diff --git a/gcloud/_version b/gcloud/_version
index 88b6b58f1..d011b7149 100644
--- a/gcloud/_version
+++ b/gcloud/_version
@@ -1,8 +1,8 @@
-Google Cloud SDK 449.0.0
-alpha 2023.10.02
-beta 2023.10.02
+Google Cloud SDK 450.0.0
+alpha 2023.10.06
+beta 2023.10.06
 bq 2.0.98
 bundled-python3-unix 3.9.16
-core 2023.10.02
+core 2023.10.06
 gcloud-crc32c 1.0.0
 gsutil 5.26
diff --git a/gcloud/ai/index-endpoints/deploy-index b/gcloud/ai/index-endpoints/deploy-index
index 9dfd72efa..8f7a6a8c9 100644
--- a/gcloud/ai/index-endpoints/deploy-index
+++ b/gcloud/ai/index-endpoints/deploy-index
@@ -5,7 +5,8 @@ NAME
 SYNOPSIS
     gcloud ai index-endpoints deploy-index (INDEX_ENDPOINT : --region=REGION)
         --deployed-index-id=DEPLOYED_INDEX_ID --display-name=DISPLAY_NAME
-        --index=INDEX [--max-replica-count=MAX_REPLICA_COUNT]
+        --index=INDEX [--machine-type=MACHINE_TYPE]
+        [--max-replica-count=MAX_REPLICA_COUNT]
         [--min-replica-count=MIN_REPLICA_COUNT]
         [--reserved-ip-ranges=[RESERVED_IP_RANGES,...]] [GCLOUD_WIDE_FLAG ...]
 
@@ -69,6 +70,11 @@ REQUIRED FLAGS
         ID of the index.
 
 OPTIONAL FLAGS
+     --machine-type=MACHINE_TYPE
+        The machine resources to be used for each node of this deployment. For
+        available machine types, see
+        https://cloud.google.com/ai-platform-unified/docs/predictions/machine-types.
+
      --max-replica-count=MAX_REPLICA_COUNT
         Maximum number of machine replicas the deployed index will be always
         deployed on.
diff --git a/gcloud/ai/indexes/help b/gcloud/ai/indexes/help
index cdf7c02b6..7c3dfac79 100644
--- a/gcloud/ai/indexes/help
+++ b/gcloud/ai/indexes/help
@@ -27,9 +27,15 @@ COMMANDS
      list
         Lists the indexes of the given project and region.
 
+     remove-datapoints
+        Remove data points from the specified index.
+
      update
         Update an Vertex AI index.
 
+     upsert-datapoints
+        Upsert data points into the specified index.
+
 NOTES
     These variants are also available:
 
diff --git a/gcloud/ai/indexes/remove-datapoints b/gcloud/ai/indexes/remove-datapoints
new file mode 100644
index 000000000..252169b25
--- /dev/null
+++ b/gcloud/ai/indexes/remove-datapoints
@@ -0,0 +1,80 @@
+NAME
+    gcloud ai indexes remove-datapoints - remove data points from the specified
+        index
+
+SYNOPSIS
+    gcloud ai indexes remove-datapoints (INDEX : --region=REGION)
+        (--datapoint-ids=[DATAPOINT_IDS,...]
+          | --datapoints-from-file=DATAPOINTS_FROM_FILE) [GCLOUD_WIDE_FLAG ...]
+
+EXAMPLES
+    To remove datapoints from an index '123', run:
+
+        $ gcloud ai indexes remove-datapoints 123 \
+            --datapoint-ids=example1,example2 --project=example \
+            --region=us-central1
+
+    Or put datapoint ids in a json file and run:
+
+        $ gcloud ai indexes remove-datapoints 123 \
+            --datapoints-from-file=example.json --project=example \
+            --region=us-central1
+
+POSITIONAL ARGUMENTS
+     Index resource - Index to remove data points from. The arguments in this
+     group can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways.
+
+     To set the project attribute:
+      ◆ provide the argument index on the command line with a fully specified
+        name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       INDEX
+          ID of the index or fully qualified identifier for the index.
+
+          To set the name attribute:
+          ▸ provide the argument index on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --region=REGION
+          Cloud region for the index.
+
+          To set the region attribute:
+          ▸ provide the argument index on the command line with a fully
+            specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property ai/region;
+          ▸ choose one from the prompted list of available regions.
+
+REQUIRED FLAGS
+     Exactly one of these must be specified:
+
+       --datapoint-ids=[DATAPOINT_IDS,...]
+          List of index datapoint ids to be removed from the index.
+
+       --datapoints-from-file=DATAPOINTS_FROM_FILE
+          Path to a local JSON file that contains the data points that need to
+          be added to the index.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha ai indexes remove-datapoints
+
+        $ gcloud beta ai indexes remove-datapoints
+
diff --git a/gcloud/ai/indexes/upsert-datapoints b/gcloud/ai/indexes/upsert-datapoints
new file mode 100644
index 000000000..65ba3e65a
--- /dev/null
+++ b/gcloud/ai/indexes/upsert-datapoints
@@ -0,0 +1,68 @@
+NAME
+    gcloud ai indexes upsert-datapoints - upsert data points into the specified
+        index
+
+SYNOPSIS
+    gcloud ai indexes upsert-datapoints (INDEX : --region=REGION)
+        --datapoints-from-file=DATAPOINTS_FROM_FILE [GCLOUD_WIDE_FLAG ...]
+
+EXAMPLES
+    To upsert datapoints into an index '123', run:
+
+        $ gcloud ai indexes upsert-datapoints 123 \
+            --datapoints-from-file=example.json --project=example \
+            --region=us-central1
+
+POSITIONAL ARGUMENTS
+     Index resource - Index to upsert data points from. The arguments in this
+     group can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways.
+
+     To set the project attribute:
+      ◆ provide the argument index on the command line with a fully specified
+        name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       INDEX
+          ID of the index or fully qualified identifier for the index.
+
+          To set the name attribute:
+          ▸ provide the argument index on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --region=REGION
+          Cloud region for the index.
+
+          To set the region attribute:
+          ▸ provide the argument index on the command line with a fully
+            specified name;
+          ▸ provide the argument --region on the command line;
+          ▸ set the property ai/region;
+          ▸ choose one from the prompted list of available regions.
+
+REQUIRED FLAGS
+     --datapoints-from-file=DATAPOINTS_FROM_FILE
+        Path to a local JSON file that contains the data points that need to be
+        added to the index.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha ai indexes upsert-datapoints
+
+        $ gcloud beta ai indexes upsert-datapoints
+
diff --git a/gcloud/alpha/ai/index-endpoints/deploy-index b/gcloud/alpha/ai/index-endpoints/deploy-index
index 9357e1650..02ae0bd89 100644
--- a/gcloud/alpha/ai/index-endpoints/deploy-index
+++ b/gcloud/alpha/ai/index-endpoints/deploy-index
@@ -6,7 +6,8 @@ SYNOPSIS
     gcloud alpha ai index-endpoints deploy-index
         (INDEX_ENDPOINT : --region=REGION)
         --deployed-index-id=DEPLOYED_INDEX_ID --display-name=DISPLAY_NAME
-        --index=INDEX [--max-replica-count=MAX_REPLICA_COUNT]
+        --index=INDEX [--machine-type=MACHINE_TYPE]
+        [--max-replica-count=MAX_REPLICA_COUNT]
         [--min-replica-count=MIN_REPLICA_COUNT]
         [--reserved-ip-ranges=[RESERVED_IP_RANGES,...]] [GCLOUD_WIDE_FLAG ...]
 
@@ -70,6 +71,11 @@ REQUIRED FLAGS
         ID of the index.
 
 OPTIONAL FLAGS
+     --machine-type=MACHINE_TYPE
+        The machine resources to be used for each node of this deployment. For
+        available machine types, see
+        https://cloud.google.com/ai-platform-unified/docs/predictions/machine-types.
+
      --max-replica-count=MAX_REPLICA_COUNT
         Maximum number of machine replicas the deployed index will be always
         deployed on.
diff --git a/gcloud/alpha/ai/indexes/remove-datapoints b/gcloud/alpha/ai/indexes/remove-datapoints
index ceb19403d..aa16b5808 100644
--- a/gcloud/alpha/ai/indexes/remove-datapoints
+++ b/gcloud/alpha/ai/indexes/remove-datapoints
@@ -8,13 +8,13 @@ SYNOPSIS
           | --datapoints-from-file=DATAPOINTS_FROM_FILE) [GCLOUD_WIDE_FLAG ...]
 
 EXAMPLES
-    To remove datapoints from an index '123', run:
+    To remove data points from an index 123, run:
 
         $ gcloud alpha ai indexes remove-datapoints 123 \
             --datapoint-ids=example1,example2 --project=example \
             --region=us-central1
 
-    Or put datapoint ids in a json file and run:
+    Or put datapoint ids in a JSON file and run:
 
         $ gcloud alpha ai indexes remove-datapoints 123 \
             --datapoints-from-file=example.json --project=example \
@@ -75,7 +75,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud ai indexes remove-datapoints
 
         $ gcloud beta ai indexes remove-datapoints
 
diff --git a/gcloud/alpha/ai/indexes/upsert-datapoints b/gcloud/alpha/ai/indexes/upsert-datapoints
index 1bf5a078e..8666f019d 100644
--- a/gcloud/alpha/ai/indexes/upsert-datapoints
+++ b/gcloud/alpha/ai/indexes/upsert-datapoints
@@ -7,7 +7,7 @@ SYNOPSIS
         --datapoints-from-file=DATAPOINTS_FROM_FILE [GCLOUD_WIDE_FLAG ...]
 
 EXAMPLES
-    To upsert datapoints into an index '123', run:
+    To upsert datapoints into an index 123, run:
 
         $ gcloud alpha ai indexes upsert-datapoints 123 \
             --datapoints-from-file=example.json --project=example \
@@ -63,7 +63,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud ai indexes upsert-datapoints
 
         $ gcloud beta ai indexes upsert-datapoints
 
diff --git a/gcloud/alpha/builds/enterprise-config/bitbucketserver/create b/gcloud/alpha/builds/enterprise-config/bitbucketserver/create
index 75901fd33..35b2d5957 100644
--- a/gcloud/alpha/builds/enterprise-config/bitbucketserver/create
+++ b/gcloud/alpha/builds/enterprise-config/bitbucketserver/create
@@ -9,8 +9,10 @@ SYNOPSIS
         --read-access-token-secret-version=READ_ACCESS_TOKEN_SECRET_VERSION
         --user-name=USER_NAME
         --webhook-secret-secret-version=WEBHOOK_SECRET_SECRET_VERSION
-        [--peered-network=PEERED_NETWORK] [--region=REGION]
-        [--ssl-ca-file=SSL_CA_FILE] [GCLOUD_WIDE_FLAG ...]
+        [--region=REGION] [--ssl-ca-file=SSL_CA_FILE]
+        [--peered-network=PEERED_NETWORK
+          --peered-network-ip-range=PEERED_NETWORK_IP_RANGE]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) Create a Bitbucket Server config for use by Google Cloud Build.
@@ -45,12 +47,6 @@ REQUIRED FLAGS
         projects/{secret_project}/secrets/{secret_name}/versions/{secret_version}.
 
 OPTIONAL FLAGS
-     --peered-network=PEERED_NETWORK
-        VPC network that should be used when making calls to the Bitbucket
-        Server instance.
-
-        If not specified, calls will be made over the public internet.
-
      --region=REGION
         The region of the Cloud Build Service to use. Must be set to a
         supported region name (e.g. us-central1). If unset, builds/region,
@@ -61,6 +57,17 @@ OPTIONAL FLAGS
         Path to a local file that contains SSL certificate to use for requests
         to Bitbucket Server. The certificate should be in PEM format.
 
+     --peered-network=PEERED_NETWORK
+        VPC network that should be used when making calls to the Bitbucket
+        Server instance.
+
+        If not specified, calls will be made over the public internet.
+
+     --peered-network-ip-range=PEERED_NETWORK_IP_RANGE
+        IP range within the peered network. This is specified in CIDR notation
+        with a slash and the subnet prefix size. Examples: 192.168.0.0/24 or
+        '/29'.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/alpha/compute/disks/create b/gcloud/alpha/compute/disks/create
index 828cd2220..95aa46194 100644
--- a/gcloud/alpha/compute/disks/create
+++ b/gcloud/alpha/compute/disks/create
@@ -3,9 +3,9 @@ NAME
 
 SYNOPSIS
     gcloud alpha compute disks create DISK_NAME [DISK_NAME ...]
-        [--architecture=ARCHITECTURE] [--confidential-compute]
-        [--csek-key-file=FILE] [--description=DESCRIPTION]
-        [--erase-windows-vss-signature]
+        [--access-mode=ACCESS_MODE] [--architecture=ARCHITECTURE]
+        [--confidential-compute] [--csek-key-file=FILE]
+        [--description=DESCRIPTION] [--erase-windows-vss-signature]
         [--guest-os-features=[GUEST_OS_FEATURE,...]] [--interface=INTERFACE]
         [--labels=[KEY=VALUE,...]] [--licenses=[LICENSE,...]] [--multi-writer]
         [--physical-block-size=PHYSICAL_BLOCK_SIZE; default="4096"]
@@ -62,6 +62,10 @@ POSITIONAL ARGUMENTS
         https://cloud.google.com/compute/docs/naming-resources
 
 FLAGS
+     --access-mode=ACCESS_MODE
+        Specifies the access mode that the disk can support. ACCESS_MODE must
+        be one of: READ_ONLY_MANY, READ_WRITE_MANY, READ_WRITE_SINGLE.
+
      --architecture=ARCHITECTURE
         Specifies the architecture or processor type that this disk can
         support. For available processor types on Compute Engine, see
diff --git a/gcloud/alpha/compute/disks/update b/gcloud/alpha/compute/disks/update
index 4b7d8326f..e30489336 100644
--- a/gcloud/alpha/compute/disks/update
+++ b/gcloud/alpha/compute/disks/update
@@ -2,7 +2,7 @@ NAME
     gcloud alpha compute disks update - update a Compute Engine persistent disk
 
 SYNOPSIS
-    gcloud alpha compute disks update DISK_NAME
+    gcloud alpha compute disks update DISK_NAME [--access-mode=ACCESS_MODE]
         [--provisioned-iops=PROVISIONED_IOPS]
         [--provisioned-throughput=PROVISIONED_THROUGHPUT] [--size=SIZE]
         [--update-labels=[KEY=VALUE,...]]
@@ -40,6 +40,10 @@ POSITIONAL ARGUMENTS
         Name of the disk to update.
 
 FLAGS
+     --access-mode=ACCESS_MODE
+        Specifies the access mode that the disk can support. ACCESS_MODE must
+        be one of: READ_ONLY_MANY, READ_WRITE_MANY, READ_WRITE_SINGLE.
+
      --provisioned-iops=PROVISIONED_IOPS
         Provisioned IOPS of disk to update. Only for use with disks of type
         hyperdisk-extreme.
diff --git a/gcloud/alpha/compute/instance-groups/managed/create-instance b/gcloud/alpha/compute/instance-groups/managed/create-instance
index d046a27b7..f46317082 100644
--- a/gcloud/alpha/compute/instance-groups/managed/create-instance
+++ b/gcloud/alpha/compute/instance-groups/managed/create-instance
@@ -19,7 +19,7 @@ DESCRIPTION
     (ALPHA) gcloud alpha compute instance-groups managed create-instance
     creates a virtual machine instance with a defined name and optionally its
     stateful configuration: stateful disk, stateful metadata key-values, and
-    stateful IP addressess. Stateful configuration is stored in the
+    stateful IP addresses. Stateful configuration is stored in the
     corresponding newly created per-instance config. An instance with a
     per-instance config will preserve its given name, specified disks,
     specified metadata key-values, and specified internal and external IPs
diff --git a/gcloud/alpha/compute/interconnects/attachments/partner/create b/gcloud/alpha/compute/interconnects/attachments/partner/create
index 9c6b72ef7..dd3113836 100644
--- a/gcloud/alpha/compute/interconnects/attachments/partner/create
+++ b/gcloud/alpha/compute/interconnects/attachments/partner/create
@@ -7,7 +7,8 @@ SYNOPSIS
         --edge-availability-domain=AVAILABILITY_DOMAIN --router=ROUTER
         [--description=DESCRIPTION] [--dry-run] [--enable-admin]
         [--encryption=ENCRYPTION] [--ipsec-internal-addresses=[ADDRESSES]]
-        [--mtu=MTU] [--region=REGION] [GCLOUD_WIDE_FLAG ...]
+        [--mtu=MTU] [--region=REGION] [--stack-type=STACK_TYPE]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) gcloud alpha compute interconnects attachments partner create is
@@ -114,6 +115,15 @@ OPTIONAL FLAGS
         Alternatively, the region can be stored in the environment variable
         CLOUDSDK_COMPUTE_REGION.
 
+     --stack-type=STACK_TYPE
+        The stack type of the protocol(s) enabled on this interconnect
+        attachment. STACK_TYPE must be one of:
+
+         IPV4_IPV6
+            Both IPv4 and IPv6 protocols are enabled on this attachment.
+         IPV4_ONLY
+            Only IPv4 protocol is enabled on this attachment.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/alpha/compute/interconnects/attachments/partner/update b/gcloud/alpha/compute/interconnects/attachments/partner/update
index b7e093e95..09bdd89fb 100644
--- a/gcloud/alpha/compute/interconnects/attachments/partner/update
+++ b/gcloud/alpha/compute/interconnects/attachments/partner/update
@@ -5,7 +5,8 @@ NAME
 SYNOPSIS
     gcloud alpha compute interconnects attachments partner update NAME
         [--description=DESCRIPTION] [--enable-admin] [--mtu=MTU]
-        [--region=REGION] [--update-labels=[KEY=VALUE,...]]
+        [--region=REGION] [--stack-type=STACK_TYPE]
+        [--update-labels=[KEY=VALUE,...]]
         [--clear-labels | --remove-labels=[KEY,...]] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
@@ -52,6 +53,15 @@ FLAGS
         Alternatively, the region can be stored in the environment variable
         CLOUDSDK_COMPUTE_REGION.
 
+     --stack-type=STACK_TYPE
+        The stack type of the protocol(s) enabled on this interconnect
+        attachment. STACK_TYPE must be one of:
+
+         IPV4_IPV6
+            Both IPv4 and IPv6 protocols are enabled on this attachment.
+         IPV4_ONLY
+            Only IPv4 protocol is enabled on this attachment.
+
      --update-labels=[KEY=VALUE,...]
         List of label KEY=VALUE pairs to update. If a label exists, its value
         is modified. Otherwise, a new label is created.
diff --git a/gcloud/alpha/compute/interconnects/create b/gcloud/alpha/compute/interconnects/create
index c2ccc5e83..9aa3a6464 100644
--- a/gcloud/alpha/compute/interconnects/create
+++ b/gcloud/alpha/compute/interconnects/create
@@ -102,11 +102,11 @@ OPTIONAL FLAGS
         (only one value is supported):
 
          MACSEC
-            If specified then the interconnect will be created on MACsec
-            capable hardware ports. If not specified, the default value is
-            false, which will allocate non-MACsec capable ports first if
-            available. This parameter can only be provided during interconnect
-            INSERT and cannot be changed using interconnect PATCH.
+            If specified then the interconnect is created on MACsec capable
+            hardware ports. If not specified, the interconnect is created on
+            non-MACsec capable ports first, if available. This parameter can
+            only be provided during interconnect INSERT and cannot be changed
+            using interconnect PATCH.
 
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
diff --git a/gcloud/alpha/compute/interconnects/macsec/add-key b/gcloud/alpha/compute/interconnects/macsec/add-key
index f57691fa2..4eaed5938 100644
--- a/gcloud/alpha/compute/interconnects/macsec/add-key
+++ b/gcloud/alpha/compute/interconnects/macsec/add-key
@@ -49,7 +49,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud compute interconnects macsec add-key
 
         $ gcloud beta compute interconnects macsec add-key
 
diff --git a/gcloud/alpha/compute/interconnects/macsec/get-config b/gcloud/alpha/compute/interconnects/macsec/get-config
index 674448b38..cd0b5becc 100644
--- a/gcloud/alpha/compute/interconnects/macsec/get-config
+++ b/gcloud/alpha/compute/interconnects/macsec/get-config
@@ -36,7 +36,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud compute interconnects macsec get-config
 
         $ gcloud beta compute interconnects macsec get-config
 
diff --git a/gcloud/alpha/compute/interconnects/macsec/help b/gcloud/alpha/compute/interconnects/macsec/help
index 5eae06965..6d58e3288 100644
--- a/gcloud/alpha/compute/interconnects/macsec/help
+++ b/gcloud/alpha/compute/interconnects/macsec/help
@@ -39,7 +39,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud compute interconnects macsec
 
         $ gcloud beta compute interconnects macsec
 
diff --git a/gcloud/alpha/compute/interconnects/macsec/remove-key b/gcloud/alpha/compute/interconnects/macsec/remove-key
index fcf6b9f5a..4a77beb0b 100644
--- a/gcloud/alpha/compute/interconnects/macsec/remove-key
+++ b/gcloud/alpha/compute/interconnects/macsec/remove-key
@@ -39,7 +39,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud compute interconnects macsec remove-key
 
         $ gcloud beta compute interconnects macsec remove-key
 
diff --git a/gcloud/alpha/compute/interconnects/macsec/update b/gcloud/alpha/compute/interconnects/macsec/update
index 4699cbbe8..f409dae63 100644
--- a/gcloud/alpha/compute/interconnects/macsec/update
+++ b/gcloud/alpha/compute/interconnects/macsec/update
@@ -49,7 +49,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud compute interconnects macsec update
 
         $ gcloud beta compute interconnects macsec update
 
diff --git a/gcloud/alpha/compute/interconnects/macsec/update-key b/gcloud/alpha/compute/interconnects/macsec/update-key
index 5139658df..5230c720a 100644
--- a/gcloud/alpha/compute/interconnects/macsec/update-key
+++ b/gcloud/alpha/compute/interconnects/macsec/update-key
@@ -49,7 +49,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
+
+        $ gcloud compute interconnects macsec update-key
 
         $ gcloud beta compute interconnects macsec update-key
 
diff --git a/gcloud/alpha/compute/sole-tenancy/node-groups/perform-maintenance b/gcloud/alpha/compute/sole-tenancy/node-groups/perform-maintenance
index 8a86eac3a..89c883555 100644
--- a/gcloud/alpha/compute/sole-tenancy/node-groups/perform-maintenance
+++ b/gcloud/alpha/compute/sole-tenancy/node-groups/perform-maintenance
@@ -63,5 +63,7 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist.
+    access allowlist. This variant is also available:
+
+        $ gcloud beta compute sole-tenancy node-groups perform-maintenance
 
diff --git a/gcloud/alpha/compute/tpus/queued-resources/create b/gcloud/alpha/compute/tpus/queued-resources/create
index 8110f93d7..7ae4e9055 100644
--- a/gcloud/alpha/compute/tpus/queued-resources/create
+++ b/gcloud/alpha/compute/tpus/queued-resources/create
@@ -9,9 +9,10 @@ SYNOPSIS
         (--node-id=NODE_ID
           | [--node-count=NODE_COUNT : --node-prefix=NODE_PREFIX]) [--async]
         [--autocheckpoint-enabled] [--best-effort]
-        [--data-disk=[mode=MODE],[source=SOURCE]] [--description=DESCRIPTION]
-        [--guaranteed] [--internal-ips] [--labels=[KEY=VALUE,...]]
-        [--metadata=[KEY=VALUE,...]] [--metadata-from-file=[KEY=VALUE,...]]
+        [--boot-disk=[KEY=VALUE,...]] [--data-disk=[mode=MODE],[source=SOURCE]]
+        [--description=DESCRIPTION] [--guaranteed] [--internal-ips]
+        [--labels=[KEY=VALUE,...]] [--metadata=[KEY=VALUE,...]]
+        [--metadata-from-file=[KEY=VALUE,...]]
         [--network=NETWORK; default="default"] [--range=RANGE]
         [--reservation-host-folder=RESERVATION_HOST_FOLDER]
         [--reservation-host-organization=RESERVATION_HOST_ORGANIZATION]
@@ -149,6 +150,24 @@ OPTIONAL FLAGS
         If provided, the Node requested here may be scheduled at the 'best
         effort' tier.
 
