diff --git a/gcloud/_version b/gcloud/_version
index 6fccd4aad..fca3a7c15 100644
--- a/gcloud/_version
+++ b/gcloud/_version
@@ -1,8 +1,8 @@
-Google Cloud SDK 476.0.0
-alpha 2024.05.10
-beta 2024.05.10
+Google Cloud SDK 477.0.0
+alpha 2024.05.17
+beta 2024.05.17
 bq 2.1.4
 bundled-python3-unix 3.11.8
-core 2024.05.10
+core 2024.05.17
 gcloud-crc32c 1.0.0
 gsutil 5.29
diff --git a/gcloud/alpha/anthos/auth/login b/gcloud/alpha/anthos/auth/login
index 64749003a..550476992 100644
--- a/gcloud/alpha/anthos/auth/login
+++ b/gcloud/alpha/anthos/auth/login
@@ -3,9 +3,10 @@ NAME
         client
 
 SYNOPSIS
-    gcloud alpha anthos auth login [--cluster=CLUSTER] [--dry-run]
-        [--kubeconfig=KUBECONFIG] [--login-config=LOGIN_CONFIG]
-        [--login-config-cert=LOGIN_CONFIG_CERT] [--server=SERVER]
+    gcloud alpha anthos auth login [--no-browser] [--cluster=CLUSTER]
+        [--dry-run] [--kubeconfig=KUBECONFIG] [--login-config=LOGIN_CONFIG]
+        [--login-config-cert=LOGIN_CONFIG_CERT]
+        [--remote-bootstrap=REMOTE_BOOTSTRAP] [--server=SERVER]
         [--set-preferred-auth] [--user=USER] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
@@ -38,7 +39,17 @@ EXAMPLES
         $ gcloud alpha anthos auth login --cluster=testcluster \
           --server=<server-url> --kubeconfig=my.kubeconfig
 
+    To add credentials to custom kubeconfig file with server side login using a
+    remote-device for login:
+
+        $ gcloud alpha anthos auth login --cluster=testcluster \
+          --server=<server-url> --kubeconfig=my.kubeconfig --no-browser
+
 FLAGS
+     --no-browser
+        Option to indicate login completion on a second device with
+        browser.Used with server option.
+
      --cluster=CLUSTER
         Cluster to authenticate against. If no cluster is specified, the
         command will print a list of available options.
@@ -58,6 +69,10 @@ FLAGS
         Specifies the CA certificate file to be added to trusted pool for
         making HTTPS connections to a --login-config URL.
 
+     --remote-bootstrap=REMOTE_BOOTSTRAP
+        Option to complete login that was started using no-browser optionon a
+        remote device that does not have a browser.
+
      --server=SERVER
         Specifies the URL of API server of the cluster to authenticate against.
 
diff --git a/gcloud/alpha/builds/worker-pools/create b/gcloud/alpha/builds/worker-pools/create
index 7865d03a0..bfeb53846 100644
--- a/gcloud/alpha/builds/worker-pools/create
+++ b/gcloud/alpha/builds/worker-pools/create
@@ -4,6 +4,7 @@ NAME
 
 SYNOPSIS
     gcloud alpha builds worker-pools create WORKER_POOL --region=REGION
+        [--generation=GENERATION; default=1]
         [--config-from-file=CONFIG_FROM_FILE | --peered-network=PEERED_NETWORK
           --peered-network-ip-range=PEERED_NETWORK_IP_RANGE --no-public-egress
           --worker-disk-size=WORKER_DISK_SIZE
@@ -41,6 +42,9 @@ REQUIRED FLAGS
         https://cloud.google.com/build/docs/locations for available locations.
 
 OPTIONAL FLAGS
+     --generation=GENERATION; default=1
+        Generation of the worker pool.
+
      At most one of these can be specified:
 
        --config-from-file=CONFIG_FROM_FILE
diff --git a/gcloud/alpha/builds/worker-pools/delete b/gcloud/alpha/builds/worker-pools/delete
index ec71e544b..987eaa0e6 100644
--- a/gcloud/alpha/builds/worker-pools/delete
+++ b/gcloud/alpha/builds/worker-pools/delete
@@ -4,13 +4,13 @@ NAME
 
 SYNOPSIS
     gcloud alpha builds worker-pools delete WORKER_POOL --region=REGION
-        [GCLOUD_WIDE_FLAG ...]
+        [--generation=GENERATION; default=1] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) Delete a private worker pool from Google Cloud Build.
 
 EXAMPLES
-    To delete a private worker pool named wp1 in region us-central1, run:
+    To delete a worker pool named wp1 in region us-central1, run:
 
         $ gcloud alpha builds worker-pools delete wp1 --region=us-central1
 
@@ -22,6 +22,10 @@ REQUIRED FLAGS
      --region=REGION
         The Cloud region where the worker pool is.
 
+OPTIONAL FLAGS
+     --generation=GENERATION; default=1
+        Generation of the worker pool.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/alpha/builds/worker-pools/describe b/gcloud/alpha/builds/worker-pools/describe
index 430c6979b..7225ca764 100644
--- a/gcloud/alpha/builds/worker-pools/describe
+++ b/gcloud/alpha/builds/worker-pools/describe
@@ -1,13 +1,13 @@
 NAME
-    gcloud alpha builds worker-pools describe - describe a private worker pool
-        used by Cloud Build
+    gcloud alpha builds worker-pools describe - describe a worker pool used by
+        Cloud Build
 
 SYNOPSIS
     gcloud alpha builds worker-pools describe WORKER_POOL --region=REGION
-        [GCLOUD_WIDE_FLAG ...]
+        [--generation=GENERATION; default=1] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) Describe a private worker pool used by Cloud Build.
+    (ALPHA) Describe a worker pool used by Cloud Build.
 
 EXAMPLES
     To get information about a worker pool named wp1 in region us-central1,
@@ -23,6 +23,10 @@ REQUIRED FLAGS
      --region=REGION
         The Cloud region where the worker pool is.
 
+OPTIONAL FLAGS
+     --generation=GENERATION; default=1
+        Generation of the worker pool.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/alpha/builds/worker-pools/help b/gcloud/alpha/builds/worker-pools/help
index d920a4c61..aa565d1cb 100644
--- a/gcloud/alpha/builds/worker-pools/help
+++ b/gcloud/alpha/builds/worker-pools/help
@@ -23,10 +23,10 @@ COMMANDS
         (ALPHA) Delete a private worker pool from Google Cloud Build.
 
      describe
-        (ALPHA) Describe a private worker pool used by Cloud Build.
+        (ALPHA) Describe a worker pool used by Cloud Build.
 
      list
-        (ALPHA) List all private worker pools in a Google Cloud project.
+        (ALPHA) List all worker pools in a Google Cloud project.
 
      update
         (ALPHA) Update a private pool used by Cloud Build.
diff --git a/gcloud/alpha/builds/worker-pools/list b/gcloud/alpha/builds/worker-pools/list
index d978d8950..dbb848a72 100644
--- a/gcloud/alpha/builds/worker-pools/list
+++ b/gcloud/alpha/builds/worker-pools/list
@@ -1,14 +1,15 @@
 NAME
-    gcloud alpha builds worker-pools list - list all private worker pools in a
-        Google Cloud project
+    gcloud alpha builds worker-pools list - list all worker pools in a Google
+        Cloud project
 
 SYNOPSIS
-    gcloud alpha builds worker-pools list --region=REGION [--filter=EXPRESSION]
+    gcloud alpha builds worker-pools list --region=REGION
+        [--generation=GENERATION; default=1] [--filter=EXPRESSION]
         [--limit=LIMIT] [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [--uri]
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) List all private worker pools in a Google Cloud project.
+    (ALPHA) List all worker pools in a Google Cloud project.
 
 EXAMPLES
     To fetch a list of worker pools running in region us-central1, run:
@@ -19,6 +20,10 @@ REQUIRED FLAGS
      --region=REGION
         The Cloud region to list worker pools in.
 
+FLAGS
+     --generation=GENERATION; default=1
+        Generation of the worker pool.
+
 LIST COMMAND FLAGS
      --filter=EXPRESSION
         Apply a Boolean filter EXPRESSION to each resource item to be listed.
diff --git a/gcloud/alpha/builds/worker-pools/update b/gcloud/alpha/builds/worker-pools/update
index 804a54c88..e8f62bcb3 100644
--- a/gcloud/alpha/builds/worker-pools/update
+++ b/gcloud/alpha/builds/worker-pools/update
@@ -6,19 +6,18 @@ SYNOPSIS
     gcloud alpha builds worker-pools update WORKER_POOL --region=REGION
         (--config-from-file=CONFIG_FROM_FILE | --public-egress
           | --no-public-egress --worker-disk-size=WORKER_DISK_SIZE
-          --worker-machine-type=WORKER_MACHINE_TYPE) [GCLOUD_WIDE_FLAG ...]
+          --worker-machine-type=WORKER_MACHINE_TYPE)
+        [--generation=GENERATION; default=1] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
     (ALPHA) Update a private pool used by Cloud Build.
 
 EXAMPLES
-      ▪ Private pools
+    To change the machine type and disk size of workers in a worker pool named
+    wp1, run:
 
-    To change the machine type and disk size of a private pool named pwp1, run:
-
-        $ gcloud alpha builds worker-pools update pwp1 \
-            --region=us-central1 --worker-machine-type=e2-standard-2 \
-            --worker-disk-size=64GB
+        $ gcloud alpha builds worker-pools update wp1 --region=us-central1 \
+            --worker-machine-type=e2-standard-2 --worker-disk-size=64GB
 
 POSITIONAL ARGUMENTS
      WORKER_POOL
@@ -67,6 +66,10 @@ REQUIRED FLAGS
 
               If unspecified, Cloud Build uses a standard machine type.
 
+OPTIONAL FLAGS
+     --generation=GENERATION; default=1
+        Generation of the worker pool.
+
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
     --billing-project, --configuration, --flags-file, --flatten, --format,
diff --git a/gcloud/alpha/compute/instance-templates/create b/gcloud/alpha/compute/instance-templates/create
index 1aac8e346..ad14a76d3 100644
--- a/gcloud/alpha/compute/instance-templates/create
+++ b/gcloud/alpha/compute/instance-templates/create
@@ -343,6 +343,17 @@ FLAGS
             to. You must provide exactly two replica zones, and one zone must
             be the same as the instance zone.
 
+         labels
+            List of label KEY=VALUE pairs separated by : character to add to
+            the disk.
+
+            Example: Key1=Value1:Key2=Value2:Key3=Value3.
+
+            Keys must start with a lowercase character and contain only hyphens
+            (-), underscores (_), lowercase characters, and numbers. Values
+            must contain only hyphens (-), underscores (_), lowercase
+            characters, and numbers.
+
      --description=DESCRIPTION
         Specifies a textual description for the instance template.
 
diff --git a/gcloud/alpha/compute/instance-templates/create-with-container b/gcloud/alpha/compute/instance-templates/create-with-container
index a9a91906e..4a0495841 100644
--- a/gcloud/alpha/compute/instance-templates/create-with-container
+++ b/gcloud/alpha/compute/instance-templates/create-with-container
@@ -42,10 +42,11 @@ SYNOPSIS
         [--network-tier=NETWORK_TIER] [--preemptible]
         [--private-ipv6-google-access-type=PRIVATE_IPV6_GOOGLE_ACCESS_TYPE]
         [--private-network-ip=PRIVATE_NETWORK_IP] [--region=REGION]
-        [--no-restart-on-failure] [--shielded-integrity-monitoring]
-        [--shielded-secure-boot] [--shielded-vtpm] [--stack-type=STACK_TYPE]
-        [--subnet=SUBNET] [--subnet-region=SUBNET_REGION]
-        [--tags=TAG,[TAG,...]] [--address=ADDRESS | --no-address]
+        [--resource-policies=[RESOURCE_POLICY,...]] [--no-restart-on-failure]
+        [--shielded-integrity-monitoring] [--shielded-secure-boot]
+        [--shielded-vtpm] [--stack-type=STACK_TYPE] [--subnet=SUBNET]
+        [--subnet-region=SUBNET_REGION] [--tags=TAG,[TAG,...]]
+        [--address=ADDRESS | --no-address]
         [--custom-cpu=CUSTOM_CPU --custom-memory=CUSTOM_MEMORY
           : --custom-extensions --custom-vm-type=CUSTOM_VM_TYPE]
         [--image-project=IMAGE_PROJECT --image=IMAGE
@@ -376,6 +377,17 @@ FLAGS
             to. You must provide exactly two replica zones, and one zone must
             be the same as the instance zone.
 
+         labels
+            List of label KEY=VALUE pairs separated by : character to add to
+            the disk.
+
+            Example: Key1=Value1:Key2=Value2:Key3=Value3.
+
+            Keys must start with a lowercase character and contain only hyphens
+            (-), underscores (_), lowercase characters, and numbers. Values
+            must contain only hyphens (-), underscores (_), lowercase
+            characters, and numbers.
+
      --description=DESCRIPTION
         Specifies a textual description for the instance template.
 
@@ -691,6 +703,14 @@ FLAGS
         Alternatively, the region can be stored in the environment variable
         CLOUDSDK_COMPUTE_REGION.
 
+     --resource-policies=[RESOURCE_POLICY,...]
+        A list of resource policy names (not URLs) to be added to each instance
+        created using this instance template. If you attach any resource
+        policies to an instance template, you can only use that instance
+        template to create instances that are in the same region as the
+        resource policies. Do not include resource policies that are located in
+        different regions in the same instance template.
+
      --restart-on-failure
         The instances will be restarted if they are terminated by Compute
         Engine. This does not affect terminations performed by the user.
diff --git a/gcloud/alpha/compute/instances/create b/gcloud/alpha/compute/instances/create
index 0e0a27f3c..b4dcb33b0 100644
--- a/gcloud/alpha/compute/instances/create
+++ b/gcloud/alpha/compute/instances/create
@@ -431,6 +431,17 @@ FLAGS
             to. You must provide exactly two replica zones, and one zone must
             be the same as the instance zone.
 
+         labels
+            List of label KEY=VALUE pairs separated by : character to add to
+            the disk.
+
+            Example: Key1=Value1:Key2=Value2:Key3=Value3.
+
+            Keys must start with a lowercase character and contain only hyphens
+            (-), underscores (_), lowercase characters, and numbers. Values
+            must contain only hyphens (-), underscores (_), lowercase
+            characters, and numbers.
+
      --csek-key-file=FILE
         Path to a Customer-Supplied Encryption Key (CSEK) key file that maps
         Compute Engine resources to user managed keys to be used when creating,
diff --git a/gcloud/alpha/compute/instances/create-with-container b/gcloud/alpha/compute/instances/create-with-container
index ac1580e92..9714882dd 100644
--- a/gcloud/alpha/compute/instances/create-with-container
+++ b/gcloud/alpha/compute/instances/create-with-container
@@ -48,7 +48,8 @@ SYNOPSIS
         [--preemptible]
         [--private-ipv6-google-access-type=PRIVATE_IPV6_GOOGLE_ACCESS_TYPE]
         [--private-network-ip=PRIVATE_NETWORK_IP]
-        [--provisioning-model=PROVISIONING_MODEL] [--no-restart-on-failure]
+        [--provisioning-model=PROVISIONING_MODEL]
+        [--resource-policies=[RESOURCE_POLICY,...]] [--no-restart-on-failure]
         [--shielded-integrity-monitoring] [--shielded-secure-boot]
         [--shielded-vtpm] [--source-instance-template=SOURCE_INSTANCE_TEMPLATE]
         [--stack-type=STACK_TYPE] [--subnet=SUBNET] [--tags=TAG,[TAG,...]]
@@ -383,6 +384,17 @@ FLAGS
             to. You must provide exactly two replica zones, and one zone must
             be the same as the instance zone.
 
