategy=GPU_SHARING_STRATEGY,
           max-shared-clients-per-gpu=MAX_SHARED_CLIENTS_PER_GPU],...]
+          | --confidential-node-type=CONFIDENTIAL_NODE_TYPE
           | --containerd-config-from-file=PATH_TO_FILE
           | --enable-confidential-nodes | --enable-gvnic
           | --enable-image-streaming | --enable-insecure-kubelet-readonly-port
@@ -102,6 +103,11 @@ REQUIRED FLAGS
               on the node. This field is used together with
               gpu-sharing-strategy.
 
+       --confidential-node-type=CONFIDENTIAL_NODE_TYPE
+          Recreate all the nodes in the node pool to be confidential VM
+          https://cloud.google.com/compute/confidential-vm/docs/about-cvm.
+          CONFIDENTIAL_NODE_TYPE must be one of: sev, sev_snp, tdx, disabled.
+
        --containerd-config-from-file=PATH_TO_FILE
           Path of the YAML file that contains containerd configuration entries
           like configuring access to private image registries.
diff --git a/gcloud/database-migration/migration-jobs/update b/gcloud/database-migration/migration-jobs/update
index 5a1b7c53a..580088443 100644
--- a/gcloud/database-migration/migration-jobs/update
+++ b/gcloud/database-migration/migration-jobs/update
@@ -11,6 +11,8 @@ SYNOPSIS
         [--type=TYPE] [--update-labels=[KEY=VALUE,...]]
         [--all-databases | --databases-filter=databaseName,[...]]
         [--clear-labels | --remove-labels=[KEY,...]]
+        [--max-concurrent-cdc-connections=MAX_CONCURRENT_CDC_CONNECTIONS
+          --max-concurrent-full-dump-connections=MAX_CONCURRENT_FULL_DUMP_CONNECTIONS --max-concurrent-destination-connections=MAX_CONCURRENT_DESTINATION_CONNECTIONS --transaction-timeout=TRANSACTION_TIMEOUT]
         [--peer-vpc=PEER_VPC | --static-ip
           | --vm=VM --vm-ip=VM_IP --vm-port=VM_PORT --vpc=VPC]
         [--sqlserver-databases=databaseName,[...] --sqlserver-diff-backup
@@ -195,6 +197,30 @@ FLAGS
           silently ignored. If --update-labels is also specified then
           --update-labels is applied first.
 
+     The heterogeneous migration config. This is used only for Oracle to Cloud
+     SQL for PostgreSQL and SQL Server to Cloud SQL for PostgreSQL migrations.
+
+       Configuration for Oracle or SQL Server as a source in a heterogeneous
+       migration.
+
+         --max-concurrent-cdc-connections=MAX_CONCURRENT_CDC_CONNECTIONS
+            Maximum number of connections Database Migration Service will open
+            to the source for CDC phase.
+
+         --max-concurrent-full-dump-connections=MAX_CONCURRENT_FULL_DUMP_CONNECTIONS
+            Maximum number of connections Database Migration Service will open
+            to the source for full dump phase.
+
+       Configuration for Postgres as a destination in a heterogeneous
+       migration.
+
+         --max-concurrent-destination-connections=MAX_CONCURRENT_DESTINATION_CONNECTIONS
+            Maximum number of concurrent connections Database Migration Service
+            will open to the destination for data migration.
+
+         --transaction-timeout=TRANSACTION_TIMEOUT
+            Timeout for data migration transactions.
+
      The connectivity method used by the migration job. If a connectivity
      method isn't specified, then it isn't updated for the migration job.
 
diff --git a/gcloud/emulators/firestore/start b/gcloud/emulators/firestore/start
index 5c0e53dd5..7bb0b47aa 100644
--- a/gcloud/emulators/firestore/start
+++ b/gcloud/emulators/firestore/start
@@ -4,7 +4,8 @@ NAME
 SYNOPSIS
     gcloud emulators firestore start [--database-mode=DATABASE_MODE]
         [--export-on-exit=EXPORT_ON_EXIT] [--host-port=HOST_PORT]
-        [--import-data=IMPORT_DATA] [--rules=RULES] [GCLOUD_WIDE_FLAG ...]
+        [--import-data=IMPORT_DATA] [--licenses] [--rules=RULES]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     This command starts a local Firestore emulator.
@@ -63,6 +64,10 @@ FLAGS
         File path to the data to be loaded into the emulator upon start up.
         Example:/home/user/myexports/sampleExport/sampleExport.overall_export_metadata.
 
+     --licenses
+        If set, the emulator will print open-source dependencies and licenses,
+        then exit.
+
      --rules=RULES
         If set, all projects will use the security rules in this file. More
         information on Firebase Rules and the syntax for this file is available
diff --git a/gcloud/filestore/regions/help b/gcloud/filestore/regions/help
index ee4d4f453..4c39e3506 100644
--- a/gcloud/filestore/regions/help
+++ b/gcloud/filestore/regions/help
@@ -16,7 +16,7 @@ COMMANDS
     COMMAND is one of the following:
 
      list
-        List Filestore regions.
+        List all Filestore regions.
 
 NOTES
     These variants are also available:
diff --git a/gcloud/filestore/regions/list b/gcloud/filestore/regions/list
index 2e743181e..109242d57 100644
--- a/gcloud/filestore/regions/list
+++ b/gcloud/filestore/regions/list
@@ -1,20 +1,19 @@
 NAME
-    gcloud filestore regions list - list Filestore regions
+    gcloud filestore regions list - list all Filestore regions
 
 SYNOPSIS
     gcloud filestore regions list [--filter=EXPRESSION] [--limit=LIMIT]
-        [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
+        [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    List all regions where Filestore API is available. The listed regions only
-    apply for Basic instances. High Scale is only available in a more
-    restricted set of regions. For details, please see
-    https://cloud.google.com/filestore/docs/regions.
+    List all Filestore regions.
 
 EXAMPLES
-    To list all the regions where Filestore instances can be created, run:
+    The following command lists a maximum of five Filestore regions sorted
+    alphabetically by name in descending order:
 
-        $ gcloud filestore regions list
+        $ gcloud filestore regions list --limit=5 --sort-by=~name
 
 LIST COMMAND FLAGS
      --filter=EXPRESSION
@@ -42,6 +41,12 @@ LIST COMMAND FLAGS
         order on that field. This flag interacts with other flags that are
         applied in this order: --flatten, --sort-by, --filter, --limit.
 
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
@@ -50,10 +55,6 @@ GCLOUD WIDE FLAGS
 
     Run $ gcloud help for details.
 
-API REFERENCE
-    This command uses the file/v1 API. The full documentation for this API can
-    be found at: https://cloud.google.com/filestore/
-
 NOTES
     These variants are also available:
 
diff --git a/gcloud/filestore/zones/help b/gcloud/filestore/zones/help
index 746b37d3c..ff9677573 100644
--- a/gcloud/filestore/zones/help
+++ b/gcloud/filestore/zones/help
@@ -16,7 +16,7 @@ COMMANDS
     COMMAND is one of the following:
 
      list
-        List Filestore zones.
+        List all Filestore zones.
 
 NOTES
     These variants are also available:
diff --git a/gcloud/filestore/zones/list b/gcloud/filestore/zones/list
index d08b0c433..d00aaa50d 100644
--- a/gcloud/filestore/zones/list
+++ b/gcloud/filestore/zones/list
@@ -1,20 +1,19 @@
 NAME
-    gcloud filestore zones list - list Filestore zones
+    gcloud filestore zones list - list all Filestore zones
 
 SYNOPSIS
     gcloud filestore zones list [--filter=EXPRESSION] [--limit=LIMIT]
-        [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
+        [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    List all zones where Filestore API is available. The listed zones only
-    apply for Basic instances. High Scale is only available in a more
-    restricted set of zones. For details, please see
-    https://cloud.google.com/filestore/docs/regions.
+    List all Filestore zones.
 
 EXAMPLES
-    To list all the zones where Filestore instances can be created, run:
+    The following command lists a maximum of five Filestore zones sorted
+    alphabetically by name in descending order:
 
-        $ gcloud filestore zones list
+        $ gcloud filestore zones list --limit=5 --sort-by=~name
 
 LIST COMMAND FLAGS
      --filter=EXPRESSION
@@ -42,6 +41,12 @@ LIST COMMAND FLAGS
         order on that field. This flag interacts with other flags that are
         applied in this order: --flatten, --sort-by, --filter, --limit.
 
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
@@ -50,10 +55,6 @@ GCLOUD WIDE FLAGS
 
     Run $ gcloud help for details.
 
-API REFERENCE
-    This command uses the file/v1 API. The full documentation for this API can
-    be found at: https://cloud.google.com/filestore/
-
 NOTES
     These variants are also available:
 
diff --git a/gcloud/iam/workforce-pools/providers/create-oidc b/gcloud/iam/workforce-pools/providers/create-oidc
index 11faf48ba..1af7d5d91 100644
--- a/gcloud/iam/workforce-pools/providers/create-oidc
+++ b/gcloud/iam/workforce-pools/providers/create-oidc
@@ -288,7 +288,7 @@ OPTIONAL FLAGS
 
             *--extra-attributes-type*=_EXTRA_ATTRIBUTES_TYPE_::
 
-            Represents the identity provider and type of claims that should be fetched. _EXTRA_ATTRIBUTES_TYPE_ must be one of: *attributes-type-unspecified*, *azure-ad-groups-id*, *azure-ad-groups-mail*.
+            Represents the identity provider and type of claims that should be fetched. _EXTRA_ATTRIBUTES_TYPE_ must be one of: *attributes-type-unspecified*, *azure-ad-groups-display-name*, *azure-ad-groups-id*, *azure-ad-groups-mail*.
 
             *--extra-attributes-filter*=_EXTRA_ATTRIBUTES_FILTER_::
 
diff --git a/gcloud/iam/workforce-pools/providers/create-saml b/gcloud/iam/workforce-pools/providers/create-saml
index 718caa8ad..5e4e8f52d 100644
--- a/gcloud/iam/workforce-pools/providers/create-saml
+++ b/gcloud/iam/workforce-pools/providers/create-saml
@@ -207,7 +207,8 @@ OPTIONAL FLAGS
      --extra-attributes-type=EXTRA_ATTRIBUTES_TYPE
         Represents the identity provider and type of claims that should be
         fetched. EXTRA_ATTRIBUTES_TYPE must be one of:
-        attributes-type-unspecified, azure-ad-groups-id, azure-ad-groups-mail.
+        attributes-type-unspecified, azure-ad-groups-display-name,
+        azure-ad-groups-id, azure-ad-groups-mail.
 
      --extra-attributes-filter=EXTRA_ATTRIBUTES_FILTER
         The filter used to request specific records from IdP. When used with
diff --git a/gcloud/iam/workforce-pools/providers/update-oidc b/gcloud/iam/workforce-pools/providers/update-oidc
index ca4fa5be9..a2fe17509 100644
--- a/gcloud/iam/workforce-pools/providers/update-oidc
+++ b/gcloud/iam/workforce-pools/providers/update-oidc
@@ -288,7 +288,7 @@ FLAGS
 
             *--extra-attributes-type*=_EXTRA_ATTRIBUTES_TYPE_:::
 
-            Represents the identity provider and type of claims that should be fetched. _EXTRA_ATTRIBUTES_TYPE_ must be one of: *attributes-type-unspecified*, *azure-ad-groups-id*, *azure-ad-groups-mail*.
+            Represents the identity provider and type of claims that should be fetched. _EXTRA_ATTRIBUTES_TYPE_ must be one of: *attributes-type-unspecified*, *azure-ad-groups-display-name*, *azure-ad-groups-id*, *azure-ad-groups-mail*.
 
 GCLOUD WIDE FLAGS
         These flags are available to all commands: --access-token-file, --account, --billing-project, --configuration, --flags-file, --flatten, --format, --help, --impersonate-service-account, --log-http, --project, --quiet, --trace-token, --user-output-enabled, --verbosity.
diff --git a/gcloud/iam/workforce-pools/providers/update-saml b/gcloud/iam/workforce-pools/providers/update-saml
index b364898d4..97ed7221c 100644
--- a/gcloud/iam/workforce-pools/providers/update-saml
+++ b/gcloud/iam/workforce-pools/providers/update-saml
@@ -225,8 +225,8 @@ FLAGS
        --extra-attributes-type=EXTRA_ATTRIBUTES_TYPE
           Represents the identity provider and type of claims that should be
           fetched. EXTRA_ATTRIBUTES_TYPE must be one of:
-          attributes-type-unspecified, azure-ad-groups-id,
-          azure-ad-groups-mail.
+          attributes-type-unspecified, azure-ad-groups-display-name,
+          azure-ad-groups-id, azure-ad-groups-mail.
 