+     --boot-disk=[KEY=VALUE,...]
+        Specifies if the boot disk should be created in confidential-compute
+        mode.
+
+            $ gcloud alpha compute tpus queued-resources create \
+                  --boot-disk confidential-compute=True,kms-key=<full_kms_key_name_here>
+
+        The following keys are allowed:
+
+         confidential-compute
+            Create the boot disk in confidential compute mode, CMEK layer is
+            required and only applicable to HyperDisk series.
+
+         kms-key
+            Specifies fully qualified Cloud KMS cryptokey name which will be
+            used to protect the disk. KMS cryptokey name format:
+            projects/<kms-project>/locations/<kms-location>/keyRings/<kms-keyring>/cryptoKeys/<key-name>
+
      --data-disk=[mode=MODE],[source=SOURCE]
         Additional data disks for the TPU VM.
 
diff --git a/gcloud/alpha/container/clusters/create b/gcloud/alpha/container/clusters/create
index f202d96bd..dd4a3c5f8 100644
--- a/gcloud/alpha/container/clusters/create
+++ b/gcloud/alpha/container/clusters/create
@@ -1569,7 +1569,7 @@ FLAGS
                 argument should be used in conjunction with
                 --enable-autoprovisioning-blue-green-upgrade to take effect.
 
-                Batch sizes are specfied by one of, batch-node-count or
+                Batch sizes are specified by one of, batch-node-count or
                 batch-percent. The duration between batches is specified by
                 batch-soak-duration.
 
@@ -1823,9 +1823,11 @@ FLAGS
                   --ephemeral-storage local-ssd-count=2
 
           'local-ssd-count' specifies the number of local SSDs to use to back
-          ephemeral storage. Local SDDs use NVMe interfaces and each is 375 GB
-          in size. Setting 'local-ssd-count=0' disables using local SSDs as
-          ephemeral storage.
+          ephemeral storage. Local SDDs use NVMe interfaces. For first- and
+          second-generation machine types, a nonzero count field is required
+          for local ssd to be configured. For third-generation machine types,
+          the count field is optional because the count is inferred from the
+          machine type.
 
           See https://cloud.google.com/compute/docs/disks/local-ssd for more
           information.
@@ -1840,8 +1842,11 @@ FLAGS
                   --ephemeral-storage-local-ssd count=2
 
           'count' specifies the number of local SSDs to use to back ephemeral
-          storage. Local SDDs use NVMe interfaces and each is 375 GB in size.
-          Setting 'count=0' disables using local SSDs as ephemeral storage.
+          storage. Local SDDs use NVMe interfaces. For first- and
+          second-generation machine types, a nonzero count field is required
+          for local ssd to be configured. For third-generation machine types,
+          the count field is optional because the count is inferred from the
+          machine type.
 
           See https://cloud.google.com/compute/docs/disks/local-ssd for more
           information.
@@ -1860,11 +1865,13 @@ FLAGS
           New nodes, including ones created by resize or recreate, will have
           these local SSDs.
 
-          Local SSDs have a fixed 375 GB capacity per device. The number of
-          disks that can be attached to an instance is limited by the maximum
-          number of disks available on a machine, which differs by compute
-          zone. See https://cloud.google.com/compute/docs/disks/local-ssd for
-          more information.
+          For first- and second-generation machine types, a nonzero count field
+          is required for local ssd to be configured. For third-generation
+          machine types, the count field is optional because the count is
+          inferred from the machine type.
+
+          See https://cloud.google.com/compute/docs/disks/local-ssd for more
+          information.
 
        --local-ssd-count=LOCAL_SSD_COUNT
           --local-ssd-count is the equivalent of using --local-ssd-volumes with
diff --git a/gcloud/alpha/container/clusters/create-auto b/gcloud/alpha/container/clusters/create-auto
index f6a79ebbe..8eba83d3b 100644
--- a/gcloud/alpha/container/clusters/create-auto
+++ b/gcloud/alpha/container/clusters/create-auto
@@ -255,10 +255,10 @@ FLAGS
 
         Examples:
 
-            $ gcloud alpha container clusters create-auto --logging=SYSTEM
+            $ gcloud alpha container clusters create-auto \
+                --logging=SYSTEM,WORKLOAD
             $ gcloud alpha container clusters create-auto \
                 --logging=SYSTEM,API_SERVER,WORKLOAD
-            $ gcloud alpha container clusters create-auto --logging=NONE
 
      --monitoring=[COMPONENT,...]
         Set the components that have monitoring enabled. Valid component values
@@ -273,7 +273,7 @@ FLAGS
 
             $ gcloud alpha container clusters create-auto \
                 --monitoring=SYSTEM,API_SERVER,POD
-            $ gcloud alpha container clusters create-auto --monitoring=NONE
+            $ gcloud alpha container clusters create-auto --monitoring=SYSTEM
 
      --network=NETWORK
         The Compute Engine Network that the cluster will connect to. Google
diff --git a/gcloud/alpha/container/clusters/update b/gcloud/alpha/container/clusters/update
index acdd0a37a..1310bb5de 100644
--- a/gcloud/alpha/container/clusters/update
+++ b/gcloud/alpha/container/clusters/update
@@ -1122,7 +1122,7 @@ REQUIRED FLAGS
                   argument should be used in conjunction with
                   --enable-autoprovisioning-blue-green-upgrade to take effect.
 
-                  Batch sizes are specfied by one of, batch-node-count or
+                  Batch sizes are specified by one of, batch-node-count or
                   batch-percent. The duration between batches is specified by
                   batch-soak-duration.
 
diff --git a/gcloud/alpha/container/node-pools/create b/gcloud/alpha/container/node-pools/create
index 25925cdbc..d0a596891 100644
--- a/gcloud/alpha/container/node-pools/create
+++ b/gcloud/alpha/container/node-pools/create
@@ -870,9 +870,11 @@ FLAGS
                   --cluster=example cluster --ephemeral-storage local-ssd-count=2
 
           'local-ssd-count' specifies the number of local SSDs to use to back
-          ephemeral storage. Local SDDs use NVMe interfaces and each is 375 GB
-          in size. Setting 'local-ssd-count=0' disables using local SSDs as
-          ephemeral storage.
+          ephemeral storage. Local SDDs use NVMe interfaces. For first- and
+          second-generation machine types, a nonzero count field is required
+          for local ssd to be configured. For third-generation machine types,
+          the count field is optional because the count is inferred from the
+          machine type.
 
           See https://cloud.google.com/compute/docs/disks/local-ssd for more
           information.
@@ -887,8 +889,11 @@ FLAGS
                   --cluster=example cluster --ephemeral-storage-local-ssd count=2
 
           'count' specifies the number of local SSDs to use to back ephemeral
-          storage. Local SDDs use NVMe interfaces and each is 375 GB in size.
-          Setting 'count=0' disables using local SSDs as ephemeral storage.
+          storage. Local SDDs use NVMe interfaces. For first- and
+          second-generation machine types, a nonzero count field is required
+          for local ssd to be configured. For third-generation machine types,
+          the count field is optional because the count is inferred from the
+          machine type.
 
           See https://cloud.google.com/compute/docs/disks/local-ssd for more
           information.
@@ -907,11 +912,13 @@ FLAGS
           New nodes, including ones created by resize or recreate, will have
           these local SSDs.
 
-          Local SSDs have a fixed 375 GB capacity per device. The number of
-          disks that can be attached to an instance is limited by the maximum
-          number of disks available on a machine, which differs by compute
-          zone. See https://cloud.google.com/compute/docs/disks/local-ssd for
-          more information.
+          For first- and second-generation machine types, a nonzero count field
+          is required for local ssd to be configured. For third-generation
+          machine types, the count field is optional because the count is
+          inferred from the machine type.
+
+          See https://cloud.google.com/compute/docs/disks/local-ssd for more
+          information.
 
        --local-ssd-count=LOCAL_SSD_COUNT
           --local-ssd-count is the equivalent of using --local-ssd-volumes with
diff --git a/gcloud/alpha/database-migration/connection-profiles/create/mysql b/gcloud/alpha/database-migration/connection-profiles/create/mysql
index 0af94d0e9..80be1d3b7 100644
--- a/gcloud/alpha/database-migration/connection-profiles/create/mysql
+++ b/gcloud/alpha/database-migration/connection-profiles/create/mysql
@@ -9,8 +9,8 @@ SYNOPSIS
         [--labels=[KEY=VALUE,...]] [--provider=PROVIDER]
         [--ca-certificate=CA_CERTIFICATE
           : --certificate=CERTIFICATE --private-key=PRIVATE_KEY]
-        [--host=HOST --port=PORT --username=USERNAME (--password=PASSWORD
-          | --prompt-for-password)] [GCLOUD_WIDE_FLAG ...]
+        [--host=HOST --port=PORT --username=USERNAME : --password=PASSWORD
+          | --prompt-for-password] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) Create a Database Migration Service connection profile for MySQL.
@@ -115,7 +115,7 @@ FLAGS
         database. Database Migration Service encrypts the value when storing
         it.
 
-     Exactly one of these must be specified:
+     At most one of these can be specified:
 
        --password=PASSWORD
           Password for the user that Database Migration Service uses to connect
diff --git a/gcloud/alpha/edge-cloud/container/clusters/node-pools/create b/gcloud/alpha/edge-cloud/container/clusters/node-pools/create
index 28fad7980..c95ae5d43 100644
--- a/gcloud/alpha/edge-cloud/container/clusters/node-pools/create
+++ b/gcloud/alpha/edge-cloud/container/clusters/node-pools/create
@@ -7,20 +7,21 @@ SYNOPSIS
         (NODE_POOL : --cluster=CLUSTER --location=LOCATION)
         --node-count=NODE_COUNT --node-location=NODE_LOCATION [--async]
         [--labels=[KEY=VALUE,...]] [--local-disk-kms-key=LOCAL_DISK_KMS_KEY]
-        [--machine-filter=MACHINE_FILTER] [GCLOUD_WIDE_FLAG ...]
+        [--lro-timeout=LRO_TIMEOUT] [--machine-filter=MACHINE_FILTER]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) Create a new Edge Container nodePool.
+    (ALPHA) Create an Edge Container node pool.
 
 EXAMPLES
-    To create a node pool called 'my-nodePool', containing 3 nodes in region
+    To create a node pool called my-nodePool, containing 3 nodes in region
     us-central1, run:
 
         $ gcloud alpha edge-cloud container clusters node-pools create \
             my-nodePool --cluster=<my-cluster> --location=us-central1 \
             --node-location=<my-node-location> --node-count=3
 
-    To create a node pool called 'my-nodePool', containing 3 nodes in region
+    To create a node pool called my-nodePool, containing 3 nodes in region
     us-central1, using only machine names matching a specific pattern, run:
 
         $ gcloud alpha edge-cloud container clusters node-pools create \
@@ -28,7 +29,7 @@ EXAMPLES
             --node-location=<my-node-location> --node-count=3 \
             --machine-filter="name:<name>"
 
-    To create a node pool called 'my-nodePool', containing 3 nodes in region
+    To create a node pool called my-nodePool, containing 3 nodes in region
     us-central1, using only machine names NOT matching a specific pattern, run:
 
         $ gcloud alpha edge-cloud container clusters node-pools create \
@@ -45,22 +46,22 @@ POSITIONAL ARGUMENTS
      To set the project attribute:
       ◆ provide the argument node_pool on the command line with a fully
         specified name;
-      ◆ set the property core/project;
-      ◆ provide the argument --project on the command line.
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
 
      This must be specified.
 
        NODE_POOL
           ID of the node pool or fully qualified identifier for the node pool.
 
-          To set the node_pool attribute:
+          To set the nodePool attribute:
           ▸ provide the argument node_pool on the command line.
 
           This positional argument must be specified if any of the other
           arguments in this group are specified.
 
        --cluster=CLUSTER
-          Kubernetes cluster.
+          Cluster of the node pool.
 
           To set the cluster attribute:
           ▸ provide the argument node_pool on the command line with a fully
@@ -68,13 +69,12 @@ POSITIONAL ARGUMENTS
           ▸ provide the argument --cluster on the command line.
 
        --location=LOCATION
-          The global location name.
+          Google Cloud location for the node pool.
 
           To set the location attribute:
           ▸ provide the argument node_pool on the command line with a fully
             specified name;
-          ▸ provide the argument --location on the command line;
-          ▸ set the property edge_container/location.
+          ▸ provide the argument --location on the command line.
 
 REQUIRED FLAGS
      --node-count=NODE_COUNT
@@ -103,6 +103,9 @@ OPTIONAL FLAGS
 
         If not provided, a Google-managed key will be used instead.
 
+     --lro-timeout=LRO_TIMEOUT
+        Overwrite the default LRO maximum timeout.
+
      --machine-filter=MACHINE_FILTER
         Only machines matching this filter will be allowed to join the node
         pool. The filtering language accepts strings like "name=<name>", and is
diff --git a/gcloud/alpha/edge-cloud/container/clusters/node-pools/update b/gcloud/alpha/edge-cloud/container/clusters/node-pools/update
index d11f4dec6..7a32311a5 100644
--- a/gcloud/alpha/edge-cloud/container/clusters/node-pools/update
+++ b/gcloud/alpha/edge-cloud/container/clusters/node-pools/update
@@ -5,16 +5,16 @@ NAME
 SYNOPSIS
     gcloud alpha edge-cloud container clusters node-pools update
         (NODE_POOL : --cluster=CLUSTER --location=LOCATION) [--async]
-        [--machine-filter=MACHINE_FILTER] [--node-count=NODE_COUNT]
-        [--update-labels=[KEY=VALUE,...]]
+        [--lro-timeout=LRO_TIMEOUT] [--machine-filter=MACHINE_FILTER]
+        [--node-count=NODE_COUNT] [--update-labels=[KEY=VALUE,...]]
         [--clear-labels | --remove-labels=[KEY,...]] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) Updates an Edge Container node pool.
 
 EXAMPLES
-    To update the number of nodes in a node pool called 'my-node-pool' in
-    region us-central1, run:
+    To update the number of nodes in a node pool called my-node-pool in region
+    us-central1, run:
 
         $ gcloud alpha edge-cloud container clusters node-pools update \
             my-node-pool --location=us-central1 --cluster=<my-cluster> \
@@ -29,22 +29,22 @@ POSITIONAL ARGUMENTS
      To set the project attribute:
       ◆ provide the argument node_pool on the command line with a fully
         specified name;
-      ◆ set the property core/project;
-      ◆ provide the argument --project on the command line.
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
 
      This must be specified.
 
        NODE_POOL
           ID of the node pool or fully qualified identifier for the node pool.
 
-          To set the node_pool attribute:
+          To set the nodePool attribute:
           ▸ provide the argument node_pool on the command line.
 
           This positional argument must be specified if any of the other
           arguments in this group are specified.
 
        --cluster=CLUSTER
-          Kubernetes cluster.
+          Cluster of the node pool.
 
           To set the cluster attribute:
           ▸ provide the argument node_pool on the command line with a fully
@@ -52,19 +52,21 @@ POSITIONAL ARGUMENTS
           ▸ provide the argument --cluster on the command line.
 
        --location=LOCATION
-          The global location name.
+          Google Cloud location for the node pool.
 
           To set the location attribute:
           ▸ provide the argument node_pool on the command line with a fully
             specified name;
-          ▸ provide the argument --location on the command line;
-          ▸ set the property edge_container/location.
+          ▸ provide the argument --location on the command line.
 
 FLAGS
      --async
         Return immediately, without waiting for the operation in progress to
         complete.
 
+     --lro-timeout=LRO_TIMEOUT
+        Overwrite the default LRO maximum timeout.
+
      --machine-filter=MACHINE_FILTER
         Only machines matching this filter will be allowed to join the node
         pool. The filtering language accepts strings like "name=<name>", and is
diff --git a/gcloud/alpha/firestore/databases/create b/gcloud/alpha/firestore/databases/create
index eba8ddeba..982aec463 100644
--- a/gcloud/alpha/firestore/databases/create
+++ b/gcloud/alpha/firestore/databases/create
@@ -68,8 +68,8 @@ OPTIONAL FLAGS
         Whether to enable Point In Time Recovery (PITR) on the created
         database.
 
-            If set to true, PITR on the new database will be enabled.
-            Default to false.
+            If set to true, PITR on the new database will be enabled. By default,
+            this feature is not enabled.
 
      --type=TYPE; default="firestore-native"
         The type of the database. TYPE must be one of: firestore-native,
diff --git a/gcloud/alpha/firestore/databases/delete b/gcloud/alpha/firestore/databases/delete
index be5453209..2573a53b1 100644
--- a/gcloud/alpha/firestore/databases/delete
+++ b/gcloud/alpha/firestore/databases/delete
@@ -3,8 +3,8 @@ NAME
         database
 
 SYNOPSIS
-    gcloud alpha firestore databases delete --database=DATABASE
-        [--allow-missing] [--etag=ETAG] [GCLOUD_WIDE_FLAG ...]
+    gcloud alpha firestore databases delete --database=DATABASE [--etag=ETAG]
+        [GCLOUD_WIDE_FLAG ...]
 
 EXAMPLES
     To delete a Firestore database test.
@@ -24,10 +24,6 @@ REQUIRED FLAGS
         The database to operate on.
 
 OPTIONAL FLAGS
-     --allow-missing
-        If set and the Database is not found, the request will succeed but no
-        action will be taken.
-
      --etag=ETAG
         The current etag of the Database. If an etag is provided and does not
         match the current etag of the database, deletion will be blocked and a
diff --git a/gcloud/alpha/firestore/databases/update b/gcloud/alpha/firestore/databases/update
index 471417949..896de06d4 100644
--- a/gcloud/alpha/firestore/databases/update
+++ b/gcloud/alpha/firestore/databases/update
@@ -41,16 +41,15 @@ FLAGS
           ▸ the default value of argument [--database] is (default).
 
      --delete-protection
-        If set to true, the firestore database will be updated to have database
+        If set to true, the Firestore database will be updated to have database
         delete protection enabled. A database with delete protection enabled
         cannot be deleted. You can disable the delete protection via
         --no-delete-protection.
 
      --enable-pitr
-        If set to true, the firestore database will be updated to enable Point
-        In Time Recovery. Customers will gradually gain the full read access to
-        their data over the past 7 days and they will be charged. You can
-        disable the this feature via --no-enable-pitr.
+        If set to true, the Firestore database will be updated to enable Point
+        In Time Recovery. You can disable the this feature via
+        --no-enable-pitr.
 
      --type=TYPE
         The database type. TYPE must be one of: datastore-mode,
diff --git a/gcloud/alpha/firestore/export b/gcloud/alpha/firestore/export
index 2fad5caf5..e13d43565 100644
--- a/gcloud/alpha/firestore/export
+++ b/gcloud/alpha/firestore/export
@@ -80,9 +80,13 @@ FLAGS
         The version of the database to export.
 
         The timestamp must be rounded to the minute, in the past, and not older
-        than 1 hour. If specified, then the exported documents will represent a
-        consistent view of the database at the provided time. Otherwise, there
-        are no guarantees about the consistency of the exported documents.
+        than 5 days. Please choose a reasonable timestamp based on prior
+        knowledge on how long exports take as data at provided snapshot
+        timestamp can expire during export.
+
+        If specified, then the exported documents will represent a consistent
+        view of the database at the provided time. Otherwise, there are no
+        guarantees about the consistency of the exported documents.
 
         For example, to operate on snapshot time 2023-05-26T10:20:00.00Z:
 
diff --git a/gcloud/alpha/iam/service-accounts/delete b/gcloud/alpha/iam/service-accounts/delete
index dd9776768..d147d5a9e 100644
--- a/gcloud/alpha/iam/service-accounts/delete
+++ b/gcloud/alpha/iam/service-accounts/delete
@@ -4,7 +4,7 @@ NAME
 
 SYNOPSIS
     gcloud alpha iam service-accounts delete SERVICE_ACCOUNT
-        [GCLOUD_WIDE_FLAG ...]
+        [--recommend=BOOLEAN_VALUE] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) If the service account does not exist, this command returns a
@@ -22,6 +22,12 @@ POSITIONAL ARGUMENTS
         as a numeric service account ID or as an email, like this:
         123456789876543212345 or my-iam-account@somedomain.com.
 
+FLAGS
+     --recommend=BOOLEAN_VALUE
+        If true, checks Active Assist recommendation for the risk level of
+        service account deletion, and issues a warning in the prompt. Optional
+        flag is set to false/no by default.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/alpha/infra-manager/deployments/delete b/gcloud/alpha/infra-manager/deployments/delete
index 776d35203..50e91b671 100644
--- a/gcloud/alpha/infra-manager/deployments/delete
+++ b/gcloud/alpha/infra-manager/deployments/delete
@@ -69,7 +69,7 @@ GCLOUD WIDE FLAGS
 
 API REFERENCE
     This command uses the config/v1 API. The full documentation for this API
-    can be found at: https://cloud.google.com/
+    can be found at: https://cloud.google.com/infrastructure-manager/docs
 
 NOTES
     This command is currently in alpha and might change without notice. If this
diff --git a/gcloud/alpha/infra-manager/deployments/describe b/gcloud/alpha/infra-manager/deployments/describe
index f35eb6498..feb7bce75 100644
--- a/gcloud/alpha/infra-manager/deployments/describe
+++ b/gcloud/alpha/infra-manager/deployments/describe
@@ -57,7 +57,7 @@ GCLOUD WIDE FLAGS
 
 API REFERENCE
     This command uses the config/v1 API. The full documentation for this API
-    can be found at: https://cloud.google.com/
+    can be found at: https://cloud.google.com/infrastructure-manager/docs
 
 NOTES
     This command is currently in alpha and might change without notice. If this
diff --git a/gcloud/alpha/infra-manager/deployments/list b/gcloud/alpha/infra-manager/deployments/list
index d383eeda7..e909c10a1 100644
--- a/gcloud/alpha/infra-manager/deployments/list
+++ b/gcloud/alpha/infra-manager/deployments/list
@@ -75,7 +75,7 @@ GCLOUD WIDE FLAGS
 
 API REFERENCE
     This command uses the config/v1 API. The full documentation for this API
-    can be found at: https://cloud.google.com/
+    can be found at: https://cloud.google.com/infrastructure-manager/docs
 
 NOTES
     This command is currently in alpha and might change without notice. If this
diff --git a/gcloud/alpha/infra-manager/resources/describe b/gcloud/alpha/infra-manager/resources/describe
index 8a757df12..c2fc6309e 100644
--- a/gcloud/alpha/infra-manager/resources/describe
+++ b/gcloud/alpha/infra-manager/resources/describe
@@ -76,7 +76,7 @@ GCLOUD WIDE FLAGS
 
 API REFERENCE
     This command uses the config/v1 API. The full documentation for this API
-    can be found at: https://cloud.google.com/
+    can be found at: https://cloud.google.com/infrastructure-manager/docs
 
 NOTES
     This command is currently in alpha and might change without notice. If this
diff --git a/gcloud/alpha/infra-manager/resources/list b/gcloud/alpha/infra-manager/resources/list
index f885b6525..fbabd3ffd 100644
--- a/gcloud/alpha/infra-manager/resources/list
+++ b/gcloud/alpha/infra-manager/resources/list
@@ -98,7 +98,7 @@ GCLOUD WIDE FLAGS
 
 API REFERENCE
     This command uses the config/v1 API. The full documentation for this API
-    can be found at: https://cloud.google.com/
+    can be found at: https://cloud.google.com/infrastructure-manager/docs
 
 NOTES
     This command is currently in alpha and might change without notice. If this
diff --git a/gcloud/alpha/infra-manager/revisions/describe b/gcloud/alpha/infra-manager/revisions/describe
index 35d640954..893a05ebc 100644
--- a/gcloud/alpha/infra-manager/revisions/describe
+++ b/gcloud/alpha/infra-manager/revisions/describe
@@ -66,7 +66,7 @@ GCLOUD WIDE FLAGS
 
 API REFERENCE
     This command uses the config/v1 API. The full documentation for this API
-    can be found at: https://cloud.google.com/
+    can be found at: https://cloud.google.com/infrastructure-manager/docs
 
 NOTES
     This command is currently in alpha and might change without notice. If this
diff --git a/gcloud/alpha/infra-manager/revisions/list b/gcloud/alpha/infra-manager/revisions/list
index 6069f1bde..54bc7a1e4 100644
--- a/gcloud/alpha/infra-manager/revisions/list
+++ b/gcloud/alpha/infra-manager/revisions/list
@@ -91,7 +91,7 @@ GCLOUD WIDE FLAGS
 
 API REFERENCE
     This command uses the config/v1 API. The full documentation for this API
-    can be found at: https://cloud.google.com/
+    can be found at: https://cloud.google.com/infrastructure-manager/docs
 
 NOTES
     This command is currently in alpha and might change without notice. If this
diff --git a/gcloud/alpha/metastore/services/update b/gcloud/alpha/metastore/services/update
index 4dafd60e7..879b1d262 100644
--- a/gcloud/alpha/metastore/services/update
+++ b/gcloud/alpha/metastore/services/update
@@ -77,8 +77,9 @@ FLAGS
 
      --data-catalog-sync
         A boolean flag to determine whether Dataproc Metastore metadata sync to
-        Data Catalog should be enabled. Cannot be updated if the service uses
-        customer-managed encryption keys.
+        Data Catalog should be enabled, false if unspecified. Mutually
+        exclusive with flag --encryption-kms-key. Cannot be updated if the
+        service uses customer-managed encryption keys.
 