+         labels
+            List of label KEY=VALUE pairs separated by : character to add to
+            the disk.
+
+            Example: Key1=Value1:Key2=Value2:Key3=Value3.
+
+            Keys must start with a lowercase character and contain only hyphens
+            (-), underscores (_), lowercase characters, and numbers. Values
+            must contain only hyphens (-), underscores (_), lowercase
+            characters, and numbers.
+
      --description=DESCRIPTION
         Specifies a textual description of the instances.
 
@@ -751,6 +763,10 @@ FLAGS
             Default. Standard provisioning model for VM instances, which has
             user-controlled runtime but no Spot discounts.
 
+     --resource-policies=[RESOURCE_POLICY,...]
+        A list of resource policy names to be added to the instance. The
+        policies must exist in the same region as the instance.
+
      --restart-on-failure
         The instances will be restarted if they are terminated by Compute
         Engine. This does not affect terminations performed by the user.
diff --git a/gcloud/alpha/compute/instances/ops-agents/policies/help b/gcloud/alpha/compute/instances/ops-agents/policies/help
index 179746719..aadb88102 100644
--- a/gcloud/alpha/compute/instances/ops-agents/policies/help
+++ b/gcloud/alpha/compute/instances/ops-agents/policies/help
@@ -36,7 +36,7 @@ COMMANDS
         policies.
 
      update
-        (ALPHA) Update a Google Cloud's operations suite agents (Ops Agents)
+        (ALPHA) Update a Google Cloud operations suite agent (Ops Agent)
         policy.
 
 NOTES
diff --git a/gcloud/alpha/compute/instances/ops-agents/policies/update b/gcloud/alpha/compute/instances/ops-agents/policies/update
index ebe9d2a87..0851968a1 100644
--- a/gcloud/alpha/compute/instances/ops-agents/policies/update
+++ b/gcloud/alpha/compute/instances/ops-agents/policies/update
@@ -1,6 +1,6 @@
 NAME
     gcloud alpha compute instances ops-agents policies update - update a Google
-        Cloud's operations suite agents (Ops Agents) policy
+        Cloud operations suite agent (Ops Agent) policy
 
 SYNOPSIS
     gcloud alpha compute instances ops-agents policies update POLICY_ID
diff --git a/gcloud/alpha/container/clusters/check-autopilot-compatibility b/gcloud/alpha/container/clusters/check-autopilot-compatibility
index a00d7f74f..8eb971084 100644
--- a/gcloud/alpha/container/clusters/check-autopilot-compatibility
+++ b/gcloud/alpha/container/clusters/check-autopilot-compatibility
@@ -26,13 +26,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 LIST COMMAND FLAGS
diff --git a/gcloud/alpha/container/clusters/config/export b/gcloud/alpha/container/clusters/config/export
index 6a51c9210..a32ed4fd6 100644
--- a/gcloud/alpha/container/clusters/config/export
+++ b/gcloud/alpha/container/clusters/config/export
@@ -70,13 +70,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/alpha/container/clusters/config/help b/gcloud/alpha/container/clusters/config/help
index 5d330af72..777463400 100644
--- a/gcloud/alpha/container/clusters/config/help
+++ b/gcloud/alpha/container/clusters/config/help
@@ -15,13 +15,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/alpha/container/clusters/create b/gcloud/alpha/container/clusters/create
index 0afa7d966..ae4596435 100644
--- a/gcloud/alpha/container/clusters/create
+++ b/gcloud/alpha/container/clusters/create
@@ -10,6 +10,7 @@ SYNOPSIS
           gpu-sharing-strategy=GPU_SHARING_STRATEGY,
           max-shared-clients-per-gpu=MAX_SHARED_CLIENTS_PER_GPU],...]]
         [--addons=[ADDON,...]] [--allow-route-overlap] [--async]
+        [--autoprovisioning-enable-insecure-kubelet-readonly-port]
         [--autoprovisioning-network-tags=TAGS,[TAGS,...]]
         [--autoprovisioning-resource-manager-tags=[KEY=VALUE,...]]
         [--autoscaling-profile=AUTOSCALING_PROFILE]
@@ -31,6 +32,7 @@ SYNOPSIS
         [--enable-dataplane-v2] [--enable-fleet] [--enable-fqdn-network-policy]
         [--enable-gke-oidc] [--enable-google-cloud-access] [--enable-gvnic]
         [--enable-identity-service] [--enable-image-streaming]
+        [--enable-insecure-kubelet-readonly-port]
         [--enable-intra-node-visibility] [--enable-ip-alias]
         [--enable-kubernetes-alpha]
         [--enable-kubernetes-unstable-apis=API,[API,...]]
@@ -221,6 +223,16 @@ FLAGS
         Return immediately, without waiting for the operation in progress to
         complete.
 
+     --autoprovisioning-enable-insecure-kubelet-readonly-port
+        Enables the Kubelet's insecure read only port for Autoprovisioned Node
+        Pools.
+
+        If not set, the value from nodePoolDefaults.nodeConfigDefaults will be
+        used.
+
+        To disable the readonly port
+        --no-autoprovisioning-enable-insecure-kubelet-readonly-port.
+
      --autoprovisioning-network-tags=TAGS,[TAGS,...]
         Applies the given Compute Engine tags (comma separated) on all nodes in
         the auto-provisioned node pools of the new Standard cluster or the new
@@ -544,6 +556,12 @@ FLAGS
      --enable-image-streaming
         Specifies whether to enable image streaming on cluster.
 
+     --enable-insecure-kubelet-readonly-port
+        Enables the Kubelet's insecure read only port.
+
+        To disable the readonly port on a cluster or node-pool set the flag to
+        --no-enable-insecure-kubelet-readonly-port.
+
      --enable-intra-node-visibility
         Enable Intra-node visibility for this cluster.
 
@@ -805,7 +823,7 @@ FLAGS
         The maximum number of nodes to allocate per default initial node pool.
         Kubernetes Engine will automatically create enough nodes pools such
         that each node pool contains less than --max-nodes-per-pool nodes.
-        Defaults to 1000 nodes, but can be set as low as 100 nodes per pool on
+        Defaults to 2000 nodes, but can be set as low as 100 nodes per pool on
         initial create.
 
      --max-pods-per-node=MAX_PODS_PER_NODE
@@ -2009,13 +2027,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
      One of either maintenance-window or the group of maintenance-window flags
diff --git a/gcloud/alpha/container/clusters/create-auto b/gcloud/alpha/container/clusters/create-auto
index d06ac2b30..fca8d081d 100644
--- a/gcloud/alpha/container/clusters/create-auto
+++ b/gcloud/alpha/container/clusters/create-auto
@@ -4,6 +4,7 @@ NAME
 
 SYNOPSIS
     gcloud alpha container clusters create-auto NAME [--async]
+        [--autoprovisioning-enable-insecure-kubelet-readonly-port]
         [--autoprovisioning-network-tags=TAGS,[TAGS,...]]
         [--autoprovisioning-resource-manager-tags=[KEY=VALUE,...]]
         [--boot-disk-kms-key=BOOT_DISK_KMS_KEY]
@@ -62,6 +63,16 @@ FLAGS
         Return immediately, without waiting for the operation in progress to
         complete.
 
+     --autoprovisioning-enable-insecure-kubelet-readonly-port
+        Enables the Kubelet's insecure read only port for Autoprovisioned Node
+        Pools.
+
+        If not set, the value from nodePoolDefaults.nodeConfigDefaults will be
+        used.
+
+        To disable the readonly port
+        --no-autoprovisioning-enable-insecure-kubelet-readonly-port.
+
      --autoprovisioning-network-tags=TAGS,[TAGS,...]
         Applies the given Compute Engine tags (comma separated) on all nodes in
         the auto-provisioned node pools of the new Standard cluster or the new
@@ -514,13 +525,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
      Options to specify the node identity.
diff --git a/gcloud/alpha/container/clusters/delete b/gcloud/alpha/container/clusters/delete
index 3638cd7e2..be491ccf1 100644
--- a/gcloud/alpha/container/clusters/delete
+++ b/gcloud/alpha/container/clusters/delete
@@ -42,13 +42,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/alpha/container/clusters/describe b/gcloud/alpha/container/clusters/describe
index c9e69b3a4..684375d3a 100644
--- a/gcloud/alpha/container/clusters/describe
+++ b/gcloud/alpha/container/clusters/describe
@@ -24,13 +24,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/alpha/container/clusters/get-credentials b/gcloud/alpha/container/clusters/get-credentials
index f534d0d1d..48a4d7ca2 100644
--- a/gcloud/alpha/container/clusters/get-credentials
+++ b/gcloud/alpha/container/clusters/get-credentials
@@ -53,13 +53,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/alpha/container/clusters/help b/gcloud/alpha/container/clusters/help
index 9c09cd7ef..184f00c0e 100644
--- a/gcloud/alpha/container/clusters/help
+++ b/gcloud/alpha/container/clusters/help
@@ -19,13 +19,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/alpha/container/clusters/list b/gcloud/alpha/container/clusters/list
index a2e87a3b8..014c21dcf 100644
--- a/gcloud/alpha/container/clusters/list
+++ b/gcloud/alpha/container/clusters/list
@@ -24,13 +24,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 LIST COMMAND FLAGS
diff --git a/gcloud/alpha/container/clusters/resize b/gcloud/alpha/container/clusters/resize
index a68b06365..3db85a807 100644
--- a/gcloud/alpha/container/clusters/resize
+++ b/gcloud/alpha/container/clusters/resize
@@ -68,13 +68,13 @@ OPTIONAL FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/alpha/container/clusters/update b/gcloud/alpha/container/clusters/update
index 27a6e567c..f41587233 100644
--- a/gcloud/alpha/container/clusters/update
+++ b/gcloud/alpha/container/clusters/update
@@ -4,7 +4,8 @@ NAME
 
 SYNOPSIS
     gcloud alpha container clusters update NAME
-        (--autoprovisioning-network-tags=[TAGS,...]
+        (--autoprovisioning-enable-insecure-kubelet-readonly-port
+          | --autoprovisioning-network-tags=[TAGS,...]
           | --autoprovisioning-resource-manager-tags=[KEY=VALUE,...]
           | --autoscaling-profile=AUTOSCALING_PROFILE | --clear-fleet-project
           | --complete-credential-rotation | --complete-ip-rotation
@@ -16,7 +17,8 @@ SYNOPSIS
           | --enable-cost-allocation | --enable-fleet
           | --enable-fqdn-network-policy | --enable-gke-oidc
           | --enable-google-cloud-access | --enable-identity-service
-          | --enable-image-streaming | --enable-intra-node-visibility
+          | --enable-image-streaming | --enable-insecure-kubelet-readonly-port
+          | --enable-intra-node-visibility
           | --enable-kubernetes-unstable-apis=API,[API,...]
           | --enable-l4-ilb-subsetting | --enable-legacy-authorization
           | --enable-logging-monitoring-system-only
@@ -121,6 +123,16 @@ POSITIONAL ARGUMENTS
 REQUIRED FLAGS
      Exactly one of these must be specified:
 
+       --autoprovisioning-enable-insecure-kubelet-readonly-port
+          Enables the Kubelet's insecure read only port for Autoprovisioned
+          Node Pools.
+
+          If not set, the value from nodePoolDefaults.nodeConfigDefaults will
+          be used.
+
+          To disable the readonly port
+          --no-autoprovisioning-enable-insecure-kubelet-readonly-port.
+
        --autoprovisioning-network-tags=[TAGS,...]
           Replaces the user specified Compute Engine tags on all nodes in all
           the existing auto-provisioned node pools in the Standard cluster or
@@ -319,6 +331,12 @@ REQUIRED FLAGS
        --enable-image-streaming
           Specifies whether to enable image streaming on cluster.
 
+       --enable-insecure-kubelet-readonly-port
+          Enables the Kubelet's insecure read only port.
+
+          To disable the readonly port on a cluster or node-pool set the flag
+          to --no-enable-insecure-kubelet-readonly-port.
+
        --enable-intra-node-visibility
           Enable Intra-node visibility for this cluster.
 
@@ -1446,13 +1464,13 @@ OPTIONAL FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
      Cluster autoscaling
diff --git a/gcloud/alpha/container/clusters/upgrade b/gcloud/alpha/container/clusters/upgrade
index 71914a76d..e53894265 100644
--- a/gcloud/alpha/container/clusters/upgrade
+++ b/gcloud/alpha/container/clusters/upgrade
@@ -96,13 +96,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
      Flags for Security Profile:
diff --git a/gcloud/alpha/container/fleet/create b/gcloud/alpha/container/fleet/create
index 7162ee9b8..f54a734c0 100644
--- a/gcloud/alpha/container/fleet/create
+++ b/gcloud/alpha/container/fleet/create
@@ -66,7 +66,7 @@ FLAGS
 
                 $ gcloud alpha container fleet create --security-posture=standard
 
-            SECURITY_POSTURE must be one of: disabled, standard.
+            SECURITY_POSTURE must be one of: disabled, standard, enterprise.
 