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
diff --git a/gcloud/iam/workload-identity-pools/add-iam-policy-binding b/gcloud/iam/workload-identity-pools/add-iam-policy-binding
new file mode 100644
index 000000000..58d33209a
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/add-iam-policy-binding
@@ -0,0 +1,154 @@
+NAME
+    gcloud iam workload-identity-pools add-iam-policy-binding - add IAM policy
+        binding for a workload identity pool
+
+SYNOPSIS
+    gcloud iam workload-identity-pools add-iam-policy-binding
+        (WORKLOAD_IDENTITY_POOL : --location=LOCATION) --member=PRINCIPAL
+        --role=ROLE
+        [--condition=[KEY=VALUE,...] | --condition-from-file=PATH_TO_FILE]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Adds a policy binding to the IAM policy of a workload identity pool, given
+    a workload identity pool ID and the binding. A binding consists of at least
+    one member, a role, and an optional condition.
+
+EXAMPLES
+    To add an IAM policy binding for the role of
+    roles/iam.workloadIdentityPoolViewer for the user test-user@gmail.com on a
+    workload identity pool with identifier my-workload-identity-pool, run:
+
+        $ gcloud iam workload-identity-pools add-iam-policy-binding \
+            my-workload-identity-pool --location="global" \
+            --member='user:test-user@gmail.com' \
+            --role='roles/iam.workloadIdentityPoolViewer'
+
+    To add an IAM policy binding for the role of
+    roles/iam.workloadIdentityPoolViewer for all authenticated users on a
+    workload identity pool with identifier my-workload-identity-pool, run:
+
+        $ gcloud iam workload-identity-pools add-iam-policy-binding \
+            my-workload-identity-pool --location="global" \
+            --member='allAuthenticatedUsers' \
+            --role='roles/iam.workloadIdentityPoolViewer'
+
+    To add an IAM policy binding that expires at the end of the year 2024 for
+    the role of roles/iam.workloadIdentityPoolViewer and the user
+    test-user@gmail.com on a workload identity pool with identifier
+    my-workload-identity-pool, run:
+
+        $ gcloud iam workload-identity-pools add-iam-policy-binding \
+            my-workload-identity-pool --location="global" \
+            --member='user:test-user@gmail.com' \
+            --role='roles/iam.workloadIdentityPoolViewer' \
+            --condition='expression=request.time <
+         timestamp("2019-01-01T00:00:00Z"),title=expires_end_of_2024,descrip\
+        tion=Expires at midnight on 2024-12-31'
+
+    See https://cloud.google.com/iam/docs/managing-policies for details on
+    policy role and member types.
+
+POSITIONAL ARGUMENTS
+     Workload identity pool resource - The workload identity pool to add the
+     IAM policy binding for. The arguments in this group can be used to specify
+     the attributes of this resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument workload_identity_pool on the command line with
+        a fully specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       WORKLOAD_IDENTITY_POOL
+          ID of the workload identity pool or fully qualified identifier for
+          the workload identity pool.
+
+          To set the workload_identity_pool attribute:
+          ▸ provide the argument workload_identity_pool on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument workload_identity_pool on the command line
+            with a fully specified name;
+          ▸ provide the argument --location on the command line.
+
+REQUIRED FLAGS
+     --member=PRINCIPAL
+        The principal to add the binding for. Should be of the form
+        user|group|serviceAccount:email or domain:domain.
+
+        Examples: user:test-user@gmail.com, group:admins@example.com,
+        serviceAccount:test123@example.domain.com, or
+        domain:example.domain.com.
+
+        Some resources also accept the following special values:
+        ◆ allUsers - Special identifier that represents anyone who is on the
+          internet, with or without a Google account.
+        ◆ allAuthenticatedUsers - Special identifier that represents anyone
+          who is authenticated with a Google account or a service account.
+
+     --role=ROLE
+        Role name to assign to the principal. The role name is the complete
+        path of a predefined role, such as roles/logging.viewer, or the role ID
+        for a custom role, such as
+        organizations/{ORGANIZATION_ID}/roles/logging.viewer.
+
+OPTIONAL FLAGS
+     At most one of these can be specified:
+
+       --condition=[KEY=VALUE,...]
+          A condition to include in the binding. When the condition is
+          explicitly specified as None (--condition=None), a binding without a
+          condition is added. When the condition is specified and is not None,
+          --role cannot be a basic role. Basic roles are roles/editor,
+          roles/owner, and roles/viewer. For more on conditions, refer to the
+          conditions overview guide:
+          https://cloud.google.com/iam/docs/conditions-overview
+
+          When using the --condition flag, include the following key-value
+          pairs:
+
+           expression
+              (Required) Condition expression that evaluates to True or False.
+              This uses a subset of Common Expression Language syntax.
+
+              If the condition expression includes a comma, use a different
+              delimiter to separate the key-value pairs. Specify the delimiter
+              before listing the key-value pairs. For example, to specify a
+              colon (:) as the delimiter, do the following:
+              --condition=^:^title=TITLE:expression=EXPRESSION. For more
+              information, see
+              https://cloud.google.com/sdk/gcloud/reference/topic/escaping.
+
+           title
+              (Required) A short string describing the purpose of the
+              expression.
+
+           description
+              (Optional) Additional description for the expression.
+
+       --condition-from-file=PATH_TO_FILE
+          Path to a local JSON or YAML file that defines the condition. To see
+          available fields, see the help for --condition. Use a full or
+          relative path to a local file containing the value of condition.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the iam/v1 API. The full documentation for this API can
+    be found at: https://cloud.google.com/iam/
diff --git a/gcloud/iam/workload-identity-pools/create b/gcloud/iam/workload-identity-pools/create
index 3f17f7fee..b04fcdc72 100644
--- a/gcloud/iam/workload-identity-pools/create
+++ b/gcloud/iam/workload-identity-pools/create
@@ -6,6 +6,8 @@ SYNOPSIS
     gcloud iam workload-identity-pools create
         (WORKLOAD_IDENTITY_POOL : --location=LOCATION)
         [--description=DESCRIPTION] [--disabled] [--display-name=DISPLAY_NAME]
+        [--inline-certificate-issuance-config-file=INLINE_CERTIFICATE_ISSUANCE_CONFIG_FILE]
+        [--inline-trust-config-file=INLINE_TRUST_CONFIG_FILE] [--mode=MODE]
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
@@ -65,6 +67,41 @@ FLAGS
      --display-name=DISPLAY_NAME
         A display name for the pool. Cannot exceed 32 characters.
 
+     --inline-certificate-issuance-config-file=INLINE_CERTIFICATE_ISSUANCE_CONFIG_FILE
+        YAML file with configuration for certificate issuance. Example file
+        format:            inlineCertificateIssuanceConfig:
+              caPools:
+                us-east1: projects/1234/locations/us-east1/caPools/capoolname
+                us-west1: projects/1234/locations/us-west1/caPools/capoolname
+              keyAlgorithm: RSA_4096
+              lifetime: 7200s
+              rotationWindowPercentage: 50
+
+     --inline-trust-config-file=INLINE_TRUST_CONFIG_FILE
+        YAML file with configuration for providing additional trust bundles.
+        Example file format:            inlineTrustConfig:
+              additionalTrustBundles:
+                example.com:
+                  trustAnchors:
+                  - pemCertificate: "-----BEGIN CERTIFICATE-----
+                    <certificate>
+                    -----END CERTIFICATE-----"
+                  - pemCertificate: "-----BEGIN CERTIFICATE-----
+                    <certificate>
+                    -----END CERTIFICATE-----"
+                myorg.com:
+                  trustAnchors:
+                  - pemCertificate: "-----BEGIN CERTIFICATE-----
+                    <certificate>
+                    -----END CERTIFICATE-----"
+                  - pemCertificate: "-----BEGIN CERTIFICATE-----
+                    <certificate>
+                    -----END CERTIFICATE-----"
+
+     --mode=MODE
+        The mode of the pool. MODE must be one of: federation-only,
+        mode-unspecified, trust-domain.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/iam/workload-identity-pools/get-iam-policy b/gcloud/iam/workload-identity-pools/get-iam-policy
new file mode 100644
index 000000000..d09ccfa89
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/get-iam-policy
@@ -0,0 +1,96 @@
+NAME
+    gcloud iam workload-identity-pools get-iam-policy - get the IAM policy for
+        a workload identity pool
+
+SYNOPSIS
+    gcloud iam workload-identity-pools get-iam-policy
+        (WORKLOAD_IDENTITY_POOL : --location=LOCATION) [--filter=EXPRESSION]
+        [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Get the IAM policy for a workload identity pool.
+
+EXAMPLES
+    The following command gets the IAM policy for the workload identity pool
+    with ID my-workload-identity-pool:
+
+        $ gcloud iam workload-identity-pools get-iam-policy \
+            my-workload-identity-pool --location="global"
+
+    The following command gets the IAM policy for the workload identity pool
+    with ID my-workload-identity-pool and outputs as a JSON which can be edited
+    and used as the policy file input for set-iam-policy command:
+
+        $ gcloud iam workload-identity-pools get-iam-policy \
+            my-workload-identity-pool --location="global" --format=json
+
+POSITIONAL ARGUMENTS
+     Workload identity pool resource - The workload identity pool for which you
+     want to get IAM policy for. The arguments in this group can be used to
+     specify the attributes of this resource. (NOTE) Some attributes are not
+     given arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument workload_identity_pool on the command line with
+        a fully specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       WORKLOAD_IDENTITY_POOL
+          ID of the workload identity pool or fully qualified identifier for
+          the workload identity pool.
+
+          To set the workload_identity_pool attribute:
+          ▸ provide the argument workload_identity_pool on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument workload_identity_pool on the command line
+            with a fully specified name;
+          ▸ provide the argument --location on the command line.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the iam/v1 API. The full documentation for this API can
+    be found at: https://cloud.google.com/iam/
diff --git a/gcloud/iam/workload-identity-pools/help b/gcloud/iam/workload-identity-pools/help
index 6e58c8382..c808506a1 100644
--- a/gcloud/iam/workload-identity-pools/help
+++ b/gcloud/iam/workload-identity-pools/help
@@ -15,6 +15,12 @@ GCLOUD WIDE FLAGS
 GROUPS
     GROUP is one of the following:
 
+     managed-identities
+        Manage IAM workload identity pool managed identities.
+
+     namespaces
+        Manage IAM workload identity pool namespaces.
+
      operations
         Manage IAM workload identity pool long running operations.
 
@@ -24,6 +30,9 @@ GROUPS
 COMMANDS
     COMMAND is one of the following:
 
+     add-iam-policy-binding
+        Add IAM policy binding for a workload identity pool.
+
      create
         Create a new workload identity pool.
 
@@ -36,9 +45,18 @@ COMMANDS
      describe
         Describe a workload identity pool.
 
+     get-iam-policy
+        Get the IAM policy for a workload identity pool.
+
      list
         List workload identity pools.
 
+     remove-iam-policy-binding
+        Remove IAM policy binding from a workload identity pool.
+
+     set-iam-policy
+        Set the IAM policy for a workload identity pool.
+
      undelete
         Undelete a workload identity pool.
 