      --endpoint-protocol=ENDPOINT_PROTOCOL
         The protocol to use for the metastore service endpoint.
diff --git a/gcloud/alpha/network-connectivity/help b/gcloud/alpha/network-connectivity/help
index f591af35a..85465e7c6 100644
--- a/gcloud/alpha/network-connectivity/help
+++ b/gcloud/alpha/network-connectivity/help
@@ -32,7 +32,9 @@ NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
 
         $ gcloud network-connectivity
 
+        $ gcloud beta network-connectivity
+
diff --git a/gcloud/alpha/notebooks/instances/create b/gcloud/alpha/notebooks/instances/create
index f670f75e9..156f0abbe 100644
--- a/gcloud/alpha/notebooks/instances/create
+++ b/gcloud/alpha/notebooks/instances/create
@@ -187,6 +187,10 @@ OPTIONAL FLAGS
      --metadata=[KEY=VALUE,...]
         Custom metadata to apply to this instance.
 
+        For example, to specify a Cloud Storage bucket for automatic backup,
+        you can use the gcs-data-bucket metadata tag. Format:
+        "--metadata=gcs-data-bucket=BUCKET".
+
      --post-startup-script=POST_STARTUP_SCRIPT
         Path to a Bash script that automatically runs after a notebook instance
         fully boots up. The path must be a URL or Cloud Storage path
diff --git a/gcloud/alpha/projects/delete b/gcloud/alpha/projects/delete
index fc6c4d941..e67ab79d0 100644
--- a/gcloud/alpha/projects/delete
+++ b/gcloud/alpha/projects/delete
@@ -2,7 +2,8 @@ NAME
     gcloud alpha projects delete - delete a project
 
 SYNOPSIS
-    gcloud alpha projects delete PROJECT_ID_OR_NUMBER [GCLOUD_WIDE_FLAG ...]
+    gcloud alpha projects delete PROJECT_ID_OR_NUMBER
+        [--recommend=BOOLEAN_VALUE] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) Deletes the project with the given project ID.
@@ -26,6 +27,12 @@ POSITIONAL ARGUMENTS
      PROJECT_ID_OR_NUMBER
         ID or number for the project you want to delete.
 
+FLAGS
+     --recommend=BOOLEAN_VALUE
+        If true, checks Active Assist recommendation for the risk level of
+        project deletion, and issues a warning in the prompt. Optional flag is
+        set to false/no by default.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/alpha/projects/remove-iam-policy-binding b/gcloud/alpha/projects/remove-iam-policy-binding
index 5f60e79f9..3ec31bfad 100644
--- a/gcloud/alpha/projects/remove-iam-policy-binding
+++ b/gcloud/alpha/projects/remove-iam-policy-binding
@@ -4,7 +4,7 @@ NAME
 
 SYNOPSIS
     gcloud alpha projects remove-iam-policy-binding PROJECT_ID
-        --member=PRINCIPAL --role=ROLE
+        --member=PRINCIPAL --role=ROLE [--recommend=BOOLEAN_VALUE]
         [--all | --condition=[KEY=VALUE,...]
           | --condition-from-file=CONDITION_FROM_FILE] [GCLOUD_WIDE_FLAG ...]
 
@@ -89,6 +89,11 @@ REQUIRED FLAGS
         The role to remove the principal from.
 
 OPTIONAL FLAGS
+     --recommend=BOOLEAN_VALUE
+        If true, checks Active Assist recommendation for the risk level of IAM
+        policy binding removal, and issues a warning in the prompt. Optional
+        flag is set to false/no by default.
+
      At most one of these can be specified:
 
        --all
diff --git a/gcloud/alpha/scc/posture-deployments/create b/gcloud/alpha/scc/posture-deployments/create
index 3af1d2dcf..0e71bf199 100644
--- a/gcloud/alpha/scc/posture-deployments/create
+++ b/gcloud/alpha/scc/posture-deployments/create
@@ -6,13 +6,13 @@ SYNOPSIS
     gcloud alpha scc posture-deployments create POSTURE_DEPLOYMENT_PARENT
         POSTURE_DEPLOYMENT_ID --posture-name=POSTURE_NAME
         --posture-revision-id=POSTURE_REVISION_ID
-        --target-resource=TARGET_RESOURCE [--description=DESCRIPTION]
+        --target-resource=TARGET_RESOURCE [--async] [--description=DESCRIPTION]
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) Create a Cloud Security Command Center (SCC) posture deployment.
-    First argument is the parent of the posture-deployment to be created.
-    Second argument is the name of the posture-deployment to be created. It is
+    First argument is the parent of the posture deployment to be created.
+    Second argument is the name of the posture deployment to be created. It is
     followed by details of the posture to be deployed and the target_resource
     to be deployed on.
 
@@ -24,7 +24,7 @@ POSITIONAL ARGUMENTS
         be created. Format: organizations/<organizationID>/locations/<location>
 
      POSTURE_DEPLOYMENT_ID
-        Name of the posture-deployment to be created. It has to be unique for
+        Name of the posture deployment to be created. It has to be unique for
         an organization.
 
 REQUIRED FLAGS
@@ -43,8 +43,12 @@ REQUIRED FLAGS
         format.
 
 OPTIONAL FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
      --description=DESCRIPTION
-        User provided description of the posture-deployment.
+        User-provided description of the posture deployment.
 
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
diff --git a/gcloud/alpha/scc/posture-deployments/delete b/gcloud/alpha/scc/posture-deployments/delete
index 98dd9437a..389ef3f5c 100644
--- a/gcloud/alpha/scc/posture-deployments/delete
+++ b/gcloud/alpha/scc/posture-deployments/delete
@@ -4,7 +4,7 @@ NAME
 
 SYNOPSIS
     gcloud alpha scc posture-deployments delete POSTURE_DEPLOYMENT_NAME
-        [--etag=ETAG] [GCLOUD_WIDE_FLAG ...]
+        [--async] [--etag=ETAG] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) Delete a Cloud Security Command Center (SCC) posture deployment.
@@ -36,6 +36,10 @@ POSITIONAL ARGUMENTS
         organizations/<organizationID>/locations/<location>/postureDeployments/<postureID>.
 
 FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
      --etag=ETAG
         Etag is an optional flag. If the provided Etag doesn't match the server
         generated Etag, the delete operation won't proceed.
diff --git a/gcloud/alpha/scc/posture-deployments/describe b/gcloud/alpha/scc/posture-deployments/describe
index 9fd16b68e..9ab2903ce 100644
--- a/gcloud/alpha/scc/posture-deployments/describe
+++ b/gcloud/alpha/scc/posture-deployments/describe
@@ -10,9 +10,9 @@ DESCRIPTION
     (ALPHA) Describe a Cloud Security Command Center (SCC) posture deployment.
 
 EXAMPLES
-    Describe a posture-deployment present on an organization:        organizations/123/locations/global/postureDeployments/posture-deployment-foo-1
-        (i.e. a posture-deployment
-        in organization 123, location global, with id posture-deployment-foo-1):
+    To describe posture deployment
+    organizations/123/locations/global/postureDeployments/posture-deployment-foo-1        (i.e. a posture deployment
+        in organization `123`, location `global`, with ID `posture-deployment-foo-1`), run:
 
         $ gcloud alpha scc posture-deployments describe \
         organizations/123/locations/global/postureDeployments/\
@@ -20,7 +20,7 @@ EXAMPLES
 
 POSITIONAL ARGUMENTS
      POSTURE_DEPLOYMENT_NAME
-        Relative resource name of the posture-deployment, like
+        Relative resource name of the posture deployment, like
         organizations/<organizationID>/locations/<location>/postureDeployments/<postureDeploymentID>.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/alpha/scc/posture-deployments/update b/gcloud/alpha/scc/posture-deployments/update
index 48339d890..19d5db697 100644
--- a/gcloud/alpha/scc/posture-deployments/update
+++ b/gcloud/alpha/scc/posture-deployments/update
@@ -36,7 +36,7 @@ EXAMPLES
 
 POSITIONAL ARGUMENTS
      POSTURE_DEPLOYMENT_NAME
-        Relative resource name of the posture-deployment, like
+        Relative resource name of the posture deployment, like
         organizations/<organizationID>/locations/<location>/postureDeployments/<postureDeploymentID>.
 
 FLAGS
diff --git a/gcloud/alpha/scc/postures/describe b/gcloud/alpha/scc/postures/describe
index 055cbc1f8..f82a068f4 100644
--- a/gcloud/alpha/scc/postures/describe
+++ b/gcloud/alpha/scc/postures/describe
@@ -9,11 +9,11 @@ SYNOPSIS
 DESCRIPTION
     (ALPHA) Describe a Cloud Security Command Center (SCC) posture.
 
-    By default, the latest created revision of the posture is described. Users
+    By default, the latest updated revision of the posture is described. Users
     must provide revision ID to describe a specific revision.
 
 EXAMPLES
-    Describe the latest revision of a posture named
+    Describe the latest updated revision of a posture named
     organizations/123/locations/global/postures/posture-foo-1 (i.e. a posture
     in organization 123, location global, with id posture-foo-1):
 
diff --git a/gcloud/alpha/scc/postures/list b/gcloud/alpha/scc/postures/list
index 266bbc99a..300269d3b 100644
--- a/gcloud/alpha/scc/postures/list
+++ b/gcloud/alpha/scc/postures/list
@@ -15,7 +15,7 @@ DESCRIPTION
 EXAMPLES
     List all postures in organization 123. If location is omitted, this returns
     postures from location 'global'. For a posture with multiple revisions,
-    only the latest revision of the posture is returned in the output.
+    only the latest updated revision of the posture is returned in the output.
 