          --workload-vulnerability-scanning=WORKLOAD_VULNERABILITY_SCANNING
             To apply standard vulnerability scanning to clusters in the fleet,
diff --git a/gcloud/alpha/container/fleet/scopes/add-app-operator-binding b/gcloud/alpha/container/fleet/scopes/add-app-operator-binding
new file mode 100644
index 000000000..d2ef7c443
--- /dev/null
+++ b/gcloud/alpha/container/fleet/scopes/add-app-operator-binding
@@ -0,0 +1,127 @@
+NAME
+    gcloud alpha container fleet scopes add-app-operator-binding - add
+        project-level and fleet scope-level IAM bindings and create a fleet
+        scope RBAC role binding for an app operator principal
+
+SYNOPSIS
+    gcloud alpha container fleet scopes add-app-operator-binding SCOPE
+        --role=ROLE (--group=GROUP | --user=USER) [--labels=[KEY=VALUE,...]]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) One binding consists of an app operator principal (user/group) and
+    a role (view/edit/admin).
+
+    This command sets up the different permissions required for an app
+    operator, including usage of fleet scopes, connect gateway, logging, and
+    metrics. The authoritative list for adding the permissions is the existing
+    RBAC role bindings under the specified scope.
+
+    This command can fail for the following reasons:
+      ▪ The scope specified does not exist.
+      ▪ The user does not have access to the specified scope.
+      ▪ The principal specified already has another binding for the scope.
+
+EXAMPLES
+    The following command:
+
+        $ gcloud alpha container fleet scopes add-app-operator-binding \
+            SCOPE --role=view --group=people@google.com --project=PROJECT_ID
+
+      ▪ adds IAM policy binding: roles/gkehub.scopeViewer on SCOPE
+      ▪ adds IAM policy binding: roles/gkehub.scopeViewerProjectLevel on
+        PROJECT_ID
+      ▪ adds IAM policy binding: roles/logging.viewAccessor on PROJECT_ID
+        with condition where bucket corresponds to SCOPE
+      ▪ creates fleet scope RBAC role binding: role view with a random ID for
+        group people@google.com.
+
+    ---
+
+    The following command:
+
+        $ gcloud alpha container fleet scopes add-app-operator-binding \
+            SCOPE --role=edit --user=person@google.com --project=PROJECT_ID
+
+      ▪ adds IAM policy binding: roles/gkehub.scopeEditor on SCOPE
+      ▪ adds IAM policy binding: roles/gkehub.scopeEditorProjectLevel on
+        PROJECT_ID
+      ▪ adds IAM policy binding: roles/logging.viewAccessor on PROJECT_ID
+        with condition where bucket corresponds to SCOPE
+      ▪ creates fleet scope RBAC role binding: role edit with a random ID for
+        user person@google.com.
+
+    ---
+
+    The following command:
+
+        $ gcloud alpha container fleet scopes add-app-operator-binding \
+            SCOPE --role=admin --user=person@google.com --project=PROJECT_ID
+
+      ▪ adds IAM policy binding: roles/gkehub.scopeAdmin on SCOPE
+      ▪ adds IAM policy binding: roles/gkehub.scopeEditorProjectLevel on
+        PROJECT_ID
+      ▪ adds IAM policy binding: roles/logging.viewAccessor on PROJECT_ID
+        with condition where bucket corresponds to SCOPE
+      ▪ creates fleet scope RBAC role binding: role admin with a random ID
+        for user person@google.com.
+
+POSITIONAL ARGUMENTS
+     Scope resource - The group of arguments defining the Fleet Scope. This
+     represents a Cloud resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument SCOPE on the command line with a fully specified
+        name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     To set the location attribute:
+      ◆ provide the argument SCOPE on the command line with a fully specified
+        name;
+      ◆ global is the only supported location.
+
+     This must be specified.
+
+       SCOPE
+          ID of the scope or fully qualified identifier for the scope.
+
+          To set the scope attribute:
+          ▸ provide the argument SCOPE on the command line.
+
+REQUIRED FLAGS
+     --role=ROLE
+        Role to assign. ROLE must be one of: admin, edit, view.
+
+     Exactly one of these must be specified:
+
+       --group=GROUP
+          Group for the role binding.
+
+       --user=USER
+          User for the role binding.
+
+OPTIONAL FLAGS
+     --labels=[KEY=VALUE,...]
+        List of label KEY=VALUE pairs to add.
+
+        Keys must start with a lowercase character and contain only hyphens
+        (-), underscores (_), lowercase characters, and numbers. Values must
+        contain only hyphens (-), underscores (_), lowercase characters, and
+        numbers.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/container/fleet/scopes/help b/gcloud/alpha/container/fleet/scopes/help
index 337ae0d9d..7abe956e3 100644
--- a/gcloud/alpha/container/fleet/scopes/help
+++ b/gcloud/alpha/container/fleet/scopes/help
@@ -25,6 +25,10 @@ GROUPS
 COMMANDS
     COMMAND is one of the following:
 
+     add-app-operator-binding
+        (ALPHA) Add project-level and fleet scope-level IAM bindings and create
+        a fleet scope RBAC role binding for an app operator principal.
+
      add-iam-policy-binding
         (ALPHA) Add IAM policy binding to a Fleet Scope.
 
diff --git a/gcloud/alpha/container/fleet/update b/gcloud/alpha/container/fleet/update
index eeb01540f..434a639c6 100644
--- a/gcloud/alpha/container/fleet/update
+++ b/gcloud/alpha/container/fleet/update
@@ -67,7 +67,7 @@ FLAGS
 
                 $ gcloud alpha container fleet update --security-posture=standard
 
-            SECURITY_POSTURE must be one of: disabled, standard.
+            SECURITY_POSTURE must be one of: disabled, standard, enterprise.
 
          --workload-vulnerability-scanning=WORKLOAD_VULNERABILITY_SCANNING
             To apply standard vulnerability scanning to clusters in the fleet,
diff --git a/gcloud/alpha/container/get-server-config b/gcloud/alpha/container/get-server-config
index 51d60e592..a373c3f99 100644
--- a/gcloud/alpha/container/get-server-config
+++ b/gcloud/alpha/container/get-server-config
@@ -21,13 +21,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 LIST COMMAND FLAGS
diff --git a/gcloud/alpha/container/hub/create b/gcloud/alpha/container/hub/create
index 2b492e646..beb41c179 100644
--- a/gcloud/alpha/container/hub/create
+++ b/gcloud/alpha/container/hub/create
@@ -66,7 +66,7 @@ FLAGS
 
                 $ gcloud alpha container hub create --security-posture=standard
 
-            SECURITY_POSTURE must be one of: disabled, standard.
+            SECURITY_POSTURE must be one of: disabled, standard, enterprise.
 
          --workload-vulnerability-scanning=WORKLOAD_VULNERABILITY_SCANNING
             To apply standard vulnerability scanning to clusters in the fleet,
diff --git a/gcloud/alpha/container/hub/scopes/add-app-operator-binding b/gcloud/alpha/container/hub/scopes/add-app-operator-binding
new file mode 100644
index 000000000..177637c1f
--- /dev/null
+++ b/gcloud/alpha/container/hub/scopes/add-app-operator-binding
@@ -0,0 +1,127 @@
+NAME
+    gcloud alpha container hub scopes add-app-operator-binding - add
+        project-level and fleet scope-level IAM bindings and create a fleet
+        scope RBAC role binding for an app operator principal
+
+SYNOPSIS
+    gcloud alpha container hub scopes add-app-operator-binding SCOPE
+        --role=ROLE (--group=GROUP | --user=USER) [--labels=[KEY=VALUE,...]]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) One binding consists of an app operator principal (user/group) and
+    a role (view/edit/admin).
+
+    This command sets up the different permissions required for an app
+    operator, including usage of fleet scopes, connect gateway, logging, and
+    metrics. The authoritative list for adding the permissions is the existing
+    RBAC role bindings under the specified scope.
+
+    This command can fail for the following reasons:
+      ▪ The scope specified does not exist.
+      ▪ The user does not have access to the specified scope.
+      ▪ The principal specified already has another binding for the scope.
+
+EXAMPLES
+    The following command:
+
+        $ gcloud alpha container hub scopes add-app-operator-binding SCOPE \
+            --role=view --group=people@google.com --project=PROJECT_ID
+
+      ▪ adds IAM policy binding: roles/gkehub.scopeViewer on SCOPE
+      ▪ adds IAM policy binding: roles/gkehub.scopeViewerProjectLevel on
+        PROJECT_ID
+      ▪ adds IAM policy binding: roles/logging.viewAccessor on PROJECT_ID
+        with condition where bucket corresponds to SCOPE
+      ▪ creates fleet scope RBAC role binding: role view with a random ID for
+        group people@google.com.
+
+    ---
+
+    The following command:
+
+        $ gcloud alpha container hub scopes add-app-operator-binding SCOPE \
+            --role=edit --user=person@google.com --project=PROJECT_ID
+
+      ▪ adds IAM policy binding: roles/gkehub.scopeEditor on SCOPE
+      ▪ adds IAM policy binding: roles/gkehub.scopeEditorProjectLevel on
+        PROJECT_ID
+      ▪ adds IAM policy binding: roles/logging.viewAccessor on PROJECT_ID
+        with condition where bucket corresponds to SCOPE
+      ▪ creates fleet scope RBAC role binding: role edit with a random ID for
+        user person@google.com.
+
+    ---
+
+    The following command:
+
+        $ gcloud alpha container hub scopes add-app-operator-binding SCOPE \
+            --role=admin --user=person@google.com --project=PROJECT_ID
+
+      ▪ adds IAM policy binding: roles/gkehub.scopeAdmin on SCOPE
+      ▪ adds IAM policy binding: roles/gkehub.scopeEditorProjectLevel on
+        PROJECT_ID
+      ▪ adds IAM policy binding: roles/logging.viewAccessor on PROJECT_ID
+        with condition where bucket corresponds to SCOPE
+      ▪ creates fleet scope RBAC role binding: role admin with a random ID
+        for user person@google.com.
+
+POSITIONAL ARGUMENTS
+     Scope resource - The group of arguments defining the Fleet Scope. This
+     represents a Cloud resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument SCOPE on the command line with a fully specified
+        name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     To set the location attribute:
+      ◆ provide the argument SCOPE on the command line with a fully specified
+        name;
+      ◆ global is the only supported location.
+
+     This must be specified.
+
+       SCOPE
+          ID of the scope or fully qualified identifier for the scope.
+
+          To set the scope attribute:
+          ▸ provide the argument SCOPE on the command line.
+
+REQUIRED FLAGS
+     --role=ROLE
+        Role to assign. ROLE must be one of: admin, edit, view.
+
+     Exactly one of these must be specified:
+
+       --group=GROUP
+          Group for the role binding.
+
+       --user=USER
+          User for the role binding.
+
+OPTIONAL FLAGS
+     --labels=[KEY=VALUE,...]
+        List of label KEY=VALUE pairs to add.
+
+        Keys must start with a lowercase character and contain only hyphens
+        (-), underscores (_), lowercase characters, and numbers. Values must
+        contain only hyphens (-), underscores (_), lowercase characters, and
+        numbers.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/container/hub/scopes/help b/gcloud/alpha/container/hub/scopes/help
index e96a80168..f340babd0 100644
--- a/gcloud/alpha/container/hub/scopes/help
+++ b/gcloud/alpha/container/hub/scopes/help
@@ -25,6 +25,10 @@ GROUPS
 COMMANDS
     COMMAND is one of the following:
 
+     add-app-operator-binding
+        (ALPHA) Add project-level and fleet scope-level IAM bindings and create
+        a fleet scope RBAC role binding for an app operator principal.
+
      add-iam-policy-binding
         (ALPHA) Add IAM policy binding to a Fleet Scope.
 
diff --git a/gcloud/alpha/container/hub/update b/gcloud/alpha/container/hub/update
index 3c311860e..94287c59b 100644
--- a/gcloud/alpha/container/hub/update
+++ b/gcloud/alpha/container/hub/update
@@ -67,7 +67,7 @@ FLAGS
 
                 $ gcloud alpha container hub update --security-posture=standard
 
-            SECURITY_POSTURE must be one of: disabled, standard.
+            SECURITY_POSTURE must be one of: disabled, standard, enterprise.
 
          --workload-vulnerability-scanning=WORKLOAD_VULNERABILITY_SCANNING
             To apply standard vulnerability scanning to clusters in the fleet,
diff --git a/gcloud/alpha/container/node-pools/complete-upgrade b/gcloud/alpha/container/node-pools/complete-upgrade
index 85e157c86..9016a6521 100644
--- a/gcloud/alpha/container/node-pools/complete-upgrade
+++ b/gcloud/alpha/container/node-pools/complete-upgrade
@@ -33,13 +33,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/alpha/container/node-pools/config/export b/gcloud/alpha/container/node-pools/config/export
index 229c2359e..1e50b45e9 100644
--- a/gcloud/alpha/container/node-pools/config/export
+++ b/gcloud/alpha/container/node-pools/config/export
@@ -99,13 +99,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/alpha/container/node-pools/config/help b/gcloud/alpha/container/node-pools/config/help
index 26fb78a55..08a5b4007 100644
--- a/gcloud/alpha/container/node-pools/config/help
+++ b/gcloud/alpha/container/node-pools/config/help
@@ -15,13 +15,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/alpha/container/node-pools/create b/gcloud/alpha/container/node-pools/create
index 8e58279c7..36e60b63a 100644
--- a/gcloud/alpha/container/node-pools/create
+++ b/gcloud/alpha/container/node-pools/create
@@ -21,10 +21,11 @@ SYNOPSIS
         [--enable-autorepair] [--no-enable-autoupgrade]
         [--enable-blue-green-upgrade] [--enable-confidential-nodes]
         [--enable-confidential-storage] [--enable-gvnic]
-        [--enable-image-streaming] [--enable-nested-virtualization]
-        [--enable-private-nodes] [--enable-queued-provisioning]
-        [--enable-surge-upgrade] [--image-type=IMAGE_TYPE]
-        [--labels=[KEY=VALUE,...]] [--linux-sysctls=KEY=VALUE,[KEY=VALUE,...]]
+        [--enable-image-streaming] [--enable-insecure-kubelet-readonly-port]
+        [--enable-nested-virtualization] [--enable-private-nodes]
+        [--enable-queued-provisioning] [--enable-surge-upgrade]
+        [--image-type=IMAGE_TYPE] [--labels=[KEY=VALUE,...]]
+        [--linux-sysctls=KEY=VALUE,[KEY=VALUE,...]]
         [--logging-variant=LOGGING_VARIANT]
         [--machine-type=MACHINE_TYPE, -m MACHINE_TYPE]
         [--max-pods-per-node=MAX_PODS_PER_NODE]
@@ -263,6 +264,12 @@ FLAGS
      --enable-image-streaming
         Specifies whether to enable image streaming on node pool.
 
+     --enable-insecure-kubelet-readonly-port
+        Enables the Kubelet's insecure read only port.
+
+        To disable the readonly port on a cluster or node-pool set the flag to
+        --no-enable-insecure-kubelet-readonly-port.
+
      --enable-nested-virtualization
         Enables the use of nested virtualization on the node pool. Defaults to
         false. Can only be enabled on UBUNTU_CONTAINERD base image or
@@ -1014,13 +1021,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
      Specifies the reservation for the node pool.
diff --git a/gcloud/alpha/container/node-pools/delete b/gcloud/alpha/container/node-pools/delete
index 938222a7b..fe820c9a7 100644
--- a/gcloud/alpha/container/node-pools/delete
+++ b/gcloud/alpha/container/node-pools/delete
@@ -40,13 +40,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/alpha/container/node-pools/describe b/gcloud/alpha/container/node-pools/describe
index ee0635688..f5fc7712a 100644
--- a/gcloud/alpha/container/node-pools/describe
+++ b/gcloud/alpha/container/node-pools/describe
@@ -30,13 +30,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/alpha/container/node-pools/help b/gcloud/alpha/container/node-pools/help
index be258b7e4..1e1d1dbdb 100644
--- a/gcloud/alpha/container/node-pools/help
+++ b/gcloud/alpha/container/node-pools/help
@@ -16,13 +16,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/alpha/container/node-pools/list b/gcloud/alpha/container/node-pools/list
index bd3a62746..f4ac3e5fd 100644
--- a/gcloud/alpha/container/node-pools/list
+++ b/gcloud/alpha/container/node-pools/list
@@ -26,13 +26,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 LIST COMMAND FLAGS
diff --git a/gcloud/alpha/container/node-pools/rollback b/gcloud/alpha/container/node-pools/rollback
index b50df04f9..8605c5bb2 100644
--- a/gcloud/alpha/container/node-pools/rollback
+++ b/gcloud/alpha/container/node-pools/rollback
@@ -41,13 +41,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/alpha/container/node-pools/update b/gcloud/alpha/container/node-pools/update
index 121057ae6..722bc9dfc 100644
--- a/gcloud/alpha/container/node-pools/update
+++ b/gcloud/alpha/container/node-pools/update
@@ -6,9 +6,9 @@ SYNOPSIS
     gcloud alpha container node-pools update NAME
         (--containerd-config-from-file=CONTAINERD_CONFIG_FROM_FILE
           | --enable-confidential-nodes | --enable-gvnic
-          | --enable-image-streaming | --enable-private-nodes
-          | --enable-queued-provisioning | --labels=[KEY=VALUE,...]
-          | --logging-variant=LOGGING_VARIANT
+          | --enable-image-streaming | --enable-insecure-kubelet-readonly-port
+          | --enable-private-nodes | --enable-queued-provisioning
+          | --labels=[KEY=VALUE,...] | --logging-variant=LOGGING_VARIANT
           | --network-performance-configs=[PROPERTY=VALUE,...]
           | --node-labels=[NODE_LABEL,...] | --node-locations=ZONE,[ZONE,...]
           | --node-taints=[NODE_TAINT,...]
@@ -72,6 +72,12 @@ REQUIRED FLAGS
        --enable-image-streaming
           Specifies whether to enable image streaming on node pool.
 