diff --git a/gcloud/iam/workload-identity-pools/managed-identities/add-attestation-rule b/gcloud/iam/workload-identity-pools/managed-identities/add-attestation-rule
new file mode 100644
index 000000000..803ad8580
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/managed-identities/add-attestation-rule
@@ -0,0 +1,98 @@
+NAME
+    gcloud iam workload-identity-pools managed-identities add-attestation-rule
+        - add an attestation rule on a workload identity pool managed identity
+
+SYNOPSIS
+    gcloud iam workload-identity-pools managed-identities add-attestation-rule
+        (MANAGED_IDENTITY : --location=LOCATION --namespace=NAMESPACE
+          --workload-identity-pool=WORKLOAD_IDENTITY_POOL)
+        --google-cloud-resource=GOOGLE_CLOUD_RESOURCE [--async]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Add an attestation rule on a workload identity pool managed identity.
+
+EXAMPLES
+    The following command adds an attestation rule with a Google Cloud resource
+    on a workload identity pool managed identity my-managed-identity.
+
+        $ gcloud iam workload-identity-pools managed-identities \
+            add-attestation-rule my-managed-identity \
+            --namespace="my-namespace" \
+            --workload-identity-pool="my-workload-identity-pool" \
+            --location="global" \
+            --google-cloud-resource="//compute.googleapis.com/projects/123/t\
+        ype/Instance/attached_service_account.uid/12345"
+
+POSITIONAL ARGUMENTS
+     Workload identity pool managed identity resource - The workload identity
+     pool managed identity to add attestation rule on. The arguments in this
+     group can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways.
+
+     To set the project attribute:
+      ◆ provide the argument managed_identity on the command line with a
+        fully specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       MANAGED_IDENTITY
+          ID of the workload identity pool managed identity or fully qualified
+          identifier for the workload identity pool managed identity.
+
+          To set the managed_identity attribute:
+          ▸ provide the argument managed_identity on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --location on the command line.
+
+       --namespace=NAMESPACE
+          The ID to use for the namespace. This value must be 2-63 characters,
+          and may contain the characters [a-z0-9-]. The prefix gcp- is reserved
+          for use by Google, and may not be specified.
+
+          To set the namespace attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --namespace on the command line.
+
+       --workload-identity-pool=WORKLOAD_IDENTITY_POOL
+          The ID to use for the pool, which becomes the final component of the
+          resource name. This value should be 4-32 characters, and may contain
+          the characters [a-z0-9-]. The prefix gcp- is reserved for use by
+          Google, and may not be specified.
+
+          To set the workload-identity-pool attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --workload-identity-pool on the command
+            line.
+
+REQUIRED FLAGS
+     --google-cloud-resource=GOOGLE_CLOUD_RESOURCE
+        A single workload operating on Google Cloud. This will be set in the
+        attestation rule to be added.
+
+OPTIONAL FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
diff --git a/gcloud/iam/workload-identity-pools/managed-identities/create b/gcloud/iam/workload-identity-pools/managed-identities/create
new file mode 100644
index 000000000..fb110f4ef
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/managed-identities/create
@@ -0,0 +1,101 @@
+NAME
+    gcloud iam workload-identity-pools managed-identities create - create a
+        workload identity pool managed identity
+
+SYNOPSIS
+    gcloud iam workload-identity-pools managed-identities create
+        (MANAGED_IDENTITY : --location=LOCATION --namespace=NAMESPACE
+          --workload-identity-pool=WORKLOAD_IDENTITY_POOL) [--async]
+        [--description=DESCRIPTION] [--disabled] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Create a workload identity pool managed identity.
+
+EXAMPLES
+    The following command creates a workload identity pool managed identity
+    with the ID my-managed-identity:
+
+        $ gcloud iam workload-identity-pools managed-identities create \
+            my-managed-identity --location="global" \
+            --workload-identity-pool="my-workload-identity-pool" \
+            --namespace="my-namespace" \
+            --description="My managed identity description" --disabled
+
+POSITIONAL ARGUMENTS
+     Workload identity pool managed identity resource - Workload identity pool
+     managed identity to create. The arguments in this group can be used to
+     specify the attributes of this resource. (NOTE) Some attributes are not
+     given arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument managed_identity on the command line with a
+        fully specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       MANAGED_IDENTITY
+          ID of the workload identity pool managed identity or fully qualified
+          identifier for the workload identity pool managed identity.
+
+          To set the managed_identity attribute:
+          ▸ provide the argument managed_identity on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --location on the command line.
+
+       --namespace=NAMESPACE
+          The ID to use for the namespace. This value must be 2-63 characters,
+          and may contain the characters [a-z0-9-]. The prefix gcp- is reserved
+          for use by Google, and may not be specified.
+
+          To set the namespace attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --namespace on the command line.
+
+       --workload-identity-pool=WORKLOAD_IDENTITY_POOL
+          The ID to use for the pool, which becomes the final component of the
+          resource name. This value should be 4-32 characters, and may contain
+          the characters [a-z0-9-]. The prefix gcp- is reserved for use by
+          Google, and may not be specified.
+
+          To set the workload-identity-pool attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --workload-identity-pool on the command
+            line.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+     --description=DESCRIPTION
+        A description of the managed identity.
+
+     --disabled
+        Whether the managed identity is disabled. If disabled, credentials may
+        no longer be issued for this identity. Existing credentials may
+        continue to be accepted until they expire.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the iam/v1 API. The full documentation for this API can
+    be found at: https://cloud.google.com/iam/
diff --git a/gcloud/iam/workload-identity-pools/managed-identities/delete b/gcloud/iam/workload-identity-pools/managed-identities/delete
new file mode 100644
index 000000000..46718ff0d
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/managed-identities/delete
@@ -0,0 +1,92 @@
+NAME
+    gcloud iam workload-identity-pools managed-identities delete - delete a
+        workload identity pool managed identity
+
+SYNOPSIS
+    gcloud iam workload-identity-pools managed-identities delete
+        (MANAGED_IDENTITY : --location=LOCATION --namespace=NAMESPACE
+          --workload-identity-pool=WORKLOAD_IDENTITY_POOL) [--async]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Delete a workload identity pool managed identity.
+
+EXAMPLES
+    The following command deletes a workload identity pool managed identity in
+    the default project with the ID my-managed-identity.
+
+        $ gcloud iam workload-identity-pools managed-identities delete \
+            my-managed-identity --location="global" \
+            --workload-identity-pool="my-workload-identity-pool" \
+            --namespace="my-namespace"
+
+POSITIONAL ARGUMENTS
+     Workload identity pool managed identity resource - Workload identity pool
+     managed identity to delete. The arguments in this group can be used to
+     specify the attributes of this resource. (NOTE) Some attributes are not
+     given arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument managed_identity on the command line with a
+        fully specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       MANAGED_IDENTITY
+          ID of the workload identity pool managed identity or fully qualified
+          identifier for the workload identity pool managed identity.
+
+          To set the managed_identity attribute:
+          ▸ provide the argument managed_identity on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --location on the command line.
+
+       --namespace=NAMESPACE
+          The ID to use for the namespace. This value must be 2-63 characters,
+          and may contain the characters [a-z0-9-]. The prefix gcp- is reserved
+          for use by Google, and may not be specified.
+
+          To set the namespace attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --namespace on the command line.
+
+       --workload-identity-pool=WORKLOAD_IDENTITY_POOL
+          The ID to use for the pool, which becomes the final component of the
+          resource name. This value should be 4-32 characters, and may contain
+          the characters [a-z0-9-]. The prefix gcp- is reserved for use by
+          Google, and may not be specified.
+
+          To set the workload-identity-pool attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --workload-identity-pool on the command
+            line.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the iam/v1 API. The full documentation for this API can
+    be found at: https://cloud.google.com/iam/
diff --git a/gcloud/iam/workload-identity-pools/managed-identities/describe b/gcloud/iam/workload-identity-pools/managed-identities/describe
new file mode 100644
index 000000000..bd8af64f8
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/managed-identities/describe
@@ -0,0 +1,87 @@
+NAME
+    gcloud iam workload-identity-pools managed-identities describe - describe a
+        workload identity pool managed identity
+
+SYNOPSIS
+    gcloud iam workload-identity-pools managed-identities describe
+        (MANAGED_IDENTITY : --location=LOCATION --namespace=NAMESPACE
+          --workload-identity-pool=WORKLOAD_IDENTITY_POOL)
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Describe a workload identity pool managed identity.
+
+EXAMPLES
+    The following command describes a workload identity pool managed identity
+    in the default project with the ID my-managed-identity.
+
+        $ gcloud iam workload-identity-pools managed-identities describe \
+            my-managed-identity --location="global" \
+            --workload-identity-pool="my-workload-identity-pool" \
+            --namespace="my-namespace"
+
+POSITIONAL ARGUMENTS
+     Workload identity pool managed identity resource - Workload identity pool
+     managed identity to describe. The arguments in this group can be used to
+     specify the attributes of this resource. (NOTE) Some attributes are not
+     given arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument managed_identity on the command line with a
+        fully specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       MANAGED_IDENTITY
+          ID of the workload identity pool managed identity or fully qualified
+          identifier for the workload identity pool managed identity.
+
+          To set the managed_identity attribute:
+          ▸ provide the argument managed_identity on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --location on the command line.
+
+       --namespace=NAMESPACE
+          The ID to use for the namespace. This value must be 2-63 characters,
+          and may contain the characters [a-z0-9-]. The prefix gcp- is reserved
+          for use by Google, and may not be specified.
+
+          To set the namespace attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --namespace on the command line.
+
+       --workload-identity-pool=WORKLOAD_IDENTITY_POOL
+          The ID to use for the pool, which becomes the final component of the
+          resource name. This value should be 4-32 characters, and may contain
+          the characters [a-z0-9-]. The prefix gcp- is reserved for use by
+          Google, and may not be specified.
+
+          To set the workload-identity-pool attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --workload-identity-pool on the command
+            line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the iam/v1 API. The full documentation for this API can
+    be found at: https://cloud.google.com/iam/
diff --git a/gcloud/iam/workload-identity-pools/managed-identities/help b/gcloud/iam/workload-identity-pools/managed-identities/help
new file mode 100644
index 000000000..d33e6251e
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/managed-identities/help
@@ -0,0 +1,57 @@
+NAME
+    gcloud iam workload-identity-pools managed-identities - manage IAM workload
+        identity pool managed identities
+
+SYNOPSIS
+    gcloud iam workload-identity-pools managed-identities GROUP | COMMAND
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Commands for managing IAM workload identity pool managed identities.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+GROUPS
+    GROUP is one of the following:
+
+     operations
+        Manage IAM workload identity pool managed identity long running
+        operations.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     add-attestation-rule
+        Add an attestation rule on a workload identity pool managed identity.
+
+     create
+        Create a workload identity pool managed identity.
+
+     delete
+        Delete a workload identity pool managed identity.
+
+     describe
+        Describe a workload identity pool managed identity.
+
+     list
+        List workload identity pool managed identities.
+
+     list-attestation-rules
+        List the attestation rules on a workload identity pool managed
+        identity.
+
+     remove-attestation-rule
+        Remove an attestation rule on a workload identity pool managed
+        identity.
+
+     set-attestation-rules
+        Set attestation rules on a workload identity pool managed identity.
+
+     undelete
+        Undelete a workload identity pool managed identity.
+
+     update
+        Update workload identity pool managed identity.
diff --git a/gcloud/iam/workload-identity-pools/managed-identities/list b/gcloud/iam/workload-identity-pools/managed-identities/list
new file mode 100644
index 000000000..a83a31849
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/managed-identities/list
@@ -0,0 +1,108 @@
+NAME
+    gcloud iam workload-identity-pools managed-identities list - list workload
+        identity pool managed identities
+
+SYNOPSIS
+    gcloud iam workload-identity-pools managed-identities list
+        (--namespace=NAMESPACE : --location=LOCATION
+          --workload-identity-pool=WORKLOAD_IDENTITY_POOL) [--show-deleted]
+        [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
+        [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    List workload identity pool managed identities.
+
+EXAMPLES
+    The following command lists all managed identities in the workload identity
+    pool namespace, including soft-deleted managed identities:
+
+        $ gcloud iam workload-identity-pools managed-identities list \
+            --namespace="my-namespace" \
+            --workload-identity-pool="my-workload-identity-pool" \
+            --location="global" --show-deleted
+
+REQUIRED FLAGS
+     Workload identity pool namespace resource - Parent workload identity pool
+     namespace to list managed identities for. The arguments in this group can
+     be used to specify the attributes of this resource. (NOTE) Some attributes
+     are not given arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument --namespace on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       --namespace=NAMESPACE
+          ID of the workload identity pool namespace or fully qualified
+          identifier for the workload identity pool namespace.
+
+          To set the namespace attribute:
+          ▸ provide the argument --namespace on the command line.
+
+          This flag argument must be specified if any of the other arguments in
+          this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument --namespace on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+       --workload-identity-pool=WORKLOAD_IDENTITY_POOL
+          The ID to use for the pool, which becomes the final component of the
+          resource name. This value should be 4-32 characters, and may contain
+          the characters [a-z0-9-]. The prefix gcp- is reserved for use by
+          Google, and may not be specified.
+
+          To set the workload-identity-pool attribute:
+          ▸ provide the argument --namespace on the command line with a fully
+            specified name;
+          ▸ provide the argument --workload-identity-pool on the command
+            line.
+
+FLAGS
+     --show-deleted
+        Whether to return soft-deleted resources.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the iam/v1 API. The full documentation for this API can
+    be found at: https://cloud.google.com/iam/
diff --git a/gcloud/iam/workload-identity-pools/managed-identities/list-attestation-rules b/gcloud/iam/workload-identity-pools/managed-identities/list-attestation-rules
new file mode 100644
index 000000000..c1eb2bb99
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/managed-identities/list-attestation-rules
@@ -0,0 +1,121 @@
+NAME
+    gcloud iam workload-identity-pools managed-identities
+        list-attestation-rules - list the attestation rules on a workload
+        identity pool managed identity
+
+SYNOPSIS
+    gcloud iam workload-identity-pools managed-identities
+        list-attestation-rules
+        (MANAGED_IDENTITY : --location=LOCATION --namespace=NAMESPACE
+          --workload-identity-pool=WORKLOAD_IDENTITY_POOL)
+        [--container-id-filter=CONTAINER_ID_FILTER] [--filter=EXPRESSION]
+        [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    List the attestation rules on a workload identity pool managed identity.
+
+EXAMPLES
+    The following command lists the attestation rules on a workload identity
+    pool managed identity my-managed-identity with a container id filter.
+
+        $ gcloud iam workload-identity-pools managed-identities \
+            list-attestation-rules my-managed-identity \
+            --namespace="my-namespace" \
+            --workload-identity-pool="my-workload-identity-pool" \
+            --location="global" \
+            --container-id-filter="projects/123,projects/456"
+
+POSITIONAL ARGUMENTS
+     Workload identity pool managed identity resource - The managed identity to
+     list attestation rules. The arguments in this group can be used to specify
+     the attributes of this resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument managed_identity on the command line with a
+        fully specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       MANAGED_IDENTITY
+          ID of the workload identity pool managed identity or fully qualified
+          identifier for the workload identity pool managed identity.
+
+          To set the managed_identity attribute:
+          ▸ provide the argument managed_identity on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --location on the command line.
+
+       --namespace=NAMESPACE
+          The ID to use for the namespace. This value must be 2-63 characters,
+          and may contain the characters [a-z0-9-]. The prefix gcp- is reserved
+          for use by Google, and may not be specified.
+
+          To set the namespace attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --namespace on the command line.
+
+       --workload-identity-pool=WORKLOAD_IDENTITY_POOL
+          The ID to use for the pool, which becomes the final component of the
+          resource name. This value should be 4-32 characters, and may contain
+          the characters [a-z0-9-]. The prefix gcp- is reserved for use by
+          Google, and may not be specified.
+
+          To set the workload-identity-pool attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --workload-identity-pool on the command
+            line.
+
+FLAGS
+     --container-id-filter=CONTAINER_ID_FILTER
+        Apply a filter on the container ids of the attestation rules being
+        listed. Expects a comma-delimited string of project numbers in the
+        format projects/<project-number>,....
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
diff --git a/gcloud/iam/workload-identity-pools/managed-identities/operations/describe b/gcloud/iam/workload-identity-pools/managed-identities/operations/describe
new file mode 100644
index 000000000..b3675e234
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/managed-identities/operations/describe
@@ -0,0 +1,101 @@
+NAME
+    gcloud iam workload-identity-pools managed-identities operations describe -
+        describe a workload identity pool managed identity operation
+
+SYNOPSIS
+    gcloud iam workload-identity-pools managed-identities operations describe
+        (OPERATION : --location=LOCATION --managed-identity=MANAGED_IDENTITY
+          --namespace=NAMESPACE
+          --workload-identity-pool=WORKLOAD_IDENTITY_POOL)
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Describe a workload identity pool managed identity operation.
+
+EXAMPLES
+    The following command describes the long-running workload identity pool
+    managed identity operation with the ID my-operation:
+
+        $ gcloud iam workload-identity-pools managed-identities operations \
+            describe my-operation \
+            --workload-identity-pool="my-workload-identity-pool" \
+            --namespace="my-namespace" \
+            --managed-identity="my-managed-identity" --location="global"
+
+POSITIONAL ARGUMENTS
+     Workload identity pool managed identity operation resource - Workload
+     identity pool managed identity long-running operation to describe. The
+     arguments in this group can be used to specify the attributes of this
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument operation on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       OPERATION
+          ID of the workload identity pool managed identity operation or fully
+          qualified identifier for the workload identity pool managed identity
+          operation.
+
+          To set the operation attribute:
+          ▸ provide the argument operation on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument operation on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+       --managed-identity=MANAGED_IDENTITY
+          The ID to use for the managed identity. This value must be 2-63
+          characters and may contain the characters [a-z0-9-]. The prefix gcp-
+          is reserved for use by Google, and may not be specified.
+
+          To set the managed-identity attribute:
+          ▸ provide the argument operation on the command line with a fully
+            specified name;
+          ▸ provide the argument --managed-identity on the command line.
+
+       --namespace=NAMESPACE
+          The ID to use for the namespace. This value must be 2-63 characters,
+          and may contain the characters [a-z0-9-]. The prefix gcp- is reserved
+          for use by Google, and may not be specified.
+
+          To set the namespace attribute:
+          ▸ provide the argument operation on the command line with a fully
+            specified name;
+          ▸ provide the argument --namespace on the command line.
+
+       --workload-identity-pool=WORKLOAD_IDENTITY_POOL
+          The ID to use for the pool, which becomes the final component of the
+          resource name. This value should be 4-32 characters, and may contain
+          the characters [a-z0-9-]. The prefix gcp- is reserved for use by
+          Google, and may not be specified.
+
+          To set the workload-identity-pool attribute:
+          ▸ provide the argument operation on the command line with a fully
+            specified name;
+          ▸ provide the argument --workload-identity-pool on the command
+            line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the iam/v1 API. The full documentation for this API can
+    be found at: https://cloud.google.com/iam/
diff --git a/gcloud/iam/workload-identity-pools/managed-identities/operations/help b/gcloud/iam/workload-identity-pools/managed-identities/operations/help
new file mode 100644
index 000000000..914b179e5
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/managed-identities/operations/help
@@ -0,0 +1,22 @@
+NAME
+    gcloud iam workload-identity-pools managed-identities operations - manage
+        IAM workload identity pool managed identity long running operations
+
+SYNOPSIS
+    gcloud iam workload-identity-pools managed-identities operations COMMAND
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Commands for managing IAM workload identity pool managed identity long
+    running operations.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     describe
+        Describe a workload identity pool managed identity operation.
diff --git a/gcloud/iam/workload-identity-pools/managed-identities/remove-attestation-rule b/gcloud/iam/workload-identity-pools/managed-identities/remove-attestation-rule
new file mode 100644
index 000000000..dcbb41a76
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/managed-identities/remove-attestation-rule
@@ -0,0 +1,100 @@
+NAME
+    gcloud iam workload-identity-pools managed-identities
+        remove-attestation-rule - remove an attestation rule on a workload
+        identity pool managed identity
+
+SYNOPSIS
+    gcloud iam workload-identity-pools managed-identities
+        remove-attestation-rule
+        (MANAGED_IDENTITY : --location=LOCATION --namespace=NAMESPACE
+          --workload-identity-pool=WORKLOAD_IDENTITY_POOL)
+        --google-cloud-resource=GOOGLE_CLOUD_RESOURCE [--async]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Remove an attestation rule on a workload identity pool managed identity.
+
+EXAMPLES
+    The following command removes an attestation rule with a Google Cloud
+    resource on a workload identity pool managed identity my-managed-identity.
+
+        $ gcloud iam workload-identity-pools managed-identities \
+            remove-attestation-rule my-managed-identity \
+            --namespace="my-namespace" \
+            --workload-identity-pool="my-workload-identity-pool" \
+            --location="global" \
+            --google-cloud-resource="//compute.googleapis.com/projects/123/t\
+        ype/Instance/attached_service_account.uid/12345"
+
+POSITIONAL ARGUMENTS
+     Workload identity pool managed identity resource - The workload identity
+     pool managed identity to remove attestation rule on. The arguments in this