         $ gcloud alpha scc postures list organizations/123
 
diff --git a/gcloud/alpha/service-extensions/help b/gcloud/alpha/service-extensions/help
new file mode 100644
index 000000000..4859e58f5
--- /dev/null
+++ b/gcloud/alpha/service-extensions/help
@@ -0,0 +1,34 @@
+NAME
+    gcloud alpha service-extensions - manage Service Extensions resources
+
+SYNOPSIS
+    gcloud alpha service-extensions GROUP [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Manage Service Extensions resources.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+GROUPS
+    GROUP is one of the following:
+
+     wasm-actions
+        (ALPHA) Interact with and manage Service Extensions WasmActions.
+
+     wasm-plugin-versions
+        (ALPHA) Interact with and manage Service Extensions WasmPluginVersions.
+
+     wasm-plugins
+        (ALPHA) Interact with and manage Service Extensions WasmPlugins.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist. This variant is also available:
+
+        $ gcloud beta service-extensions
+
diff --git a/gcloud/alpha/service-extensions/wasm-actions/create b/gcloud/alpha/service-extensions/wasm-actions/create
new file mode 100644
index 000000000..c1b5bcc57
--- /dev/null
+++ b/gcloud/alpha/service-extensions/wasm-actions/create
@@ -0,0 +1,115 @@
+NAME
+    gcloud alpha service-extensions wasm-actions create - create a WasmAction
+
+SYNOPSIS
+    gcloud alpha service-extensions wasm-actions create
+        (WASM_ACTION : --location=LOCATION) --wasm-plugin=WASM_PLUGIN [--async]
+        [--description=DESCRIPTION] [--labels=[KEY=VALUE,...]]
+        [--supported-events=[EVENT,...]] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) This command creates a WasmAction that uses the specfied
+    WasmPlugin.
+
+EXAMPLES
+    To create a WasmAction called my-action using WasmPlugin my-plugin, run:
+
+        $ gcloud alpha service-extensions wasm-actions create my-action \
+            --wasm-plugin=my-plugin
+
+    You may also specify the full resource path to a plugin, e.g.
+    projects/my-project/locations/global/wasmPlugins/my-plugin
+
+POSITIONAL ARGUMENTS
+     WasmAction resource - The ID of the WasmAction. The arguments in this
+     group can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways.
+
+     To set the project attribute:
+      ◆ provide the argument wasm_action on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       WASM_ACTION
+          ID of the WasmAction or fully qualified identifier for the
+          WasmAction.
+
+          To set the wasm_action attribute:
+          ▸ provide the argument wasm_action on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location Id.
+
+          To set the location attribute:
+          ▸ provide the argument wasm_action on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line;
+          ▸ use global location.
+
+REQUIRED FLAGS
+     WasmPlugin resource - ID of the WasmPlugin to use for this action. This
+     represents a Cloud resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument --wasm-plugin on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     To set the location attribute:
+      ◆ provide the argument --wasm-plugin on the command line with a fully
+        specified name;
+      ◆ provide the argument --location on the command line;
+      ◆ use global location.
+
+     This must be specified.
+
+       --wasm-plugin=WASM_PLUGIN
+          ID of the WasmPlugin or fully qualified identifier for the
+          WasmPlugin.
+
+          To set the wasm_plugin attribute:
+          ▸ provide the argument --wasm-plugin on the command line.
+
+OPTIONAL FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+     --description=DESCRIPTION
+        Provides an optional, human-readable description of the service.
+
+     --labels=[KEY=VALUE,...]
+        List of label KEY=VALUE pairs to add.
+
+        Keys must start with a lowercase character and contain only hyphens
+        (-), underscores (_), lowercase characters, and numbers. Values must
+        contain only hyphens (-), underscores (_), lowercase characters, and
+        numbers.
+
+     --supported-events=[EVENT,...]
+        Specify the portion of the request/response payload to be processed by
+        the Plugin. EVENT must be one of: request-headers, response-headers.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/service-extensions/wasm-actions/delete b/gcloud/alpha/service-extensions/wasm-actions/delete
new file mode 100644
index 000000000..52eaa0a11
--- /dev/null
+++ b/gcloud/alpha/service-extensions/wasm-actions/delete
@@ -0,0 +1,71 @@
+NAME
+    gcloud alpha service-extensions wasm-actions delete - delete a WasmAction
+
+SYNOPSIS
+    gcloud alpha service-extensions wasm-actions delete
+        (WASM_ACTION : --location=LOCATION) [--async] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Delete a WasmAction.
+
+EXAMPLES
+    To delete a WasmAction called 'my-wasm-action', run:
+
+        $ gcloud alpha service-extensions wasm-actions delete my-wasm-action
+
+POSITIONAL ARGUMENTS
+     WasmAction resource - The WasmAction to delete. The arguments in this
+     group can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways.
+
+     To set the project attribute:
+      ◆ provide the argument wasm_action on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       WASM_ACTION
+          ID of the WasmAction or fully qualified identifier for the
+          WasmAction.
+
+          To set the wasm_action attribute:
+          ▸ provide the argument wasm_action on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location Id.
+
+          To set the location attribute:
+          ▸ provide the argument wasm_action on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line;
+          ▸ use global location.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networkservices/v1alpha1 API. The full documentation
+    for this API can be found at: https://cloud.google.com/networking
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/service-extensions/wasm-actions/describe b/gcloud/alpha/service-extensions/wasm-actions/describe
new file mode 100644
index 000000000..59c53a8b0
--- /dev/null
+++ b/gcloud/alpha/service-extensions/wasm-actions/describe
@@ -0,0 +1,68 @@
+NAME
+    gcloud alpha service-extensions wasm-actions describe - show details about
+        a WasmAction
+
+SYNOPSIS
+    gcloud alpha service-extensions wasm-actions describe
+        (WASM_ACTION : --location=LOCATION) [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Show details about a WasmAction.
+
+EXAMPLES
+    To show details about a WasmAction, run:
+
+        $ gcloud alpha service-extensions wasm-actions describe \
+            my-wasm-action
+
+POSITIONAL ARGUMENTS
+     WasmAction resource - The WasmAction you want to describe. The arguments
+     in this group can be used to specify the attributes of this resource.
+     (NOTE) Some attributes are not given arguments in this group but can be
+     set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument wasm_action on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       WASM_ACTION
+          ID of the WasmAction or fully qualified identifier for the
+          WasmAction.
+
+          To set the wasm_action attribute:
+          ▸ provide the argument wasm_action on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location Id.
+
+          To set the location attribute:
+          ▸ provide the argument wasm_action on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line;
+          ▸ use global location.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networkservices/v1alpha1 API. The full documentation
+    for this API can be found at: https://cloud.google.com/networking
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/service-extensions/wasm-actions/help b/gcloud/alpha/service-extensions/wasm-actions/help
new file mode 100644
index 000000000..e61177052
--- /dev/null
+++ b/gcloud/alpha/service-extensions/wasm-actions/help
@@ -0,0 +1,36 @@
+NAME
+    gcloud alpha service-extensions wasm-actions - interact with and manage
+        Service Extensions WasmActions
+
+SYNOPSIS
+    gcloud alpha service-extensions wasm-actions COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Interact with and manage Service Extensions WasmActions.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     create
+        (ALPHA) Create a WasmAction.
+
+     delete
+        (ALPHA) Delete a WasmAction.
+
+     describe
+        (ALPHA) Show details about a WasmAction.
+
+     list
+        (ALPHA) List all WasmActions.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/service-extensions/wasm-actions/list b/gcloud/alpha/service-extensions/wasm-actions/list
new file mode 100644
index 000000000..8a468b305
--- /dev/null
+++ b/gcloud/alpha/service-extensions/wasm-actions/list
@@ -0,0 +1,85 @@
+NAME
+    gcloud alpha service-extensions wasm-actions list - list all WasmActions
+
+SYNOPSIS
+    gcloud alpha service-extensions wasm-actions list [--location=LOCATION]
+        [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
+        [--sort-by=[FIELD,...]] [--uri] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) List WasmActions.
+
+EXAMPLES
+    To list existing WasmActions, run:
+
+        $ gcloud alpha service-extensions wasm-actions list
+
+FLAGS
+     Location resource - The parent location. This represents a Cloud resource.
+     (NOTE) Some attributes are not given arguments in this group but can be
+     set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument --location on the command line with a fully
+        specified name;
+      ◆ use global location with a fully specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+       --location=LOCATION
+          ID of the location or fully qualified identifier for the location.
+
+          To set the location attribute:
+          ▸ provide the argument --location on the command line;
+          ▸ use global location.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networkservices/v1alpha1 API. The full documentation
+    for this API can be found at: https://cloud.google.com/networking
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/service-extensions/wasm-plugin-versions/create b/gcloud/alpha/service-extensions/wasm-plugin-versions/create
new file mode 100644
index 000000000..55f0dc2fe
--- /dev/null
+++ b/gcloud/alpha/service-extensions/wasm-plugin-versions/create
@@ -0,0 +1,113 @@
+NAME
+    gcloud alpha service-extensions wasm-plugin-versions create - create a
+        WasmPluginVersion
+
+SYNOPSIS
+    gcloud alpha service-extensions wasm-plugin-versions create
+        (WASM_PLUGIN_VERSION : --location=LOCATION --wasm-plugin=WASM_PLUGIN)
+        --image=IMAGE [--async] [--description=DESCRIPTION]
+        [--labels=[KEY=VALUE,...]]
+        [--plugin-config=PLUGIN_CONFIG
+          | --plugin-config-file=PLUGIN_CONFIG_FILE
+          | --plugin-config-uri=PLUGIN_CONFIG_URI] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Create a new WasmPluginVersion.
+
+EXAMPLES
+    To create a WasmPluginVersion called 'my-plugin-version', run:
+
+        $ gcloud alpha service-extensions wasm-plugin-versions create \
+            my-plugin-version --wasm-plugin=my-plugin \
+            --image=...-docker.pkg.dev/my-project/repository/container:tag
+
+POSITIONAL ARGUMENTS
+     WasmPluginVersion resource - The ID of the WasmPluginVersion to create.
+     The arguments in this group can be used to specify the attributes of this
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument wasm_plugin_version on the command line with a
+        fully specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       WASM_PLUGIN_VERSION
+          ID of the WasmPluginVersion or fully qualified identifier for the
+          WasmPluginVersion.
+
+          To set the wasm_plugin_version attribute:
+          ▸ provide the argument wasm_plugin_version on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location Id.
+
+          To set the location attribute:
+          ▸ provide the argument wasm_plugin_version on the command line with
+            a fully specified name;
+          ▸ provide the argument --location on the command line;
+          ▸ use global location.
+
+       --wasm-plugin=WASM_PLUGIN
+          The ID of the WasmPlugin.
+
+          To set the wasm-plugin attribute:
+          ▸ provide the argument wasm_plugin_version on the command line with
+            a fully specified name;
+          ▸ provide the argument --wasm-plugin on the command line.
+
+REQUIRED FLAGS
+     --image=IMAGE
+        URI of the container image containing the WasmPlugin, stored in the
+        Artifact Registry.
+
+OPTIONAL FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+     --description=DESCRIPTION
+        A human-readable description of the resource.
+
+     --labels=[KEY=VALUE,...]
+        List of KEY=VALUE labels to attach to this resource.
+
+     Configuration for the WasmPlugin, provided to the Proxy-Wasm plugin at
+     runtime via the proxy_on_configure Proxy-Wasm ABI.
+
+     At most one of these can be specified:
+
+       --plugin-config=PLUGIN_CONFIG
+          WasmPlugin configuration in the textual format.
+
+       --plugin-config-file=PLUGIN_CONFIG_FILE
+          Path to a file containg WasmPlugin configuration.
+
+       --plugin-config-uri=PLUGIN_CONFIG_URI
+          URI of the container image containing the plugin configuration,
+          stored in the Artifact Registry.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networkservices/v1alpha1 API. The full documentation
+    for this API can be found at: https://cloud.google.com/networking
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/service-extensions/wasm-plugin-versions/delete b/gcloud/alpha/service-extensions/wasm-plugin-versions/delete
new file mode 100644
index 000000000..59e5725a9
--- /dev/null
+++ b/gcloud/alpha/service-extensions/wasm-plugin-versions/delete
@@ -0,0 +1,82 @@
+NAME
+    gcloud alpha service-extensions wasm-plugin-versions delete - delete a
+        WasmPluginVersion
+
+SYNOPSIS
+    gcloud alpha service-extensions wasm-plugin-versions delete
+        (WASM_PLUGIN_VERSION : --location=LOCATION --wasm-plugin=WASM_PLUGIN)
+        [--async] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Delete a WasmPluginVersion.
+
+EXAMPLES
+    To delete a WasmPluginVersion called 'my-plugin-version', run:
+
+        $ gcloud alpha service-extensions wasm-plugin-versions delete \
+            my-plugin-version
+
+POSITIONAL ARGUMENTS
+     WasmPluginVersion resource - The WasmPluginVersion to delete. The
+     arguments in this group can be used to specify the attributes of this
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument wasm_plugin_version on the command line with a
+        fully specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       WASM_PLUGIN_VERSION
+          ID of the WasmPluginVersion or fully qualified identifier for the
+          WasmPluginVersion.
+
+          To set the wasm_plugin_version attribute:
+          ▸ provide the argument wasm_plugin_version on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location Id.
+
+          To set the location attribute:
+          ▸ provide the argument wasm_plugin_version on the command line with
+            a fully specified name;
+          ▸ provide the argument --location on the command line;
+          ▸ use global location.
+
+       --wasm-plugin=WASM_PLUGIN
+          The ID of the WasmPlugin.
+
+          To set the wasm-plugin attribute:
+          ▸ provide the argument wasm_plugin_version on the command line with
+            a fully specified name;
+          ▸ provide the argument --wasm-plugin on the command line.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networkservices/v1alpha1 API. The full documentation
+    for this API can be found at: https://cloud.google.com/networking
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/service-extensions/wasm-plugin-versions/describe b/gcloud/alpha/service-extensions/wasm-plugin-versions/describe
new file mode 100644
index 000000000..0f19c7d92
--- /dev/null
+++ b/gcloud/alpha/service-extensions/wasm-plugin-versions/describe
@@ -0,0 +1,77 @@
+NAME
+    gcloud alpha service-extensions wasm-plugin-versions describe - show
+        details about a WasmPluginVersion
+
+SYNOPSIS
+    gcloud alpha service-extensions wasm-plugin-versions describe
+        (WASM_PLUGIN_VERSION : --location=LOCATION --wasm-plugin=WASM_PLUGIN)
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Show details about a WasmPluginVersion.
+
+EXAMPLES
+    To show details about a WasmPluginVersion, run:
+
+        $ gcloud alpha service-extensions wasm-plugin-versions describe \
+            my-plugin-version
+
+POSITIONAL ARGUMENTS
+     WasmPluginVersion resource - The WasmPluginVersion you want to describe.
+     The arguments in this group can be used to specify the attributes of this
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument wasm_plugin_version on the command line with a
+        fully specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       WASM_PLUGIN_VERSION
+          ID of the WasmPluginVersion or fully qualified identifier for the
+          WasmPluginVersion.
+
+          To set the wasm_plugin_version attribute:
+          ▸ provide the argument wasm_plugin_version on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location Id.
+
+          To set the location attribute:
+          ▸ provide the argument wasm_plugin_version on the command line with
+            a fully specified name;
+          ▸ provide the argument --location on the command line;
+          ▸ use global location.
+
+       --wasm-plugin=WASM_PLUGIN
+          The ID of the WasmPlugin.
+
+          To set the wasm-plugin attribute:
+          ▸ provide the argument wasm_plugin_version on the command line with
+            a fully specified name;
+          ▸ provide the argument --wasm-plugin on the command line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networkservices/v1alpha1 API. The full documentation
+    for this API can be found at: https://cloud.google.com/networking
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/service-extensions/wasm-plugin-versions/help b/gcloud/alpha/service-extensions/wasm-plugin-versions/help
new file mode 100644
index 000000000..873cad748
--- /dev/null
+++ b/gcloud/alpha/service-extensions/wasm-plugin-versions/help
@@ -0,0 +1,37 @@
+NAME
+    gcloud alpha service-extensions wasm-plugin-versions - interact with and
+        manage Service Extensions WasmPluginVersions
+
+SYNOPSIS
+    gcloud alpha service-extensions wasm-plugin-versions COMMAND
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Interact with and manage Service Extensions WasmPluginVersions.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     create
+        (ALPHA) Create a WasmPluginVersion.
+
+     delete
+        (ALPHA) Delete a WasmPluginVersion.
+
+     describe
+        (ALPHA) Show details about a WasmPluginVersion.
+
+     list
+        (ALPHA) List all WasmPluginVersions for a WasmPlugin.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/service-extensions/wasm-plugin-versions/list b/gcloud/alpha/service-extensions/wasm-plugin-versions/list
new file mode 100644
index 000000000..87d1f366c
--- /dev/null
+++ b/gcloud/alpha/service-extensions/wasm-plugin-versions/list
@@ -0,0 +1,102 @@
+NAME
+    gcloud alpha service-extensions wasm-plugin-versions list - list all
+        WasmPluginVersions for a WasmPlugin
+
+SYNOPSIS
+    gcloud alpha service-extensions wasm-plugin-versions list
+        (--wasm-plugin=WASM_PLUGIN : --location=LOCATION) [--filter=EXPRESSION]
+        [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) List WasmPluginVersions.
+
+EXAMPLES
+    To list existing WasmPluginVersions, run:
+
+        $ gcloud alpha service-extensions wasm-plugin-versions list \
+            --wasm-plugin=WASM_PLUGIN
+
+REQUIRED FLAGS
+     WasmPlugin resource - The parent WasmPlugin. The arguments in this group
+     can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways.
+
+     To set the project attribute:
+      ◆ provide the argument --wasm-plugin on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       --wasm-plugin=WASM_PLUGIN
+          ID of the WasmPlugin or fully qualified identifier for the
+          WasmPlugin.
+
+          To set the wasm-plugin attribute:
+          ▸ provide the argument --wasm-plugin on the command line.
+
+          This flag argument must be specified if any of the other arguments in
+          this group are specified.
+
+       --location=LOCATION
+          The location Id.
+
+          To set the location attribute:
+          ▸ provide the argument --wasm-plugin on the command line with a
+            fully specified name;
+          ▸ provide the argument --location on the command line;
+          ▸ use global location.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networkservices/v1alpha1 API. The full documentation
+    for this API can be found at: https://cloud.google.com/networking
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/service-extensions/wasm-plugins/create b/gcloud/alpha/service-extensions/wasm-plugins/create
new file mode 100644
index 000000000..d6d8975e9
--- /dev/null
+++ b/gcloud/alpha/service-extensions/wasm-plugins/create
@@ -0,0 +1,134 @@
+NAME
+    gcloud alpha service-extensions wasm-plugins create - create a WasmPlugin
+
+SYNOPSIS
+    gcloud alpha service-extensions wasm-plugins create
+        (WASM_PLUGIN : --location=LOCATION) [--async]
+        [--description=DESCRIPTION] [--labels=[KEY=VALUE,...]]
+        [--log-config=[LOG_CONFIG,...]]
+        [--image=IMAGE
+          --main-version=MAIN_VERSION --plugin-config=PLUGIN_CONFIG
+          | --plugin-config-file=PLUGIN_CONFIG_FILE
+          | --plugin-config-uri=PLUGIN_CONFIG_URI] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Create a new WasmPlugin and optionally create a WasmPluginVersion
+    and set it as main (serving) one.
+
+EXAMPLES
+    To create a WasmPlugin called my-plugin, run:
+
+        $ gcloud alpha service-extensions wasm-plugins create my-plugin
+
+    To create a WasmPlugin called my-plugin, together with a new version called
+    v1, and set it as main, run:
+
+        $ gcloud alpha service-extensions wasm-plugins create my-plugin \
+            --main-version=v1 \
+            --image=...-docker.pkg.dev/my-project/repository/container:tag
+
+POSITIONAL ARGUMENTS
+     WasmPlugin resource - The ID of the WasmPlugin to create. The arguments in
+     this group can be used to specify the attributes of this resource. (NOTE)
+     Some attributes are not given arguments in this group but can be set in
+     other ways.
+
+     To set the project attribute:
+      ◆ provide the argument wasm_plugin on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       WASM_PLUGIN
+          ID of the WasmPlugin or fully qualified identifier for the
+          WasmPlugin.
+
+          To set the wasm_plugin attribute:
+          ▸ provide the argument wasm_plugin on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location Id.
+
+          To set the location attribute:
+          ▸ provide the argument wasm_plugin on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line;
+          ▸ use global location.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+     --description=DESCRIPTION
+        Provides an optional, human-readable description of the service.
+
+     --labels=[KEY=VALUE,...]
+        List of label KEY=VALUE pairs to add.
+
+        Keys must start with a lowercase character and contain only hyphens
+        (-), underscores (_), lowercase characters, and numbers. Values must
+        contain only hyphens (-), underscores (_), lowercase characters, and
+        numbers.
+
+     --log-config=[LOG_CONFIG,...]
+        Logging options for the activity performed by this WasmPlugin.
+        Following options can be set:
+        ◆ enable - whether to enable logging. If log-config flag is set,
+          enable option is required.
+
+        ◆ sample-rate - configures the sampling rate of activity logs, where
+          1.0 means all logged activity is reported and 0.0 means no activity
+          is reported. The default value is 1.0, and the value of the field
+          must be in [0, 1].
+
+        ◆ min-log-level - specificies the lowest level of the logs which
+          should be exported to Cloud Logging. The default value is INFO.
+
+        Example usage:
+        --log-config=enable=True,sample-rate=0.5,min-log-level=INFO
+        --log_config=enable=False
+
+     --image=IMAGE
+        URI of the container image containing the Wasm module, stored in the
+        Artifact Registry.
+
+     --main-version=MAIN_VERSION
+        ID of the WasmPluginVersion that will be created for that WasmPlugin
+        and that will be set as the current main version.
+
+     Configuration for the WasmPlugin, provided to the plugin at runtime via
+     the proxy_on_configure call (the exact name of the invoked function
+     depends on the Proxy-Wasm SDK used).
+
+     At most one of these can be specified:
+
+       --plugin-config=PLUGIN_CONFIG
+          WasmPlugin configuration in the textual format.
+
+       --plugin-config-file=PLUGIN_CONFIG_FILE
+          Path to a local file containing the plugin configuration.
+
+       --plugin-config-uri=PLUGIN_CONFIG_URI
+          URI of the container image containing the plugin configuration,
+          stored in the Artifact Registry.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/service-extensions/wasm-plugins/delete b/gcloud/alpha/service-extensions/wasm-plugins/delete
new file mode 100644
index 000000000..d098b457e
--- /dev/null
+++ b/gcloud/alpha/service-extensions/wasm-plugins/delete
@@ -0,0 +1,71 @@
+NAME
+    gcloud alpha service-extensions wasm-plugins delete - delete a WasmPlugin
+
+SYNOPSIS
+    gcloud alpha service-extensions wasm-plugins delete
+        (WASM_PLUGIN : --location=LOCATION) [--async] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Delete a WasmPlugin.
+
+EXAMPLES
+    To delete a WasmPlugin called 'my-plugin', run:
+
+        $ gcloud alpha service-extensions wasm-plugins delete my-plugin
+
+POSITIONAL ARGUMENTS
+     WasmPlugin resource - The WasmPlugin to delete. The arguments in this
+     group can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways.
+
+     To set the project attribute:
+      ◆ provide the argument wasm_plugin on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       WASM_PLUGIN
+          ID of the WasmPlugin or fully qualified identifier for the
+          WasmPlugin.
+
+          To set the wasm_plugin attribute:
+          ▸ provide the argument wasm_plugin on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location Id.
+
+          To set the location attribute:
+          ▸ provide the argument wasm_plugin on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line;
+          ▸ use global location.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networkservices/v1alpha1 API. The full documentation
+    for this API can be found at: https://cloud.google.com/networking
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/service-extensions/wasm-plugins/describe b/gcloud/alpha/service-extensions/wasm-plugins/describe
new file mode 100644
index 000000000..485d5e960
--- /dev/null
+++ b/gcloud/alpha/service-extensions/wasm-plugins/describe
@@ -0,0 +1,67 @@
+NAME
+    gcloud alpha service-extensions wasm-plugins describe - show details about
+        a WasmPlugin
+
+SYNOPSIS
+    gcloud alpha service-extensions wasm-plugins describe
+        (WASM_PLUGIN : --location=LOCATION) [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Show details about a WasmPlugin.
+
+EXAMPLES
+    To show details about a WasmPlugin, run:
+
+        $ gcloud alpha service-extensions wasm-plugins describe my-plugin
+
+POSITIONAL ARGUMENTS
+     WasmPlugin resource - The WasmPlugin you want to describe. The arguments
+     in this group can be used to specify the attributes of this resource.
+     (NOTE) Some attributes are not given arguments in this group but can be
+     set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument wasm_plugin on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       WASM_PLUGIN
+          ID of the WasmPlugin or fully qualified identifier for the
+          WasmPlugin.
+
+          To set the wasm_plugin attribute:
+          ▸ provide the argument wasm_plugin on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location Id.
+
+          To set the location attribute:
+          ▸ provide the argument wasm_plugin on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line;
+          ▸ use global location.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networkservices/v1alpha1 API. The full documentation
+    for this API can be found at: https://cloud.google.com/networking
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/service-extensions/wasm-plugins/help b/gcloud/alpha/service-extensions/wasm-plugins/help
new file mode 100644
index 000000000..0cf46dfab
--- /dev/null
+++ b/gcloud/alpha/service-extensions/wasm-plugins/help
@@ -0,0 +1,39 @@
+NAME
+    gcloud alpha service-extensions wasm-plugins - interact with and manage
+        Service Extensions WasmPlugins
+
+SYNOPSIS
+    gcloud alpha service-extensions wasm-plugins COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Interact with and manage Service Extensions WasmPlugins.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     create
+        (ALPHA) Create a WasmPlugin.
+
+     delete
+        (ALPHA) Delete a WasmPlugin.
+
+     describe
+        (ALPHA) Show details about a WasmPlugin.
+
+     list
+        (ALPHA) List all WasmPlugins.
+
+     update
+        (ALPHA) Update a WasmPlugin.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/service-extensions/wasm-plugins/list b/gcloud/alpha/service-extensions/wasm-plugins/list
new file mode 100644
index 000000000..0768c0f91
--- /dev/null
+++ b/gcloud/alpha/service-extensions/wasm-plugins/list
@@ -0,0 +1,85 @@
+NAME
+    gcloud alpha service-extensions wasm-plugins list - list all WasmPlugins
+
+SYNOPSIS
+    gcloud alpha service-extensions wasm-plugins list [--location=LOCATION]
+        [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
+        [--sort-by=[FIELD,...]] [--uri] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) List WasmPlugins.
+
+EXAMPLES
+    To list existing WasmPlugins, run:
+
+        $ gcloud alpha service-extensions wasm-plugins list
+
+FLAGS
+     Location resource - The parent location. This represents a Cloud resource.
+     (NOTE) Some attributes are not given arguments in this group but can be
+     set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument --location on the command line with a fully
+        specified name;
+      ◆ use global location with a fully specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+       --location=LOCATION
+          ID of the location or fully qualified identifier for the location.
+
+          To set the location attribute:
+          ▸ provide the argument --location on the command line;
+          ▸ use global location.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+     --uri
+        Print a list of resource URIs instead of the default output, and change
+        the command output to a list of URIs. If this flag is used with
+        --format, the formatting is applied on this URI list. To display URIs
+        alongside other keys instead, use the uri() transform.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networkservices/v1alpha1 API. The full documentation
+    for this API can be found at: https://cloud.google.com/networking
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/service-extensions/wasm-plugins/update b/gcloud/alpha/service-extensions/wasm-plugins/update
new file mode 100644
index 000000000..78f478090
--- /dev/null
+++ b/gcloud/alpha/service-extensions/wasm-plugins/update
@@ -0,0 +1,156 @@
+NAME
+    gcloud alpha service-extensions wasm-plugins update - update a WasmPlugin
+
+SYNOPSIS
+    gcloud alpha service-extensions wasm-plugins update
+        (WASM_PLUGIN : --location=LOCATION) [--async]
+        [--description=DESCRIPTION] [--labels=[KEY=VALUE,...]]
+        [--log-config=[LOG_CONFIG,...]]
+        [--image=IMAGE
+          --main-version=MAIN_VERSION --plugin-config=PLUGIN_CONFIG
+          | --plugin-config-file=PLUGIN_CONFIG_FILE
+          | --plugin-config-uri=PLUGIN_CONFIG_URI] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Update an existing WasmPlugin and optionally create a
+    WasmPluginVersion and set it as main (serving) one.
+
+    If --image is not specified:
+      ▪ the method only updates the WasmPlugin resource without creating a
+        WasmPluginVersion.
+      ▪ the --plugin-config** flags are disallowed.
+      ▪ if --main-version is set, then the referenced WasmPluginVersion must
+        already exists and it will be set as main (serving) one.
+
+    If --image is specified:
+      ▪ the --main-version flag should also be specified.
+      ▪ the method updates the WasmPlugin resource and creates a new
+        WasmPluginVersion with --main-version name and sets it as main
+        (serving) one.
+      ▪ the --plugin-config** flags are allowed.
+      ▪ the --async flag is disallowed.
+
+EXAMPLES
+    To update a WasmPlugin called my-plugin, run:
+
+        $ gcloud alpha service-extensions wasm-plugins update my-plugin \
+            --main-version=new-version --description="A new description." \
+            --labels=label1=value1
+
+    To update a WasmPlugin called my-plugin and also create a new version
+    called v1 and set it as main:
+
+        $ gcloud alpha service-extensions wasm-plugins update my-plugin \
+            --main-version=v1 --description="A new description." \
+            --labels=label1=value1 \
+            --image=...-docker.pkg.dev/my-project/repository/container:tag
+
+POSITIONAL ARGUMENTS
+     WasmPlugin resource - The ID of the WasmPlugin to update. The arguments in
+     this group can be used to specify the attributes of this resource. (NOTE)
+     Some attributes are not given arguments in this group but can be set in
+     other ways.
+
+     To set the project attribute:
+      ◆ provide the argument wasm_plugin on the command line with a fully
+        specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       WASM_PLUGIN
+          ID of the WasmPlugin or fully qualified identifier for the
+          WasmPlugin.
+
+          To set the wasm_plugin attribute:
+          ▸ provide the argument wasm_plugin on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          The location Id.
+
+          To set the location attribute:
+          ▸ provide the argument wasm_plugin on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line;
+          ▸ use global location.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+     --description=DESCRIPTION
+        Provides an optional, human-readable description of the service.
+
+     --labels=[KEY=VALUE,...]
+        List of label KEY=VALUE pairs to add.
+
+        Keys must start with a lowercase character and contain only hyphens
+        (-), underscores (_), lowercase characters, and numbers. Values must
+        contain only hyphens (-), underscores (_), lowercase characters, and
+        numbers.
+
+     --log-config=[LOG_CONFIG,...]
+        Logging options for the activity performed by this WasmPlugin.
+        Following options can be set:
+        ◆ enable - whether to enable logging. If log-config flag is set,
+          enable option is required.
+
+        ◆ sample-rate - configures the sampling rate of activity logs, where
+          1.0 means all logged activity is reported and 0.0 means no activity
+          is reported. The default value is 1.0, and the value of the field
+          must be in [0, 1].
+
+        ◆ min-log-level - specificies the lowest level of the logs which
+          should be exported to Cloud Logging. The default value is INFO.
+
+        Example usage:
+        --log-config=enable=True,sample-rate=0.5,min-log-level=INFO
+        --log_config=enable=False
+
+     --image=IMAGE
+        URI of the container image containing the Wasm module, stored in the
+        Artifact Registry.
+
+     --main-version=MAIN_VERSION
+        The ID of the WasmPluginVersion that should be the currently serving
+        one. The version referred to must be a child of this WasmPlugin.
+
+        If the --image flag was also provided, the WasmPluginVersion will be
+        created for that WasmPlugin and will be set as the current main
+        version.
+
+     Configuration for the WasmPlugin, provided to the plugin at runtime via
+     the proxy_on_configure call (the exact name of the invoked function
+     depends on the Proxy-Wasm SDK used).
+
+     At most one of these can be specified:
+
+       --plugin-config=PLUGIN_CONFIG
+          WasmPlugin configuration in the textual format.
+
+       --plugin-config-file=PLUGIN_CONFIG_FILE
+          Path to a local file containing the plugin configuration.
+
+       --plugin-config-uri=PLUGIN_CONFIG_URI
+          URI of the container image containing the plugin configuration,
+          stored in the Artifact Registry.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/storage/ls b/gcloud/alpha/storage/ls
index 08a96feea..f93cd80a1 100644
--- a/gcloud/alpha/storage/ls
+++ b/gcloud/alpha/storage/ls
@@ -4,8 +4,9 @@ NAME
 SYNOPSIS
     gcloud alpha storage ls [PATH ...] [--additional-headers=HEADER=VALUE]
         [--all-versions, -a] [--buckets, -b] [--etag, -e]
-        [--fetch-encrypted-object-hashes] [--format=FORMAT] [--readable-sizes]
-        [--recursive, -R, -r] [--full, -L | --json, -j | --long, -l]
+        [--fetch-encrypted-object-hashes] [--format=FORMAT]
+        [--read-paths-from-stdin, -I] [--readable-sizes] [--recursive, -R, -r]
+        [--full, -L | --json, -j | --long, -l]
         [--decryption-keys=[DECRYPTION_KEY,...]] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
@@ -75,7 +76,7 @@ FLAGS
         this command invocation.
 
      --all-versions, -a
-        Include non-current object versions in the listing. This flag is
+        Include noncurrent object versions in the listing. This flag is
         typically only useful for buckets with object versioning
         (https://cloud.google.com/storage/docs/object-versioning) enabled. If
         combined with the --long option, the metageneration for each listed
@@ -101,6 +102,9 @@ FLAGS
         "--format=gsutil"). Other format values (e.g. "json") do not work. See
         different ls flags and commands for alternative formatting.
 
+     --read-paths-from-stdin, -I
+        Read the list of URLs from stdin.
+
      --readable-sizes
         When used with --long, print object sizes in human readable format,
         such as 1 KiB, 234 MiB, or 2 GiB.
diff --git a/gcloud/asset/search-all-resources b/gcloud/asset/search-all-resources
index 29c2d99e9..ece512499 100644
--- a/gcloud/asset/search-all-resources
+++ b/gcloud/asset/search-all-resources
@@ -106,6 +106,10 @@ FLAGS
           Compute instances that have relationships with instance-group-1 in
           the Compute instance group resource name, for relationship type
           INSTANCE_TO_INSTANCEGROUP.
+        ◆ sccSecurityMarks.key=value to find Cloud resources that are
+          attached with security marks whose key is key and value is value.
+        ◆ sccSecurityMarks.key:* to find Cloud resources that are attached
+          with security marks whose key is key.
         ◆ state:ACTIVE to find Cloud resources whose state contains ACTIVE as
           a word.
         ◆ NOT state:ACTIVE to find Cloud resources whose state doesn't
diff --git a/gcloud/beta/ai/index-endpoints/deploy-index b/gcloud/beta/ai/index-endpoints/deploy-index
index 30e026ff1..715395abc 100644
--- a/gcloud/beta/ai/index-endpoints/deploy-index
+++ b/gcloud/beta/ai/index-endpoints/deploy-index
@@ -6,7 +6,8 @@ SYNOPSIS
     gcloud beta ai index-endpoints deploy-index
         (INDEX_ENDPOINT : --region=REGION)
         --deployed-index-id=DEPLOYED_INDEX_ID --display-name=DISPLAY_NAME
-        --index=INDEX [--max-replica-count=MAX_REPLICA_COUNT]
+        --index=INDEX [--machine-type=MACHINE_TYPE]
+        [--max-replica-count=MAX_REPLICA_COUNT]
         [--min-replica-count=MIN_REPLICA_COUNT]
         [--reserved-ip-ranges=[RESERVED_IP_RANGES,...]] [GCLOUD_WIDE_FLAG ...]
 
@@ -70,6 +71,11 @@ REQUIRED FLAGS
         ID of the index.
 
 OPTIONAL FLAGS
+     --machine-type=MACHINE_TYPE
+        The machine resources to be used for each node of this deployment. For
+        available machine types, see
+        https://cloud.google.com/ai-platform-unified/docs/predictions/machine-types.
+
      --max-replica-count=MAX_REPLICA_COUNT
         Maximum number of machine replicas the deployed index will be always
         deployed on.
diff --git a/gcloud/beta/ai/indexes/remove-datapoints b/gcloud/beta/ai/indexes/remove-datapoints
index d404521bc..1fa94ae55 100644
--- a/gcloud/beta/ai/indexes/remove-datapoints
+++ b/gcloud/beta/ai/indexes/remove-datapoints
@@ -8,13 +8,13 @@ SYNOPSIS
           | --datapoints-from-file=DATAPOINTS_FROM_FILE) [GCLOUD_WIDE_FLAG ...]
 
 EXAMPLES
-    To remove datapoints from an index '123', run:
+    To remove data points from an index 123, run:
 
         $ gcloud beta ai indexes remove-datapoints 123 \
             --datapoint-ids=example1,example2 --project=example \
             --region=us-central1
 
-    Or put datapoint ids in a json file and run:
+    Or put datapoint ids in a JSON file and run:
 
         $ gcloud beta ai indexes remove-datapoints 123 \
             --datapoints-from-file=example.json --project=example \
@@ -72,8 +72,10 @@ GCLOUD WIDE FLAGS
     Run $ gcloud help for details.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud ai indexes remove-datapoints
 
         $ gcloud alpha ai indexes remove-datapoints
 
diff --git a/gcloud/beta/ai/indexes/upsert-datapoints b/gcloud/beta/ai/indexes/upsert-datapoints
index 37e9d074a..251f9446c 100644
--- a/gcloud/beta/ai/indexes/upsert-datapoints
+++ b/gcloud/beta/ai/indexes/upsert-datapoints
@@ -7,7 +7,7 @@ SYNOPSIS
         --datapoints-from-file=DATAPOINTS_FROM_FILE [GCLOUD_WIDE_FLAG ...]
 