+       --enable-insecure-kubelet-readonly-port
+          Enables the Kubelet's insecure read only port.
+
+          To disable the readonly port on a cluster or node-pool set the flag
+          to --no-enable-insecure-kubelet-readonly-port.
+
        --enable-private-nodes
           Enables provisioning nodes with private IP addresses only.
 
@@ -497,13 +503,13 @@ OPTIONAL FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/alpha/container/operations/cancel b/gcloud/alpha/container/operations/cancel
index bd5b846fd..f17b6919e 100644
--- a/gcloud/alpha/container/operations/cancel
+++ b/gcloud/alpha/container/operations/cancel
@@ -31,13 +31,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/alpha/container/operations/describe b/gcloud/alpha/container/operations/describe
index 4bade324c..4a24a2bdf 100644
--- a/gcloud/alpha/container/operations/describe
+++ b/gcloud/alpha/container/operations/describe
@@ -23,13 +23,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/alpha/container/operations/help b/gcloud/alpha/container/operations/help
index 40740ed1d..8b11bf9fc 100644
--- a/gcloud/alpha/container/operations/help
+++ b/gcloud/alpha/container/operations/help
@@ -15,13 +15,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/alpha/container/operations/list b/gcloud/alpha/container/operations/list
index 95ed8d380..932df54f6 100644
--- a/gcloud/alpha/container/operations/list
+++ b/gcloud/alpha/container/operations/list
@@ -21,13 +21,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 LIST COMMAND FLAGS
diff --git a/gcloud/alpha/container/operations/wait b/gcloud/alpha/container/operations/wait
index b52187381..7b8d5955d 100644
--- a/gcloud/alpha/container/operations/wait
+++ b/gcloud/alpha/container/operations/wait
@@ -23,13 +23,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/alpha/iam/workforce-pools/providers/create-oidc b/gcloud/alpha/iam/workforce-pools/providers/create-oidc
index af4dff0f8..0f17b7add 100644
--- a/gcloud/alpha/iam/workforce-pools/providers/create-oidc
+++ b/gcloud/alpha/iam/workforce-pools/providers/create-oidc
@@ -286,7 +286,7 @@ OPTIONAL FLAGS
      --extra-attributes-type=EXTRA_ATTRIBUTES_TYPE
         Represents the identity provider and type of claims that should be
         fetched. EXTRA_ATTRIBUTES_TYPE must be one of:
-        attributes-type-unspecified, azure-ad-groups-mail.
+        attributes-type-unspecified, azure-ad-groups-id, azure-ad-groups-mail.
 
      --extra-attributes-filter=EXTRA_ATTRIBUTES_FILTER
         The filter used to request specific records from IdP. In case of
diff --git a/gcloud/alpha/iam/workforce-pools/providers/update-oidc b/gcloud/alpha/iam/workforce-pools/providers/update-oidc
index c6eb4112f..003ba3659 100644
--- a/gcloud/alpha/iam/workforce-pools/providers/update-oidc
+++ b/gcloud/alpha/iam/workforce-pools/providers/update-oidc
@@ -287,7 +287,8 @@ FLAGS
        --extra-attributes-type=EXTRA_ATTRIBUTES_TYPE
           Represents the identity provider and type of claims that should be
           fetched. EXTRA_ATTRIBUTES_TYPE must be one of:
-          attributes-type-unspecified, azure-ad-groups-mail.
+          attributes-type-unspecified, azure-ad-groups-id,
+          azure-ad-groups-mail.
 
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
diff --git a/gcloud/alpha/looker/instances/create b/gcloud/alpha/looker/instances/create
index c17cf1a88..375e50273 100644
--- a/gcloud/alpha/looker/instances/create
+++ b/gcloud/alpha/looker/instances/create
@@ -84,9 +84,6 @@ REQUIRED FLAGS
             exploration and development. Drive your business through
             operational analytics.
 