+     group can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways.
+
+     To set the project attribute:
+      ◆ provide the argument managed_identity on the command line with a
+        fully specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       MANAGED_IDENTITY
+          ID of the workload identity pool managed identity or fully qualified
+          identifier for the workload identity pool managed identity.
+
+          To set the managed_identity attribute:
+          ▸ provide the argument managed_identity on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --location on the command line.
+
+       --namespace=NAMESPACE
+          The ID to use for the namespace. This value must be 2-63 characters,
+          and may contain the characters [a-z0-9-]. The prefix gcp- is reserved
+          for use by Google, and may not be specified.
+
+          To set the namespace attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --namespace on the command line.
+
+       --workload-identity-pool=WORKLOAD_IDENTITY_POOL
+          The ID to use for the pool, which becomes the final component of the
+          resource name. This value should be 4-32 characters, and may contain
+          the characters [a-z0-9-]. The prefix gcp- is reserved for use by
+          Google, and may not be specified.
+
+          To set the workload-identity-pool attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --workload-identity-pool on the command
+            line.
+
+REQUIRED FLAGS
+     --google-cloud-resource=GOOGLE_CLOUD_RESOURCE
+        A single workload operating on Google Cloud. This will be set in the
+        attestation rule to be added.
+
+OPTIONAL FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
diff --git a/gcloud/iam/workload-identity-pools/managed-identities/set-attestation-rules b/gcloud/iam/workload-identity-pools/managed-identities/set-attestation-rules
new file mode 100644
index 000000000..2d3919d0e
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/managed-identities/set-attestation-rules
@@ -0,0 +1,96 @@
+NAME
+    gcloud iam workload-identity-pools managed-identities set-attestation-rules
+        - set attestation rules on a workload identity pool managed identity
+
+SYNOPSIS
+    gcloud iam workload-identity-pools managed-identities set-attestation-rules
+        (MANAGED_IDENTITY : --location=LOCATION --namespace=NAMESPACE
+          --workload-identity-pool=WORKLOAD_IDENTITY_POOL)
+        --policy-file=POLICY_FILE [--async] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Set attestation rules on a workload identity pool managed identity.
+
+EXAMPLES
+    The following command sets attestation rules on a workload identity pool
+    managed identity my-managed-identity using a policy file.
+
+        $ gcloud iam workload-identity-pools managed-identities \
+            set-attestation-rules my-managed-identity \
+            --namespace="my-namespace" \
+            --workload-identity-pool="my-workload-identity-pool" \
+            --location="global" --policy-file="policy.json"
+
+POSITIONAL ARGUMENTS
+     Workload identity pool managed identity resource - The workload identity
+     pool managed identity to set attestation rules on. The arguments in this
+     group can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways.
+
+     To set the project attribute:
+      ◆ provide the argument managed_identity on the command line with a
+        fully specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       MANAGED_IDENTITY
+          ID of the workload identity pool managed identity or fully qualified
+          identifier for the workload identity pool managed identity.
+
+          To set the managed_identity attribute:
+          ▸ provide the argument managed_identity on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --location on the command line.
+
+       --namespace=NAMESPACE
+          The ID to use for the namespace. This value must be 2-63 characters,
+          and may contain the characters [a-z0-9-]. The prefix gcp- is reserved
+          for use by Google, and may not be specified.
+
+          To set the namespace attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --namespace on the command line.
+
+       --workload-identity-pool=WORKLOAD_IDENTITY_POOL
+          The ID to use for the pool, which becomes the final component of the
+          resource name. This value should be 4-32 characters, and may contain
+          the characters [a-z0-9-]. The prefix gcp- is reserved for use by
+          Google, and may not be specified.
+
+          To set the workload-identity-pool attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --workload-identity-pool on the command
+            line.
+
+REQUIRED FLAGS
+     --policy-file=POLICY_FILE
+        Path to a local JSON-formatted or YAML-formatted file containing an
+        attestation policy, structured as a list of attestation rules
+        (https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.namespaces.managedIdentities/setAttestationRules#request-body).
+
+OPTIONAL FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
diff --git a/gcloud/iam/workload-identity-pools/managed-identities/undelete b/gcloud/iam/workload-identity-pools/managed-identities/undelete
new file mode 100644
index 000000000..32289dbc7
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/managed-identities/undelete
@@ -0,0 +1,92 @@
+NAME
+    gcloud iam workload-identity-pools managed-identities undelete - undelete a
+        workload identity pool managed identity
+
+SYNOPSIS
+    gcloud iam workload-identity-pools managed-identities undelete
+        (MANAGED_IDENTITY : --location=LOCATION --namespace=NAMESPACE
+          --workload-identity-pool=WORKLOAD_IDENTITY_POOL) [--async]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Undelete a workload identity pool managed identity.
+
+EXAMPLES
+    The following command undeletes a workload identity pool managed identity
+    in the default project with the ID my-managed-identity.
+
+        $ gcloud iam workload-identity-pools managed-identities undelete \
+            my-managed-identity --location="global" \
+            --workload-identity-pool="my-workload-identity-pool" \
+            --namespace="my-namespace"
+
+POSITIONAL ARGUMENTS
+     Workload identity pool managed identity resource - Workload identity pool
+     managed identity to undelete. The arguments in this group can be used to
+     specify the attributes of this resource. (NOTE) Some attributes are not
+     given arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument managed_identity on the command line with a
+        fully specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       MANAGED_IDENTITY
+          ID of the workload identity pool managed identity or fully qualified
+          identifier for the workload identity pool managed identity.
+
+          To set the managed_identity attribute:
+          ▸ provide the argument managed_identity on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --location on the command line.
+
+       --namespace=NAMESPACE
+          The ID to use for the namespace. This value must be 2-63 characters,
+          and may contain the characters [a-z0-9-]. The prefix gcp- is reserved
+          for use by Google, and may not be specified.
+
+          To set the namespace attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --namespace on the command line.
+
+       --workload-identity-pool=WORKLOAD_IDENTITY_POOL
+          The ID to use for the pool, which becomes the final component of the
+          resource name. This value should be 4-32 characters, and may contain
+          the characters [a-z0-9-]. The prefix gcp- is reserved for use by
+          Google, and may not be specified.
+
+          To set the workload-identity-pool attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --workload-identity-pool on the command
+            line.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the iam/v1 API. The full documentation for this API can
+    be found at: https://cloud.google.com/iam/
diff --git a/gcloud/iam/workload-identity-pools/managed-identities/update b/gcloud/iam/workload-identity-pools/managed-identities/update
new file mode 100644
index 000000000..433212f4b
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/managed-identities/update
@@ -0,0 +1,101 @@
+NAME
+    gcloud iam workload-identity-pools managed-identities update - update
+        workload identity pool managed identity
+
+SYNOPSIS
+    gcloud iam workload-identity-pools managed-identities update
+        (MANAGED_IDENTITY : --location=LOCATION --namespace=NAMESPACE
+          --workload-identity-pool=WORKLOAD_IDENTITY_POOL) [--async]
+        [--description=DESCRIPTION] [--disabled] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Update workload identity pool managed identity.
+
+EXAMPLES
+    The following command updates the workload identity pool managed identity
+    with the ID my-managed-identity:
+
+        $ gcloud iam workload-identity-pools managed-identities update \
+            my-managed-identity --location="global" \
+            --workload-identity-pool="my-workload-identity-pool" \
+            --namespace="my-namespace" \
+            --description="My managed identity description" --disabled
+
+POSITIONAL ARGUMENTS
+     Workload identity pool managed identity resource - Workload identity pool
+     managed identity to update. The arguments in this group can be used to
+     specify the attributes of this resource. (NOTE) Some attributes are not
+     given arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument managed_identity on the command line with a
+        fully specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       MANAGED_IDENTITY
+          ID of the workload identity pool managed identity or fully qualified
+          identifier for the workload identity pool managed identity.
+
+          To set the managed_identity attribute:
+          ▸ provide the argument managed_identity on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --location on the command line.
+
+       --namespace=NAMESPACE
+          The ID to use for the namespace. This value must be 2-63 characters,
+          and may contain the characters [a-z0-9-]. The prefix gcp- is reserved
+          for use by Google, and may not be specified.
+
+          To set the namespace attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --namespace on the command line.
+
+       --workload-identity-pool=WORKLOAD_IDENTITY_POOL
+          The ID to use for the pool, which becomes the final component of the
+          resource name. This value should be 4-32 characters, and may contain
+          the characters [a-z0-9-]. The prefix gcp- is reserved for use by
+          Google, and may not be specified.
+
+          To set the workload-identity-pool attribute:
+          ▸ provide the argument managed_identity on the command line with a
+            fully specified name;
+          ▸ provide the argument --workload-identity-pool on the command
+            line.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+     --description=DESCRIPTION
+        A description of the managed identity.
+
+     --disabled
+        Whether the managed identity is disabled. If disabled, credentials may
+        no longer be issued for this identity. Existing credentials may
+        continue to be accepted until they expire.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the iam/v1 API. The full documentation for this API can
+    be found at: https://cloud.google.com/iam/
diff --git a/gcloud/iam/workload-identity-pools/namespaces/add-attestation-rule b/gcloud/iam/workload-identity-pools/namespaces/add-attestation-rule
new file mode 100644
index 000000000..b55e1629d
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/namespaces/add-attestation-rule
@@ -0,0 +1,86 @@
+NAME
+    gcloud iam workload-identity-pools namespaces add-attestation-rule - add an
+        attestation rule on a workload identity pool namespace
+
+SYNOPSIS
+    gcloud iam workload-identity-pools namespaces add-attestation-rule
+        (NAMESPACE : --location=LOCATION
+          --workload-identity-pool=WORKLOAD_IDENTITY_POOL)
+        --google-cloud-resource=GOOGLE_CLOUD_RESOURCE [--async]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Add an attestation rule on a workload identity pool namespace.
+
+EXAMPLES
+    The following command adds an attestation rule with a Google Cloud resource
+    on a workload identity pool namespace my-namespace.
+
+        $ gcloud iam workload-identity-pools namespaces \
+            add-attestation-rule my-namespace \
+            --workload-identity-pool="my-workload-identity-pool" \
+            --location="global" \
+            --google-cloud-resource="//compute.googleapis.com/projects/123/t\
+        ype/Instance/attached_service_account.uid/12345"
+
+POSITIONAL ARGUMENTS
+     Workload identity pool namespace resource - The workload identity pool
+     namespace to add attestation rule on. The arguments in this group can be
+     used to specify the attributes of this resource. (NOTE) Some attributes
+     are not given arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument namespace on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       NAMESPACE
+          ID of the workload identity pool namespace or fully qualified
+          identifier for the workload identity pool namespace.
+
+          To set the namespace attribute:
+          ▸ provide the argument namespace on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument namespace on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+       --workload-identity-pool=WORKLOAD_IDENTITY_POOL
+          The ID to use for the pool, which becomes the final component of the
+          resource name. This value should be 4-32 characters, and may contain
+          the characters [a-z0-9-]. The prefix gcp- is reserved for use by
+          Google, and may not be specified.
+
+          To set the workload-identity-pool attribute:
+          ▸ provide the argument namespace on the command line with a fully
+            specified name;
+          ▸ provide the argument --workload-identity-pool on the command
+            line.
+
+REQUIRED FLAGS
+     --google-cloud-resource=GOOGLE_CLOUD_RESOURCE
+        A single workload operating on Google Cloud. This will be set in the
+        attestation rule to be added.
+
+OPTIONAL FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
diff --git a/gcloud/iam/workload-identity-pools/namespaces/create b/gcloud/iam/workload-identity-pools/namespaces/create
new file mode 100644
index 000000000..cbf8c2625
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/namespaces/create
@@ -0,0 +1,90 @@
+NAME
+    gcloud iam workload-identity-pools namespaces create - create a workload
+        identity pool namespace
+
+SYNOPSIS
+    gcloud iam workload-identity-pools namespaces create
+        (NAMESPACE : --location=LOCATION
+          --workload-identity-pool=WORKLOAD_IDENTITY_POOL) [--async]
+        [--description=DESCRIPTION] [--disabled] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Create a workload identity pool namespace.
+
+EXAMPLES
+    The following command creates a workload identity pool namespace with the
+    ID my-namespace:
+
+        $ gcloud iam workload-identity-pools namespaces create \
+            my-namespace --location="global" \
+            --workload-identity-pool="my-workload-identity-pool" \
+            --description="My namespace description" --disabled
+
+POSITIONAL ARGUMENTS
+     Workload identity pool namespace resource - The workload identity pool
+     namespace to create. The arguments in this group can be used to specify
+     the attributes of this resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument namespace on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       NAMESPACE
+          ID of the workload identity pool namespace or fully qualified
+          identifier for the workload identity pool namespace.
+
+          To set the namespace attribute:
+          ▸ provide the argument namespace on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument namespace on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+       --workload-identity-pool=WORKLOAD_IDENTITY_POOL
+          The ID to use for the pool, which becomes the final component of the
+          resource name. This value should be 4-32 characters, and may contain
+          the characters [a-z0-9-]. The prefix gcp- is reserved for use by
+          Google, and may not be specified.
+
+          To set the workload-identity-pool attribute:
+          ▸ provide the argument namespace on the command line with a fully
+            specified name;
+          ▸ provide the argument --workload-identity-pool on the command
+            line.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+     --description=DESCRIPTION
+        A description of the namespace.
+
+     --disabled
+        Whether the namespace is disabled. If disabled, credentials may no
+        longer be issued for identities in this namespace. Existing credentials
+        may continue to be accepted until they expire.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the iam/v1 API. The full documentation for this API can
+    be found at: https://cloud.google.com/iam/
diff --git a/gcloud/iam/workload-identity-pools/namespaces/delete b/gcloud/iam/workload-identity-pools/namespaces/delete
new file mode 100644
index 000000000..74aefa4da
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/namespaces/delete
@@ -0,0 +1,81 @@
+NAME
+    gcloud iam workload-identity-pools namespaces delete - delete a workload
+        identity pool namespace
+
+SYNOPSIS
+    gcloud iam workload-identity-pools namespaces delete
+        (NAMESPACE : --location=LOCATION
+          --workload-identity-pool=WORKLOAD_IDENTITY_POOL) [--async]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Delete a workload identity pool namespace.
+
+EXAMPLES
+    The following command deletes a workload identity pool namespace in the
+    default project with the ID my-namespace.
+
+        $ gcloud iam workload-identity-pools namespaces delete \
+            my-namespace --location="global" \
+            --workload-identity-pool="my-workload-identity-pool"
+
+POSITIONAL ARGUMENTS
+     Workload identity pool namespace resource - The workload identity pool
+     namespace to delete. The arguments in this group can be used to specify
+     the attributes of this resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument namespace on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       NAMESPACE
+          ID of the workload identity pool namespace or fully qualified
+          identifier for the workload identity pool namespace.
+
+          To set the namespace attribute:
+          ▸ provide the argument namespace on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument namespace on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+       --workload-identity-pool=WORKLOAD_IDENTITY_POOL
+          The ID to use for the pool, which becomes the final component of the
+          resource name. This value should be 4-32 characters, and may contain
+          the characters [a-z0-9-]. The prefix gcp- is reserved for use by
+          Google, and may not be specified.
+
+          To set the workload-identity-pool attribute:
+          ▸ provide the argument namespace on the command line with a fully
+            specified name;
+          ▸ provide the argument --workload-identity-pool on the command
+            line.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the iam/v1 API. The full documentation for this API can
+    be found at: https://cloud.google.com/iam/
diff --git a/gcloud/iam/workload-identity-pools/namespaces/describe b/gcloud/iam/workload-identity-pools/namespaces/describe
new file mode 100644
index 000000000..f0349431f
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/namespaces/describe
@@ -0,0 +1,76 @@
+NAME
+    gcloud iam workload-identity-pools namespaces describe - describe a
+        workload identity pool namespace
+
+SYNOPSIS
+    gcloud iam workload-identity-pools namespaces describe
+        (NAMESPACE : --location=LOCATION
+          --workload-identity-pool=WORKLOAD_IDENTITY_POOL)
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Describe a workload identity pool namespace.
+
+EXAMPLES
+    The following command describes a workload identity pool namespace in the
+    default project with the ID my-namespace.
+
+        $ gcloud iam workload-identity-pools namespaces describe \
+            my-namespace --location="global" \
+            --workload-identity-pool="my-workload-identity-pool"
+
+POSITIONAL ARGUMENTS
+     Workload identity pool namespace resource - The workload identity pool
+     namespace to describe. The arguments in this group can be used to specify
+     the attributes of this resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument namespace on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       NAMESPACE
+          ID of the workload identity pool namespace or fully qualified
+          identifier for the workload identity pool namespace.
+
+          To set the namespace attribute:
+          ▸ provide the argument namespace on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument namespace on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+       --workload-identity-pool=WORKLOAD_IDENTITY_POOL
+          The ID to use for the pool, which becomes the final component of the
+          resource name. This value should be 4-32 characters, and may contain
+          the characters [a-z0-9-]. The prefix gcp- is reserved for use by
+          Google, and may not be specified.
+
+          To set the workload-identity-pool attribute:
+          ▸ provide the argument namespace on the command line with a fully
+            specified name;
+          ▸ provide the argument --workload-identity-pool on the command
+            line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the iam/v1 API. The full documentation for this API can
+    be found at: https://cloud.google.com/iam/
diff --git a/gcloud/iam/workload-identity-pools/namespaces/help b/gcloud/iam/workload-identity-pools/namespaces/help
new file mode 100644
index 000000000..e2061233b
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/namespaces/help
@@ -0,0 +1,54 @@
+NAME
+    gcloud iam workload-identity-pools namespaces - manage IAM workload
+        identity pool namespaces
+
+SYNOPSIS
+    gcloud iam workload-identity-pools namespaces GROUP | COMMAND
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Commands for managing IAM workload identity pool namespaces.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+GROUPS
+    GROUP is one of the following:
+
+     operations
+        Manage IAM workload identity pool namespace long running operations.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     add-attestation-rule
+        Add an attestation rule on a workload identity pool namespace.
+
+     create
+        Create a workload identity pool namespace.
+
+     delete
+        Delete a workload identity pool namespace.
+
+     describe
+        Describe a workload identity pool namespace.
+
+     list
+        List workload identity pool namespaces.
+
+     list-attestation-rules
+        List the attestation rules on a workload identity pool namespace.
+
+     remove-attestation-rule
+        Remove an attestation rule on a workload identity pool namespace.
+
+     set-attestation-rules
+        Set attestation rules on a workload identity pool namespace.
+
+     undelete
+        Undelete a workload identity pool namespace.
+
+     update
+        Update workload identity pool namespace.
diff --git a/gcloud/iam/workload-identity-pools/namespaces/list b/gcloud/iam/workload-identity-pools/namespaces/list
new file mode 100644
index 000000000..b10c27447
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/namespaces/list
@@ -0,0 +1,95 @@
+NAME
+    gcloud iam workload-identity-pools namespaces list - list workload identity
+        pool namespaces
+
+SYNOPSIS
+    gcloud iam workload-identity-pools namespaces list
+        (--workload-identity-pool=WORKLOAD_IDENTITY_POOL : --location=LOCATION)
+        [--show-deleted] [--filter=EXPRESSION] [--limit=LIMIT]
+        [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    List workload identity pool namespaces.
+
+EXAMPLES
+    The following command lists all namespaces in the workload identity pool,
+    including soft-deleted namespaces:
+
+        $ gcloud iam workload-identity-pools namespaces list \
+            --workload-identity-pool="my-workload-identity-pool" \
+            --location="global" --show-deleted
+
+REQUIRED FLAGS
+     Workload identity pool resource - The parent workload identity pool to
+     list namespaces for. The arguments in this group can be used to specify
+     the attributes of this resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument --workload-identity-pool on the command line
+        with a fully specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       --workload-identity-pool=WORKLOAD_IDENTITY_POOL
+          ID of the workload identity pool or fully qualified identifier for
+          the workload identity pool.
+
+          To set the workload-identity-pool attribute:
+          ▸ provide the argument --workload-identity-pool on the command
+            line.
+
+          This flag argument must be specified if any of the other arguments in
+          this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument --workload-identity-pool on the command line
+            with a fully specified name;
+          ▸ provide the argument --location on the command line.
+
+FLAGS
+     --show-deleted
+        Whether to return soft-deleted resources.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the iam/v1 API. The full documentation for this API can
+    be found at: https://cloud.google.com/iam/
diff --git a/gcloud/iam/workload-identity-pools/namespaces/list-attestation-rules b/gcloud/iam/workload-identity-pools/namespaces/list-attestation-rules
new file mode 100644
index 000000000..35d062eef
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/namespaces/list-attestation-rules
@@ -0,0 +1,108 @@
+NAME
+    gcloud iam workload-identity-pools namespaces list-attestation-rules - list
+        the attestation rules on a workload identity pool namespace
+
+SYNOPSIS
+    gcloud iam workload-identity-pools namespaces list-attestation-rules
+        (NAMESPACE : --location=LOCATION
+          --workload-identity-pool=WORKLOAD_IDENTITY_POOL)
+        [--container-id-filter=CONTAINER_ID_FILTER] [--filter=EXPRESSION]
+        [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    List the attestation rules on a workload identity pool namespace.
+
+EXAMPLES
+    The following command lists the attestation rules on a workload identity
+    pool namespace my-namespace with a container id filter.