 EXAMPLES
-    To upsert datapoints into an index '123', run:
+    To upsert datapoints into an index 123, run:
 
         $ gcloud beta ai indexes upsert-datapoints 123 \
             --datapoints-from-file=example.json --project=example \
@@ -60,8 +60,10 @@ GCLOUD WIDE FLAGS
     Run $ gcloud help for details.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud ai indexes upsert-datapoints
 
         $ gcloud alpha ai indexes upsert-datapoints
 
diff --git a/gcloud/beta/asset/search-all-resources b/gcloud/beta/asset/search-all-resources
index f67ef7c03..64c3851db 100644
--- a/gcloud/beta/asset/search-all-resources
+++ b/gcloud/beta/asset/search-all-resources
@@ -107,6 +107,10 @@ FLAGS
           Compute instances that have relationships with instance-group-1 in
           the Compute instance group resource name, for relationship type
           INSTANCE_TO_INSTANCEGROUP.
+        ◆ sccSecurityMarks.key=value to find Cloud resources that are
+          attached with security marks whose key is key and value is value.
+        ◆ sccSecurityMarks.key:* to find Cloud resources that are attached
+          with security marks whose key is key.
         ◆ state:ACTIVE to find Cloud resources whose state contains ACTIVE as
           a word.
         ◆ NOT state:ACTIVE to find Cloud resources whose state doesn't
diff --git a/gcloud/beta/compute/instance-groups/managed/create-instance b/gcloud/beta/compute/instance-groups/managed/create-instance
index bc013fd4d..8594e62c6 100644
--- a/gcloud/beta/compute/instance-groups/managed/create-instance
+++ b/gcloud/beta/compute/instance-groups/managed/create-instance
@@ -19,7 +19,7 @@ DESCRIPTION
     (BETA) gcloud beta compute instance-groups managed create-instance creates
     a virtual machine instance with a defined name and optionally its stateful
     configuration: stateful disk, stateful metadata key-values, and stateful IP
-    addressess. Stateful configuration is stored in the corresponding newly
+    addresses. Stateful configuration is stored in the corresponding newly
     created per-instance config. An instance with a per-instance config will
     preserve its given name, specified disks, specified metadata key-values,
     and specified internal and external IPs during instance recreation,
diff --git a/gcloud/beta/compute/interconnects/create b/gcloud/beta/compute/interconnects/create
index d7919683f..ca8d70a27 100644
--- a/gcloud/beta/compute/interconnects/create
+++ b/gcloud/beta/compute/interconnects/create
@@ -102,11 +102,11 @@ OPTIONAL FLAGS
         (only one value is supported):
 
          MACSEC
-            If specified then the interconnect will be created on MACsec
-            capable hardware ports. If not specified, the default value is
-            false, which will allocate non-MACsec capable ports first if
-            available. This parameter can only be provided during interconnect
-            INSERT and cannot be changed using interconnect PATCH.
+            If specified then the interconnect is created on MACsec capable
+            hardware ports. If not specified, the interconnect is created on
+            non-MACsec capable ports first, if available. This parameter can
+            only be provided during interconnect INSERT and cannot be changed
+            using interconnect PATCH.
 
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
diff --git a/gcloud/beta/compute/interconnects/macsec/add-key b/gcloud/beta/compute/interconnects/macsec/add-key
index 7f21f1250..575716120 100644
--- a/gcloud/beta/compute/interconnects/macsec/add-key
+++ b/gcloud/beta/compute/interconnects/macsec/add-key
@@ -46,8 +46,10 @@ GCLOUD WIDE FLAGS
     Run $ gcloud help for details.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute interconnects macsec add-key
 
         $ gcloud alpha compute interconnects macsec add-key
 
diff --git a/gcloud/beta/compute/interconnects/macsec/get-config b/gcloud/beta/compute/interconnects/macsec/get-config
index 305f691ae..8ee60ef1c 100644
--- a/gcloud/beta/compute/interconnects/macsec/get-config
+++ b/gcloud/beta/compute/interconnects/macsec/get-config
@@ -33,8 +33,10 @@ GCLOUD WIDE FLAGS
     Run $ gcloud help for details.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute interconnects macsec get-config
 
         $ gcloud alpha compute interconnects macsec get-config
 
diff --git a/gcloud/beta/compute/interconnects/macsec/help b/gcloud/beta/compute/interconnects/macsec/help
index 220fc277e..92f128444 100644
--- a/gcloud/beta/compute/interconnects/macsec/help
+++ b/gcloud/beta/compute/interconnects/macsec/help
@@ -36,8 +36,10 @@ COMMANDS
         configuration.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute interconnects macsec
 
         $ gcloud alpha compute interconnects macsec
 
diff --git a/gcloud/beta/compute/interconnects/macsec/remove-key b/gcloud/beta/compute/interconnects/macsec/remove-key
index 84129be94..8c19712a4 100644
--- a/gcloud/beta/compute/interconnects/macsec/remove-key
+++ b/gcloud/beta/compute/interconnects/macsec/remove-key
@@ -36,8 +36,10 @@ GCLOUD WIDE FLAGS
     Run $ gcloud help for details.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute interconnects macsec remove-key
 
         $ gcloud alpha compute interconnects macsec remove-key
 
diff --git a/gcloud/beta/compute/interconnects/macsec/update b/gcloud/beta/compute/interconnects/macsec/update
index 9c5247092..594fd8266 100644
--- a/gcloud/beta/compute/interconnects/macsec/update
+++ b/gcloud/beta/compute/interconnects/macsec/update
@@ -46,8 +46,10 @@ GCLOUD WIDE FLAGS
     Run $ gcloud help for details.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute interconnects macsec update
 
         $ gcloud alpha compute interconnects macsec update
 
diff --git a/gcloud/beta/compute/interconnects/macsec/update-key b/gcloud/beta/compute/interconnects/macsec/update-key
index 9a4e0a941..7e08c0fa0 100644
--- a/gcloud/beta/compute/interconnects/macsec/update-key
+++ b/gcloud/beta/compute/interconnects/macsec/update-key
@@ -46,8 +46,10 @@ GCLOUD WIDE FLAGS
     Run $ gcloud help for details.
 
 NOTES
-    This command is currently in beta and might change without notice. This
-    variant is also available:
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud compute interconnects macsec update-key
 
         $ gcloud alpha compute interconnects macsec update-key
 
diff --git a/gcloud/beta/compute/reservations/create b/gcloud/beta/compute/reservations/create
index d80e61e48..e513163ab 100644
--- a/gcloud/beta/compute/reservations/create
+++ b/gcloud/beta/compute/reservations/create
@@ -12,6 +12,8 @@ SYNOPSIS
           --min-cpu-platform=MIN_CPU_PLATFORM])
           : --require-specific-reservation --resource-policies=[KEY=VALUE,...])
         [--description=DESCRIPTION] [--zone=ZONE]
+        [--delete-after-duration=DELETE_AFTER_DURATION
+          | --delete-at-time=DELETE_AT_TIME]
         [--share-setting=SHARE_SETTING
           --share-with=SHARE_WITH,[SHARE_WITH,...]] [GCLOUD_WIDE_FLAG ...]
 
@@ -137,6 +139,25 @@ OPTIONAL FLAGS
         Alternatively, the zone can be stored in the environment variable
         CLOUDSDK_COMPUTE_ZONE.
 
+     Manage auto-delete properties for reservations.
+
+     At most one of these can be specified:
+
+       --delete-after-duration=DELETE_AFTER_DURATION
+          Automatically deletes the reservations after a specified number of
+          days, hours, minutes, or seconds from its creation. For example,
+          specify 30m for 30 minutes, or 1d2h3m4s for 1 day, 2 hours, 3
+          minutes, and 4 seconds. For more information, see $ gcloud topic
+          datetimes.
+
+       --delete-at-time=DELETE_AT_TIME
+          Automatically deletes the reservation at a specific time from its
+          creation. The specified time must be an RFC3339 timestamp, which must
+          be formatted as "YYYY-MM-DDTHH:MM:SSZ" where YYYY = year, MM = month,
+          DD = day, HH = hours, MM = minutes, SS = seconds, and Z = time zone
+          in Coordinated Universal Time (UTC). For example, specify
+          2021-11-20T07:00:00Z.
+
      Manage the properties of a shared reservation.
 
        --share-setting=SHARE_SETTING
diff --git a/gcloud/beta/compute/reservations/update b/gcloud/beta/compute/reservations/update
index d64c4445e..3f40a2f17 100644
--- a/gcloud/beta/compute/reservations/update
+++ b/gcloud/beta/compute/reservations/update
@@ -7,7 +7,10 @@ SYNOPSIS
         [--add-share-with=PROJECT,[PROJECT,...]]
         [--remove-share-with=PROJECT,[PROJECT,...]]
         [--share-with=SHARE_WITH,[SHARE_WITH,...]] [--vm-count=VM_COUNT]
-        [--zone=ZONE] [GCLOUD_WIDE_FLAG ...]
+        [--zone=ZONE]
+        [--delete-after-duration=DELETE_AFTER_DURATION
+          | --delete-at-time=DELETE_AT_TIME | --disable-auto-delete]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (BETA) Update Compute Engine reservations.
@@ -87,6 +90,28 @@ FLAGS
         Alternatively, the zone can be stored in the environment variable
         CLOUDSDK_COMPUTE_ZONE.
 
+     Manage auto-delete properties for reservations.
+
+     At most one of these can be specified:
+
+       --delete-after-duration=DELETE_AFTER_DURATION
+          Automatically deletes the reservations after a specified number of
+          days, hours, minutes, or seconds from its creation. For example,
+          specify 30m for 30 minutes, or 1d2h3m4s for 1 day, 2 hours, 3
+          minutes, and 4 seconds. For more information, see $ gcloud topic
+          datetimes.
+
+       --delete-at-time=DELETE_AT_TIME
+          Automatically deletes the reservation at a specific time from its
+          creation. The specified time must be an RFC3339 timestamp, which must
+          be formatted as "YYYY-MM-DDTHH:MM:SSZ" where YYYY = year, MM = month,
+          DD = day, HH = hours, MM = minutes, SS = seconds, and Z = time zone
+          in Coordinated Universal Time (UTC). For example, specify
+          2021-11-20T07:00:00Z.
+
+       --disable-auto-delete
+          Disables the auto-delete setting for the reservation.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/beta/compute/sole-tenancy/node-groups/create b/gcloud/beta/compute/sole-tenancy/node-groups/create
index d1ef0c1cd..8fdace65d 100644
--- a/gcloud/beta/compute/sole-tenancy/node-groups/create
+++ b/gcloud/beta/compute/sole-tenancy/node-groups/create
@@ -5,7 +5,9 @@ NAME
 SYNOPSIS
     gcloud beta compute sole-tenancy node-groups create NAME
         --node-template=NODE_TEMPLATE --target-size=TARGET_SIZE
-        [--description=DESCRIPTION] [--maintenance-policy=MAINTENANCE_POLICY]
+        [--description=DESCRIPTION]
+        [--maintenance-interval=MAINTENANCE_INTERVAL]
+        [--maintenance-policy=MAINTENANCE_POLICY]
         [--maintenance-window-start-time=START_TIME] [--zone=ZONE]
         [--autoscaler-mode=AUTOSCALER_MODE
           : --max-nodes=MAX_NODES --min-nodes=MIN_NODES]
@@ -36,6 +38,18 @@ OPTIONAL FLAGS
      --description=DESCRIPTION
         An optional description of this resource.
 
+     --maintenance-interval=MAINTENANCE_INTERVAL
+        Specifies the frequency of planned maintenance events.
+        MAINTENANCE_INTERVAL must be one of:
+
+         as-needed
+            VMs are eligible to receive infrastructure and hypervisor updates
+            as they become available.
+         recurrent
+            VMs receive infrastructure and hypervisor updates on a periodic
+            basis, minimizing the number of maintenance operations (live
+            migrations or terminations) on an individual VM.
+
      --maintenance-policy=MAINTENANCE_POLICY
         Determines the maintenance behavior during host maintenance events. For
         more information, see
diff --git a/gcloud/beta/compute/sole-tenancy/node-groups/help b/gcloud/beta/compute/sole-tenancy/node-groups/help
index 1107dd2a8..75e568220 100644
--- a/gcloud/beta/compute/sole-tenancy/node-groups/help
+++ b/gcloud/beta/compute/sole-tenancy/node-groups/help
@@ -37,6 +37,9 @@ COMMANDS
      list-nodes
         (BETA) List Compute Engine sole-tenant nodes present in a nodegroup.
 
+     perform-maintenance
+        (BETA) Perform maintenance on nodes in a Compute Engine node group.
+
      remove-iam-policy-binding
         (BETA) Remove IAM policy binding from a Compute Engine node group.
 
diff --git a/gcloud/beta/compute/sole-tenancy/node-groups/perform-maintenance b/gcloud/beta/compute/sole-tenancy/node-groups/perform-maintenance
new file mode 100644
index 000000000..efc712315
--- /dev/null
+++ b/gcloud/beta/compute/sole-tenancy/node-groups/perform-maintenance
@@ -0,0 +1,67 @@
+NAME
+    gcloud beta compute sole-tenancy node-groups perform-maintenance - perform
+        maintenance on nodes in a Compute Engine node group
+
+SYNOPSIS
+    gcloud beta compute sole-tenancy node-groups perform-maintenance NAME
+        --nodes=NODE,[NODE,...] [--start-time=START_TIME] [--zone=ZONE]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Perform maintenance on nodes in a Compute Engine node group.
+
+EXAMPLES
+    To perform maintenance on nodes in a node group, run:
+
+        $ gcloud beta compute sole-tenancy node-groups perform-maintenance \
+            my-node-group --nodes=node-1,node-2 \
+            --start-time=2023-05-01T00:00:00.000-08:00
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the node group to operate on.
+
+REQUIRED FLAGS
+     --nodes=NODE,[NODE,...]
+        The names of the nodes to perform maintenance on.
+
+OPTIONAL FLAGS
+     --start-time=START_TIME
+        The requested time for the maintenance window to start. The timestamp
+        must be an RFC3339 valid string.
+
+     --zone=ZONE
+        Zone of the node group to operate on. If not specified and the
+        compute/zone property isn't set, you might be prompted to select a zone
+        (interactive mode only).
+
+        To avoid prompting when this flag is omitted, you can set the
+        compute/zone property:
+
+            $ gcloud config set compute/zone ZONE
+
+        A list of zones can be fetched by running:
+
+            $ gcloud compute zones list
+
+        To unset the property, run:
+
+            $ gcloud config unset compute/zone
+
+        Alternatively, the zone can be stored in the environment variable
+        CLOUDSDK_COMPUTE_ZONE.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha compute sole-tenancy node-groups perform-maintenance
+
diff --git a/gcloud/beta/container/clusters/create b/gcloud/beta/container/clusters/create
index ffa6bf688..1eb73156b 100644
--- a/gcloud/beta/container/clusters/create
+++ b/gcloud/beta/container/clusters/create
@@ -1536,7 +1536,7 @@ FLAGS
                 argument should be used in conjunction with
                 --enable-autoprovisioning-blue-green-upgrade to take effect.
 
-                Batch sizes are specfied by one of, batch-node-count or
+                Batch sizes are specified by one of, batch-node-count or
                 batch-percent. The duration between batches is specified by
                 batch-soak-duration.
 
@@ -1790,9 +1790,11 @@ FLAGS
                   --ephemeral-storage local-ssd-count=2
 
           'local-ssd-count' specifies the number of local SSDs to use to back
-          ephemeral storage. Local SDDs use NVMe interfaces and each is 375 GB
-          in size. Setting 'local-ssd-count=0' disables using local SSDs as
-          ephemeral storage.
+          ephemeral storage. Local SDDs use NVMe interfaces. For first- and
+          second-generation machine types, a nonzero count field is required
+          for local ssd to be configured. For third-generation machine types,
+          the count field is optional because the count is inferred from the
+          machine type.
 
           See https://cloud.google.com/compute/docs/disks/local-ssd for more
           information.
@@ -1807,8 +1809,11 @@ FLAGS
                   --ephemeral-storage-local-ssd count=2
 
           'count' specifies the number of local SSDs to use to back ephemeral
-          storage. Local SDDs use NVMe interfaces and each is 375 GB in size.
-          Setting 'count=0' disables using local SSDs as ephemeral storage.
+          storage. Local SDDs use NVMe interfaces. For first- and
+          second-generation machine types, a nonzero count field is required
+          for local ssd to be configured. For third-generation machine types,
+          the count field is optional because the count is inferred from the
+          machine type.
 
           See https://cloud.google.com/compute/docs/disks/local-ssd for more
           information.
@@ -1827,11 +1832,13 @@ FLAGS
           New nodes, including ones created by resize or recreate, will have
           these local SSDs.
 
-          Local SSDs have a fixed 375 GB capacity per device. The number of
-          disks that can be attached to an instance is limited by the maximum
-          number of disks available on a machine, which differs by compute
-          zone. See https://cloud.google.com/compute/docs/disks/local-ssd for
-          more information.
+          For first- and second-generation machine types, a nonzero count field
+          is required for local ssd to be configured. For third-generation
+          machine types, the count field is optional because the count is
+          inferred from the machine type.
+
+          See https://cloud.google.com/compute/docs/disks/local-ssd for more
+          information.
 
        --local-ssd-count=LOCAL_SSD_COUNT
           The number of local SSD disks to provision on each node, formatted
diff --git a/gcloud/beta/container/clusters/create-auto b/gcloud/beta/container/clusters/create-auto
index fb7c302c7..50a61bfc0 100644
--- a/gcloud/beta/container/clusters/create-auto
+++ b/gcloud/beta/container/clusters/create-auto
@@ -255,10 +255,10 @@ FLAGS
 
         Examples:
 
-            $ gcloud beta container clusters create-auto --logging=SYSTEM
+            $ gcloud beta container clusters create-auto \
+                --logging=SYSTEM,WORKLOAD
             $ gcloud beta container clusters create-auto \
                 --logging=SYSTEM,API_SERVER,WORKLOAD
-            $ gcloud beta container clusters create-auto --logging=NONE
 
      --monitoring=[COMPONENT,...]
         Set the components that have monitoring enabled. Valid component values
@@ -273,7 +273,7 @@ FLAGS
 
             $ gcloud beta container clusters create-auto \
                 --monitoring=SYSTEM,API_SERVER,POD
-            $ gcloud beta container clusters create-auto --monitoring=NONE
+            $ gcloud beta container clusters create-auto --monitoring=SYSTEM
 
      --network=NETWORK
         The Compute Engine Network that the cluster will connect to. Google
diff --git a/gcloud/beta/container/clusters/update b/gcloud/beta/container/clusters/update
index 5797ccf07..7a425b181 100644
--- a/gcloud/beta/container/clusters/update
+++ b/gcloud/beta/container/clusters/update
@@ -1111,7 +1111,7 @@ REQUIRED FLAGS
                   argument should be used in conjunction with
                   --enable-autoprovisioning-blue-green-upgrade to take effect.
 
-                  Batch sizes are specfied by one of, batch-node-count or
+                  Batch sizes are specified by one of, batch-node-count or
                   batch-percent. The duration between batches is specified by
                   batch-soak-duration.
 
diff --git a/gcloud/beta/container/node-pools/create b/gcloud/beta/container/node-pools/create
index bc2cb654b..9d689ab9c 100644
--- a/gcloud/beta/container/node-pools/create
+++ b/gcloud/beta/container/node-pools/create
@@ -852,9 +852,11 @@ FLAGS
                   --cluster=example cluster --ephemeral-storage local-ssd-count=2
 
           'local-ssd-count' specifies the number of local SSDs to use to back
-          ephemeral storage. Local SDDs use NVMe interfaces and each is 375 GB
-          in size. Setting 'local-ssd-count=0' disables using local SSDs as
-          ephemeral storage.
+          ephemeral storage. Local SDDs use NVMe interfaces. For first- and
+          second-generation machine types, a nonzero count field is required
+          for local ssd to be configured. For third-generation machine types,
+          the count field is optional because the count is inferred from the
+          machine type.
 
           See https://cloud.google.com/compute/docs/disks/local-ssd for more
           information.
@@ -869,8 +871,11 @@ FLAGS
                   --cluster=example cluster --ephemeral-storage-local-ssd count=2
 
           'count' specifies the number of local SSDs to use to back ephemeral
-          storage. Local SDDs use NVMe interfaces and each is 375 GB in size.
-          Setting 'count=0' disables using local SSDs as ephemeral storage.
+          storage. Local SDDs use NVMe interfaces. For first- and
+          second-generation machine types, a nonzero count field is required
+          for local ssd to be configured. For third-generation machine types,
+          the count field is optional because the count is inferred from the
+          machine type.
 
           See https://cloud.google.com/compute/docs/disks/local-ssd for more
           information.
@@ -889,11 +894,13 @@ FLAGS
           New nodes, including ones created by resize or recreate, will have
           these local SSDs.
 
-          Local SSDs have a fixed 375 GB capacity per device. The number of
-          disks that can be attached to an instance is limited by the maximum
-          number of disks available on a machine, which differs by compute
-          zone. See https://cloud.google.com/compute/docs/disks/local-ssd for
-          more information.
+          For first- and second-generation machine types, a nonzero count field
+          is required for local ssd to be configured. For third-generation
+          machine types, the count field is optional because the count is
+          inferred from the machine type.
+
+          See https://cloud.google.com/compute/docs/disks/local-ssd for more
+          information.
 
        --local-ssd-count=LOCAL_SSD_COUNT
           The number of local SSD disks to provision on each node, formatted
diff --git a/gcloud/beta/firestore/databases/create b/gcloud/beta/firestore/databases/create
index b9a5c0e10..75190107d 100644
--- a/gcloud/beta/firestore/databases/create
+++ b/gcloud/beta/firestore/databases/create
@@ -5,7 +5,8 @@ NAME
 SYNOPSIS
     gcloud beta firestore databases create --location=LOCATION
         [--database=DATABASE; default="(default)"] [--delete-protection]
-        [--type=TYPE; default="firestore-native"] [GCLOUD_WIDE_FLAG ...]
+        [--enable-pitr] [--type=TYPE; default="firestore-native"]
+        [GCLOUD_WIDE_FLAG ...]
 
 EXAMPLES
     To create a Firestore Native database in nam5.
@@ -28,6 +29,12 @@ EXAMPLES
         $ gcloud beta firestore databases create --location=nam5 \
           --delete-protection
 
+    To create a Firestore Native database in nam5 with Point In Time Recovery
+    (PITR) enabled.
+
+        $ gcloud beta firestore databases create --location=nam5 \
+          --enable-pitr
+
 REQUIRED FLAGS
      --location=LOCATION
         The location to operate on. Available locations are listed at
@@ -57,6 +64,13 @@ OPTIONAL FLAGS
 
             Default to false.
 
+     --enable-pitr
+        Whether to enable Point In Time Recovery (PITR) on the created
+        database.
+
+            If set to true, PITR on the new database will be enabled. By default,
+            this feature is not enabled.
+
      --type=TYPE; default="firestore-native"
         The type of the database. TYPE must be one of: firestore-native,
         datastore-mode.
diff --git a/gcloud/beta/firestore/databases/update b/gcloud/beta/firestore/databases/update
index 50da02bc3..ca83ed683 100644
--- a/gcloud/beta/firestore/databases/update
+++ b/gcloud/beta/firestore/databases/update
@@ -4,7 +4,7 @@ NAME
 
 SYNOPSIS
     gcloud beta firestore databases update [--async] [--database=DATABASE]
-        [--type=TYPE] [GCLOUD_WIDE_FLAG ...]
+        [--enable-pitr] [--type=TYPE] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (BETA) Update the database configuration of a Cloud Firestore database.
@@ -39,6 +39,11 @@ FLAGS
           ▸ provide the argument --database on the command line;
           ▸ the default value of argument [--database] is (default).
 