-         looker-modeler
-            Standalone Model Service.
-
          standard
             This edition provides a full-feature edition for product
             exploration and development. Exceptional for all your Analytics.
diff --git a/gcloud/alpha/managed-kafka/clusters/create b/gcloud/alpha/managed-kafka/clusters/create
new file mode 100644
index 000000000..dda3401a8
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/clusters/create
@@ -0,0 +1,113 @@
+NAME
+    gcloud alpha managed-kafka clusters create - create an Apache Kafka for
+        BigQuery cluster
+
+SYNOPSIS
+    gcloud alpha managed-kafka clusters create (CLUSTER : --location=LOCATION)
+        --cpu=CPU --memory=MEMORY --subnets=[SUBNETS,...] [--async]
+        [--auto-rebalance] [--encryption-key=ENCRYPTION_KEY]
+        [--labels=[KEY=VALUE,...]] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Create an Apache Kafka for BigQuery cluster.
+
+EXAMPLES
+    To create a cluster, run the following:
+
+        $ gcloud alpha managed-kafka clusters create mycluster \
+            --location=us-central1 --cpu=3 --memory=3GiB \
+            --subnets=projects/PROJECT_ID/regions/us-central1/subnetworks/\
+        default
+
+POSITIONAL ARGUMENTS
+     Cluster resource - Identifies the cluster for which the command runs. The
+     arguments in this group can be used to specify the attributes of this
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument cluster on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       CLUSTER
+          ID of the cluster or fully qualified identifier for the cluster.
+
+          To set the cluster attribute:
+          ▸ provide the argument cluster on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          ID of the location of the Apache Kafka for BigQuery resource. See
+          https://cloud.google.com/managed-kafka/docs/locations for a list of
+          supported locations.
+
+          To set the location attribute:
+          ▸ provide the argument cluster on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+REQUIRED FLAGS
+     --cpu=CPU
+        The number of vCPUs to provision for the cluster. The minimum is 3.
+
+     --memory=MEMORY
+        The memory to provision for the cluster in bytes. The value must be
+        between 1 GiB and 8 GiB per vCPU. Ex. 1024Mi, 4Gi.
+
+     --subnets=[SUBNETS,...]
+        VPC subnets from which the cluster is accessible. Both broker and
+        bootstrap server IP addresses and DNS entries are automatically created
+        in each subnet. The subnet must be located in the same region as the
+        cluster. The project may differ. A minimum of 1 subnet is required. A
+        maximum of 10 subnets can be specified. Use commas to separate multiple
+        subnets. The name of the subnet must be in the format
+        projects/PROJECT_ID/regions/REGION/subnetworks/SUBNET.
+
+OPTIONAL FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+     --auto-rebalance
+        Whether the automatic rebalancing is enabled. If automatic rebalancing
+        is enabled, topic partitions are rebalanced among brokers when the
+        number of CPUs in the cluster changes. Automatic rebalancing is enabled
+        by default. Use --no-auto-rebalance to disable this flag.
+
+     --encryption-key=ENCRYPTION_KEY
+        The relative resource path of the Cloud KMS key to use for encryption
+        in the form:
+        projects/PROJECT_ID/locations/LOCATION/keyRings/KEY_RING/cryptoKeys/KEY.
+        The key must be located in the same region as the cluster. The key
+        cannot be changed once set.
+
+     --labels=[KEY=VALUE,...]
+        List of label KEY=VALUE pairs to add. Keys must start with a lowercase
+        character and contain only hyphens (-), underscores (), lowercase
+        characters, and numbers. Values must contain only hyphens (-),
+        underscores (), lowercase characters, and numbers.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the managedkafka/v1 API. The full documentation for this
+    API can be found at: https://cloud.google.com/managed-kafka
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/managed-kafka/clusters/delete b/gcloud/alpha/managed-kafka/clusters/delete
new file mode 100644
index 000000000..0b7dc9039
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/clusters/delete
@@ -0,0 +1,74 @@
+NAME
+    gcloud alpha managed-kafka clusters delete - delete an Apache Kafka for
+        BigQuery cluster
+
+SYNOPSIS
+    gcloud alpha managed-kafka clusters delete (CLUSTER : --location=LOCATION)
+        [--async] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Delete an Apache Kafka for BigQuery cluster.
+
+EXAMPLES
+    To delete a cluster named mycluster located in us-central1, run the
+    following:
+
+        $ gcloud alpha managed-kafka clusters delete mycluster \
+            --location=us-central1
+
+POSITIONAL ARGUMENTS
+     Cluster resource - Identifies the cluster for deletion. The arguments in
+     this group can be used to specify the attributes of this resource. (NOTE)
+     Some attributes are not given arguments in this group but can be set in
+     other ways.
+
+     To set the project attribute:
+      ◆ provide the argument cluster on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       CLUSTER
+          ID of the cluster or fully qualified identifier for the cluster.
+
+          To set the cluster attribute:
+          ▸ provide the argument cluster on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          ID of the location of the Apache Kafka for BigQuery resource. See
+          https://cloud.google.com/managed-kafka/docs/locations for a list of
+          supported locations.
+
+          To set the location attribute:
+          ▸ provide the argument cluster on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the managedkafka/v1 API. The full documentation for this
+    API can be found at: https://cloud.google.com/managed-kafka
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/managed-kafka/clusters/describe b/gcloud/alpha/managed-kafka/clusters/describe
new file mode 100644
index 000000000..9073fda44
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/clusters/describe
@@ -0,0 +1,69 @@
+NAME
+    gcloud alpha managed-kafka clusters describe - describe an Apache Kafka for
+        BigQuery cluster
+
+SYNOPSIS
+    gcloud alpha managed-kafka clusters describe
+        (CLUSTER : --location=LOCATION) [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Describe an Apache Kafka for BigQuery cluster.
+
+EXAMPLES
+    To describe a cluster named mycluster located in us-central1, run the
+    following:
+
+        $ gcloud alpha managed-kafka clusters describe mycluster \
+            --location=us-central1
+
+POSITIONAL ARGUMENTS
+     Cluster resource - Identifies the cluster for details to be displayed. The
+     arguments in this group can be used to specify the attributes of this
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument cluster on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       CLUSTER
+          ID of the cluster or fully qualified identifier for the cluster.
+
+          To set the cluster attribute:
+          ▸ provide the argument cluster on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          ID of the location of the Apache Kafka for BigQuery resource. See
+          https://cloud.google.com/managed-kafka/docs/locations for a list of
+          supported locations.
+
+          To set the location attribute:
+          ▸ provide the argument cluster on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the managedkafka/v1 API. The full documentation for this
+    API can be found at: https://cloud.google.com/managed-kafka
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/managed-kafka/clusters/help b/gcloud/alpha/managed-kafka/clusters/help
new file mode 100644
index 000000000..575eea3fd
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/clusters/help
@@ -0,0 +1,40 @@
+NAME
+    gcloud alpha managed-kafka clusters - administer Apache Kafka for BigQuery
+        clusters
+
+SYNOPSIS
+    gcloud alpha managed-kafka clusters COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Administer Apache Kafka for BigQuery clusters.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     create
+        (ALPHA) Create an Apache Kafka for BigQuery cluster.
+
+     delete
+        (ALPHA) Delete an Apache Kafka for BigQuery cluster.
+
+     describe
+        (ALPHA) Describe an Apache Kafka for BigQuery cluster.
+
+     list
+        (ALPHA) List all Apache Kafka for BigQuery clusters in a given
+        location.
+
+     update
+        (ALPHA) Update an Apache Kafka for BigQuery cluster.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/managed-kafka/clusters/list b/gcloud/alpha/managed-kafka/clusters/list
new file mode 100644
index 000000000..2016cef6f
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/clusters/list
@@ -0,0 +1,82 @@
+NAME
+    gcloud alpha managed-kafka clusters list - list all Apache Kafka for
+        BigQuery clusters in a given location
+
+SYNOPSIS
+    gcloud alpha managed-kafka clusters list --location=LOCATION
+        [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
+        [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) List all Apache Kafka for BigQuery clusters in a given location. To
+    specify the maximum number of clusters to list, use the --limit flag.
+
+EXAMPLES
+    To list all clusters in a given location, such as us-central1, run the
+    following:
+
+        $ gcloud alpha managed-kafka clusters list --location=us-central1
+
+REQUIRED FLAGS
+     Location resource - Identifies the region which contains all the clusters
+     to be listed. This represents a Cloud resource. (NOTE) Some attributes are
+     not given arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument --location on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       --location=LOCATION
+          ID of the location or fully qualified identifier for the location.
+
+          To set the location attribute:
+          ▸ provide the argument --location on the command line.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the managedkafka/v1 API. The full documentation for this
+    API can be found at: https://cloud.google.com/managed-kafka
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/managed-kafka/clusters/update b/gcloud/alpha/managed-kafka/clusters/update
new file mode 100644
index 000000000..9fc4f04d7
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/clusters/update
@@ -0,0 +1,107 @@
+NAME
+    gcloud alpha managed-kafka clusters update - update an Apache Kafka for
+        BigQuery cluster
+
+SYNOPSIS
+    gcloud alpha managed-kafka clusters update (CLUSTER : --location=LOCATION)
+        (--auto-rebalance --cpu=CPU
+          --labels=[KEY=VALUE,...] --memory=MEMORY --subnets=[SUBNETS,...])
+        [--async] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Update an Apache Kafka for BigQuery cluster.
+
+EXAMPLES
+    To update an attribute in a cluster named mycluster located in us-central1,
+    such as the CPU, run the following:
+
+        $ gcloud alpha managed-kafka clusters update mycluster \
+            --location=us-central1 --cpu=3
+
+POSITIONAL ARGUMENTS
+     Cluster resource - Identifies the cluster to be updated. The arguments in
+     this group can be used to specify the attributes of this resource. (NOTE)
+     Some attributes are not given arguments in this group but can be set in
+     other ways.
+
+     To set the project attribute:
+      ◆ provide the argument cluster on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       CLUSTER
+          ID of the cluster or fully qualified identifier for the cluster.
+
+          To set the cluster attribute:
+          ▸ provide the argument cluster on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          ID of the location of the Apache Kafka for BigQuery resource. See
+          https://cloud.google.com/managed-kafka/docs/locations for a list of
+          supported locations.
+
+          To set the location attribute:
+          ▸ provide the argument cluster on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+REQUIRED FLAGS
+     At least one of these must be specified:
+
+       --auto-rebalance
+          Whether the automatic rebalancing is enabled. If automatic
+          rebalancing is enabled, topic partitions are rebalanced among brokers
+          when the number of CPUs in the cluster changes. Automatic rebalancing
+          is enabled by default. Use --no-auto-rebalance to disable this flag.
+
+       --cpu=CPU
+          The number of vCPUs to provision for the cluster. The minimum is 3.
+
+       --labels=[KEY=VALUE,...]
+          List of label KEY=VALUE pairs to add. Keys must start with a
+          lowercase character and contain only hyphens (-), underscores (),
+          lowercase characters, and numbers. Values must contain only hyphens
+          (-), underscores (), lowercase characters, and numbers.
+
+       --memory=MEMORY
+          The memory to provision for the cluster in bytes. The value must be
+          between 1 GiB and 8 GiB per vCPU. Ex. 1024Mi, 4Gi.
+
+       --subnets=[SUBNETS,...]
+          VPC subnets from which the cluster is accessible. Both broker and
+          bootstrap server IP addresses and DNS entries are automatically
+          created in each subnet. The subnet must be located in the same region
+          as the cluster. The project may differ. A minimum of 1 subnet is
+          required. A maximum of 10 subnets can be specified. Use commas to
+          separate multiple subnets. The name of the subnet must be in the
+          format projects/PROJECT_ID/regions/REGION/subnetworks/SUBNET.
+
+OPTIONAL FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the managedkafka/v1 API. The full documentation for this
+    API can be found at: https://cloud.google.com/managed-kafka
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/managed-kafka/consumer-groups/delete b/gcloud/alpha/managed-kafka/consumer-groups/delete
new file mode 100644
index 000000000..726887361
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/consumer-groups/delete
@@ -0,0 +1,79 @@
+NAME
+    gcloud alpha managed-kafka consumer-groups delete - delete an Apache Kafka
+        for BigQuery consumer group
+
+SYNOPSIS
+    gcloud alpha managed-kafka consumer-groups delete
+        (CONSUMER_GROUP : --cluster=CLUSTER --location=LOCATION)
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Delete an Apache Kafka for BigQuery consumer group.
+
+EXAMPLES
+    To delete a consumer group in a cluster named mycluster located in
+    us-central1, run the following:
+
+        $ gcloud alpha managed-kafka consumer-groups delete \
+            myconsumergroup --cluster=mycluster --location=us-central1
+
+POSITIONAL ARGUMENTS
+     Consumer group resource - Identifies the consumer group for deletion. The
+     arguments in this group can be used to specify the attributes of this
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument consumer_group on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       CONSUMER_GROUP
+          ID of the consumer_group or fully qualified identifier for the
+          consumer_group.
+
+          To set the consumer_group attribute:
+          ▸ provide the argument consumer_group on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --cluster=CLUSTER
+          The cluster name.
+
+          To set the cluster attribute:
+          ▸ provide the argument consumer_group on the command line with a
+            fully specified name;
+          ▸ provide the argument --cluster on the command line.
+
+       --location=LOCATION
+          ID of the location of the Apache Kafka for BigQuery resource. See
+          https://cloud.google.com/managed-kafka/docs/locations for a list of
+          supported locations.
+
+          To set the location attribute:
+          ▸ provide the argument consumer_group on the command line with a
+            fully specified name;
+          ▸ provide the argument --location on the command line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the managedkafka/v1 API. The full documentation for this
+    API can be found at: https://cloud.google.com/managed-kafka
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/managed-kafka/consumer-groups/describe b/gcloud/alpha/managed-kafka/consumer-groups/describe
new file mode 100644
index 000000000..d15dcd2f0
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/consumer-groups/describe
@@ -0,0 +1,79 @@
+NAME
+    gcloud alpha managed-kafka consumer-groups describe - describe an Apache
+        Kafka for BigQuery consumer group
+
+SYNOPSIS
+    gcloud alpha managed-kafka consumer-groups describe
+        (CONSUMER_GROUP : --cluster=CLUSTER --location=LOCATION)
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Describe an Apache Kafka for BigQuery consumer group.
+
+EXAMPLES
+    To describe a consumer group in a cluster named mycluster located in
+    us-central1, run the following:
+
+        $ gcloud alpha managed-kafka consumer-groups describe \
+            myconsumergroup --cluster=mycluster --location=us-central1
+
+POSITIONAL ARGUMENTS
+     Consumer group resource - Identifies the consumer group for details to be
+     displayed. The arguments in this group can be used to specify the
+     attributes of this resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument consumer_group on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       CONSUMER_GROUP
+          ID of the consumer_group or fully qualified identifier for the
+          consumer_group.
+
+          To set the consumer_group attribute:
+          ▸ provide the argument consumer_group on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --cluster=CLUSTER
+          The cluster name.
+
+          To set the cluster attribute:
+          ▸ provide the argument consumer_group on the command line with a
+            fully specified name;
+          ▸ provide the argument --cluster on the command line.
+
+       --location=LOCATION
+          ID of the location of the Apache Kafka for BigQuery resource. See
+          https://cloud.google.com/managed-kafka/docs/locations for a list of
+          supported locations.
+
+          To set the location attribute:
+          ▸ provide the argument consumer_group on the command line with a
+            fully specified name;
+          ▸ provide the argument --location on the command line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the managedkafka/v1 API. The full documentation for this
+    API can be found at: https://cloud.google.com/managed-kafka
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/managed-kafka/consumer-groups/help b/gcloud/alpha/managed-kafka/consumer-groups/help
new file mode 100644
index 000000000..987ddec87
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/consumer-groups/help
@@ -0,0 +1,37 @@
+NAME
+    gcloud alpha managed-kafka consumer-groups - administer Apache Kafka for
+        BigQuery consumer groups
+
+SYNOPSIS
+    gcloud alpha managed-kafka consumer-groups COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Administer Apache Kafka for BigQuery consumer groups.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     delete
+        (ALPHA) Delete an Apache Kafka for BigQuery consumer group.
+
+     describe
+        (ALPHA) Describe an Apache Kafka for BigQuery consumer group.
+
+     list
+        (ALPHA) List all Apache Kafka for BigQuery consumer groups in a given
+        cluster and location.
+
+     update
+        (ALPHA) Update an Apache Kafka for BigQuery consumer group.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/managed-kafka/consumer-groups/list b/gcloud/alpha/managed-kafka/consumer-groups/list
new file mode 100644
index 000000000..68cd7845b
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/consumer-groups/list
@@ -0,0 +1,98 @@
+NAME
+    gcloud alpha managed-kafka consumer-groups list - list all Apache Kafka for
+        BigQuery consumer groups in a given cluster and location
+
+SYNOPSIS
+    gcloud alpha managed-kafka consumer-groups list
+        (CLUSTER : --location=LOCATION) [--filter=EXPRESSION] [--limit=LIMIT]
+        [--page-size=PAGE_SIZE] [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) List all Apache Kafka for BigQuery consumer groups in a given
+    cluster and location. To specify the maximum number of consumer groups to
+    list, use the --limit flag.
+
+EXAMPLES
+    To list all consumer groups in a cluster named mycluster located in
+    us-central1, run the following:
+
+        $ gcloud alpha managed-kafka consumer-groups list mycluster \
+            --location=us-central1
+
+POSITIONAL ARGUMENTS
+     Cluster resource - Identifies the cluster which contains all the consumer
+     groups to be listed. The arguments in this group can be used to specify
+     the attributes of this resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument cluster on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       CLUSTER
+          ID of the cluster or fully qualified identifier for the cluster.
+
+          To set the cluster attribute:
+          ▸ provide the argument cluster on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          ID of the location of the Apache Kafka for BigQuery resource. See
+          https://cloud.google.com/managed-kafka/docs/locations for a list of
+          supported locations.
+
+          To set the location attribute:
+          ▸ provide the argument cluster on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the managedkafka/v1 API. The full documentation for this
+    API can be found at: https://cloud.google.com/managed-kafka
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/managed-kafka/consumer-groups/update b/gcloud/alpha/managed-kafka/consumer-groups/update
new file mode 100644
index 000000000..644b861f9
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/consumer-groups/update
@@ -0,0 +1,103 @@
+NAME
+    gcloud alpha managed-kafka consumer-groups update - update an Apache Kafka
+        for BigQuery consumer group
+
+SYNOPSIS
+    gcloud alpha managed-kafka consumer-groups update
+        (CONSUMER_GROUP : --cluster=CLUSTER --location=LOCATION)
+        --topics-file=JSON|YAML|FILE [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Update an Apache Kafka for BigQuery consumer group.
+
+EXAMPLES
+    To specify a file for updating the topics of a consumer group, run the
+    following:
+
+        $gcloud alpha managed-kafka consumer-groups update myconsumergroup |
+            --cluster=mycluster \
+            --location=us-central1 \
+            --topics-file=topics.json
+
+    To update the topics of a consumer group with inline JSON, run the
+    following:
+
+        $gcloud alpha managed-kafka consumer-groups update myconsumergroup |
+            --cluster=mycluster \
+            --location=us-central1 \
+            --topics-file='{"topic":{"partitions":{"0":{"offset":1,"metadata":"metadata"}}}}'
+
+POSITIONAL ARGUMENTS
+     Consumer group resource - Identifies the consumer group to be updated. The
+     arguments in this group can be used to specify the attributes of this
+     resource. (NOTE) Some attributes are not given arguments in this group but
+     can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument consumer_group on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       CONSUMER_GROUP
+          ID of the consumer_group or fully qualified identifier for the
+          consumer_group.
+
+          To set the consumer_group attribute:
+          ▸ provide the argument consumer_group on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --cluster=CLUSTER
+          The cluster name.
+
+          To set the cluster attribute:
+          ▸ provide the argument consumer_group on the command line with a
+            fully specified name;
+          ▸ provide the argument --cluster on the command line.
+
+       --location=LOCATION
+          ID of the location of the Apache Kafka for BigQuery resource. See
+          https://cloud.google.com/managed-kafka/docs/locations for a list of
+          supported locations.
+
+          To set the location attribute:
+          ▸ provide the argument consumer_group on the command line with a
+            fully specified name;
+          ▸ provide the argument --location on the command line.
+
+REQUIRED FLAGS
+     --topics-file=JSON|YAML|FILE
+        The path to the JSON or YAML file containing the configuration of the
+        topics to be updated for the consumer group. This also supports inline
+        JSON or YAML. Required, Sets topics_file value.
+
+        Input Example:
+
+            --topics-file=string
+
+        File Example:
+
+            --topics-file=path_to_file.(yaml|json)
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the managedkafka/v1 API. The full documentation for this
+    API can be found at: https://cloud.google.com/managed-kafka
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/managed-kafka/help b/gcloud/alpha/managed-kafka/help
new file mode 100644
index 000000000..d6a5cbb08
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/help
@@ -0,0 +1,34 @@
+NAME
+    gcloud alpha managed-kafka - administer Apache Kafka for BigQuery clusters,
+        topics, and consumer groups
+
+SYNOPSIS
+    gcloud alpha managed-kafka GROUP [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Administer Apache Kafka for BigQuery clusters, topics, and consumer
+    groups.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+GROUPS
+    GROUP is one of the following:
+
+     clusters
+        (ALPHA) Administer Apache Kafka for BigQuery clusters.
+
+     consumer-groups
+        (ALPHA) Administer Apache Kafka for BigQuery consumer groups.
+
+     topics
+        (ALPHA) Administer Apache Kafka for BigQuery topics.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/managed-kafka/topics/create b/gcloud/alpha/managed-kafka/topics/create
new file mode 100644
index 000000000..e480405d1
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/topics/create
@@ -0,0 +1,96 @@
+NAME
+    gcloud alpha managed-kafka topics create - create an Apache Kafka for
+        BigQuery topic
+
+SYNOPSIS
+    gcloud alpha managed-kafka topics create
+        (TOPIC : --cluster=CLUSTER --location=LOCATION) --partitions=PARTITIONS
+        --replication-factor=REPLICATION_FACTOR [--configs=[KEY=VALUE,...]]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Create an Apache Kafka for BigQuery topic.
+
+EXAMPLES
+    To create a topic in a cluster named mycluster located in us-central1, run
+    the following:
+
+        $ gcloud alpha managed-kafka topics create mytopic \
+            --cluster=mycluster --location=us-central1 --partitions=1 \
+            --replication-factor=3
+
+POSITIONAL ARGUMENTS
+     Topic resource - Identifies the name of the topic that this command
+     creates. The arguments in this group can be used to specify the attributes
+     of this resource. (NOTE) Some attributes are not given arguments in this
+     group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument topic on the command line with a fully specified
+        name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       TOPIC
+          ID of the topic or fully qualified identifier for the topic.
+
+          To set the topic attribute:
+          ▸ provide the argument topic on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --cluster=CLUSTER
+          The cluster name.
+
+          To set the cluster attribute:
+          ▸ provide the argument topic on the command line with a fully
+            specified name;
+          ▸ provide the argument --cluster on the command line.
+
+       --location=LOCATION
+          ID of the location of the Apache Kafka for BigQuery resource. See
+          https://cloud.google.com/managed-kafka/docs/locations for a list of
+          supported locations.
+
+          To set the location attribute:
+          ▸ provide the argument topic on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+REQUIRED FLAGS
+     --partitions=PARTITIONS
+        The number of partitions in a topic. You can increase the partition
+        count for a topic, but you cannot decrease it. Increasing partitions
+        for a topic that uses a key might change how messages are distributed.
+
+     --replication-factor=REPLICATION_FACTOR
+        The number of replicas of each partition. A replication factor of 3 is
+        recommended for high availability.
+
+OPTIONAL FLAGS
+     --configs=[KEY=VALUE,...]
+        Configuration for the topic that are overridden from the cluster
+        defaults. The key of the map is a Kafka topic property name, for
+        example: cleanup.policy=compact, compression.type=producer.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the managedkafka/v1 API. The full documentation for this
+    API can be found at: https://cloud.google.com/managed-kafka
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/managed-kafka/topics/delete b/gcloud/alpha/managed-kafka/topics/delete
new file mode 100644
index 000000000..2347eedc0
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/topics/delete
@@ -0,0 +1,77 @@
+NAME
+    gcloud alpha managed-kafka topics delete - delete an Apache Kafka for
+        BigQuery topic
+
+SYNOPSIS
+    gcloud alpha managed-kafka topics delete
+        (TOPIC : --cluster=CLUSTER --location=LOCATION) [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Delete an Apache Kafka for BigQuery topic.
+
+EXAMPLES
+    To delete a topic in a cluster named mycluster located in us-central1, run
+    the following:
+
+        $ gcloud alpha managed-kafka topics delete mytopic \
+            --cluster=mycluster --location=us-central1
+
+POSITIONAL ARGUMENTS
+     Topic resource - Identifies the topic for deletion. The arguments in this
+     group can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways.
+
+     To set the project attribute:
+      ◆ provide the argument topic on the command line with a fully specified
+        name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       TOPIC
+          ID of the topic or fully qualified identifier for the topic.
+
+          To set the topic attribute:
+          ▸ provide the argument topic on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --cluster=CLUSTER
+          The cluster name.
+
+          To set the cluster attribute:
+          ▸ provide the argument topic on the command line with a fully
+            specified name;
+          ▸ provide the argument --cluster on the command line.
+
+       --location=LOCATION
+          ID of the location of the Apache Kafka for BigQuery resource. See
+          https://cloud.google.com/managed-kafka/docs/locations for a list of
+          supported locations.
+
+          To set the location attribute:
+          ▸ provide the argument topic on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the managedkafka/v1 API. The full documentation for this
+    API can be found at: https://cloud.google.com/managed-kafka
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/managed-kafka/topics/describe b/gcloud/alpha/managed-kafka/topics/describe
new file mode 100644
index 000000000..a09b164f4
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/topics/describe
@@ -0,0 +1,77 @@
+NAME
+    gcloud alpha managed-kafka topics describe - describe an Apache Kafka for
+        BigQuery topic
+
+SYNOPSIS
+    gcloud alpha managed-kafka topics describe
+        (TOPIC : --cluster=CLUSTER --location=LOCATION) [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Describe an Apache Kafka for BigQuery topic.
+
+EXAMPLES
+    To describe a topic in a cluster named mycluster located in us-central1,
+    run the following:
+
+        $ gcloud alpha managed-kafka topics describe mytopic \
+            --cluster=mycluster --location=us-central1
+
+POSITIONAL ARGUMENTS
+     Topic resource - The describe command displays properties of the topic
+     specified by this parameter. The arguments in this group can be used to
+     specify the attributes of this resource. (NOTE) Some attributes are not
+     given arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument topic on the command line with a fully specified
+        name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       TOPIC
+          ID of the topic or fully qualified identifier for the topic.
+
+          To set the topic attribute:
+          ▸ provide the argument topic on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --cluster=CLUSTER
+          The cluster name.
+
+          To set the cluster attribute:
+          ▸ provide the argument topic on the command line with a fully
+            specified name;
+          ▸ provide the argument --cluster on the command line.
+
+       --location=LOCATION
+          ID of the location of the Apache Kafka for BigQuery resource. See
+          https://cloud.google.com/managed-kafka/docs/locations for a list of
+          supported locations.
+
+          To set the location attribute:
+          ▸ provide the argument topic on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the managedkafka/v1 API. The full documentation for this
+    API can be found at: https://cloud.google.com/managed-kafka
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/managed-kafka/topics/help b/gcloud/alpha/managed-kafka/topics/help
new file mode 100644
index 000000000..88ab04bcb
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/topics/help
@@ -0,0 +1,39 @@
+NAME
+    gcloud alpha managed-kafka topics - administer Apache Kafka for BigQuery
+        topics
+
+SYNOPSIS
+    gcloud alpha managed-kafka topics COMMAND [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Administer Apache Kafka for BigQuery topics.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     create
+        (ALPHA) Create an Apache Kafka for BigQuery topic.
+
+     delete
+        (ALPHA) Delete an Apache Kafka for BigQuery topic.
+
+     describe
+        (ALPHA) Describe an Apache Kafka for BigQuery topic.
+
+     list
+        (ALPHA) List all Apache Kafka for BigQuery topics in a given cluster.
+
+     update
+        (ALPHA) Update an Apache Kafka for BigQuery topic.
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/managed-kafka/topics/list b/gcloud/alpha/managed-kafka/topics/list
new file mode 100644
index 000000000..01bb27088
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/topics/list
@@ -0,0 +1,97 @@
+NAME
+    gcloud alpha managed-kafka topics list - list all Apache Kafka for BigQuery
+        topics in a given cluster
+
+SYNOPSIS
+    gcloud alpha managed-kafka topics list (CLUSTER : --location=LOCATION)
+        [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
+        [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) List all Apache Kafka for BigQuery topics in a given cluster. To
+    specify the maximum number of topics to list, use the --limit flag.
+
+EXAMPLES
+    To list all topics in a cluster named mycluster located in us-central1, run
+    the following:
+
+        $ gcloud alpha managed-kafka topics list mycluster \
+            --location=us-central1
+
+POSITIONAL ARGUMENTS
+     Cluster resource - Identifies the cluster which contains all the topics to
+     be listed. The arguments in this group can be used to specify the
+     attributes of this resource. (NOTE) Some attributes are not given
+     arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument cluster on the command line with a fully
+        specified name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       CLUSTER
+          ID of the cluster or fully qualified identifier for the cluster.
+
+          To set the cluster attribute:
+          ▸ provide the argument cluster on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --location=LOCATION
+          ID of the location of the Apache Kafka for BigQuery resource. See
+          https://cloud.google.com/managed-kafka/docs/locations for a list of
+          supported locations.
+
+          To set the location attribute:
+          ▸ provide the argument cluster on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the managedkafka/v1 API. The full documentation for this
+    API can be found at: https://cloud.google.com/managed-kafka
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/managed-kafka/topics/update b/gcloud/alpha/managed-kafka/topics/update
new file mode 100644
index 000000000..a19513759
--- /dev/null
+++ b/gcloud/alpha/managed-kafka/topics/update
@@ -0,0 +1,93 @@
+NAME
+    gcloud alpha managed-kafka topics update - update an Apache Kafka for
+        BigQuery topic
+
+SYNOPSIS
+    gcloud alpha managed-kafka topics update
+        (TOPIC : --cluster=CLUSTER --location=LOCATION)
+        (--configs=[KEY=VALUE,...] --partitions=PARTITIONS)
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (ALPHA) Update an Apache Kafka for BigQuery topic.
+
+EXAMPLES
+    To update an attribute in a topic, such as the partitions, for a cluster
+    named mycluster located in us-central1, run the following:
+
+        $ gcloud alpha managed-kafka topics update mytopic \
+            --cluster=mycluster --location=us-central1 --partitions=3
+
+POSITIONAL ARGUMENTS
+     Topic resource - Identifies the topic to be updated. The arguments in this
+     group can be used to specify the attributes of this resource. (NOTE) Some
+     attributes are not given arguments in this group but can be set in other
+     ways.
+
+     To set the project attribute:
+      ◆ provide the argument topic on the command line with a fully specified
+        name;
+      ◆ provide the argument --project on the command line;
+      ◆ set the property core/project.
+
+     This must be specified.
+
+       TOPIC
+          ID of the topic or fully qualified identifier for the topic.
+
+          To set the topic attribute:
+          ▸ provide the argument topic on the command line.
+
+          This positional argument must be specified if any of the other
+          arguments in this group are specified.
+
+       --cluster=CLUSTER
+          The cluster name.
+
+          To set the cluster attribute:
+          ▸ provide the argument topic on the command line with a fully
+            specified name;
+          ▸ provide the argument --cluster on the command line.
+
+       --location=LOCATION
+          ID of the location of the Apache Kafka for BigQuery resource. See
+          https://cloud.google.com/managed-kafka/docs/locations for a list of
+          supported locations.
+
+          To set the location attribute:
+          ▸ provide the argument topic on the command line with a fully
+            specified name;
+          ▸ provide the argument --location on the command line.
+
+REQUIRED FLAGS
+     At least one of these must be specified:
+
+       --configs=[KEY=VALUE,...]
+          Configuration for the topic that are overridden from the cluster
+          defaults. The key of the map is a Kafka topic property name, for
+          example: cleanup.policy=compact, compression.type=producer.
+
+       --partitions=PARTITIONS
+          The number of partitions in a topic. You can increase the partition
+          count for a topic, but you cannot decrease it. Increasing partitions
+          for a topic that uses a key might change how messages are
+          distributed.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the managedkafka/v1 API. The full documentation for this
+    API can be found at: https://cloud.google.com/managed-kafka
+
+NOTES
+    This command is currently in alpha and might change without notice. If this
+    command fails with API permission errors despite specifying the correct
+    project, you might be trying to access an API with an invitation-only early
+    access allowlist.
+
diff --git a/gcloud/alpha/network-connectivity/help b/gcloud/alpha/network-connectivity/help
index 85465e7c6..dd00fed2b 100644
--- a/gcloud/alpha/network-connectivity/help
+++ b/gcloud/alpha/network-connectivity/help
@@ -23,7 +23,7 @@ GROUPS
         (ALPHA) Manage internal ranges.
 