+
+        $ gcloud iam workload-identity-pools namespaces \
+            list-attestation-rules my-namespace \
+            --workload-identity-pool="my-workload-identity-pool" \
+            --location="global" \
+            --container-id-filter="projects/123,projects/456"
+
+POSITIONAL ARGUMENTS
+     Workload identity pool namespace resource - The namespace to list
+     attestation rules. The arguments in this group can be used to specify the
+     attributes of this resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument namespace on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       NAMESPACE
+          ID of the workload identity pool namespace or fully qualified
+          identifier for the workload identity pool namespace.
+
+          To set the namespace attribute:
+          ▸ provide the argument namespace on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument namespace on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+       --workload-identity-pool=WORKLOAD_IDENTITY_POOL
+          The ID to use for the pool, which becomes the final component of the
+          resource name. This value should be 4-32 characters, and may contain
+          the characters [a-z0-9-]. The prefix gcp- is reserved for use by
+          Google, and may not be specified.
+
+          To set the workload-identity-pool attribute:
+          ▸ provide the argument namespace on the command line with a fully
+            specified name;
+          ▸ provide the argument --workload-identity-pool on the command
+            line.
+
+FLAGS
+     --container-id-filter=CONTAINER_ID_FILTER
+        Apply a filter on the container ids of the attestation rules being
+        listed. Expects a comma-delimited string of project numbers in the
+        format projects/<project-number>,....
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
diff --git a/gcloud/iam/workload-identity-pools/namespaces/operations/describe b/gcloud/iam/workload-identity-pools/namespaces/operations/describe
new file mode 100644
index 000000000..5eecb5697
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/namespaces/operations/describe
@@ -0,0 +1,89 @@
+NAME
+    gcloud iam workload-identity-pools namespaces operations describe -
+        describe a workload identity pool namespace operation
+
+SYNOPSIS
+    gcloud iam workload-identity-pools namespaces operations describe
+        (OPERATION : --location=LOCATION --namespace=NAMESPACE
+          --workload-identity-pool=WORKLOAD_IDENTITY_POOL)
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Describe a workload identity pool namespace operation.
+
+EXAMPLES
+    The following command describes the long-running workload identity pool
+    namespace operation with the ID my-operation:
+
+        $ gcloud iam workload-identity-pools namespaces operations \
+            describe my-operation \
+            --workload-identity-pool="my-workload-identity-pool" \
+            --namespace="my-namespace" --location="global"
+
+POSITIONAL ARGUMENTS
+     Workload identity pool namespace operation resource - The workload
+     identity pool namespace long-running operation to describe. The arguments
+     in this group can be used to specify the attributes of this resource.
+     (NOTE) Some attributes are not given arguments in this group but can be
+     set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument operation on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       OPERATION
+          ID of the workload identity pool namespace operation or fully
+          qualified identifier for the workload identity pool namespace
+          operation.
+
+          To set the operation attribute:
+          ▸ provide the argument operation on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument operation on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+       --namespace=NAMESPACE
+          The ID to use for the namespace. This value must be 2-63 characters,
+          and may contain the characters [a-z0-9-]. The prefix gcp- is reserved
+          for use by Google, and may not be specified.
+
+          To set the namespace attribute:
+          ▸ provide the argument operation on the command line with a fully
+            specified name;
+          ▸ provide the argument --namespace on the command line.
+
+       --workload-identity-pool=WORKLOAD_IDENTITY_POOL
+          The ID to use for the pool, which becomes the final component of the
+          resource name. This value should be 4-32 characters, and may contain
+          the characters [a-z0-9-]. The prefix gcp- is reserved for use by
+          Google, and may not be specified.
+
+          To set the workload-identity-pool attribute:
+          ▸ provide the argument operation on the command line with a fully
+            specified name;
+          ▸ provide the argument --workload-identity-pool on the command
+            line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the iam/v1 API. The full documentation for this API can
+    be found at: https://cloud.google.com/iam/
diff --git a/gcloud/iam/workload-identity-pools/namespaces/operations/help b/gcloud/iam/workload-identity-pools/namespaces/operations/help
new file mode 100644
index 000000000..b7ec3a6e2
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/namespaces/operations/help
@@ -0,0 +1,22 @@
+NAME
+    gcloud iam workload-identity-pools namespaces operations - manage IAM
+        workload identity pool namespace long running operations
+
+SYNOPSIS
+    gcloud iam workload-identity-pools namespaces operations COMMAND
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Commands for managing IAM workload identity pool namespace long running
+    operations.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     describe
+        Describe a workload identity pool namespace operation.
diff --git a/gcloud/iam/workload-identity-pools/namespaces/remove-attestation-rule b/gcloud/iam/workload-identity-pools/namespaces/remove-attestation-rule
new file mode 100644
index 000000000..bccb05817
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/namespaces/remove-attestation-rule
@@ -0,0 +1,86 @@
+NAME
+    gcloud iam workload-identity-pools namespaces remove-attestation-rule -
+        remove an attestation rule on a workload identity pool namespace
+
+SYNOPSIS
+    gcloud iam workload-identity-pools namespaces remove-attestation-rule
+        (NAMESPACE : --location=LOCATION
+          --workload-identity-pool=WORKLOAD_IDENTITY_POOL)
+        --google-cloud-resource=GOOGLE_CLOUD_RESOURCE [--async]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Remove an attestation rule on a workload identity pool namespace.
+
+EXAMPLES
+    The following command removes an attestation rule with a Google Cloud
+    resource on a workload identity pool namespace my-namespace.
+
+        $ gcloud iam workload-identity-pools namespaces \
+            remove-attestation-rule my-namespace \
+            --workload-identity-pool="my-workload-identity-pool" \
+            --location="global" \
+            --google-cloud-resource="//compute.googleapis.com/projects/123/t\
+        ype/Instance/attached_service_account.uid/12345"
+
+POSITIONAL ARGUMENTS
+     Workload identity pool namespace resource - The workload identity pool
+     namespace to remove attestation rule on. The arguments in this group can
+     be used to specify the attributes of this resource. (NOTE) Some attributes
+     are not given arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument namespace on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       NAMESPACE
+          ID of the workload identity pool namespace or fully qualified
+          identifier for the workload identity pool namespace.
+
+          To set the namespace attribute:
+          ▸ provide the argument namespace on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument namespace on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+       --workload-identity-pool=WORKLOAD_IDENTITY_POOL
+          The ID to use for the pool, which becomes the final component of the
+          resource name. This value should be 4-32 characters, and may contain
+          the characters [a-z0-9-]. The prefix gcp- is reserved for use by
+          Google, and may not be specified.
+
+          To set the workload-identity-pool attribute:
+          ▸ provide the argument namespace on the command line with a fully
+            specified name;
+          ▸ provide the argument --workload-identity-pool on the command
+            line.
+
+REQUIRED FLAGS
+     --google-cloud-resource=GOOGLE_CLOUD_RESOURCE
+        A single workload operating on Google Cloud. This will be set in the
+        attestation rule to be added.
+
+OPTIONAL FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
diff --git a/gcloud/iam/workload-identity-pools/namespaces/set-attestation-rules b/gcloud/iam/workload-identity-pools/namespaces/set-attestation-rules
new file mode 100644
index 000000000..c595ee3e8
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/namespaces/set-attestation-rules
@@ -0,0 +1,84 @@
+NAME
+    gcloud iam workload-identity-pools namespaces set-attestation-rules - set
+        attestation rules on a workload identity pool namespace
+
+SYNOPSIS
+    gcloud iam workload-identity-pools namespaces set-attestation-rules
+        (NAMESPACE : --location=LOCATION
+          --workload-identity-pool=WORKLOAD_IDENTITY_POOL)
+        --policy-file=POLICY_FILE [--async] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Set attestation rules on a workload identity pool namespace.
+
+EXAMPLES
+    The following command sets attestation rules on a workload identity pool
+    namespace my-namespace using a policy file.
+
+        $ gcloud iam workload-identity-pools namespaces \
+            set-attestation-rules my-namespace \
+            --workload-identity-pool="my-workload-identity-pool" \
+            --location="global" --policy-file="policy.json"
+
+POSITIONAL ARGUMENTS
+     Workload identity pool namespace resource - The workload identity pool
+     namespace to set attestations rule on. The arguments in this group can be
+     used to specify the attributes of this resource. (NOTE) Some attributes
+     are not given arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument namespace on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       NAMESPACE
+          ID of the workload identity pool namespace or fully qualified
+          identifier for the workload identity pool namespace.
+
+          To set the namespace attribute:
+          ▸ provide the argument namespace on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument namespace on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+       --workload-identity-pool=WORKLOAD_IDENTITY_POOL
+          The ID to use for the pool, which becomes the final component of the
+          resource name. This value should be 4-32 characters, and may contain
+          the characters [a-z0-9-]. The prefix gcp- is reserved for use by
+          Google, and may not be specified.
+
+          To set the workload-identity-pool attribute:
+          ▸ provide the argument namespace on the command line with a fully
+            specified name;
+          ▸ provide the argument --workload-identity-pool on the command
+            line.
+
+REQUIRED FLAGS
+     --policy-file=POLICY_FILE
+        Path to a local JSON-formatted or YAML-formatted file containing an
+        attestation policy, structured as a list of attestation rules
+        (https://cloud.google.com/iam/docs/reference/rest/v1/projects.locations.workloadIdentityPools.namespaces/setAttestationRules#request-body).
+
+OPTIONAL FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
diff --git a/gcloud/iam/workload-identity-pools/namespaces/undelete b/gcloud/iam/workload-identity-pools/namespaces/undelete
new file mode 100644
index 000000000..5ab55b97c
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/namespaces/undelete
@@ -0,0 +1,81 @@
+NAME
+    gcloud iam workload-identity-pools namespaces undelete - undelete a
+        workload identity pool namespace
+
+SYNOPSIS
+    gcloud iam workload-identity-pools namespaces undelete
+        (NAMESPACE : --location=LOCATION
+          --workload-identity-pool=WORKLOAD_IDENTITY_POOL) [--async]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Undelete a workload identity pool namespace.
+
+EXAMPLES
+    The following command undeletes a workload identity pool namespace in the
+    default project with the ID my-namespace.
+
+        $ gcloud iam workload-identity-pools namespaces undelete \
+            my-namespace --location="global" \
+            --workload-identity-pool="my-workload-identity-pool"
+
+POSITIONAL ARGUMENTS
+     Workload identity pool namespace resource - The workload identity pool
+     namespace to undelete. The arguments in this group can be used to specify
+     the attributes of this resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument namespace on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       NAMESPACE
+          ID of the workload identity pool namespace or fully qualified
+          identifier for the workload identity pool namespace.
+
+          To set the namespace attribute:
+          ▸ provide the argument namespace on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument namespace on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+       --workload-identity-pool=WORKLOAD_IDENTITY_POOL
+          The ID to use for the pool, which becomes the final component of the
+          resource name. This value should be 4-32 characters, and may contain
+          the characters [a-z0-9-]. The prefix gcp- is reserved for use by
+          Google, and may not be specified.
+
+          To set the workload-identity-pool attribute:
+          ▸ provide the argument namespace on the command line with a fully
+            specified name;
+          ▸ provide the argument --workload-identity-pool on the command
+            line.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the iam/v1 API. The full documentation for this API can
+    be found at: https://cloud.google.com/iam/
diff --git a/gcloud/iam/workload-identity-pools/namespaces/update b/gcloud/iam/workload-identity-pools/namespaces/update
new file mode 100644
index 000000000..e4ff05774
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/namespaces/update
@@ -0,0 +1,90 @@
+NAME
+    gcloud iam workload-identity-pools namespaces update - update workload
+        identity pool namespace
+
+SYNOPSIS
+    gcloud iam workload-identity-pools namespaces update
+        (NAMESPACE : --location=LOCATION
+          --workload-identity-pool=WORKLOAD_IDENTITY_POOL) [--async]
+        [--description=DESCRIPTION] [--disabled] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Update workload identity pool namespace.
+
+EXAMPLES
+    The following command updates the workload identity pool namespace with the
+    ID my-namespace:
+
+        $ gcloud iam workload-identity-pools namespaces update \
+            my-namespace --location="global" \
+            --workload-identity-pool="my-workload-identity-pool" \
+            --description="My namespace description" --disabled
+
+POSITIONAL ARGUMENTS
+     Workload identity pool namespace resource - The workload identity pool
+     namespace to update. The arguments in this group can be used to specify
+     the attributes of this resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument namespace on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       NAMESPACE
+          ID of the workload identity pool namespace or fully qualified
+          identifier for the workload identity pool namespace.
+
+          To set the namespace attribute:
+          ▸ provide the argument namespace on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument namespace on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+       --workload-identity-pool=WORKLOAD_IDENTITY_POOL
+          The ID to use for the pool, which becomes the final component of the
+          resource name. This value should be 4-32 characters, and may contain
+          the characters [a-z0-9-]. The prefix gcp- is reserved for use by
+          Google, and may not be specified.
+
+          To set the workload-identity-pool attribute:
+          ▸ provide the argument namespace on the command line with a fully
+            specified name;
+          ▸ provide the argument --workload-identity-pool on the command
+            line.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+     --description=DESCRIPTION
+        A description of the namespace.
+
+     --disabled
+        Whether the namespace is disabled. If disabled, credentials may no
+        longer be issued for identities in this namespace. Existing credentials
+        may continue to be accepted until they expire.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the iam/v1 API. The full documentation for this API can
+    be found at: https://cloud.google.com/iam/
diff --git a/gcloud/iam/workload-identity-pools/remove-iam-policy-binding b/gcloud/iam/workload-identity-pools/remove-iam-policy-binding
new file mode 100644
index 000000000..f910ee749
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/remove-iam-policy-binding
@@ -0,0 +1,158 @@
+NAME
+    gcloud iam workload-identity-pools remove-iam-policy-binding - remove IAM
+        policy binding from a workload identity pool
+
+SYNOPSIS
+    gcloud iam workload-identity-pools remove-iam-policy-binding
+        (WORKLOAD_IDENTITY_POOL : --location=LOCATION) --member=PRINCIPAL
+        --role=ROLE
+        [--all | --condition=[KEY=VALUE,...]
+          | --condition-from-file=PATH_TO_FILE] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Removes a policy binding from the IAM policy of a workload identity pool. A
+    binding consists of at least one member, a role, and an optional condition.
+
+EXAMPLES
+    To remove an IAM policy binding for the role of
+    roles/iam.workloadIdentityPoolViewer for the user test-user@gmail.com on a
+    workload identity pool with identifier my-workload-identity-pool, run:
+
+        $ gcloud iam workload-identity-pools remove-iam-policy-binding \
+            my-workload-identity-pool --location="global" \
+            --member='user:test-user@gmail.com' \
+            --role='roles/iam.workloadIdentityPoolViewer'
+
+    To remove an IAM policy binding for the role of
+    roles/iam.workloadIdentityPoolViewer from all authenticated users on
+    workload identity pool with identifier my-workload-identity-pool, run:
+
+        $ gcloud iam workload-identity-pools remove-iam-policy-binding \
+            my-workload-identity-pool --location="global" \
+            --member='allAuthenticatedUsers' \
+            --role='roles/iam.workloadIdentityPoolViewer'
+
+    To remove an IAM policy binding which expires at the end of the year 2024
+    for the role of roles/iam.workloadIdentityPoolViewer and the user
+    test-user@gmail.com on a workload identity pool with identifier
+    my-workload-identity-pool, run:
+
+        $ gcloud iam workload-identity-pools remove-iam-policy-binding \
+            my-workload-identity-pool --location="global" \
+            --member='user:test-user@gmail.com' \
+            --role='roles/iam.workloadIdentityPoolViewer' \
+            --condition='expression=request.time <
+         timestamp("2019-01-01T00:00:00Z"),title=expires_end_of_2024,descrip\
+        tion=Expires at midnight on 2024-12-31'
+
+    See https://cloud.google.com/iam/docs/managing-policies for details on
+    policy role and member types.
+
+POSITIONAL ARGUMENTS
+     Workload identity pool resource - The workload identity pool to remove the
+     IAM policy binding from. The arguments in this group can be used to
+     specify the attributes of this resource. (NOTE) Some attributes are not
+     given arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument workload_identity_pool on the command line with
+        a fully specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       WORKLOAD_IDENTITY_POOL
+          ID of the workload identity pool or fully qualified identifier for
+          the workload identity pool.
+
+          To set the workload_identity_pool attribute:
+          ▸ provide the argument workload_identity_pool on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument workload_identity_pool on the command line
+            with a fully specified name;
+          ▸ provide the argument --location on the command line.
+
+REQUIRED FLAGS
+     --member=PRINCIPAL
+        The principal to remove the binding for. Should be of the form
+        user|group|serviceAccount:email or domain:domain.
+
+        Examples: user:test-user@gmail.com, group:admins@example.com,
+        serviceAccount:test123@example.domain.com, or
+        domain:example.domain.com.
+
+        Deleted principals have an additional deleted: prefix and a ?uid=UID
+        suffix, where UID is a unique identifier for the principal. Example:
+        deleted:user:test-user@gmail.com?uid=123456789012345678901.
+
+        Some resources also accept the following special values:
+        ◆ allUsers - Special identifier that represents anyone who is on the
+          internet, with or without a Google account.
+        ◆ allAuthenticatedUsers - Special identifier that represents anyone
+          who is authenticated with a Google account or a service account.
+
+     --role=ROLE
+        The role to remove the principal from.
+
+OPTIONAL FLAGS
+     At most one of these can be specified:
+
+       --all
+          Remove all bindings with this role and principal, irrespective of any
+          conditions.
+
+       --condition=[KEY=VALUE,...]
+          The condition of the binding that you want to remove. When the
+          condition is explicitly specified as None (--condition=None), a
+          binding without a condition is removed. Otherwise, only a binding
+          with a condition that exactly matches the specified condition
+          (including the optional description) is removed. For more on
+          conditions, refer to the conditions overview guide:
+          https://cloud.google.com/iam/docs/conditions-overview
+
+          When using the --condition flag, include the following key-value
+          pairs:
+
+           expression
+              (Required) Condition expression that evaluates to True or False.
+              This uses a subset of Common Expression Language syntax.
+
+              If the condition expression includes a comma, use a different
+              delimiter to separate the key-value pairs. Specify the delimiter
+              before listing the key-value pairs. For example, to specify a
+              colon (:) as the delimiter, do the following:
+              --condition=^:^title=TITLE:expression=EXPRESSION. For more
+              information, see
+              https://cloud.google.com/sdk/gcloud/reference/topic/escaping.
+
+           title
+              (Required) A short string describing the purpose of the
+              expression.
+
+           description
+              (Optional) Additional description for the expression.
+
+       --condition-from-file=PATH_TO_FILE
+          Path to a local JSON or YAML file that defines the condition. To see
+          available fields, see the help for --condition. Use a full or
+          relative path to a local file containing the value of condition.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the iam/v1 API. The full documentation for this API can
+    be found at: https://cloud.google.com/iam/
diff --git a/gcloud/iam/workload-identity-pools/set-iam-policy b/gcloud/iam/workload-identity-pools/set-iam-policy
new file mode 100644
index 000000000..ee821fcd8
--- /dev/null
+++ b/gcloud/iam/workload-identity-pools/set-iam-policy
@@ -0,0 +1,72 @@
+NAME
+    gcloud iam workload-identity-pools set-iam-policy - set the IAM policy for
+        a workload identity pool
+
+SYNOPSIS
+    gcloud iam workload-identity-pools set-iam-policy
+        (WORKLOAD_IDENTITY_POOL : --location=LOCATION) POLICY_FILE
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Replaces the existing IAM policy for a workload identity pool given a
+    workload identity pool ID and a file encoded in JSON or YAML that contains
+    the IAM policy.
+
+EXAMPLES
+    The following command reads an IAM policy defined in a JSON file
+    policy.json and sets it for the workload identity pool with ID
+    my-workload-identity-pool:
+
+        $ gcloud iam workload-identity-pools set-iam-policy \
+            my-workload-identity-pool policy.json --location="global"
+
+POSITIONAL ARGUMENTS
+     Workload identity pool resource - The workload identity pool for which you
+     want to set IAM policy for. The arguments in this group can be used to
+     specify the attributes of this resource. (NOTE) Some attributes are not
+     given arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument workload_identity_pool on the command line with
+        a fully specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       WORKLOAD_IDENTITY_POOL
+          ID of the workload identity pool or fully qualified identifier for
+          the workload identity pool.
+
+          To set the workload_identity_pool attribute:
+          ▸ provide the argument workload_identity_pool on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location name.
+
+          To set the location attribute:
+          ▸ provide the argument workload_identity_pool on the command line
+            with a fully specified name;
+          ▸ provide the argument --location on the command line.
+
+     POLICY_FILE
+        Path to a local JSON or YAML formatted file containing a valid policy.
+
+        The output of the get-iam-policy command is a valid file, as is any
+        JSON or YAML file conforming to the structure of a Policy
+        (https://cloud.google.com/iam/reference/rest/v1/Policy).
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the iam/v1 API. The full documentation for this API can
+    be found at: https://cloud.google.com/iam/
diff --git a/gcloud/iam/workload-identity-pools/update b/gcloud/iam/workload-identity-pools/update
index 14eae44a2..e5d0ff59f 100644
--- a/gcloud/iam/workload-identity-pools/update
+++ b/gcloud/iam/workload-identity-pools/update
@@ -5,6 +5,8 @@ SYNOPSIS
     gcloud iam workload-identity-pools update
         (WORKLOAD_IDENTITY_POOL : --location=LOCATION)
         [--description=DESCRIPTION] [--disabled] [--display-name=DISPLAY_NAME]
+        [--inline-trust-config-file=INLINE_TRUST_CONFIG_FILE]
+        [--inline-certificate-issuance-config-file=INLINE_CERTIFICATE_ISSUANCE_CONFIG_FILE | --certificate-lifetime=CERTIFICATE_LIFETIME --key-algorithm=KEY_ALGORITHM --rotation-window-percentage=ROTATION_WINDOW_PERCENTAGE]
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
@@ -63,6 +65,52 @@ FLAGS
      --display-name=DISPLAY_NAME
         A display name for the pool. Cannot exceed 32 characters.
 