+     --enable-pitr
+        If set to true, the Firestore database will be updated to enable Point
+        In Time Recovery. You can disable the this feature via
+        --no-enable-pitr.
+
      --type=TYPE
         The database type. TYPE must be one of: datastore-mode,
         firestore-native.
diff --git a/gcloud/beta/firestore/export b/gcloud/beta/firestore/export
index 1884da343..0e907c78a 100644
--- a/gcloud/beta/firestore/export
+++ b/gcloud/beta/firestore/export
@@ -6,7 +6,8 @@ SYNOPSIS
     gcloud beta firestore export OUTPUT_URI_PREFIX [--async]
         [--collection-ids=[COLLECTION_IDS,...]]
         [--database=DATABASE; default="(default)"]
-        [--namespace-ids=[NAMESPACE_IDS,...]] [GCLOUD_WIDE_FLAG ...]
+        [--namespace-ids=[NAMESPACE_IDS,...]] [--snapshot-time=SNAPSHOT_TIME]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (BETA) export Cloud Firestore documents to Google Cloud Storage.
@@ -28,6 +29,11 @@ EXAMPLES
         $ gcloud beta firestore export gs://mybucket/my/path \
             --namespace-ids='specific namespace id'
 
+    To export from a snapshot at '2023-05-26T10:20:00.00Z', run:
+
+        $ gcloud beta firestore export gs://mybucket/my/path \
+            --snapshot-time='2023-05-26T10:20:00.00Z'
+
 POSITIONAL ARGUMENTS
      OUTPUT_URI_PREFIX
         Location where the export files will be stored. Must be a valid Google
@@ -70,6 +76,23 @@ FLAGS
 
             $ gcloud beta firestore export --namespaces-ids='customers','orders'
 
+     --snapshot-time=SNAPSHOT_TIME
+        The version of the database to export.
+
+        The timestamp must be rounded to the minute, in the past, and not older
+        than 5 days. Please choose a reasonable timestamp based on prior
+        knowledge on how long exports take as data at provided snapshot
+        timestamp can expire during export.
+
+        If specified, then the exported documents will represent a consistent
+        view of the database at the provided time. Otherwise, there are no
+        guarantees about the consistency of the exported documents.
+
+        For example, to operate on snapshot time 2023-05-26T10:20:00.00Z:
+
+            $ gcloud beta firestore export \
+                --snapshot-time='2023-05-26T10:20:00.00Z'
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/beta/metastore/services/update b/gcloud/beta/metastore/services/update
index 564449d71..8d9310260 100644
--- a/gcloud/beta/metastore/services/update
+++ b/gcloud/beta/metastore/services/update
@@ -76,8 +76,9 @@ FLAGS
 
      --data-catalog-sync
         A boolean flag to determine whether Dataproc Metastore metadata sync to
-        Data Catalog should be enabled. Cannot be updated if the service uses
-        customer-managed encryption keys.
+        Data Catalog should be enabled, false if unspecified. Mutually
+        exclusive with flag --encryption-kms-key. Cannot be updated if the
+        service uses customer-managed encryption keys.
 
      --endpoint-protocol=ENDPOINT_PROTOCOL
         The protocol to use for the metastore service endpoint.
diff --git a/gcloud/beta/network-connectivity/help b/gcloud/beta/network-connectivity/help
new file mode 100644
index 000000000..e6c4f31b0
--- /dev/null
+++ b/gcloud/beta/network-connectivity/help
@@ -0,0 +1,23 @@
+NAME
+    gcloud beta network-connectivity - manage Network Connectivity Center
+        resources
+
+SYNOPSIS
+    gcloud beta network-connectivity GROUP [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Manage Network Connectivity Center resources.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud network-connectivity
+
+        $ gcloud alpha network-connectivity
+
diff --git a/gcloud/beta/notebooks/instances/create b/gcloud/beta/notebooks/instances/create
index 6ac572315..6b71067e6 100644
--- a/gcloud/beta/notebooks/instances/create
+++ b/gcloud/beta/notebooks/instances/create
@@ -187,6 +187,10 @@ OPTIONAL FLAGS
      --metadata=[KEY=VALUE,...]
         Custom metadata to apply to this instance.
 
+        For example, to specify a Cloud Storage bucket for automatic backup,
+        you can use the gcs-data-bucket metadata tag. Format:
+        "--metadata=gcs-data-bucket=BUCKET".
+
      --post-startup-script=POST_STARTUP_SCRIPT
         Path to a Bash script that automatically runs after a notebook instance
         fully boots up. The path must be a URL or Cloud Storage path
diff --git a/gcloud/beta/service-extensions/help b/gcloud/beta/service-extensions/help
new file mode 100644
index 000000000..6801db212
--- /dev/null
+++ b/gcloud/beta/service-extensions/help
@@ -0,0 +1,20 @@
+NAME
+    gcloud beta service-extensions - manage Service Extensions resources
+
+SYNOPSIS
+    gcloud beta service-extensions GROUP [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Manage Service Extensions resources.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in beta and might change without notice. This
+    variant is also available:
+
+        $ gcloud alpha service-extensions
+
diff --git a/gcloud/composer/environments/create b/gcloud/composer/environments/create
index 1e1f333a0..16135a8b2 100644
--- a/gcloud/composer/environments/create
+++ b/gcloud/composer/environments/create
@@ -32,6 +32,8 @@ SYNOPSIS
           --snapshot-creation-schedule=SNAPSHOT_CREATION_SCHEDULE
           --snapshot-location=SNAPSHOT_LOCATION
           --snapshot-schedule-timezone=SNAPSHOT_SCHEDULE_TIMEZONE]
+        [--enable-triggerer --triggerer-count=TRIGGERER_COUNT
+          --triggerer-cpu=TRIGGERER_CPU --triggerer-memory=TRIGGERER_MEMORY]
         [--kms-key=KMS_KEY : --kms-keyring=KMS_KEYRING
           --kms-location=KMS_LOCATION --kms-project=KMS_PROJECT]
         [--maintenance-window-end=MAINTENANCE_WINDOW_END
@@ -401,6 +403,28 @@ FLAGS
           This flag argument must be specified if any of the other arguments in
           this group are specified.
 
+     Group of arguments for setting triggerer settings in Composer 2.0.31 or
+     greater.
+
+       --enable-triggerer
+          (DEPRECATED) Enable use of a triggerer, supported in the Environments
+          with Composer 2.0.31 and Airflow 2.2.5 and greater.
+
+          This flag is deprecated. Use --triggerer-count instead.
+
+       --triggerer-count=TRIGGERER_COUNT
+          Number of triggerers, supported in the Environments with Composer
+          2.0.31 and Airflow 2.2.5 and greater.
+
+       --triggerer-cpu=TRIGGERER_CPU
+          CPU allocated to Airflow triggerer. Supported in the Environments
+          with Composer 2.0.31 and Airflow 2.2.5 and greater.
+
+       --triggerer-memory=TRIGGERER_MEMORY
+          Memory allocated to Airflow triggerer, ex. 512MB, 3GB, 2. If units
+          are not provided, defaults to GB. Supported in the Environments with
+          Composer 2.0.31 and Airflow 2.2.5 and greater.
+
      Key resource - The Cloud KMS (Key Management Service) cryptokey that will
      be used to protect the environment. The 'Cloud Composer Service Agent'
      service account must hold permission 'Cloud KMS CryptoKey
diff --git a/gcloud/composer/environments/update b/gcloud/composer/environments/update
index c2eb942ef..10d6fa221 100644
--- a/gcloud/composer/environments/update
+++ b/gcloud/composer/environments/update
@@ -25,7 +25,10 @@ SYNOPSIS
           --scheduler-storage=SCHEDULER_STORAGE --web-server-cpu=WEB_SERVER_CPU
           --web-server-memory=WEB_SERVER_MEMORY
           --web-server-storage=WEB_SERVER_STORAGE --worker-cpu=WORKER_CPU
-          --worker-memory=WORKER_MEMORY --worker-storage=WORKER_STORAGE
+          --worker-memory=WORKER_MEMORY
+          --worker-storage=WORKER_STORAGE --disable-triggerer
+          | --enable-triggerer --triggerer-count=TRIGGERER_COUNT
+          --triggerer-cpu=TRIGGERER_CPU --triggerer-memory=TRIGGERER_MEMORY
           | --update-airflow-configs=[KEY=VALUE,...] --clear-airflow-configs
           | --remove-airflow-configs=[KEY,...]
           | --update-env-variables=[NAME=VALUE,...] --clear-env-variables
@@ -252,6 +255,42 @@ REQUIRED FLAGS
             Storage allocated to Airflow worker, ex. 600MB, 3GB, 2. If units
             are not provided, defaults to GB.
 
+         Group of arguments for setting triggerer settings in Composer 2.0.31
+         or greater.
+
+         At most one of these can be specified:
+
+           --disable-triggerer
+              (DEPRECATED) Disable a triggerer, supported in the Environments
+              with Composer 2.0.31 and Airflow 2.2.5 and greater.
+
+              This flag is deprecated. Use --triggerer-count 0 instead.
+
+           Group of arguments for setting triggerer settings during update in
+           Composer 2.0.31 or greater.
+
+             --enable-triggerer
+                (DEPRECATED) Enable use of a triggerer, supported in the
+                Environments with Composer 2.0.31 and Airflow 2.2.5 and
+                greater.
+
+                This flag is deprecated. Use --triggerer-count instead.
+
+             --triggerer-count=TRIGGERER_COUNT
+                Number of triggerers, supported in the Environments with
+                Composer 2.0.31 and Airflow 2.2.5 and greater.
+
+             --triggerer-cpu=TRIGGERER_CPU
+                CPU allocated to Airflow triggerer. Supported in the
+                Environments with Composer 2.0.31 and Airflow 2.2.5 and
+                greater.
+
+             --triggerer-memory=TRIGGERER_MEMORY
+                Memory allocated to Airflow triggerer, ex. 512MB, 3GB, 2. If
+                units are not provided, defaults to GB. Supported in the
+                Environments with Composer 2.0.31 and Airflow 2.2.5 and
+                greater.
+
        Group of arguments for modifying the Airflow configuration.
 
          --update-airflow-configs=[KEY=VALUE,...]
diff --git a/gcloud/compute/instance-groups/managed/create b/gcloud/compute/instance-groups/managed/create
index 24d501d66..f3817df14 100644
--- a/gcloud/compute/instance-groups/managed/create
+++ b/gcloud/compute/instance-groups/managed/create
@@ -9,6 +9,10 @@ SYNOPSIS
         [--initial-delay=INITIAL_DELAY] [--instance-redistribution-type=TYPE]
         [--list-managed-instances-results=MODE]
         [--stateful-disk=[auto-delete=AUTO-DELETE],[device-name=DEVICE-NAME]]
+        [--stateful-external-ip=[enabled],
+          [auto-delete=AUTO-DELETE],[interface-name=INTERFACE-NAME]]
+        [--stateful-internal-ip=[enabled],
+          [auto-delete=AUTO-DELETE],[interface-name=INTERFACE-NAME]]
         [--target-distribution-shape=SHAPE] [--target-pool=[TARGET_POOL,...]]
         [--zones=ZONE,[ZONE,...]]
         [--health-check=HEALTH_CHECK | --http-health-check=HTTP_HEALTH_CHECK
@@ -143,6 +147,76 @@ OPTIONAL FLAGS
               the group; for example, when the instance is deleted manually or
               when the group size is decreased.
 
+     --stateful-external-ip=[enabled],[auto-delete=AUTO-DELETE],[interface-name=INTERFACE-NAME]
+        External IPs considered stateful by the instance group. Managed
+        instance groups preserve stateful IPs on VM autohealing, update, and
+        recreate events.
+
+        Use this argument multiple times to make more external IPs stateful.
+
+        At least one of the following is required:
+
+         enabled
+            Marks the IP address as stateful. The network interface named nic0
+            is assumed by default when interface-name is not specified. This
+            flag can be omitted when interface-name is provided explicitly.
+
+         interface-name
+            Marks the IP address from this network interface as stateful. This
+            flag can be omitted when enabled is provided.
+
+            Additional arguments:
+
+         auto-delete
+            (Optional) Prescribes what should happen to an associated static
+            Address resource when a VM instance is permanently deleted.
+            Regardless of the value of the delete rule, stateful IP addresses
+            are always preserved on instance autohealing, update, and
+            recreation operations. The following options are available:
+            ▸ never: (Default) Never delete the static IP address. Instead,
+              unassign the address when its instance is permanently deleted and
+              keep the address reserved.
+            ▸ on-permanent-instance-deletion: Delete the static IP address
+              reservation when the instance that it's assigned to is
+              permanently deleted from the instance group; for example, when
+              the instance is deleted manually or when the group size is
+              decreased.
+
+     --stateful-internal-ip=[enabled],[auto-delete=AUTO-DELETE],[interface-name=INTERFACE-NAME]
+        Internal IPs considered stateful by the instance group. Managed
+        instance groups preserve stateful IPs on VM autohealing, update, and
+        recreate events.
+
+        Use this argument multiple times to make more internal IPs stateful.
+
+        At least one of the following is required:
+
+         enabled
+            Marks the IP address as stateful. The network interface named nic0
+            is assumed by default when interface-name is not specified. This
+            flag can be omitted when interface-name is provided explicitly.
+
+         interface-name
+            Marks the IP address from this network interface as stateful. This
+            flag can be omitted when enabled is provided.
+
+            Additional arguments:
+
+         auto-delete
+            (Optional) Prescribes what should happen to an associated static
+            Address resource when a VM instance is permanently deleted.
+            Regardless of the value of the delete rule, stateful IP addresses
+            are always preserved on instance autohealing, update, and
+            recreation operations. The following options are available:
+            ▸ never: (Default) Never delete the static IP address. Instead,
+              unassign the address when its instance is permanently deleted and
+              keep the address reserved.
+            ▸ on-permanent-instance-deletion: Delete the static IP address
+              reservation when the instance that it's assigned to is
+              permanently deleted from the instance group; for example, when
+              the instance is deleted manually or when the group size is
+              decreased.
+
      --target-distribution-shape=SHAPE
         Specifies how a regional managed instance group distributes its
         instances across zones within the region. The default shape is even.
diff --git a/gcloud/compute/instance-groups/managed/create-instance b/gcloud/compute/instance-groups/managed/create-instance
index 6a761c931..84b2b4cbc 100644
--- a/gcloud/compute/instance-groups/managed/create-instance
+++ b/gcloud/compute/instance-groups/managed/create-instance
@@ -8,30 +8,40 @@ SYNOPSIS
         --instance=INSTANCE
         [--stateful-disk=[auto-delete=AUTO-DELETE],
           [device-name=DEVICE-NAME],[mode=MODE],[source=SOURCE]]
+        [--stateful-external-ip=[address=ADDRESS],
+          [auto-delete=AUTO-DELETE],[interface-name=INTERFACE-NAME]]
+        [--stateful-internal-ip=[address=ADDRESS],
+          [auto-delete=AUTO-DELETE],[interface-name=INTERFACE-NAME]]
         [--stateful-metadata=KEY=VALUE,[KEY=VALUE,...]]
         [--region=REGION | --zone=ZONE] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     gcloud compute instance-groups managed create-instance creates a virtual
     machine instance with a defined name and optionally its stateful
-    configuration: stateful disk and stateful metadata key-values. Stateful
-    configuration is stored in the corresponding newly created per-instance
-    config. An instance with a per-instance config will preserve its given
-    name, specified disks, and specified metadata key-values during instance
-    recreation, auto-healing, updates, and any other lifecycle transitions of
-    the instance.
+    configuration: stateful disk, stateful metadata key-values, and stateful IP
+    addresses. Stateful configuration is stored in the corresponding newly
+    created per-instance config. An instance with a per-instance config will
+    preserve its given name, specified disks, specified metadata key-values,
+    and specified internal and external IPs during instance recreation,
+    auto-healing, updates, and any other lifecycle transitions of the instance.
 
 EXAMPLES
     To create an instance instance-1 in my-group (in region europe-west4) with
-    metadata my-key: my-value and a disk disk-1 attached to it as the device
-    device-1, run:
+    metadata my-key: my-value, a disk disk-1 attached to it as the device
+    device-1, stateful internal IP 192.168.0.10 on the default interface
+    (nic0), and existing address reservation my-address for stateful external
+    IP on interface nic1, run:
 
         $ gcloud compute instance-groups managed create-instance my-group \
           --region=europe-west4 --instance=instance-1 \
           --stateful-disk='device-name=foo,source=https://compute.googleap\
         is.com/compute/alpha/projects/my-project/zones/europe-west4/disks/di\
         sk-1,mode=rw,auto-delete=on-permanent-instance-deletion' \
-            --stateful-metadata='my-key=my-value'
+            --stateful-metadata='my-key=my-value' \
+            --stateful-internal-ip=address=192.168.0.10,\
+        auto-delete=on-permanent-instance-deletion \
+            --stateful-external-ip=address=/projects/example-project/\
+        regions/europe-west4/addresses/my-address,interface-name=nic1
 
 POSITIONAL ARGUMENTS
      NAME
@@ -53,6 +63,92 @@ OPTIONAL FLAGS
         The same disk can be attached to more than one instance but only in
         read-only mode.
 
+     --stateful-external-ip=[address=ADDRESS],[auto-delete=AUTO-DELETE],[interface-name=INTERFACE-NAME]
+        Managed instance groups preserve stateful IPs on VM autohealing,
+        update, and recreate events.
+
+        Use this argument multiple times to update more IPs.
+
+        If a stateful external IP with the given interface name already exists
+        in the current instance configuration, its properties are replaced by
+        the newly provided ones. Otherwise, a new stateful external IP
+        definition is added to the instance configuration.
+
+         interface-name
+            (Optional) Network interface name. If omitted, the default network
+            interface named nic0 is assumed.
+
+                *address*::: Static IP address to assign to the instance in one of
+                the following formats:
+
+            + Address: URL of a static IP address reservation. For example:
+            projects/example-project/regions/us-east1/addresses/example-ip-name.
+
+            + Literal: For example: 130.211.181.55.
+
+            If the provided IP address is not yet reserved, the managed
+            instance group automatically creates the corresponding IP address
+            reservation. If the provided IP address is reserved, the group
+            assigns the reservation to the instance.
+
+         auto-delete
+            (Optional) Prescribes what should happen to an associated static
+            Address resource when a VM instance is permanently deleted.
+            Regardless of the value of the delete rule, stateful IP addresses
+            are always preserved on instance autohealing, update, and
+            recreation operations. The following options are available:
+            ▸ never: (Default) Never delete the static IP address. Instead,
+              unassign the address when its instance is permanently deleted and
+              keep the address reserved.
+            ▸ on-permanent-instance-deletion: Delete the static IP address
+              reservation when the instance that it's assigned to is
+              permanently deleted from the instance group; for example, when
+              the instance is deleted manually or when the group size is
+              decreased.
+
+     --stateful-internal-ip=[address=ADDRESS],[auto-delete=AUTO-DELETE],[interface-name=INTERFACE-NAME]
+        Managed instance groups preserve stateful IPs on VM autohealing,
+        update, and recreate events.
+
+        Use this argument multiple times to update more IPs.
+
+        If a stateful internal IP with the given interface name already exists
+        in the current instance configuration, its properties are replaced by
+        the newly provided ones. Otherwise, a new stateful internal IP
+        definition is added to the instance configuration.
+
+         interface-name
+            (Optional) Network interface name. If omitted, the default network
+            interface named nic0 is assumed.
+
+                *address*::: Static IP address to assign to the instance in one of
+                the following formats:
+
+            + Address: URL of a static IP address reservation. For example:
+            projects/example-project/regions/us-east1/addresses/example-ip-name.
+
+            + Literal: For example: 130.211.181.55.
+
+            If the provided IP address is not yet reserved, the managed
+            instance group automatically creates the corresponding IP address
+            reservation. If the provided IP address is reserved, the group
+            assigns the reservation to the instance.
+
+         auto-delete
+            (Optional) Prescribes what should happen to an associated static
+            Address resource when a VM instance is permanently deleted.
+            Regardless of the value of the delete rule, stateful IP addresses
+            are always preserved on instance autohealing, update, and
+            recreation operations. The following options are available:
+            ▸ never: (Default) Never delete the static IP address. Instead,
+              unassign the address when its instance is permanently deleted and
+              keep the address reserved.
+            ▸ on-permanent-instance-deletion: Delete the static IP address
+              reservation when the instance that it's assigned to is
+              permanently deleted from the instance group; for example, when
+              the instance is deleted manually or when the group size is
+              decreased.
+
      --stateful-metadata=KEY=VALUE,[KEY=VALUE,...]
         Additional metadata to be made available to the guest operating system
         in addition to the metadata defined in the instance template.
diff --git a/gcloud/compute/instance-groups/managed/instance-configs/create b/gcloud/compute/instance-groups/managed/instance-configs/create
index 032e6de43..1010681cf 100644
--- a/gcloud/compute/instance-groups/managed/instance-configs/create
+++ b/gcloud/compute/instance-groups/managed/instance-configs/create
@@ -9,6 +9,10 @@ SYNOPSIS
           default="none"]
         [--stateful-disk=[auto-delete=AUTO-DELETE],
           [device-name=DEVICE-NAME],[mode=MODE],[source=SOURCE]]
+        [--stateful-external-ip=[address=ADDRESS],
+          [auto-delete=AUTO-DELETE],[interface-name=INTERFACE-NAME]]
+        [--stateful-internal-ip=[address=ADDRESS],
+          [auto-delete=AUTO-DELETE],[interface-name=INTERFACE-NAME]]
         [--stateful-metadata=KEY=VALUE,[KEY=VALUE,...]] [--no-update-instance]
         [--region=REGION | --zone=ZONE] [GCLOUD_WIDE_FLAG ...]
 
@@ -36,6 +40,20 @@ EXAMPLES
     does not exist in the group's instance template, then the command adds
     my-disk to my-instance.
 
+    To create a per-instance config with a stateful internal IP 192.168.0.10
+    and a stateful external IP reserved in address my-address, on instance
+    my-instance, run:
+
+        $ gcloud compute instance-groups managed instance-configs create \
+            my-group --region=europe-west4 --instance=my-instance \
+            --stateful-internal-ip=address=192.168.0.10,\
+        interface-name=nic0 \
+            --stateful-external-ip=address=/projects/example-project/\
+        regions/europe-west4/addresses/my-address,interface-name=nic0
+
+    If the provided IP address is not yet reserved, the MIG automatically
+    creates a corresponding IP address reservation.
+
 POSITIONAL ARGUMENTS
      NAME
         Name of the managed instance group to create a per-instance config for.
@@ -99,6 +117,90 @@ OPTIONAL FLAGS
               the group; for example, when the instance is deleted manually or
               when the group size is decreased.
 
+     --stateful-external-ip=[address=ADDRESS],[auto-delete=AUTO-DELETE],[interface-name=INTERFACE-NAME]
+        Managed instance groups preserve stateful IPs on VM autohealing,
+        update, and recreate events.
+
+        You can preserve the IP address that's specified in a network interface
+        for a specific managed instance, even if that network interface is not
+        defined in the group's instance template.
+
+        Use this argument multiple times to attach and preserve multiple IPs.
+
+         interface-name
+            (Optional) Network interface name. If omitted, the default network
+            interface named nic0 is assumed.
+
+                *address*::: Static IP address to assign to the instance in one of
+                the following formats:
+
+            + Address: URL of a static IP address reservation. For example:
+            projects/example-project/regions/us-east1/addresses/example-ip-name.
+
+            + Literal: For example: 130.211.181.55.
+
+            If the provided IP address is not yet reserved, the managed
+            instance group automatically creates the corresponding IP address
+            reservation. If the provided IP address is reserved, the group
+            assigns the reservation to the instance.
+
+         auto-delete
+            (Optional) Prescribes what should happen to an associated static
+            Address resource when a VM instance is permanently deleted.
+            Regardless of the value of the delete rule, stateful IP addresses
+            are always preserved on instance autohealing, update, and
+            recreation operations. The following options are available:
+            ▸ never: (Default) Never delete the static IP address. Instead,
+              unassign the address when its instance is permanently deleted and
+              keep the address reserved.
+            ▸ on-permanent-instance-deletion: Delete the static IP address
+              reservation when the instance that it's assigned to is
+              permanently deleted from the instance group; for example, when
+              the instance is deleted manually or when the group size is
+              decreased.
+
+     --stateful-internal-ip=[address=ADDRESS],[auto-delete=AUTO-DELETE],[interface-name=INTERFACE-NAME]
+        Managed instance groups preserve stateful IPs on VM autohealing,
+        update, and recreate events.
+
+        You can preserve the IP address that's specified in a network interface
+        for a specific managed instance, even if that network interface is not
+        defined in the group's instance template.
+
+        Use this argument multiple times to attach and preserve multiple IPs.
+
+         interface-name
+            (Optional) Network interface name. If omitted, the default network
+            interface named nic0 is assumed.
+
+                *address*::: Static IP address to assign to the instance in one of
+                the following formats:
+
+            + Address: URL of a static IP address reservation. For example:
+            projects/example-project/regions/us-east1/addresses/example-ip-name.
+
+            + Literal: For example: 130.211.181.55.
+
+            If the provided IP address is not yet reserved, the managed
+            instance group automatically creates the corresponding IP address
+            reservation. If the provided IP address is reserved, the group
+            assigns the reservation to the instance.
+
+         auto-delete
+            (Optional) Prescribes what should happen to an associated static
+            Address resource when a VM instance is permanently deleted.
+            Regardless of the value of the delete rule, stateful IP addresses
+            are always preserved on instance autohealing, update, and
+            recreation operations. The following options are available:
+            ▸ never: (Default) Never delete the static IP address. Instead,
+              unassign the address when its instance is permanently deleted and
+              keep the address reserved.
+            ▸ on-permanent-instance-deletion: Delete the static IP address
+              reservation when the instance that it's assigned to is
+              permanently deleted from the instance group; for example, when
+              the instance is deleted manually or when the group size is
+              decreased.
+
      --stateful-metadata=KEY=VALUE,[KEY=VALUE,...]
         Additional metadata to be made available to the guest operating system
         in addition to the metadata defined in the instance template.
diff --git a/gcloud/compute/instance-groups/managed/instance-configs/update b/gcloud/compute/instance-groups/managed/instance-configs/update
index 40aa600d0..cdf56733a 100644
--- a/gcloud/compute/instance-groups/managed/instance-configs/update
+++ b/gcloud/compute/instance-groups/managed/instance-configs/update
@@ -8,9 +8,15 @@ SYNOPSIS
         [--instance-update-minimal-action=INSTANCE_UPDATE_MINIMAL_ACTION;
           default="none"]
         [--remove-stateful-disks=DEVICE_NAME,[DEVICE_NAME,...]]
+        [--remove-stateful-external-ips=KEY,[KEY,...]]
+        [--remove-stateful-internal-ips=KEY,[KEY,...]]
         [--remove-stateful-metadata=KEY,[KEY,...]]
         [--stateful-disk=[auto-delete=AUTO-DELETE],
           [device-name=DEVICE-NAME],[mode=MODE],[source=SOURCE]]
+        [--stateful-external-ip=[address=ADDRESS],
+          [auto-delete=AUTO-DELETE],[interface-name=INTERFACE-NAME]]
+        [--stateful-internal-ip=[address=ADDRESS],
+          [auto-delete=AUTO-DELETE],[interface-name=INTERFACE-NAME]]
         [--stateful-metadata=KEY=VALUE,[KEY=VALUE,...]] [--no-update-instance]
         [--region=REGION | --zone=ZONE] [GCLOUD_WIDE_FLAG ...]
 