      policy-based-routes
-        (ALPHA) Manage Policy Based Routes.
+        (ALPHA) Manage Policy-based Routes.
 
      spokes
         (ALPHA) Manage Network Connectivity Center spokes.
diff --git a/gcloud/alpha/network-connectivity/policy-based-routes/create b/gcloud/alpha/network-connectivity/policy-based-routes/create
index 80ad6f4fe..baa2f6984 100644
--- a/gcloud/alpha/network-connectivity/policy-based-routes/create
+++ b/gcloud/alpha/network-connectivity/policy-based-routes/create
@@ -1,6 +1,6 @@
 NAME
     gcloud alpha network-connectivity policy-based-routes create - create a new
-        policy based route
+        policy-based route
 
 SYNOPSIS
     gcloud alpha network-connectivity policy-based-routes create
@@ -8,7 +8,7 @@ SYNOPSIS
         [--description=DESCRIPTION] [--destination-range=DESTINATION_RANGE]
         [--ip-protocol=IP_PROTOCOL] [--labels=[KEY=VALUE,...]]
         [--priority=PRIORITY]
-        [--protocol-version=PROTOCOL_VERSION; default="IPv4"]
+        [--protocol-version=PROTOCOL_VERSION; default="IPV4"]
         [--source-range=SOURCE_RANGE]
         [--interconnect-attachment-region=INTERCONNECT_ATTACHMENT_REGION
           | --tags=[TAGS,...]]
@@ -17,18 +17,18 @@ SYNOPSIS
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) Create a new policy based route with the given name.
+    (ALPHA) Create a new policy-based route with the given name.
 
 EXAMPLES
-    To create a policy based route with the name my-pbr to route all l4 traffic
-    in default network to a ilb with vip 10.0.0.1, run:
+    To create a policy-based route with the name my-pbr to route all traffic in
+    default network to an internal load balancer with IP 10.0.0.1, run:
 
         $ gcloud alpha network-connectivity policy-based-routes create \
             my-pbr --network="projects/my-project/global/networks/default" \
             --next-hop-ilb-ip=10.0.0.1
 
 POSITIONAL ARGUMENTS
-     Policy based route resource - Name of the policy based route to be
+     Policy based route resource - Name of the policy-based route to be
      created. This represents a Cloud resource. (NOTE) Some attributes are not
      given arguments in this group but can be set in other ways.
 
@@ -62,11 +62,11 @@ OPTIONAL FLAGS
         create the resource.
 
      --destination-range=DESTINATION_RANGE
-        Destination IP range of outgoing packets that this policy based route
+        Destination IP range of outgoing packets that this policy-based route
         applies to.
 
      --ip-protocol=IP_PROTOCOL
-        IP protocol that this policy based route applies to. Valid values are
+        IP protocol that this policy-based route applies to. Valid values are
         TCP, UDP, and ALL. Default is ALL.
 
      --labels=[KEY=VALUE,...]
@@ -78,38 +78,38 @@ OPTIONAL FLAGS
         numbers.
 
      --priority=PRIORITY
-        Priority of this policy based route. Priority is used to break ties in
-        cases where there are more than one matching policy based routes found.
-        In cases where multiple policy based routes are matched, the one with
+        Priority of this policy-based route. Priority is used to break ties in
+        cases where there are more than one matching policy-based routes found.
+        In cases where multiple policy-based routes are matched, the one with
         the lowest-numbered priority value wins. The default value is 1000. The
         priority value must be from 1 to 65535, inclusive. Note the priority of
-        policy based route is always higher than other types of route (e.g.
+        policy-based route is always higher than other types of route (e.g.
         static routes/advanced routes)
 
-     --protocol-version=PROTOCOL_VERSION; default="IPv4"
-        Internet protocol versions this policy based route applies to. For this
-        version, only IPV4 is supported. PROTOCOL_VERSION must be one of: ipv4,
-        protocol-version-unspecified.
+     --protocol-version=PROTOCOL_VERSION; default="IPV4"
+        Internet protocol versions that this policy-based route applies to.
+        Valid values are IPV4, and IPV6. Default is IPV4'. PROTOCOL_VERSION
+        must be one of: *ipv4*, *ipv6*, *protocol-version-unspecified*.
 
      --source-range=SOURCE_RANGE
-        Source IP range of outgoing packets that this policy based route
+        Source IP range of outgoing packets that this policy-based route
         applies to.
 
      At most one of these can be specified:
 
        --interconnect-attachment-region=INTERCONNECT_ATTACHMENT_REGION
-          Cloud region to install this policy based route on interconnect
+          Cloud region to install this policy-based route on interconnect
           attachment. Use all to install it on all interconnect attachments.
           Note if both --tags and --interconnect-attachment-region are not set,
-          then the policy based route will be installed in all network
+          then the policy-based route will be installed in all network
           endpoints, including VMs, VPNs, and Interconnect attachements, in the
           network.
 
        --tags=[TAGS,...]
-          List of VM instance tags to which this route applies to. VM instances
-          that have ANY of tags specified here will install this route. Note if
+          List of VM instance tags that this route applies to. VM instances
+          that have ANY of tags specified here installs this route. Note if
           both --tags and --interconnect-attachment-region are not set, then
-          the policy based route will be installed in all endpoints, including
+          the policy-based route will be installed in all endpoints, including
           VMs, VPNs, and Interconnect attachements, in the network.
 
      At most one of these can be specified:
@@ -119,9 +119,9 @@ OPTIONAL FLAGS
           handle packets.
 
        --next-hop-other-routes=NEXT_HOP_OTHER_ROUTES
-          Next hop should be other routes that handle packets. This will
-          effectively exclude matching packets being applied on other PBRs with
-          a lower priority. NEXT_HOP_OTHER_ROUTES must be one of:
+          Next hop should be other routes that handle packets. This effectively
+          excludes matching packets being applied on other policy-based routes
+          with a lower priority. NEXT_HOP_OTHER_ROUTES must be one of:
           default-routing, other-routes-unspecified.
 
 GCLOUD WIDE FLAGS
@@ -133,15 +133,17 @@ GCLOUD WIDE FLAGS
     Run $ gcloud help for details.
 
 API REFERENCE
-    This command uses the networkconnectivity/v1 API. The full documentation
-    for this API can be found at:
+    This command uses the networkconnectivity/v1beta API. The full
+    documentation for this API can be found at:
     https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
 
 NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
 
         $ gcloud network-connectivity policy-based-routes create
 
+        $ gcloud beta network-connectivity policy-based-routes create
+
diff --git a/gcloud/alpha/network-connectivity/policy-based-routes/delete b/gcloud/alpha/network-connectivity/policy-based-routes/delete
index 54a27af57..68021b0ff 100644
--- a/gcloud/alpha/network-connectivity/policy-based-routes/delete
+++ b/gcloud/alpha/network-connectivity/policy-based-routes/delete
@@ -1,21 +1,21 @@
 NAME
     gcloud alpha network-connectivity policy-based-routes delete - delete a
-        policy based route
+        policy-based route
 
 SYNOPSIS
     gcloud alpha network-connectivity policy-based-routes delete
         POLICY_BASED_ROUTE [--async] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) Delete the specified policy based route.
+    (ALPHA) Delete the specified policy-based route.
 
 EXAMPLES
-    To delete a policy based route named my-pbr, run:
+    To delete a policy-based route named my-pbr, run:
 
         $ gcloud alpha network-connectivity policy-based-routes delete my-pbr
 
 POSITIONAL ARGUMENTS
-     Policy based route resource - Name of the policy based route to be
+     Policy based route resource - Name of the policy-based route to be
      deleted. This represents a Cloud resource. (NOTE) Some attributes are not
      given arguments in this group but can be set in other ways.
 
@@ -48,15 +48,17 @@ GCLOUD WIDE FLAGS
     Run $ gcloud help for details.
 
 API REFERENCE
-    This command uses the networkconnectivity/v1 API. The full documentation
-    for this API can be found at:
+    This command uses the networkconnectivity/v1beta API. The full
+    documentation for this API can be found at:
     https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
 
 NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
 
         $ gcloud network-connectivity policy-based-routes delete
 
+        $ gcloud beta network-connectivity policy-based-routes delete
+
diff --git a/gcloud/alpha/network-connectivity/policy-based-routes/describe b/gcloud/alpha/network-connectivity/policy-based-routes/describe
index ba181129c..925604248 100644
--- a/gcloud/alpha/network-connectivity/policy-based-routes/describe
+++ b/gcloud/alpha/network-connectivity/policy-based-routes/describe
@@ -1,22 +1,22 @@
 NAME
     gcloud alpha network-connectivity policy-based-routes describe - describe a
-        policy based route
+        policy-based route
 
 SYNOPSIS
     gcloud alpha network-connectivity policy-based-routes describe
         POLICY_BASED_ROUTE [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) Retrieve and display details about a policy based route.
+    (ALPHA) Retrieve and display details about a policy-based route.
 