+     --inline-trust-config-file=INLINE_TRUST_CONFIG_FILE
+        YAML file with configuration for providing additional trust bundles.
+        Example file format:            inlineTrustConfig:
+              additionalTrustBundles:
+                example.com:
+                  trustAnchors:
+                  - pemCertificate: "-----BEGIN CERTIFICATE-----
+                    <certificate>
+                    -----END CERTIFICATE-----"
+                  - pemCertificate: "-----BEGIN CERTIFICATE-----
+                    <certificate>
+                    -----END CERTIFICATE-----"
+                myorg.com:
+                  trustAnchors:
+                  - pemCertificate: "-----BEGIN CERTIFICATE-----
+                    <certificate>
+                    -----END CERTIFICATE-----"
+                  - pemCertificate: "-----BEGIN CERTIFICATE-----
+                    <certificate>
+                    -----END CERTIFICATE-----"
+
+     At most one of these can be specified:
+
+       --inline-certificate-issuance-config-file=INLINE_CERTIFICATE_ISSUANCE_CONFIG_FILE
+          YAML file with configuration for certificate issuance. Example file
+          format:              inlineCertificateIssuanceConfig:
+                caPools:
+                  us-east1: projects/1234/locations/us-east1/caPools/capoolname
+                  us-west1: projects/1234/locations/us-west1/caPools/capoolname
+                keyAlgorithm: RSA_4096
+                lifetime: 7200s
+                rotationWindowPercentage: 50
+
+       --certificate-lifetime=CERTIFICATE_LIFETIME
+          Lifetime of the workload certificates issued by the CA pool.
+
+       --key-algorithm=KEY_ALGORITHM
+          Key algorithm to use when generating the key pair. This key pair will
+          be used to create the certificate. KEY_ALGORITHM must be one of:
+          ecdsa-p256, ecdsa-p384, key-algorithm-unspecified, rsa-2048,
+          rsa-3072, rsa-4096.
+
+       --rotation-window-percentage=ROTATION_WINDOW_PERCENTAGE
+          Rotation window percentage indicating when certificate rotation
+          should be initiated based on remaining lifetime.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/lustre/instances/create b/gcloud/lustre/instances/create
index cf60c412b..61c560da0 100644
--- a/gcloud/lustre/instances/create
+++ b/gcloud/lustre/instances/create
@@ -5,8 +5,9 @@ SYNOPSIS
     gcloud lustre instances create (INSTANCE : --location=LOCATION)
         --capacity-gib=CAPACITY_GIB --filesystem=FILESYSTEM --network=NETWORK
         [--async] [--description=DESCRIPTION] [--gke-support-enabled]
-        [--labels=[LABELS,...]] [--request-id=REQUEST_ID]
-        [GCLOUD_WIDE_FLAG ...]
+        [--labels=[LABELS,...]]
+        [--per-unit-storage-throughput=PER_UNIT_STORAGE_THROUGHPUT]
+        [--request-id=REQUEST_ID] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     Create an instance
@@ -112,6 +113,10 @@ OPTIONAL FLAGS
 