@@ -43,6 +49,20 @@ EXAMPLES
     for my-disk-1 and my-disk-2; if these disk are not defined in the group's
     instance template, then they are detached.
 
+    To update a per-instance configuration with a stateful internal IP
+    192.168.0.10, on instance my-instance, run:
+
+        $ gcloud compute instance-groups managed instance-configs update \
+            my-group --region=europe-west4 --instance=my-instance \
+            --stateful-internal-ip=address=192.168.0.10,interface-name=nic0
+
+    To update a per-instance configuration to remove a stateful external IP
+    that's defined in network interface nic0, on instance my-instance, run:
+
+        $ gcloud compute instance-groups managed instance-configs update \
+            my-group --region=europe-west4 --instance=my-instance \
+            --remove-stateful-internal-ips=nic0
+
 POSITIONAL ARGUMENTS
      NAME
         Name of the managed instance group to update per-instance config for.
@@ -74,6 +94,14 @@ OPTIONAL FLAGS
         Remove stateful configuration for the specified disks from the
         instance's configuration.
 
+     --remove-stateful-external-ips=KEY,[KEY,...]
+        List of all stateful IP network interface names to remove from the
+        instance's per-instance configuration.
+
+     --remove-stateful-internal-ips=KEY,[KEY,...]
+        List of all stateful IP network interface names to remove from the
+        instance's per-instance configuration.
+
      --remove-stateful-metadata=KEY,[KEY,...]
         Remove stateful configuration for the specified metadata keys from the
         instance's configuration.
@@ -119,6 +147,114 @@ OPTIONAL FLAGS
               the group; for example, when the instance is deleted manually or
               when the group size is decreased.
 
+     --stateful-external-ip=[address=ADDRESS],[auto-delete=AUTO-DELETE],[interface-name=INTERFACE-NAME]
+        Managed instance groups preserve stateful IPs on VM autohealing,
+        update, and recreate events.
+
+        You can preserve the IP address that's specified in a network interface
+        for a specific managed instance, even if that network interface is not
+        defined in the group's instance template.
+
+        Use this argument multiple times to update multiple IPs.
+
+        If a stateful IP with the given network interface name exists in the
+        current per-instance configuration, its properties are replaced by the
+        newly provided ones. Otherwise, a new stateful IP definition is added
+        to the per-instance configuration.
+
+         interface-name
+            (Optional) Network interface name. If omitted, the default network
+            interface named nic0 is assumed.
+
+         address
+            (Optional) Static IP address to assign to the instance in one of
+            the following formats:
+
+            + Address: URL of a static IP address reservation. For example:
+            projects/example-project/regions/us-east1/addresses/example-ip-name.
+
+            + Literal: For example: 130.211.181.55.
+
+            If the provided IP address is not yet reserved, the managed
+            instance group automatically creates the corresponding IP address
+            reservation. If the provided IP address is reserved, the group
+            assigns the reservation to the instance.
+
+            The address flag is optional if an address is already defined in
+            the instance's per-instance configuration. Otherwise it is
+            required.
+
+            If omitted, the currently configured address remains unchanged.
+
+         auto-delete
+            (Optional) Prescribes what should happen to an associated static
+            Address resource when a VM instance is permanently deleted.
+            Regardless of the value of the delete rule, stateful IP addresses
+            are always preserved on instance autohealing, update, and
+            recreation operations. The following options are available:
+            ▸ never: (Default) Never delete the static IP address. Instead,
+              unassign the address when its instance is permanently deleted and
+              keep the address reserved.
+            ▸ on-permanent-instance-deletion: Delete the static IP address
+              reservation when the instance that it's assigned to is
+              permanently deleted from the instance group; for example, when
+              the instance is deleted manually or when the group size is
+              decreased.
+
+     --stateful-internal-ip=[address=ADDRESS],[auto-delete=AUTO-DELETE],[interface-name=INTERFACE-NAME]
+        Managed instance groups preserve stateful IPs on VM autohealing,
+        update, and recreate events.
+
+        You can preserve the IP address that's specified in a network interface
+        for a specific managed instance, even if that network interface is not
+        defined in the group's instance template.
+
+        Use this argument multiple times to update multiple IPs.
+
+        If a stateful IP with the given network interface name exists in the
+        current per-instance configuration, its properties are replaced by the
+        newly provided ones. Otherwise, a new stateful IP definition is added
+        to the per-instance configuration.
+
+         interface-name
+            (Optional) Network interface name. If omitted, the default network
+            interface named nic0 is assumed.
+
+         address
+            (Optional) Static IP address to assign to the instance in one of
+            the following formats:
+
+            + Address: URL of a static IP address reservation. For example:
+            projects/example-project/regions/us-east1/addresses/example-ip-name.
+
+            + Literal: For example: 130.211.181.55.
+
+            If the provided IP address is not yet reserved, the managed
+            instance group automatically creates the corresponding IP address
+            reservation. If the provided IP address is reserved, the group
+            assigns the reservation to the instance.
+
+            The address flag is optional if an address is already defined in
+            the instance's per-instance configuration. Otherwise it is
+            required.
+
+            If omitted, the currently configured address remains unchanged.
+
+         auto-delete
+            (Optional) Prescribes what should happen to an associated static
+            Address resource when a VM instance is permanently deleted.
+            Regardless of the value of the delete rule, stateful IP addresses
+            are always preserved on instance autohealing, update, and
+            recreation operations. The following options are available:
+            ▸ never: (Default) Never delete the static IP address. Instead,
+              unassign the address when its instance is permanently deleted and
+              keep the address reserved.
+            ▸ on-permanent-instance-deletion: Delete the static IP address
+              reservation when the instance that it's assigned to is
+              permanently deleted from the instance group; for example, when
+              the instance is deleted manually or when the group size is
+              decreased.
+
      --stateful-metadata=KEY=VALUE,[KEY=VALUE,...]
         Additional metadata to be made available to the guest operating system
         in addition to the metadata defined in the instance template.
diff --git a/gcloud/compute/instance-groups/managed/update b/gcloud/compute/instance-groups/managed/update
index 6ff4d0324..9984aa7ed 100644
--- a/gcloud/compute/instance-groups/managed/update
+++ b/gcloud/compute/instance-groups/managed/update
@@ -8,7 +8,13 @@ SYNOPSIS
         [--instance-redistribution-type=TYPE]
         [--list-managed-instances-results=MODE]
         [--remove-stateful-disks=DEVICE_NAME,[DEVICE_NAME,...]]
+        [--remove-stateful-external-ips=INTERFACE_NAME,[...]]
+        [--remove-stateful-internal-ips=INTERFACE_NAME,[...]]
         [--stateful-disk=[auto-delete=AUTO-DELETE],[device-name=DEVICE-NAME]]
+        [--stateful-external-ip=[enabled],
+          [auto-delete=AUTO-DELETE],[interface-name=INTERFACE-NAME]]
+        [--stateful-internal-ip=[enabled],
+          [auto-delete=AUTO-DELETE],[interface-name=INTERFACE-NAME]]
         [--target-distribution-shape=SHAPE]
         [--clear-autohealing
           | --initial-delay=INITIAL_DELAY --health-check=HEALTH_CHECK
@@ -103,6 +109,14 @@ FLAGS
      --remove-stateful-disks=DEVICE_NAME,[DEVICE_NAME,...]
         Remove stateful configuration for the specified disks.
 
+     --remove-stateful-external-ips=INTERFACE_NAME,[...]
+        Remove stateful configuration for the specified interfaces for external
+        IPs.
+
+     --remove-stateful-internal-ips=INTERFACE_NAME,[...]
+        Remove stateful configuration for the specified interfaces for internal
+        IPs.
+
      --stateful-disk=[auto-delete=AUTO-DELETE],[device-name=DEVICE-NAME]
         Disks considered stateful by the instance group. Managed instance
         groups preserve and reattach stateful disks on VM autohealing, update,
@@ -128,6 +142,84 @@ FLAGS
               the group; for example, when the instance is deleted manually or
               when the group size is decreased.
 
+     --stateful-external-ip=[enabled],[auto-delete=AUTO-DELETE],[interface-name=INTERFACE-NAME]
+        Managed instance groups preserve stateful IPs on VM autohealing,
+        update, and recreate events.
+
+        Use this argument multiple times to update more IPs.
+
+        If a stateful external IP with the given interface name already exists
+        in the current instance configuration, its properties are replaced by
+        the newly provided ones. Otherwise, a new stateful external IP
+        definition is added to the instance configuration.
+
+        At least one of the following is required:
+
+         enabled
+            Marks the IP address as stateful. The network interface named nic0
+            is assumed by default when interface-name is not specified. This
+            flag can be omitted when interface-name is provided explicitly.
+
+         interface-name
+            Marks the IP address from this network interface as stateful. This
+            flag can be omitted when enabled is provided.
+
+            Additional arguments:
+
+         auto-delete
+            (Optional) Prescribes what should happen to an associated static
+            Address resource when a VM instance is permanently deleted.
+            Regardless of the value of the delete rule, stateful IP addresses
+            are always preserved on instance autohealing, update, and
+            recreation operations. The following options are available:
+            ▸ never: (Default) Never delete the static IP address. Instead,
+              unassign the address when its instance is permanently deleted and
+              keep the address reserved.
+            ▸ on-permanent-instance-deletion: Delete the static IP address
+              reservation when the instance that it's assigned to is
+              permanently deleted from the instance group; for example, when
+              the instance is deleted manually or when the group size is
+              decreased.
+
+     --stateful-internal-ip=[enabled],[auto-delete=AUTO-DELETE],[interface-name=INTERFACE-NAME]
+        Managed instance groups preserve stateful IPs on VM autohealing,
+        update, and recreate events.
+
+        Use this argument multiple times to update more IPs.
+
+        If a stateful internal IP with the given interface name already exists
+        in the current instance configuration, its properties are replaced by
+        the newly provided ones. Otherwise, a new stateful internal IP
+        definition is added to the instance configuration.
+
+        At least one of the following is required:
+
+         enabled
+            Marks the IP address as stateful. The network interface named nic0
+            is assumed by default when interface-name is not specified. This
+            flag can be omitted when interface-name is provided explicitly.
+
+         interface-name
+            Marks the IP address from this network interface as stateful. This
+            flag can be omitted when enabled is provided.
+
+            Additional arguments:
+
+         auto-delete
+            (Optional) Prescribes what should happen to an associated static
+            Address resource when a VM instance is permanently deleted.
+            Regardless of the value of the delete rule, stateful IP addresses
+            are always preserved on instance autohealing, update, and
+            recreation operations. The following options are available:
+            ▸ never: (Default) Never delete the static IP address. Instead,
+              unassign the address when its instance is permanently deleted and
+              keep the address reserved.
+            ▸ on-permanent-instance-deletion: Delete the static IP address
+              reservation when the instance that it's assigned to is
+              permanently deleted from the instance group; for example, when
+              the instance is deleted manually or when the group size is
+              decreased.
+
      --target-distribution-shape=SHAPE
         Specifies how a regional managed instance group distributes its
         instances across zones within the region. The default shape is even.
diff --git a/gcloud/compute/interconnects/create b/gcloud/compute/interconnects/create
index d6d40e83c..8d1dc9ef1 100644
--- a/gcloud/compute/interconnects/create
+++ b/gcloud/compute/interconnects/create
@@ -7,7 +7,8 @@ SYNOPSIS
         --location=LOCATION --requested-link-count=REQUESTED_LINK_COUNT
         [--admin-enabled] [--customer-name=CUSTOMER_NAME]
         [--description=DESCRIPTION] [--noc-contact-email=NOC_CONTACT_EMAIL]
-        [--remote-location=REMOTE_LOCATION] [GCLOUD_WIDE_FLAG ...]
+        [--remote-location=REMOTE_LOCATION]
+        [--requested-features=[FEATURES,...]] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     gcloud compute interconnects create is used to create interconnects. An
@@ -92,6 +93,17 @@ OPTIONAL FLAGS
         remote-locations list command to find the appropriate remote location
         to use when creating a Cross-Cloud Interconnect.
 
+     --requested-features=[FEATURES,...]
+        List of features requested for this interconnect. FEATURES must be
+        (only one value is supported):
+
+         MACSEC
+            If specified then the interconnect is created on MACsec capable
+            hardware ports. If not specified, the interconnect is created on
+            non-MACsec capable ports first, if available. This parameter can
+            only be provided during interconnect INSERT and cannot be changed
+            using interconnect PATCH.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/compute/interconnects/help b/gcloud/compute/interconnects/help
index 5b542e002..0f026d2d3 100644
--- a/gcloud/compute/interconnects/help
+++ b/gcloud/compute/interconnects/help
@@ -29,6 +29,9 @@ GROUPS
      locations
         Read and manipulate Compute Engine interconnect locations.
 
+     macsec
+        Read and manipulate Compute Engine interconnect MACsec configuration.
+
      remote-locations
         Read and manipulate Google Compute Engine interconnect remote
         locations.
diff --git a/gcloud/compute/interconnects/macsec/add-key b/gcloud/compute/interconnects/macsec/add-key
new file mode 100644
index 000000000..f746146b0
--- /dev/null
+++ b/gcloud/compute/interconnects/macsec/add-key
@@ -0,0 +1,53 @@
+NAME
+    gcloud compute interconnects macsec add-key - add pre-shared key to a
+        Compute Engine interconnect MACsec configuration
+
+SYNOPSIS
+    gcloud compute interconnects macsec add-key NAME --key-name=KEY_NAME
+        [--start-time=START_TIME] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud compute interconnects macsec add-key is used to add a pre-shared key
+    to MACsec configuration of interconnect.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To add a pre-shared key to MACsec configuration, run:
+
+        $ gcloud compute interconnects macsec add-key example-interconnect \
+            --key-name=default-key --start-time=2021-02-01T12:12:12Z
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect to update.
+
+REQUIRED FLAGS
+     --key-name=KEY_NAME
+        A name of pre-shared key being added to MACsec configuration of the
+        interconnect. The name must be 1-63 characters long, and comply with
+        RFC1035.
+
+OPTIONAL FLAGS
+     --start-time=START_TIME
+        A RFC3339 timestamp on or after which the key is valid. startTime can
+        be in the future. If the keychain has a single key, --start-time can be
+        omitted. If the keychain has multiple keys, --start-time is mandatory
+        for each key. The start times of two consecutive keys must be at least
+        6 hours apart.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute interconnects macsec add-key
+
+        $ gcloud beta compute interconnects macsec add-key
+
diff --git a/gcloud/compute/interconnects/macsec/get-config b/gcloud/compute/interconnects/macsec/get-config
new file mode 100644
index 000000000..45643625d
--- /dev/null
+++ b/gcloud/compute/interconnects/macsec/get-config
@@ -0,0 +1,39 @@
+NAME
+    gcloud compute interconnects macsec get-config - get MACsec configuration
+        of a Compute Engine interconnect
+
+SYNOPSIS
+    gcloud compute interconnects macsec get-config NAME [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud compute interconnects macsec get-config displays all MACsec
+    configuration data associated with Compute Engine interconnect in a
+    project.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To displays all MACsec configuration data associated with Compute Engine
+    interconnect in a project, run:
+
+        $ gcloud compute interconnects macsec get-config example-interconnect
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect to describe.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute interconnects macsec get-config
+
+        $ gcloud beta compute interconnects macsec get-config
+
diff --git a/gcloud/compute/interconnects/macsec/help b/gcloud/compute/interconnects/macsec/help
new file mode 100644
index 000000000..d90bb6a88
--- /dev/null
+++ b/gcloud/compute/interconnects/macsec/help
@@ -0,0 +1,43 @@
+NAME
+    gcloud compute interconnects macsec - read and manipulate Compute Engine
+        interconnect MACsec configuration
+
+SYNOPSIS
+    gcloud compute interconnects macsec COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    Read and manipulate Compute Engine interconnect MACsec configuration.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     add-key
+        Add pre-shared key to a Compute Engine interconnect MACsec
+        configuration.
+
+     get-config
+        Get MACsec configuration of a Compute Engine interconnect.
+
+     remove-key
+        Remove pre-shared key from a Compute Engine interconnect MACsec
+        configuration.
+
+     update
+        Update a Compute Engine interconnect MACsec configuration.
+
+     update-key
+        Update pre-shared key in a Compute Engine interconnect MACsec
+        configuration.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute interconnects macsec
+
+        $ gcloud beta compute interconnects macsec
+
diff --git a/gcloud/compute/interconnects/macsec/remove-key b/gcloud/compute/interconnects/macsec/remove-key
new file mode 100644
index 000000000..e7a640967
--- /dev/null
+++ b/gcloud/compute/interconnects/macsec/remove-key
@@ -0,0 +1,44 @@
+NAME
+    gcloud compute interconnects macsec remove-key - remove pre-shared key from
+        a Compute Engine interconnect MACsec configuration
+
+SYNOPSIS
+    gcloud compute interconnects macsec remove-key NAME --key-name=KEY_NAME
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud compute interconnects macsec remove-key is used to remove pre-shared
+    key from MACsec configuration of interconnect.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To remove a pre-shared key from MACsec configuration, run:
+
+        $ gcloud compute interconnects macsec remove-key \
+            example-interconnect --key-name=default-key
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect to update.
+
+REQUIRED FLAGS
+     --key-name=KEY_NAME
+        The name of pre-shared key being removed from MACsec configuration of
+        the interconnect.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute interconnects macsec remove-key
+
+        $ gcloud beta compute interconnects macsec remove-key
+
diff --git a/gcloud/compute/interconnects/macsec/update b/gcloud/compute/interconnects/macsec/update
new file mode 100644
index 000000000..28909d992
--- /dev/null
+++ b/gcloud/compute/interconnects/macsec/update
@@ -0,0 +1,54 @@
+NAME
+    gcloud compute interconnects macsec update - update a Compute Engine
+        interconnect MACsec configuration
+
+SYNOPSIS
+    gcloud compute interconnects macsec update NAME [--enabled] [--fail-open]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud compute interconnects macsec update is used to update MACsec
+    configuration of interconnect. An interconnect represents a single specific
+    connection between Google and the customer.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To enable MACsec on an interconnect, run:
+
+        $ gcloud compute interconnects macsec update example-interconnect \
+            --enabled
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect to update.
+
+FLAGS
+     --enabled
+        Enable or disable MACsec on this Interconnect. MACsec enablement will
+        fail if the MACsec configuration is not specified. Use --no-enabled to
+        disable it.
+
+     --fail-open
+        If enabled, the Interconnect will be configured with a should-secure
+        MACsec security policy, that allows the Google router to fallback to
+        cleartext traffic if the MKA session cannot be established. By default,
+        the Interconnect will be configured with a must-secure security policy
+        that drops all traffic if the MKA session cannot be established with
+        your router. Use --no-fail-open to disable it.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute interconnects macsec update
+
+        $ gcloud beta compute interconnects macsec update
+
diff --git a/gcloud/compute/interconnects/macsec/update-key b/gcloud/compute/interconnects/macsec/update-key
new file mode 100644
index 000000000..6b72af3e3
--- /dev/null
+++ b/gcloud/compute/interconnects/macsec/update-key
@@ -0,0 +1,54 @@
+NAME
+    gcloud compute interconnects macsec update-key - update pre-shared key in a
+        Compute Engine interconnect MACsec configuration
+
+SYNOPSIS
+    gcloud compute interconnects macsec update-key NAME --key-name=KEY_NAME
+        [--start-time=START_TIME] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    gcloud compute interconnects macsec update-key is used to update a
+    pre-shared key in MACsec configuration of interconnect.
+
+    For an example, refer to the EXAMPLES section below.
+
+EXAMPLES
+    To update a pre-shared key in MACsec configuration, run:
+
+        $ gcloud compute interconnects macsec update-key \
+            example-interconnect --key-name=default-key \
+            --start-time=2021-02-01T12:12:12Z
+
+POSITIONAL ARGUMENTS
+     NAME
+        Name of the interconnect to update.
+
+REQUIRED FLAGS
+     --key-name=KEY_NAME
+        A name of pre-shared key being added to MACsec configuration of the
+        interconnect. The name must be 1-63 characters long, and comply with
+        RFC1035.
+
+OPTIONAL FLAGS
+     --start-time=START_TIME
+        A RFC3339 timestamp on or after which the key is valid. startTime can
+        be in the future. If the keychain has a single key, --start-time can be
+        omitted. If the keychain has multiple keys, --start-time is mandatory
+        for each key. The start times of two consecutive keys must be at least
+        6 hours apart.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    These variants are also available:
+
+        $ gcloud alpha compute interconnects macsec update-key
+
+        $ gcloud beta compute interconnects macsec update-key
+
diff --git a/gcloud/container/clusters/create b/gcloud/container/clusters/create
index ba8eedae3..8c6a30cb0 100644
--- a/gcloud/container/clusters/create
+++ b/gcloud/container/clusters/create
@@ -1376,7 +1376,7 @@ FLAGS
                 argument should be used in conjunction with
                 --enable-autoprovisioning-blue-green-upgrade to take effect.
 
-                Batch sizes are specfied by one of, batch-node-count or
+                Batch sizes are specified by one of, batch-node-count or
                 batch-percent. The duration between batches is specified by
                 batch-soak-duration.
 
@@ -1612,8 +1612,11 @@ FLAGS
                   --ephemeral-storage-local-ssd count=2
 
           'count' specifies the number of local SSDs to use to back ephemeral
-          storage. Local SDDs use NVMe interfaces and each is 375 GB in size.
-          Setting 'count=0' disables using local SSDs as ephemeral storage.
+          storage. Local SDDs use NVMe interfaces. For first- and
+          second-generation machine types, a nonzero count field is required
+          for local ssd to be configured. For third-generation machine types,
+          the count field is optional because the count is inferred from the
+          machine type.
 
           See https://cloud.google.com/compute/docs/disks/local-ssd for more
           information.
@@ -1632,11 +1635,13 @@ FLAGS
           New nodes, including ones created by resize or recreate, will have
           these local SSDs.
 
-          Local SSDs have a fixed 375 GB capacity per device. The number of
-          disks that can be attached to an instance is limited by the maximum
-          number of disks available on a machine, which differs by compute
-          zone. See https://cloud.google.com/compute/docs/disks/local-ssd for
-          more information.
+          For first- and second-generation machine types, a nonzero count field
+          is required for local ssd to be configured. For third-generation
+          machine types, the count field is optional because the count is
+          inferred from the machine type.
+
+          See https://cloud.google.com/compute/docs/disks/local-ssd for more
+          information.
 