 EXAMPLES
-    To display details about a policy based route named my-pbr, run:
+    To display details about a policy-based route named my-pbr, run:
 
         $ gcloud alpha network-connectivity policy-based-routes describe \
             my-pbr
 
 POSITIONAL ARGUMENTS
-     Policy based route resource - Name of the policy based route to be
+     Policy based route resource - Name of the policy-based route to be
      described. This represents a Cloud resource. (NOTE) Some attributes are
      not given arguments in this group but can be set in other ways.
 
@@ -44,15 +44,17 @@ GCLOUD WIDE FLAGS
     Run $ gcloud help for details.
 
 API REFERENCE
-    This command uses the networkconnectivity/v1 API. The full documentation
-    for this API can be found at:
+    This command uses the networkconnectivity/v1beta API. The full
+    documentation for this API can be found at:
     https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
 
 NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
 
         $ gcloud network-connectivity policy-based-routes describe
 
+        $ gcloud beta network-connectivity policy-based-routes describe
+
diff --git a/gcloud/alpha/network-connectivity/policy-based-routes/help b/gcloud/alpha/network-connectivity/policy-based-routes/help
index 0d1971534..7fd7e31e6 100644
--- a/gcloud/alpha/network-connectivity/policy-based-routes/help
+++ b/gcloud/alpha/network-connectivity/policy-based-routes/help
@@ -1,5 +1,5 @@
 NAME
-    gcloud alpha network-connectivity policy-based-routes - manage Policy Based
+    gcloud alpha network-connectivity policy-based-routes - manage Policy-based
         Routes
 
 SYNOPSIS
@@ -7,7 +7,7 @@ SYNOPSIS
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) Manage Policy Based Routes.
+    (ALPHA) Manage Policy-based Routes.
 
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --help.
@@ -18,22 +18,24 @@ COMMANDS
     COMMAND is one of the following:
 
      create
-        (ALPHA) Create a new policy based route.
+        (ALPHA) Create a new policy-based route.
 
      delete
-        (ALPHA) Delete a policy based route.
+        (ALPHA) Delete a policy-based route.
 
      describe
-        (ALPHA) Describe a policy based route.
+        (ALPHA) Describe a policy-based route.
 
      list
-        (ALPHA) List policy based routes.
+        (ALPHA) List policy-based routes.
 
 NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
 
         $ gcloud network-connectivity policy-based-routes
 
+        $ gcloud beta network-connectivity policy-based-routes
+
diff --git a/gcloud/alpha/network-connectivity/policy-based-routes/list b/gcloud/alpha/network-connectivity/policy-based-routes/list
index 537d97340..2efe313e3 100644
--- a/gcloud/alpha/network-connectivity/policy-based-routes/list
+++ b/gcloud/alpha/network-connectivity/policy-based-routes/list
@@ -1,6 +1,6 @@
 NAME
-    gcloud alpha network-connectivity policy-based-routes list - list policy
-        based routes
+    gcloud alpha network-connectivity policy-based-routes list - list
+        policy-based routes
 
 SYNOPSIS
     gcloud alpha network-connectivity policy-based-routes list
@@ -8,11 +8,11 @@ SYNOPSIS
         [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    (ALPHA) Retrieve and display a list of all policy based routes in the
+    (ALPHA) Retrieve and display a list of all policy-based routes in the
     specified project.
 
 EXAMPLES
-    To display details about a policy based route named my-pbr, run:
+    To display details about a policy-based route named my-pbr, run:
 
         $ gcloud alpha network-connectivity policy-based-routes list my-pbr
 
@@ -51,15 +51,17 @@ GCLOUD WIDE FLAGS
     Run $ gcloud help for details.
 
 API REFERENCE
-    This command uses the networkconnectivity/v1 API. The full documentation
-    for this API can be found at:
+    This command uses the networkconnectivity/v1beta API. The full
+    documentation for this API can be found at:
     https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
 
 NOTES
     This command is currently in alpha and might change without notice. If this
     command fails with API permission errors despite specifying the correct
     project, you might be trying to access an API with an invitation-only early
-    access allowlist. This variant is also available:
+    access allowlist. These variants are also available:
 
         $ gcloud network-connectivity policy-based-routes list
 
+        $ gcloud beta network-connectivity policy-based-routes list
+
diff --git a/gcloud/alpha/redis/clusters/create b/gcloud/alpha/redis/clusters/create
index 42643f328..8b89373a2 100644
--- a/gcloud/alpha/redis/clusters/create
+++ b/gcloud/alpha/redis/clusters/create
@@ -6,7 +6,8 @@ SYNOPSIS
     gcloud alpha redis clusters create (CLUSTER : --region=REGION)
         --network=NETWORK --shard-count=SHARD_COUNT
         [--aof-append-fsync=AOF_APPEND_FSYNC] [--async] [--auth-mode=AUTH_MODE]
-        [--node-type=NODE_TYPE] [--persistence-mode=PERSISTENCE_MODE]
+        [--deletion-protection] [--node-type=NODE_TYPE]
+        [--persistence-mode=PERSISTENCE_MODE]
         [--rdb-snapshot-period=RDB_SNAPSHOT_PERIOD]
         [--rdb-snapshot-start-time=RDB_SNAPSHOT_START_TIME]
         [--redis-config=[KEY=VALUE,...]] [--replica-count=REPLICA_COUNT]
@@ -114,6 +115,10 @@ OPTIONAL FLAGS
          iam-auth
             IAM basic authorization is enabled for the cluster.
 
+     --deletion-protection
+        Enable deletion protection for the Redis Cluster. Use
+        --deletion-protection/--no-deletion-protection to enable/disable it.
+
      --node-type=NODE_TYPE
         Node Type of the redis cluster Node. NODE_TYPE must be one of:
         redis-highmem-medium, redis-highmem-xlarge, redis-shared-core-nano,
diff --git a/gcloud/alpha/redis/clusters/update b/gcloud/alpha/redis/clusters/update
index 4a611c2c1..d751b37c0 100644
--- a/gcloud/alpha/redis/clusters/update
+++ b/gcloud/alpha/redis/clusters/update
@@ -4,7 +4,7 @@ NAME
 
 SYNOPSIS
     gcloud alpha redis clusters update (CLUSTER : --region=REGION)
-        [--aof-append-fsync=AOF_APPEND_FSYNC] [--async]
+        [--aof-append-fsync=AOF_APPEND_FSYNC] [--async] [--deletion-protection]
         [--persistence-mode=PERSISTENCE_MODE]
         [--rdb-snapshot-period=RDB_SNAPSHOT_PERIOD]
         [--rdb-snapshot-start-time=RDB_SNAPSHOT_START_TIME]
@@ -77,6 +77,10 @@ FLAGS
         Return immediately, without waiting for the operation in progress to
         complete.
 
+     --deletion-protection
+        Enable deletion protection for the Redis Cluster. Use
+        --deletion-protection/--no-deletion-protection to enable/disable it.
+
      --persistence-mode=PERSISTENCE_MODE
         Operation mode for persistence. PERSISTENCE_MODE must be one of:
 
diff --git a/gcloud/alpha/scc/manage/services/describe b/gcloud/alpha/scc/manage/services/describe
index 814104d45..6c0d6a902 100644
--- a/gcloud/alpha/scc/manage/services/describe
+++ b/gcloud/alpha/scc/manage/services/describe
@@ -38,7 +38,20 @@ EXAMPLES
 POSITIONAL ARGUMENTS
      SERVICE_NAME
         The service name, provided either in lowercase hyphenated form (e.g.
-        security-health-analytics), or in abbreviated form (e.g. sha)
+        security-health-analytics), or in abbreviated form (e.g. sha) if
+        applicable.
+
+        The list of supported services is:
+
+        ◆ security-health-analytics (can be abbreviated as sha)
+
+        ◆ event-threat-detection (can be abbreviated as etd)
+
+        ◆ container-threat-detection (can be abbreviated as ctd)
+
+        ◆ vm-threat-detection (can be abbreviated as vmtd)
+
+        ◆ web-security-scanner (can be abbreviated as wss)
 
 REQUIRED FLAGS
      Exactly one of these must be specified:
diff --git a/gcloud/alpha/scc/manage/services/update b/gcloud/alpha/scc/manage/services/update
index 772ebc0ae..d1cea5945 100644
--- a/gcloud/alpha/scc/manage/services/update
+++ b/gcloud/alpha/scc/manage/services/update
@@ -38,7 +38,20 @@ EXAMPLES
 POSITIONAL ARGUMENTS
      SERVICE_NAME
         The service name, provided either in lowercase hyphenated form (e.g.
-        security-health-analytics), or in abbreviated form (e.g. sha)
+        security-health-analytics), or in abbreviated form (e.g. sha) if
+        applicable.
+
+        The list of supported services is:
+
+        ◆ security-health-analytics (can be abbreviated as sha)
+
+        ◆ event-threat-detection (can be abbreviated as etd)
+
+        ◆ container-threat-detection (can be abbreviated as ctd)
+
+        ◆ vm-threat-detection (can be abbreviated as vmtd)
+
+        ◆ web-security-scanner (can be abbreviated as wss)
 
 REQUIRED FLAGS
      At least one of these must be specified:
diff --git a/gcloud/anthos/auth/login b/gcloud/anthos/auth/login
index 5c023e891..d23c2eeb9 100644
--- a/gcloud/anthos/auth/login
+++ b/gcloud/anthos/auth/login
@@ -2,9 +2,10 @@ NAME
     gcloud anthos auth login - authenticate clusters using the Anthos client
 
 SYNOPSIS
-    gcloud anthos auth login [--cluster=CLUSTER] [--dry-run]
+    gcloud anthos auth login [--no-browser] [--cluster=CLUSTER] [--dry-run]
         [--kubeconfig=KUBECONFIG] [--login-config=LOGIN_CONFIG]
-        [--login-config-cert=LOGIN_CONFIG_CERT] [--server=SERVER]
+        [--login-config-cert=LOGIN_CONFIG_CERT]
+        [--remote-bootstrap=REMOTE_BOOTSTRAP] [--server=SERVER]
         [--set-preferred-auth] [--user=USER] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
@@ -37,7 +38,17 @@ EXAMPLES
         $ gcloud anthos auth login --cluster=testcluster \
           --server=<server-url> --kubeconfig=my.kubeconfig
 
+    To add credentials to custom kubeconfig file with server side login using a
+    remote-device for login:
+
+        $ gcloud anthos auth login --cluster=testcluster \
+          --server=<server-url> --kubeconfig=my.kubeconfig --no-browser
+
 FLAGS
+     --no-browser
+        Option to indicate login completion on a second device with
+        browser.Used with server option.
+
      --cluster=CLUSTER
         Cluster to authenticate against. If no cluster is specified, the
         command will print a list of available options.
@@ -57,6 +68,10 @@ FLAGS
         Specifies the CA certificate file to be added to trusted pool for
         making HTTPS connections to a --login-config URL.
 
+     --remote-bootstrap=REMOTE_BOOTSTRAP
+        Option to complete login that was started using no-browser optionon a
+        remote device that does not have a browser.
+
      --server=SERVER
         Specifies the URL of API server of the cluster to authenticate against.
 
diff --git a/gcloud/beta/anthos/auth/login b/gcloud/beta/anthos/auth/login
index 9cbacfd44..1b6c03982 100644
--- a/gcloud/beta/anthos/auth/login
+++ b/gcloud/beta/anthos/auth/login
@@ -3,9 +3,10 @@ NAME
         client
 
 SYNOPSIS
-    gcloud beta anthos auth login [--cluster=CLUSTER] [--dry-run]
-        [--kubeconfig=KUBECONFIG] [--login-config=LOGIN_CONFIG]
-        [--login-config-cert=LOGIN_CONFIG_CERT] [--server=SERVER]
+    gcloud beta anthos auth login [--no-browser] [--cluster=CLUSTER]
+        [--dry-run] [--kubeconfig=KUBECONFIG] [--login-config=LOGIN_CONFIG]
+        [--login-config-cert=LOGIN_CONFIG_CERT]
+        [--remote-bootstrap=REMOTE_BOOTSTRAP] [--server=SERVER]
         [--set-preferred-auth] [--user=USER] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
@@ -38,7 +39,17 @@ EXAMPLES
         $ gcloud beta anthos auth login --cluster=testcluster \
           --server=<server-url> --kubeconfig=my.kubeconfig
 
+    To add credentials to custom kubeconfig file with server side login using a
+    remote-device for login:
+
+        $ gcloud beta anthos auth login --cluster=testcluster \
+          --server=<server-url> --kubeconfig=my.kubeconfig --no-browser
+
 FLAGS
+     --no-browser
+        Option to indicate login completion on a second device with
+        browser.Used with server option.
+
      --cluster=CLUSTER
         Cluster to authenticate against. If no cluster is specified, the
         command will print a list of available options.
@@ -58,6 +69,10 @@ FLAGS
         Specifies the CA certificate file to be added to trusted pool for
         making HTTPS connections to a --login-config URL.
 
+     --remote-bootstrap=REMOTE_BOOTSTRAP
+        Option to complete login that was started using no-browser optionon a
+        remote device that does not have a browser.
+
      --server=SERVER
         Specifies the URL of API server of the cluster to authenticate against.
 
diff --git a/gcloud/beta/compute/instance-templates/create b/gcloud/beta/compute/instance-templates/create
index 2e4ed8f7c..2bd0caaf6 100644
--- a/gcloud/beta/compute/instance-templates/create
+++ b/gcloud/beta/compute/instance-templates/create
@@ -336,6 +336,17 @@ FLAGS
             to. You must provide exactly two replica zones, and one zone must
             be the same as the instance zone.
 
+         labels
+            List of label KEY=VALUE pairs separated by : character to add to
+            the disk.
+
+            Example: Key1=Value1:Key2=Value2:Key3=Value3.
+
+            Keys must start with a lowercase character and contain only hyphens
+            (-), underscores (_), lowercase characters, and numbers. Values
+            must contain only hyphens (-), underscores (_), lowercase
+            characters, and numbers.
+
      --description=DESCRIPTION
         Specifies a textual description for the instance template.
 
diff --git a/gcloud/beta/compute/instance-templates/create-with-container b/gcloud/beta/compute/instance-templates/create-with-container
index 7cdca22b9..ab1cedcc4 100644
--- a/gcloud/beta/compute/instance-templates/create-with-container
+++ b/gcloud/beta/compute/instance-templates/create-with-container
@@ -40,10 +40,10 @@ SYNOPSIS
         [--network-tier=NETWORK_TIER] [--preemptible]
         [--private-ipv6-google-access-type=PRIVATE_IPV6_GOOGLE_ACCESS_TYPE]
         [--private-network-ip=PRIVATE_NETWORK_IP] [--region=REGION]
-        [--no-restart-on-failure] [--shielded-integrity-monitoring]
-        [--shielded-secure-boot] [--shielded-vtpm] [--stack-type=STACK_TYPE]
-        [--subnet=SUBNET] [--tags=TAG,[TAG,...]]
-        [--address=ADDRESS | --no-address]
+        [--resource-policies=[RESOURCE_POLICY,...]] [--no-restart-on-failure]
+        [--shielded-integrity-monitoring] [--shielded-secure-boot]
+        [--shielded-vtpm] [--stack-type=STACK_TYPE] [--subnet=SUBNET]
+        [--tags=TAG,[TAG,...]] [--address=ADDRESS | --no-address]
         [--custom-cpu=CUSTOM_CPU --custom-memory=CUSTOM_MEMORY
           : --custom-extensions --custom-vm-type=CUSTOM_VM_TYPE]
         [--image-project=IMAGE_PROJECT --image=IMAGE
@@ -372,6 +372,17 @@ FLAGS
             to. You must provide exactly two replica zones, and one zone must
             be the same as the instance zone.
 