             --labels=path_to_file.(yaml|json)
 
+     --per-unit-storage-throughput=PER_UNIT_STORAGE_THROUGHPUT
+        The throughput of the instance in MB/s/TiB. Valid values are 250, 500,
+        1000. Default value is 1000.
+
      --request-id=REQUEST_ID
         An optional request ID to identify requests. Specify a unique request
         ID so that if you must retry your request, the server will know to
diff --git a/gcloud/lustre/instances/export-data b/gcloud/lustre/instances/export-data
index cc9f139be..89bc66208 100644
--- a/gcloud/lustre/instances/export-data
+++ b/gcloud/lustre/instances/export-data
@@ -16,9 +16,10 @@ EXAMPLES
         $ gcloud lustre instances export-data
 
 POSITIONAL ARGUMENTS
-     Instance resource - Name of the resource. The arguments in this group can
-     be used to specify the attributes of this resource. (NOTE) Some attributes
-     are not given arguments in this group but can be set in other ways.
+     Instance resource - The name of the Managed Lustre instance. The arguments
+     in this group can be used to specify the attributes of this resource.
+     (NOTE) Some attributes are not given arguments in this group but can be
+     set in other ways.
 
      To set the project attribute:
       ◆ provide the argument instance on the command line with a fully
@@ -47,7 +48,9 @@ POSITIONAL ARGUMENTS
 
 REQUIRED FLAGS
      --gcs-path-uri=GCS_PATH_URI
-        URI to a Cloud Storage path in the format: gs://<bucket_name>.
+        The URI to a Cloud Storage bucket, or a path within a bucket, using the
+        format gs://<bucket_name>/<optional_path_inside_bucket>/. If a path
+        inside the bucket is specified, it must end with a forward slash (/).
 
 OPTIONAL FLAGS
      --async
@@ -55,8 +58,9 @@ OPTIONAL FLAGS
         complete.
 
      --lustre-path=LUSTRE_PATH
-        Root directory path to the Managed Lustre file system, starting with /.
-        Defaults to / if unset.
+        The root directory path to the Managed Lustre file system. Must start
+        with /. Default is /. If you're importing data into Managed Lustre, any
+        path other than the default must already exist on the file system.
 
      --request-id=REQUEST_ID
         UUID to identify requests.
diff --git a/gcloud/lustre/instances/import-data b/gcloud/lustre/instances/import-data
index 2ebebbe69..f61ce910f 100644
--- a/gcloud/lustre/instances/import-data
+++ b/gcloud/lustre/instances/import-data
@@ -47,7 +47,9 @@ POSITIONAL ARGUMENTS
 
 REQUIRED FLAGS
      --gcs-path-uri=GCS_PATH_URI
-        URI to a Cloud Storage path in the format: gs://<bucket_name>.
+        The URI to a Cloud Storage bucket, or a path within a bucket, using the
+        format gs://<bucket_name>/<optional_path_inside_bucket>/. If a path
+        inside the bucket is specified, it must end with a forward slash (/).
 
 OPTIONAL FLAGS
      --async
@@ -55,16 +57,17 @@ OPTIONAL FLAGS
         complete.
 
      --lustre-path=LUSTRE_PATH
-        Root directory path to the Managed Lustre file system, starting with /.
-        Defaults to / if unset.
+        The root directory path to the Managed Lustre file system. Must start
+        with /. Default is /. If you're importing data into Managed Lustre, any
+        path other than the default must already exist on the file system.
 
      --request-id=REQUEST_ID
         UUID to identify requests.
 
      ServiceAccount resource - User-specified service account used to perform
-     the transfer. If unspecified, the default Lustre P4 service account will
-     be used. This represents a Cloud resource. (NOTE) Some attributes are not
-     given arguments in this group but can be set in other ways.
+     the transfer. If unspecified, the default Managed Lustre service agent
+     will be used. This represents a Cloud resource. (NOTE) Some attributes are
+     not given arguments in this group but can be set in other ways.
 
      To set the project attribute:
       ◆ provide the argument --service-account on the command line with a
diff --git a/gcloud/lustre/instances/update b/gcloud/lustre/instances/update
index 84505de39..568db5616 100644
--- a/gcloud/lustre/instances/update
+++ b/gcloud/lustre/instances/update
@@ -4,7 +4,9 @@ NAME
 SYNOPSIS
     gcloud lustre instances update (INSTANCE : --location=LOCATION) [--async]
         [--capacity-gib=CAPACITY_GIB] [--description=DESCRIPTION]
-        [--[no-]gke-support-enabled] [--request-id=REQUEST_ID]
+        [--[no-]gke-support-enabled]
+        [--per-unit-storage-throughput=PER_UNIT_STORAGE_THROUGHPUT]
+        [--request-id=REQUEST_ID]
         [--labels=[LABELS,...]
           | --update-labels=[UPDATE_LABELS,...] --clear-labels
           | --remove-labels=[__REMOVE_LABELS,...]] [GCLOUD_WIDE_FLAG ...]
@@ -65,6 +67,10 @@ FLAGS
         default, GKE clients are not supported. Use --gke-support-enabled to
         enable and --no-gke-support-enabled to disable.
 
+     --per-unit-storage-throughput=PER_UNIT_STORAGE_THROUGHPUT
+        The throughput of the instance in MB/s/TiB. Valid values are 250, 500,
+        1000. Default value is 1000.
+
      --request-id=REQUEST_ID
         An optional request ID to identify requests. Specify a unique request
         ID so that if you must retry your request, the server will know to
diff --git a/gcloud/network-connectivity/internal-ranges/create b/gcloud/network-connectivity/internal-ranges/create
index b6315343b..c140ccd21 100644
--- a/gcloud/network-connectivity/internal-ranges/create
+++ b/gcloud/network-connectivity/internal-ranges/create
@@ -8,7 +8,7 @@ SYNOPSIS
         (--ip-cidr-range=IP_CIDR_RANGE | [--prefix-length=PREFIX_LENGTH
           : --exclude-cidr-ranges=[EXCLUDE_CIDR_RANGES,...]
           --target-cidr-range=[TARGET_CIDR_RANGE,...]]) [--async]
-        [--description=DESCRIPTION] [--labels=[KEY=VALUE,...]]
+        [--description=DESCRIPTION] [--immutable] [--labels=[KEY=VALUE,...]]
         [--overlaps=[OVERLAPS,...]] [--peering=PEERING; default="for-self"]
         [--usage=USAGE; default="for-vpc"]
         [--migration-source=MIGRATION_SOURCE
@@ -110,6 +110,10 @@ OPTIONAL FLAGS
      --description=DESCRIPTION
         Description of the internal range to be created.
 
+     --immutable
+        Mark the internal range as immutable. Then only non-semantic fields
+        like description and labels could be modified after creation.
+
      --labels=[KEY=VALUE,...]
         List of label KEY=VALUE pairs to add.
 
diff --git a/gcloud/pubsub/help b/gcloud/pubsub/help
index 63a6cbc10..541158686 100644
--- a/gcloud/pubsub/help
+++ b/gcloud/pubsub/help
@@ -27,6 +27,9 @@ GROUPS
      lite-topics
         Manage Pub/Sub Lite topics.
 