        --local-ssd-count=LOCAL_SSD_COUNT
           The number of local SSD disks to provision on each node, formatted
diff --git a/gcloud/container/clusters/create-auto b/gcloud/container/clusters/create-auto
index f1b485f30..046ae229e 100644
--- a/gcloud/container/clusters/create-auto
+++ b/gcloud/container/clusters/create-auto
@@ -235,10 +235,9 @@ FLAGS
 
         Examples:
 
-            $ gcloud container clusters create-auto --logging=SYSTEM
+            $ gcloud container clusters create-auto --logging=SYSTEM,WORKLOAD
             $ gcloud container clusters create-auto \
                 --logging=SYSTEM,API_SERVER,WORKLOAD
-            $ gcloud container clusters create-auto --logging=NONE
 
      --monitoring=[COMPONENT,...]
         Set the components that have monitoring enabled. Valid component values
@@ -253,7 +252,7 @@ FLAGS
 
             $ gcloud container clusters create-auto \
                 --monitoring=SYSTEM,API_SERVER,POD
-            $ gcloud container clusters create-auto --monitoring=NONE
+            $ gcloud container clusters create-auto --monitoring=SYSTEM
 
      --network=NETWORK
         The Compute Engine Network that the cluster will connect to. Google
diff --git a/gcloud/container/clusters/update b/gcloud/container/clusters/update
index 5cd910d1f..2efd05fbd 100644
--- a/gcloud/container/clusters/update
+++ b/gcloud/container/clusters/update
@@ -995,7 +995,7 @@ REQUIRED FLAGS
                   argument should be used in conjunction with
                   --enable-autoprovisioning-blue-green-upgrade to take effect.
 
-                  Batch sizes are specfied by one of, batch-node-count or
+                  Batch sizes are specified by one of, batch-node-count or
                   batch-percent. The duration between batches is specified by
                   batch-soak-duration.
 
diff --git a/gcloud/container/node-pools/create b/gcloud/container/node-pools/create
index 94c168029..007f28f59 100644
--- a/gcloud/container/node-pools/create
+++ b/gcloud/container/node-pools/create
@@ -806,8 +806,11 @@ FLAGS
                   cluster --ephemeral-storage-local-ssd count=2
 
           'count' specifies the number of local SSDs to use to back ephemeral
-          storage. Local SDDs use NVMe interfaces and each is 375 GB in size.
-          Setting 'count=0' disables using local SSDs as ephemeral storage.
+          storage. Local SDDs use NVMe interfaces. For first- and
+          second-generation machine types, a nonzero count field is required
+          for local ssd to be configured. For third-generation machine types,
+          the count field is optional because the count is inferred from the
+          machine type.
 
           See https://cloud.google.com/compute/docs/disks/local-ssd for more
           information.
@@ -826,11 +829,13 @@ FLAGS
           New nodes, including ones created by resize or recreate, will have
           these local SSDs.
 
-          Local SSDs have a fixed 375 GB capacity per device. The number of
-          disks that can be attached to an instance is limited by the maximum
-          number of disks available on a machine, which differs by compute
-          zone. See https://cloud.google.com/compute/docs/disks/local-ssd for
-          more information.
+          For first- and second-generation machine types, a nonzero count field
+          is required for local ssd to be configured. For third-generation
+          machine types, the count field is optional because the count is
+          inferred from the machine type.
+
+          See https://cloud.google.com/compute/docs/disks/local-ssd for more
+          information.
 
        --local-ssd-count=LOCAL_SSD_COUNT
           The number of local SSD disks to provision on each node, formatted
diff --git a/gcloud/data-catalog/entries/create b/gcloud/data-catalog/entries/create
index 52f3d5d02..e8884c2d6 100644
--- a/gcloud/data-catalog/entries/create
+++ b/gcloud/data-catalog/entries/create
@@ -11,6 +11,7 @@ SYNOPSIS
           --source-system-create-time=SOURCE_SYSTEM_CREATE_TIME
           --source-system-update-time=SOURCE_SYSTEM_UPDATE_TIME]))
         [--description=DESCRIPTION] [--display-name=DISPLAY_NAME]
+        [--fully-qualified-name=FULLY_QUALIFIED_NAME]
         [--schema=[COLUMN_NAME=COLUMN_TYPE,...]
           | --schema-from-file=SCHEMA_FROM_FILE] [GCLOUD_WIDE_FLAG ...]
 
@@ -158,6 +159,9 @@ OPTIONAL FLAGS
      --display-name=DISPLAY_NAME
         Human-readable name for the entry.
 
+     --fully-qualified-name=FULLY_QUALIFIED_NAME
+        Fully qualified name of the resource.
+
      Column schema for the entry. A schema consists of a list of column names
      along with their types, descriptions, modes, and nested subcolumns. For
      example:
diff --git a/gcloud/database-migration/connection-profiles/create/mysql b/gcloud/database-migration/connection-profiles/create/mysql
index 6340ecd0f..84750a848 100644
--- a/gcloud/database-migration/connection-profiles/create/mysql
+++ b/gcloud/database-migration/connection-profiles/create/mysql
@@ -9,8 +9,8 @@ SYNOPSIS
         [--labels=[KEY=VALUE,...]] [--provider=PROVIDER]
         [--ca-certificate=CA_CERTIFICATE
           : --client-certificate=CLIENT_CERTIFICATE --private-key=PRIVATE_KEY]
-        [--host=HOST --port=PORT --username=USERNAME (--password=PASSWORD
-          | --prompt-for-password)] [GCLOUD_WIDE_FLAG ...]
+        [--host=HOST --port=PORT --username=USERNAME : --password=PASSWORD
+          | --prompt-for-password] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     Create a Database Migration Service connection profile for MySQL.
@@ -116,7 +116,7 @@ FLAGS
         database. Database Migration Service encrypts the value when storing
         it.
 
-     Exactly one of these must be specified:
+     At most one of these can be specified:
 
        --password=PASSWORD
           Password for the user that Database Migration Service uses to connect
diff --git a/gcloud/edge-cloud/container/clusters/node-pools/create b/gcloud/edge-cloud/container/clusters/node-pools/create
index d27d49e10..f6fa371d1 100644
--- a/gcloud/edge-cloud/container/clusters/node-pools/create
+++ b/gcloud/edge-cloud/container/clusters/node-pools/create
@@ -7,20 +7,21 @@ SYNOPSIS
         (NODE_POOL : --cluster=CLUSTER --location=LOCATION)
         --node-count=NODE_COUNT --node-location=NODE_LOCATION [--async]
         [--labels=[KEY=VALUE,...]] [--local-disk-kms-key=LOCAL_DISK_KMS_KEY]
-        [--machine-filter=MACHINE_FILTER] [GCLOUD_WIDE_FLAG ...]
+        [--lro-timeout=LRO_TIMEOUT] [--machine-filter=MACHINE_FILTER]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    Create a new Edge Container nodePool.
+    Create an Edge Container node pool.
 
 EXAMPLES
-    To create a node pool called 'my-nodePool', containing 3 nodes in region
+    To create a node pool called my-nodePool, containing 3 nodes in region
     us-central1, run:
 
         $ gcloud edge-cloud container clusters node-pools create \
             my-nodePool --cluster=<my-cluster> --location=us-central1 \
             --node-location=<my-node-location> --node-count=3
 
-    To create a node pool called 'my-nodePool', containing 3 nodes in region
+    To create a node pool called my-nodePool, containing 3 nodes in region
     us-central1, using only machine names matching a specific pattern, run:
 
         $ gcloud edge-cloud container clusters node-pools create \
@@ -28,7 +29,7 @@ EXAMPLES
             --node-location=<my-node-location> --node-count=3 \
             --machine-filter="name:<name>"
 
-    To create a node pool called 'my-nodePool', containing 3 nodes in region
+    To create a node pool called my-nodePool, containing 3 nodes in region
     us-central1, using only machine names NOT matching a specific pattern, run:
 
         $ gcloud edge-cloud container clusters node-pools create \
@@ -45,22 +46,22 @@ POSITIONAL ARGUMENTS
      To set the project attribute:
       ◆ provide the argument node_pool on the command line with a fully
         specified name;
-      ◆ set the property core/project;
-      ◆ provide the argument --project on the command line.
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
 
      This must be specified.
 
        NODE_POOL
           ID of the node pool or fully qualified identifier for the node pool.
 
-          To set the node_pool attribute:
+          To set the nodePool attribute:
           ▸ provide the argument node_pool on the command line.
 
           This positional argument must be specified if any of the other
           arguments in this group are specified.
 
        --cluster=CLUSTER
-          Kubernetes cluster.
+          Cluster of the node pool.
 
           To set the cluster attribute:
           ▸ provide the argument node_pool on the command line with a fully
@@ -68,13 +69,12 @@ POSITIONAL ARGUMENTS
           ▸ provide the argument --cluster on the command line.
 
        --location=LOCATION
-          The global location name.
+          Google Cloud location for the node pool.
 
           To set the location attribute:
           ▸ provide the argument node_pool on the command line with a fully
             specified name;
-          ▸ provide the argument --location on the command line;
-          ▸ set the property edge_container/location.
+          ▸ provide the argument --location on the command line.
 
 REQUIRED FLAGS
      --node-count=NODE_COUNT
@@ -103,6 +103,9 @@ OPTIONAL FLAGS
 
         If not provided, a Google-managed key will be used instead.
 
+     --lro-timeout=LRO_TIMEOUT
+        Overwrite the default LRO maximum timeout.
+
      --machine-filter=MACHINE_FILTER
         Only machines matching this filter will be allowed to join the node
         pool. The filtering language accepts strings like "name=<name>", and is
diff --git a/gcloud/edge-cloud/container/clusters/node-pools/update b/gcloud/edge-cloud/container/clusters/node-pools/update
index c3f6a03a9..fc9374587 100644
--- a/gcloud/edge-cloud/container/clusters/node-pools/update
+++ b/gcloud/edge-cloud/container/clusters/node-pools/update
@@ -5,16 +5,16 @@ NAME
 SYNOPSIS
     gcloud edge-cloud container clusters node-pools update
         (NODE_POOL : --cluster=CLUSTER --location=LOCATION) [--async]
-        [--machine-filter=MACHINE_FILTER] [--node-count=NODE_COUNT]
-        [--update-labels=[KEY=VALUE,...]]
+        [--lro-timeout=LRO_TIMEOUT] [--machine-filter=MACHINE_FILTER]
+        [--node-count=NODE_COUNT] [--update-labels=[KEY=VALUE,...]]
         [--clear-labels | --remove-labels=[KEY,...]] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     Updates an Edge Container node pool.
 
 EXAMPLES
-    To update the number of nodes in a node pool called 'my-node-pool' in
-    region us-central1, run:
+    To update the number of nodes in a node pool called my-node-pool in region
+    us-central1, run:
 
         $ gcloud edge-cloud container clusters node-pools update \
             my-node-pool --location=us-central1 --cluster=<my-cluster> \
@@ -29,22 +29,22 @@ POSITIONAL ARGUMENTS
      To set the project attribute:
       ◆ provide the argument node_pool on the command line with a fully
         specified name;
-      ◆ set the property core/project;
-      ◆ provide the argument --project on the command line.
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
 
      This must be specified.
 
        NODE_POOL
           ID of the node pool or fully qualified identifier for the node pool.
 
-          To set the node_pool attribute:
+          To set the nodePool attribute:
           ▸ provide the argument node_pool on the command line.
 
           This positional argument must be specified if any of the other
           arguments in this group are specified.
 
        --cluster=CLUSTER
-          Kubernetes cluster.
+          Cluster of the node pool.
 
           To set the cluster attribute:
           ▸ provide the argument node_pool on the command line with a fully
@@ -52,19 +52,21 @@ POSITIONAL ARGUMENTS
           ▸ provide the argument --cluster on the command line.
 
        --location=LOCATION
-          The global location name.
+          Google Cloud location for the node pool.
 
           To set the location attribute:
           ▸ provide the argument node_pool on the command line with a fully
             specified name;
-          ▸ provide the argument --location on the command line;
-          ▸ set the property edge_container/location.
+          ▸ provide the argument --location on the command line.
 
 FLAGS
      --async
         Return immediately, without waiting for the operation in progress to
         complete.
 
+     --lro-timeout=LRO_TIMEOUT
+        Overwrite the default LRO maximum timeout.
+
      --machine-filter=MACHINE_FILTER
         Only machines matching this filter will be allowed to join the node
         pool. The filtering language accepts strings like "name=<name>", and is
diff --git a/gcloud/firestore/databases/create b/gcloud/firestore/databases/create
index 0a3423396..12ff342c9 100644
--- a/gcloud/firestore/databases/create
+++ b/gcloud/firestore/databases/create
@@ -4,7 +4,7 @@ NAME
 
 SYNOPSIS
     gcloud firestore databases create --location=LOCATION
-        [--database=DATABASE; default="(default)"]
+        [--database=DATABASE; default="(default)"] [--enable-pitr]
         [--type=TYPE; default="firestore-native"] [GCLOUD_WIDE_FLAG ...]
 
 EXAMPLES
@@ -22,6 +22,11 @@ EXAMPLES
         $ gcloud firestore databases create --database=foo \
           --location=us-east1 --type=datastore-mode
 
+    To create a Firestore Native database in nam5 with Point In Time Recovery
+    (PITR) enabled.
+
+        $ gcloud firestore databases create --location=nam5 --enable-pitr
+
 REQUIRED FLAGS
      --location=LOCATION
         The location to operate on. Available locations are listed at
@@ -43,6 +48,13 @@ OPTIONAL FLAGS
 
             Using "(default)" database ID is also allowed.
 
+     --enable-pitr
+        Whether to enable Point In Time Recovery (PITR) on the created
+        database.
+
+            If set to true, PITR on the new database will be enabled. By default,
+            this feature is not enabled.
+
      --type=TYPE; default="firestore-native"
         The type of the database. TYPE must be one of: firestore-native,
         datastore-mode.
diff --git a/gcloud/firestore/databases/update b/gcloud/firestore/databases/update
index 75c140dfd..7e19f9c7a 100644
--- a/gcloud/firestore/databases/update
+++ b/gcloud/firestore/databases/update
@@ -4,7 +4,7 @@ NAME
 
 SYNOPSIS
     gcloud firestore databases update [--async] [--database=DATABASE]
-        [--type=TYPE] [GCLOUD_WIDE_FLAG ...]
+        [--enable-pitr] [--type=TYPE] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     Update the database configuration of a Cloud Firestore database.
@@ -39,6 +39,11 @@ FLAGS
           ▸ provide the argument --database on the command line;
           ▸ the default value of argument [--database] is (default).
 
+     --enable-pitr
+        If set to true, the Firestore database will be updated to enable Point
+        In Time Recovery. You can disable the this feature via
+        --no-enable-pitr.
+
      --type=TYPE
         The database type. TYPE must be one of: datastore-mode,
         firestore-native.
diff --git a/gcloud/firestore/export b/gcloud/firestore/export
index f61081cce..c3a077942 100644
--- a/gcloud/firestore/export
+++ b/gcloud/firestore/export
@@ -6,7 +6,8 @@ SYNOPSIS
     gcloud firestore export OUTPUT_URI_PREFIX [--async]
         [--collection-ids=[COLLECTION_IDS,...]]
         [--database=DATABASE; default="(default)"]
-        [--namespace-ids=[NAMESPACE_IDS,...]] [GCLOUD_WIDE_FLAG ...]
+        [--namespace-ids=[NAMESPACE_IDS,...]] [--snapshot-time=SNAPSHOT_TIME]
+        [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     export Cloud Firestore documents to Google Cloud Storage.
@@ -28,6 +29,11 @@ EXAMPLES
         $ gcloud firestore export gs://mybucket/my/path \
             --namespace-ids='specific namespace id'
 
+    To export from a snapshot at '2023-05-26T10:20:00.00Z', run:
+
+        $ gcloud firestore export gs://mybucket/my/path \
+            --snapshot-time='2023-05-26T10:20:00.00Z'
+
 POSITIONAL ARGUMENTS
      OUTPUT_URI_PREFIX
         Location where the export files will be stored. Must be a valid Google
@@ -70,6 +76,22 @@ FLAGS
 
             $ gcloud firestore export --namespaces-ids='customers','orders'
 
+     --snapshot-time=SNAPSHOT_TIME
+        The version of the database to export.
+
+        The timestamp must be rounded to the minute, in the past, and not older
+        than 5 days. Please choose a reasonable timestamp based on prior
+        knowledge on how long exports take as data at provided snapshot
+        timestamp can expire during export.
+
+        If specified, then the exported documents will represent a consistent
+        view of the database at the provided time. Otherwise, there are no
+        guarantees about the consistency of the exported documents.
+
+        For example, to operate on snapshot time 2023-05-26T10:20:00.00Z:
+
+            $ gcloud firestore export --snapshot-time='2023-05-26T10:20:00.00Z'
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/infra-manager/deployments/delete b/gcloud/infra-manager/deployments/delete
index d772c1215..a0e31d5f4 100644
--- a/gcloud/infra-manager/deployments/delete
+++ b/gcloud/infra-manager/deployments/delete
@@ -68,7 +68,7 @@ GCLOUD WIDE FLAGS
 
 API REFERENCE
     This command uses the config/v1 API. The full documentation for this API
-    can be found at: https://cloud.google.com/
+    can be found at: https://cloud.google.com/infrastructure-manager/docs
 
 NOTES
     This variant is also available:
diff --git a/gcloud/infra-manager/deployments/describe b/gcloud/infra-manager/deployments/describe
index 80db36358..c72f1c50b 100644
--- a/gcloud/infra-manager/deployments/describe
+++ b/gcloud/infra-manager/deployments/describe
@@ -57,7 +57,7 @@ GCLOUD WIDE FLAGS
 
 API REFERENCE
     This command uses the config/v1 API. The full documentation for this API
-    can be found at: https://cloud.google.com/
+    can be found at: https://cloud.google.com/infrastructure-manager/docs
 
 NOTES
     This variant is also available:
diff --git a/gcloud/infra-manager/deployments/list b/gcloud/infra-manager/deployments/list
index e2cf89cf7..afd0eb60a 100644
--- a/gcloud/infra-manager/deployments/list
+++ b/gcloud/infra-manager/deployments/list
@@ -75,7 +75,7 @@ GCLOUD WIDE FLAGS
 
 API REFERENCE
     This command uses the config/v1 API. The full documentation for this API
-    can be found at: https://cloud.google.com/
+    can be found at: https://cloud.google.com/infrastructure-manager/docs
 
 NOTES
     This variant is also available:
diff --git a/gcloud/infra-manager/resources/describe b/gcloud/infra-manager/resources/describe
index a66ff4415..547054576 100644
--- a/gcloud/infra-manager/resources/describe
+++ b/gcloud/infra-manager/resources/describe
@@ -76,7 +76,7 @@ GCLOUD WIDE FLAGS
 
 API REFERENCE
     This command uses the config/v1 API. The full documentation for this API
-    can be found at: https://cloud.google.com/
+    can be found at: https://cloud.google.com/infrastructure-manager/docs
 
 NOTES
     This variant is also available:
diff --git a/gcloud/infra-manager/resources/list b/gcloud/infra-manager/resources/list
index 59c945cd2..724fb3a2a 100644
--- a/gcloud/infra-manager/resources/list
+++ b/gcloud/infra-manager/resources/list
@@ -98,7 +98,7 @@ GCLOUD WIDE FLAGS
 
 API REFERENCE
     This command uses the config/v1 API. The full documentation for this API
-    can be found at: https://cloud.google.com/
+    can be found at: https://cloud.google.com/infrastructure-manager/docs
 
 NOTES
     This variant is also available:
diff --git a/gcloud/infra-manager/revisions/describe b/gcloud/infra-manager/revisions/describe
index e76403de1..5579f83f6 100644
--- a/gcloud/infra-manager/revisions/describe
+++ b/gcloud/infra-manager/revisions/describe
@@ -66,7 +66,7 @@ GCLOUD WIDE FLAGS
 
 API REFERENCE
     This command uses the config/v1 API. The full documentation for this API
-    can be found at: https://cloud.google.com/
+    can be found at: https://cloud.google.com/infrastructure-manager/docs
 
 NOTES
     This variant is also available:
diff --git a/gcloud/infra-manager/revisions/list b/gcloud/infra-manager/revisions/list
index 0638ac75a..e3846572b 100644
--- a/gcloud/infra-manager/revisions/list
+++ b/gcloud/infra-manager/revisions/list
@@ -91,7 +91,7 @@ GCLOUD WIDE FLAGS
 
 API REFERENCE
     This command uses the config/v1 API. The full documentation for this API
-    can be found at: https://cloud.google.com/
+    can be found at: https://cloud.google.com/infrastructure-manager/docs
 
 NOTES
     This variant is also available:
diff --git a/gcloud/metastore/services/update b/gcloud/metastore/services/update
index 41aa5d2e0..8745c6bc5 100644
--- a/gcloud/metastore/services/update
+++ b/gcloud/metastore/services/update
@@ -3,7 +3,8 @@ NAME
 
 SYNOPSIS
     gcloud metastore services update (SERVICE : --location=LOCATION) [--async]
-        [--port=PORT] [--update-labels=[KEY=VALUE,...]]
+        [--endpoint-protocol=ENDPOINT_PROTOCOL] [--port=PORT]
+        [--update-labels=[KEY=VALUE,...]]
         [--clear-labels | --remove-labels=[KEY,...]]
         [--instance-size=INSTANCE_SIZE | --scaling-factor=SCALING_FACTOR
           | --tier=TIER]
@@ -73,6 +74,16 @@ FLAGS
         Return immediately, without waiting for the operation in progress to
         complete.
 
+     --endpoint-protocol=ENDPOINT_PROTOCOL
+        The protocol to use for the metastore service endpoint.
+        ENDPOINT_PROTOCOL must be one of:
+
+         grpc
+            The modernized GRPC protocol.
+
+         thrift
+            The legacy Apache THRIFT protocol.
+
      --port=PORT
         The TCP port on which the Metastore service will listen.
 
diff --git a/gcloud/network-connectivity/help b/gcloud/network-connectivity/help
index 3d3013a96..4d5d1228f 100644
--- a/gcloud/network-connectivity/help
+++ b/gcloud/network-connectivity/help
@@ -37,7 +37,9 @@ GROUPS
         Manage Network Connectivity Center spokes.
 
 NOTES
-    This variant is also available:
+    These variants are also available:
 
         $ gcloud alpha network-connectivity
 
+        $ gcloud beta network-connectivity
+
diff --git a/gcloud/notebooks/instances/create b/gcloud/notebooks/instances/create
index 664f6ad25..311a19aaf 100644
--- a/gcloud/notebooks/instances/create
+++ b/gcloud/notebooks/instances/create
@@ -184,6 +184,10 @@ OPTIONAL FLAGS
      --metadata=[KEY=VALUE,...]
         Custom metadata to apply to this instance.
 
+        For example, to specify a Cloud Storage bucket for automatic backup,
+        you can use the gcs-data-bucket metadata tag. Format:
+        "--metadata=gcs-data-bucket=BUCKET".
+
      --post-startup-script=POST_STARTUP_SCRIPT
         Path to a Bash script that automatically runs after a notebook instance
         fully boots up. The path must be a URL or Cloud Storage path
diff --git a/gcloud/storage/ls b/gcloud/storage/ls
index 4de7ab747..7f2ada40a 100644
--- a/gcloud/storage/ls
+++ b/gcloud/storage/ls
@@ -4,8 +4,9 @@ NAME
 SYNOPSIS
     gcloud storage ls [PATH ...] [--additional-headers=HEADER=VALUE]
         [--all-versions, -a] [--buckets, -b] [--etag, -e]
-        [--fetch-encrypted-object-hashes] [--format=FORMAT] [--readable-sizes]
-        [--recursive, -R, -r] [--full, -L | --json, -j | --long, -l]
+        [--fetch-encrypted-object-hashes] [--format=FORMAT]
+        [--read-paths-from-stdin, -I] [--readable-sizes] [--recursive, -R, -r]
+        [--full, -L | --json, -j | --long, -l]
         [--decryption-keys=[DECRYPTION_KEY,...]] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
@@ -74,7 +75,7 @@ FLAGS
         this command invocation.
 
      --all-versions, -a
-        Include non-current object versions in the listing. This flag is
+        Include noncurrent object versions in the listing. This flag is
         typically only useful for buckets with object versioning
         (https://cloud.google.com/storage/docs/object-versioning) enabled. If
         combined with the --long option, the metageneration for each listed
@@ -100,6 +101,9 @@ FLAGS
         "--format=gsutil"). Other format values (e.g. "json") do not work. See
         different ls flags and commands for alternative formatting.
 
+     --read-paths-from-stdin, -I
+        Read the list of URLs from stdin.
+
      --readable-sizes
         When used with --long, print object sizes in human readable format,
         such as 1 KiB, 234 MiB, or 2 GiB.