+     message-transforms
+        Manage Cloud Pub/Sub message transforms.
+
      schemas
         Manage Pub/Sub schemas.
 
diff --git a/gcloud/pubsub/message-transforms/help b/gcloud/pubsub/message-transforms/help
new file mode 100644
index 000000000..390c98e4f
--- /dev/null
+++ b/gcloud/pubsub/message-transforms/help
@@ -0,0 +1,30 @@
+NAME
+    gcloud pubsub message-transforms - manage Cloud Pub/Sub message transforms
+
+SYNOPSIS
+    gcloud pubsub message-transforms COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Manage Cloud Pub/Sub message transforms.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     test
+        Tests message transforms against a given message.
+
+     validate
+        Validates a message transform.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha pubsub message-transforms
+
+        $ gcloud beta pubsub message-transforms
+
diff --git a/gcloud/pubsub/message-transforms/test b/gcloud/pubsub/message-transforms/test
new file mode 100644
index 000000000..64bfae952
--- /dev/null
+++ b/gcloud/pubsub/message-transforms/test
@@ -0,0 +1,89 @@
+NAME
+    gcloud pubsub message-transforms test - tests message transforms against a
+        given message
+
+SYNOPSIS
+    gcloud pubsub message-transforms test
+        (--attribute=[ATTRIBUTE,...] --message=MESSAGE)
+        (--message-transforms-file=MESSAGE_TRANSFORMS_FILE
+          | --subscription=SUBSCRIPTION
+          | [--topic=TOPIC : --topic-project=TOPIC_PROJECT])
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Tests message transforms against a given message.
+
+REQUIRED FLAGS
+     Message to test the message transforms against.
+
+     At least one of these must be specified:
+
+       --attribute=[ATTRIBUTE,...]
+          Comma-separated list of attributes to attach to the message. Each
+          ATTRIBUTE has the form name="value". You can specify up to 100
+          attributes.
+
+       --message=MESSAGE
+          Message body to test the message transforms against.
+
+     Exactly one of these must be specified:
+
+       --message-transforms-file=MESSAGE_TRANSFORMS_FILE
+          Path to YAML or JSON file containing message transforms.
+
+       Subscription resource - Name of the subscription from which the message
+       transforms are taken to be applied to the message. This represents a
+       Cloud resource. (NOTE) Some attributes are not given arguments in this
+       group but can be set in other ways.
+
+       To set the project attribute:
+        ▸ provide the argument --subscription on the command line with a
+          fully specified name;
+        ▸ provide the argument --project on the command line;
+        ▸ set the property core/project.
+
+         --subscription=SUBSCRIPTION
+            ID of the subscription or fully qualified identifier for the
+            subscription.
+
+            To set the subscription attribute:
+            ▫ provide the argument --subscription on the command line.
+
+       Topic resource - Name of the topic from which the message transforms are
+       taken to be applied to the message. The arguments in this group can be
+       used to specify the attributes of this resource.
+
+         --topic=TOPIC
+            ID of the topic or fully qualified identifier for the topic.
+
+            To set the topic attribute:
+            ▫ provide the argument --topic on the command line.
+
+            This flag argument must be specified if any of the other arguments
+            in this group are specified.
+
+         --topic-project=TOPIC_PROJECT
+            Project ID of the Google Cloud project for the topic.
+
+            To set the project attribute:
+            ▫ provide the argument --topic on the command line with a fully
+              specified name;
+            ▫ provide the argument --topic-project on the command line;
+            ▫ provide the argument --project on the command line;
+            ▫ set the property core/project.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha pubsub message-transforms test
+
+        $ gcloud beta pubsub message-transforms test
+
diff --git a/gcloud/pubsub/message-transforms/validate b/gcloud/pubsub/message-transforms/validate
new file mode 100644
index 000000000..a563ffd44
--- /dev/null
+++ b/gcloud/pubsub/message-transforms/validate
@@ -0,0 +1,29 @@
+NAME
+    gcloud pubsub message-transforms validate - validates a message transform
+
+SYNOPSIS
+    gcloud pubsub message-transforms validate
+        --message-transform-file=MESSAGE_TRANSFORM_FILE [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Validates a message transform.
+
+REQUIRED FLAGS
+     --message-transform-file=MESSAGE_TRANSFORM_FILE
+        Path to YAML or JSON file containing a message transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha pubsub message-transforms validate
+
+        $ gcloud beta pubsub message-transforms validate
+
diff --git a/gcloud/pubsub/subscriptions/create b/gcloud/pubsub/subscriptions/create
index 2acbcdf35..f7ff2c81a 100644
--- a/gcloud/pubsub/subscriptions/create
+++ b/gcloud/pubsub/subscriptions/create
@@ -9,6 +9,7 @@ SYNOPSIS
         [--enable-message-ordering] [--expiration-period=EXPIRATION_PERIOD]
         [--labels=[KEY=VALUE,...]] [--message-filter=MESSAGE_FILTER]
         [--message-retention-duration=MESSAGE_RETENTION_DURATION]
+        [--message-transforms-file=MESSAGE_TRANSFORMS_FILE]
         [--retain-acked-messages]
         [[--bigquery-table=BIGQUERY_TABLE
           : --bigquery-service-account-email=BIGQUERY_SERVICE_ACCOUNT_EMAIL
@@ -128,6 +129,9 @@ OPTIONAL FLAGS
         seconds, minutes, hours, and days, respectively. If the unit is
         omitted, seconds is assumed.
 
+     --message-transforms-file=MESSAGE_TRANSFORMS_FILE
+        Path to YAML or JSON file containing message transforms.
+
      --retain-acked-messages
         Whether or not to retain acknowledged messages. If true, messages are
         not expunged from the subscription's backlog until they fall out of the
diff --git a/gcloud/pubsub/subscriptions/update b/gcloud/pubsub/subscriptions/update
index e2cb73f27..545cd9a29 100644
--- a/gcloud/pubsub/subscriptions/update
+++ b/gcloud/pubsub/subscriptions/update
@@ -19,6 +19,8 @@ SYNOPSIS
           [--dead-letter-topic=DEAD_LETTER_TOPIC
           : --dead-letter-topic-project=DEAD_LETTER_TOPIC_PROJECT]]
         [--clear-labels | --remove-labels=[KEY,...]]
+        [--clear-message-transforms
+          | --message-transforms-file=MESSAGE_TRANSFORMS_FILE]
         [--clear-retry-policy | --max-retry-delay=MAX_RETRY_DELAY
           --min-retry-delay=MIN_RETRY_DELAY]
         [--push-auth-service-account=SERVICE_ACCOUNT_EMAIL
@@ -307,6 +309,15 @@ FLAGS
           silently ignored. If --update-labels is also specified then
           --update-labels is applied first.
 
+     At most one of these can be specified:
+
+       --clear-message-transforms
+          If set, clears the message transforms field. Use
+          --no-clear-message-transforms to disable this flag.
+
+       --message-transforms-file=MESSAGE_TRANSFORMS_FILE
+          Path to YAML or JSON file containing message transforms.
+
      At most one of these can be specified:
 
        --clear-retry-policy
diff --git a/gcloud/pubsub/topics/create b/gcloud/pubsub/topics/create
index 64d8a1d72..b21d7775b 100644
--- a/gcloud/pubsub/topics/create
+++ b/gcloud/pubsub/topics/create
@@ -4,6 +4,7 @@ NAME
 SYNOPSIS
     gcloud pubsub topics create TOPIC [TOPIC ...] [--labels=[KEY=VALUE,...]]
         [--message-retention-duration=MESSAGE_RETENTION_DURATION]
+        [--message-transforms-file=MESSAGE_TRANSFORMS_FILE]
         [--ingestion-log-severity=INGESTION_LOG_SEVERITY
           --aws-msk-ingestion-aws-role-arn=AWS_MSK_INGESTION_AWS_ROLE_ARN
           --aws-msk-ingestion-cluster-arn=AWS_MSK_INGESTION_CLUSTER_ARN
@@ -70,6 +71,9 @@ FLAGS
         is one of "s", "m", "h", and "d" for seconds, minutes, hours, and days,
         respectively. If the unit is omitted, seconds is assumed.
 
+     --message-transforms-file=MESSAGE_TRANSFORMS_FILE
+        Path to YAML or JSON file containing message transforms.
+
      Following flags are for specifying the data source settings for an import
      topic
 
diff --git a/gcloud/pubsub/topics/update b/gcloud/pubsub/topics/update
index 841da01a9..af98ff365 100644
--- a/gcloud/pubsub/topics/update
+++ b/gcloud/pubsub/topics/update
@@ -13,6 +13,8 @@ SYNOPSIS
         [--clear-labels | --remove-labels=[KEY,...]]
         [--clear-message-retention-duration
           | --message-retention-duration=MESSAGE_RETENTION_DURATION]
+        [--clear-message-transforms
+          | --message-transforms-file=MESSAGE_TRANSFORMS_FILE]
         [--clear-schema-settings
           | [--message-encoding=ENCODING (--schema=SCHEMA
           : --schema-project=SCHEMA_PROJECT)
@@ -356,6 +358,15 @@ FLAGS
           seconds, minutes, hours, and days, respectively. If the unit is
           omitted, seconds is assumed.
 
+     At most one of these can be specified:
+
+       --clear-message-transforms
+          If set, clears the message transforms field. Use
+          --no-clear-message-transforms to disable this flag.
+
+       --message-transforms-file=MESSAGE_TRANSFORMS_FILE
+          Path to YAML or JSON file containing message transforms.
+
      At most one of these can be specified:
 
        --clear-schema-settings
diff --git a/gcloud/run/revisions/describe b/gcloud/run/revisions/describe
index b980213f1..ac2203abc 100644
--- a/gcloud/run/revisions/describe
+++ b/gcloud/run/revisions/describe
@@ -9,9 +9,10 @@ DESCRIPTION
     Obtain details about revisions.
 
 EXAMPLES
-    To describe all revisions of service default in us-central1:
+    To describe a revision my-service-00001-abc`in us-central1:
 
-        $ gcloud run revisions describe --region=us-central1 default
+        $ gcloud run revisions describe --region=us-central1 \
+          my-service-00001-abc
 
 POSITIONAL ARGUMENTS
      Revision resource - Revision to describe. The arguments in this group can
diff --git a/gcloud/scc/notifications/list b/gcloud/scc/notifications/list
index d4eca0d74..2eed09504 100644
--- a/gcloud/scc/notifications/list
+++ b/gcloud/scc/notifications/list
@@ -4,9 +4,10 @@ NAME
 
 SYNOPSIS
     gcloud scc notifications list [PARENT]
-        [--location=LOCATION; default="global"] [--filter=EXPRESSION]
-        [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]]
-        [GCLOUD_WIDE_FLAG ...]
+        [--location=LOCATION; default="global"]
+        [--folder=FOLDER | --organization=ORGANIZATION | --project=PROJECT]
+        [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
+        [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     List Security Command Center notification configs.
@@ -62,6 +63,20 @@ FLAGS
         notificationConfig resources that were created by using the Security
         Command Center API v2 and the only valid location is global.
 
+     At most one of these can be specified:
+
+       --folder=FOLDER
+          Folder where the notification config resides. Formatted as
+          folders/456 or just 456.
+
+       --organization=ORGANIZATION
+          Organization where the notification config resides. Formatted as
+          organizations/123 or just 123.
+
+       --project=PROJECT
+          Project (ID or number) where the notification config resides.
+          Formatted as projects/789 or just 789.
+
 LIST COMMAND FLAGS
      --filter=EXPRESSION
         Apply a Boolean filter EXPRESSION to each resource item to be listed.
diff --git a/gcloud/storage/buckets/create b/gcloud/storage/buckets/create
index 36e069e38..a1fd02144 100644
--- a/gcloud/storage/buckets/create
+++ b/gcloud/storage/buckets/create
@@ -116,7 +116,7 @@ FLAGS
         Minimum retention period
         (https://cloud.google.com/storage/docs/bucket-lock#retention-periods)
         for objects stored in the bucket, for example
-        --retention-period=1Y1M1D5S. Objects added to the bucket cannot be
+        --retention-period=P1Y1M1DT5S. Objects added to the bucket cannot be
         deleted until they've been stored for the specified length of time.
         Default is no retention period. Only available for Cloud Storage using
         the JSON API.
diff --git a/gcloud/storage/buckets/update b/gcloud/storage/buckets/update
index 8d120555f..fd888d78e 100644
--- a/gcloud/storage/buckets/update
+++ b/gcloud/storage/buckets/update
@@ -283,7 +283,7 @@ FLAGS
           Minimum retention period
           (https://cloud.google.com/storage/docs/bucket-lock#retention-periods)
           for objects stored in the bucket, for example
-          --retention-period=1Y1M1D5S. Objects added to the bucket cannot be
+          --retention-period=P1Y1M1DT5S. Objects added to the bucket cannot be
           deleted until they've been stored for the specified length of time.
           Default is no retention period. Only available for Cloud Storage
           using the JSON API.
diff --git a/gcloud/workbench/instances/create b/gcloud/workbench/instances/create
index 43b17f31e..7e573fdc1 100644
--- a/gcloud/workbench/instances/create
+++ b/gcloud/workbench/instances/create
@@ -32,7 +32,9 @@ SYNOPSIS
           --data-disk-encryption-key-location=DATA_DISK_ENCRYPTION_KEY_LOCATION
           --data-disk-encryption-key-project=DATA_DISK_ENCRYPTION_KEY_PROJECT]
           --network=NETWORK --nic-type=NIC_TYPE [--subnet=SUBNET
-          : --subnet-region=SUBNET_REGION]
+          : --subnet-region=SUBNET_REGION] --reservation-key=RESERVATION_KEY
+          --reservation-type=RESERVATION_TYPE; default="any"
+          --reservation-values=[VALUES,...]
           --shielded-integrity-monitoring=SHIELDED_INTEGRITY_MONITORING
           --shielded-secure-boot=SHIELDED_SECURE_BOOT
           --shielded-vtpm=SHIELDED_VTPM] [GCLOUD_WIDE_FLAG ...]
@@ -396,6 +398,22 @@ FLAGS
                 fully specified name;
               ◇ provide the argument --subnet-region on the command line.
 
+       Reservation configs.
+
+         --reservation-key=RESERVATION_KEY
+            The label key of a reservation resource. To target a specific
+            reservation by name, use compute.googleapis.com/reservation-name as
+            the key and specify the name of your reservation as its value.
+
+         --reservation-type=RESERVATION_TYPE; default="any"
+            Type of the reservation. RESERVATION_TYPE must be one of: none,
+            any, specific.
+
+         --reservation-values=[VALUES,...]
+            The label value of a reservation resource. To target a specific
+            reservation by name, use compute.googleapis.com/reservation-name as
+            the key and specify the name of your reservation as its value.
+
        Shielded VM configurations.
 
          --shielded-integrity-monitoring=SHIELDED_INTEGRITY_MONITORING