+         labels
+            List of label KEY=VALUE pairs separated by : character to add to
+            the disk.
+
+            Example: Key1=Value1:Key2=Value2:Key3=Value3.
+
+            Keys must start with a lowercase character and contain only hyphens
+            (-), underscores (_), lowercase characters, and numbers. Values
+            must contain only hyphens (-), underscores (_), lowercase
+            characters, and numbers.
+
      --description=DESCRIPTION
         Specifies a textual description for the instance template.
 
@@ -674,6 +685,14 @@ FLAGS
         Alternatively, the region can be stored in the environment variable
         CLOUDSDK_COMPUTE_REGION.
 
+     --resource-policies=[RESOURCE_POLICY,...]
+        A list of resource policy names (not URLs) to be added to each instance
+        created using this instance template. If you attach any resource
+        policies to an instance template, you can only use that instance
+        template to create instances that are in the same region as the
+        resource policies. Do not include resource policies that are located in
+        different regions in the same instance template.
+
      --restart-on-failure
         The instances will be restarted if they are terminated by Compute
         Engine. This does not affect terminations performed by the user.
diff --git a/gcloud/beta/compute/instances/create b/gcloud/beta/compute/instances/create
index 1c0b6addc..be82465b8 100644
--- a/gcloud/beta/compute/instances/create
+++ b/gcloud/beta/compute/instances/create
@@ -370,6 +370,17 @@ FLAGS
             to. You must provide exactly two replica zones, and one zone must
             be the same as the instance zone.
 
+         labels
+            List of label KEY=VALUE pairs separated by : character to add to
+            the disk.
+
+            Example: Key1=Value1:Key2=Value2:Key3=Value3.
+
+            Keys must start with a lowercase character and contain only hyphens
+            (-), underscores (_), lowercase characters, and numbers. Values
+            must contain only hyphens (-), underscores (_), lowercase
+            characters, and numbers.
+
      --csek-key-file=FILE
         Path to a Customer-Supplied Encryption Key (CSEK) key file that maps
         Compute Engine resources to user managed keys to be used when creating,
diff --git a/gcloud/beta/compute/instances/create-with-container b/gcloud/beta/compute/instances/create-with-container
index d17be6ded..ea02a1f7c 100644
--- a/gcloud/beta/compute/instances/create-with-container
+++ b/gcloud/beta/compute/instances/create-with-container
@@ -45,7 +45,8 @@ SYNOPSIS
         [--network-tier=NETWORK_TIER] [--preemptible]
         [--private-ipv6-google-access-type=PRIVATE_IPV6_GOOGLE_ACCESS_TYPE]
         [--private-network-ip=PRIVATE_NETWORK_IP]
-        [--provisioning-model=PROVISIONING_MODEL] [--no-restart-on-failure]
+        [--provisioning-model=PROVISIONING_MODEL]
+        [--resource-policies=[RESOURCE_POLICY,...]] [--no-restart-on-failure]
         [--shielded-integrity-monitoring] [--shielded-secure-boot]
         [--shielded-vtpm] [--source-instance-template=SOURCE_INSTANCE_TEMPLATE]
         [--stack-type=STACK_TYPE] [--subnet=SUBNET] [--tags=TAG,[TAG,...]]
@@ -377,6 +378,17 @@ FLAGS
             to. You must provide exactly two replica zones, and one zone must
             be the same as the instance zone.
 
+         labels
+            List of label KEY=VALUE pairs separated by : character to add to
+            the disk.
+
+            Example: Key1=Value1:Key2=Value2:Key3=Value3.
+
+            Keys must start with a lowercase character and contain only hyphens
+            (-), underscores (_), lowercase characters, and numbers. Values
+            must contain only hyphens (-), underscores (_), lowercase
+            characters, and numbers.
+
      --description=DESCRIPTION
         Specifies a textual description of the instances.
 
@@ -727,6 +739,10 @@ FLAGS
             Default. Standard provisioning model for VM instances, which has
             user-controlled runtime but no Spot discounts.
 
+     --resource-policies=[RESOURCE_POLICY,...]
+        A list of resource policy names to be added to the instance. The
+        policies must exist in the same region as the instance.
+
      --restart-on-failure
         The instances will be restarted if they are terminated by Compute
         Engine. This does not affect terminations performed by the user.
diff --git a/gcloud/beta/compute/instances/ops-agents/policies/help b/gcloud/beta/compute/instances/ops-agents/policies/help
index 056487425..c6e8214b0 100644
--- a/gcloud/beta/compute/instances/ops-agents/policies/help
+++ b/gcloud/beta/compute/instances/ops-agents/policies/help
@@ -36,8 +36,7 @@ COMMANDS
         policies.
 
      update
-        (BETA) Update a Google Cloud's operations suite agents (Ops Agents)
-        policy.
+        (BETA) Update a Google Cloud operations suite agent (Ops Agent) policy.
 
 NOTES
     This command is currently in beta and might change without notice. These
diff --git a/gcloud/beta/compute/instances/ops-agents/policies/update b/gcloud/beta/compute/instances/ops-agents/policies/update
index 992b3fbaf..bacd0c27b 100644
--- a/gcloud/beta/compute/instances/ops-agents/policies/update
+++ b/gcloud/beta/compute/instances/ops-agents/policies/update
@@ -1,6 +1,6 @@
 NAME
     gcloud beta compute instances ops-agents policies update - update a Google
-        Cloud's operations suite agents (Ops Agents) policy
+        Cloud operations suite agent (Ops Agent) policy
 
 SYNOPSIS
     gcloud beta compute instances ops-agents policies update POLICY_ID
diff --git a/gcloud/beta/container/clusters/check-autopilot-compatibility b/gcloud/beta/container/clusters/check-autopilot-compatibility
index f28f74c75..5ca2d329e 100644
--- a/gcloud/beta/container/clusters/check-autopilot-compatibility
+++ b/gcloud/beta/container/clusters/check-autopilot-compatibility
@@ -26,13 +26,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 LIST COMMAND FLAGS
diff --git a/gcloud/beta/container/clusters/create b/gcloud/beta/container/clusters/create
index 07b8354e0..d824c32dc 100644
--- a/gcloud/beta/container/clusters/create
+++ b/gcloud/beta/container/clusters/create
@@ -10,6 +10,7 @@ SYNOPSIS
           gpu-sharing-strategy=GPU_SHARING_STRATEGY,
           max-shared-clients-per-gpu=MAX_SHARED_CLIENTS_PER_GPU],...]]
         [--addons=[ADDON,...]] [--allow-route-overlap] [--async]
+        [--autoprovisioning-enable-insecure-kubelet-readonly-port]
         [--autoprovisioning-network-tags=TAGS,[TAGS,...]]
         [--autoprovisioning-resource-manager-tags=[KEY=VALUE,...]]
         [--autoscaling-profile=AUTOSCALING_PROFILE]
@@ -31,6 +32,7 @@ SYNOPSIS
         [--enable-dataplane-v2] [--enable-fleet] [--enable-fqdn-network-policy]
         [--enable-gke-oidc] [--enable-google-cloud-access] [--enable-gvnic]
         [--enable-identity-service] [--enable-image-streaming]
+        [--enable-insecure-kubelet-readonly-port]
         [--enable-intra-node-visibility] [--enable-ip-alias]
         [--enable-kubernetes-alpha]
         [--enable-kubernetes-unstable-apis=API,[API,...]]
@@ -217,6 +219,16 @@ FLAGS
         Return immediately, without waiting for the operation in progress to
         complete.
 
+     --autoprovisioning-enable-insecure-kubelet-readonly-port
+        Enables the Kubelet's insecure read only port for Autoprovisioned Node
+        Pools.
+
+        If not set, the value from nodePoolDefaults.nodeConfigDefaults will be
+        used.
+
+        To disable the readonly port
+        --no-autoprovisioning-enable-insecure-kubelet-readonly-port.
+
      --autoprovisioning-network-tags=TAGS,[TAGS,...]
         Applies the given Compute Engine tags (comma separated) on all nodes in
         the auto-provisioned node pools of the new Standard cluster or the new
@@ -540,6 +552,12 @@ FLAGS
      --enable-image-streaming
         Specifies whether to enable image streaming on cluster.
 
+     --enable-insecure-kubelet-readonly-port
+        Enables the Kubelet's insecure read only port.
+
+        To disable the readonly port on a cluster or node-pool set the flag to
+        --no-enable-insecure-kubelet-readonly-port.
+
      --enable-intra-node-visibility
         Enable Intra-node visibility for this cluster.
 
@@ -787,7 +805,7 @@ FLAGS
         The maximum number of nodes to allocate per default initial node pool.
         Kubernetes Engine will automatically create enough nodes pools such
         that each node pool contains less than --max-nodes-per-pool nodes.
-        Defaults to 1000 nodes, but can be set as low as 100 nodes per pool on
+        Defaults to 2000 nodes, but can be set as low as 100 nodes per pool on
         initial create.
 
      --max-pods-per-node=MAX_PODS_PER_NODE
@@ -1949,13 +1967,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
      One of either maintenance-window or the group of maintenance-window flags
diff --git a/gcloud/beta/container/clusters/create-auto b/gcloud/beta/container/clusters/create-auto
index 73a311249..8a7e5be50 100644
--- a/gcloud/beta/container/clusters/create-auto
+++ b/gcloud/beta/container/clusters/create-auto
@@ -4,6 +4,7 @@ NAME
 
 SYNOPSIS
     gcloud beta container clusters create-auto NAME [--async]
+        [--autoprovisioning-enable-insecure-kubelet-readonly-port]
         [--autoprovisioning-network-tags=TAGS,[TAGS,...]]
         [--autoprovisioning-resource-manager-tags=[KEY=VALUE,...]]
         [--boot-disk-kms-key=BOOT_DISK_KMS_KEY]
@@ -62,6 +63,16 @@ FLAGS
         Return immediately, without waiting for the operation in progress to
         complete.
 
+     --autoprovisioning-enable-insecure-kubelet-readonly-port
+        Enables the Kubelet's insecure read only port for Autoprovisioned Node
+        Pools.
+
+        If not set, the value from nodePoolDefaults.nodeConfigDefaults will be
+        used.
+
+        To disable the readonly port
+        --no-autoprovisioning-enable-insecure-kubelet-readonly-port.
+
      --autoprovisioning-network-tags=TAGS,[TAGS,...]
         Applies the given Compute Engine tags (comma separated) on all nodes in
         the auto-provisioned node pools of the new Standard cluster or the new
@@ -514,13 +525,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
      Options to specify the node identity.
diff --git a/gcloud/beta/container/clusters/delete b/gcloud/beta/container/clusters/delete
index a819b0d58..9a6919342 100644
--- a/gcloud/beta/container/clusters/delete
+++ b/gcloud/beta/container/clusters/delete
@@ -42,13 +42,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/beta/container/clusters/describe b/gcloud/beta/container/clusters/describe
index 56b07f9c3..969bf4f99 100644
--- a/gcloud/beta/container/clusters/describe
+++ b/gcloud/beta/container/clusters/describe
@@ -24,13 +24,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/beta/container/clusters/get-credentials b/gcloud/beta/container/clusters/get-credentials
index b572acf4a..dffacd600 100644
--- a/gcloud/beta/container/clusters/get-credentials
+++ b/gcloud/beta/container/clusters/get-credentials
@@ -53,13 +53,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/beta/container/clusters/help b/gcloud/beta/container/clusters/help
index 030e2fe14..ffa2b5025 100644
--- a/gcloud/beta/container/clusters/help
+++ b/gcloud/beta/container/clusters/help
@@ -19,13 +19,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/beta/container/clusters/list b/gcloud/beta/container/clusters/list
index fec29f123..e97f6ffca 100644
--- a/gcloud/beta/container/clusters/list
+++ b/gcloud/beta/container/clusters/list
@@ -24,13 +24,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 LIST COMMAND FLAGS
diff --git a/gcloud/beta/container/clusters/resize b/gcloud/beta/container/clusters/resize
index 4172858f1..b553aad9d 100644
--- a/gcloud/beta/container/clusters/resize
+++ b/gcloud/beta/container/clusters/resize
@@ -68,13 +68,13 @@ OPTIONAL FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/beta/container/clusters/update b/gcloud/beta/container/clusters/update
index f6ab13469..0e92e778b 100644
--- a/gcloud/beta/container/clusters/update
+++ b/gcloud/beta/container/clusters/update
@@ -4,7 +4,8 @@ NAME
 
 SYNOPSIS
     gcloud beta container clusters update NAME
-        (--autoprovisioning-network-tags=[TAGS,...]
+        (--autoprovisioning-enable-insecure-kubelet-readonly-port
+          | --autoprovisioning-network-tags=[TAGS,...]
           | --autoprovisioning-resource-manager-tags=[KEY=VALUE,...]
           | --autoscaling-profile=AUTOSCALING_PROFILE | --clear-fleet-project
           | --complete-credential-rotation | --complete-ip-rotation
@@ -16,7 +17,8 @@ SYNOPSIS
           | --enable-cost-allocation | --enable-fleet
           | --enable-fqdn-network-policy | --enable-gke-oidc
           | --enable-google-cloud-access | --enable-identity-service
-          | --enable-image-streaming | --enable-intra-node-visibility
+          | --enable-image-streaming | --enable-insecure-kubelet-readonly-port
+          | --enable-intra-node-visibility
           | --enable-kubernetes-unstable-apis=API,[API,...]
           | --enable-l4-ilb-subsetting | --enable-legacy-authorization
           | --enable-logging-monitoring-system-only
@@ -120,6 +122,16 @@ POSITIONAL ARGUMENTS
 REQUIRED FLAGS
      Exactly one of these must be specified:
 
+       --autoprovisioning-enable-insecure-kubelet-readonly-port
+          Enables the Kubelet's insecure read only port for Autoprovisioned
+          Node Pools.
+
+          If not set, the value from nodePoolDefaults.nodeConfigDefaults will
+          be used.
+
+          To disable the readonly port
+          --no-autoprovisioning-enable-insecure-kubelet-readonly-port.
+
        --autoprovisioning-network-tags=[TAGS,...]
           Replaces the user specified Compute Engine tags on all nodes in all
           the existing auto-provisioned node pools in the Standard cluster or
@@ -318,6 +330,12 @@ REQUIRED FLAGS
        --enable-image-streaming
           Specifies whether to enable image streaming on cluster.
 
+       --enable-insecure-kubelet-readonly-port
+          Enables the Kubelet's insecure read only port.
+
+          To disable the readonly port on a cluster or node-pool set the flag
+          to --no-enable-insecure-kubelet-readonly-port.
+
        --enable-intra-node-visibility
           Enable Intra-node visibility for this cluster.
 
@@ -1435,13 +1453,13 @@ OPTIONAL FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
      Cluster autoscaling
diff --git a/gcloud/beta/container/clusters/upgrade b/gcloud/beta/container/clusters/upgrade
index 702b101ef..b5e46bc1c 100644
--- a/gcloud/beta/container/clusters/upgrade
+++ b/gcloud/beta/container/clusters/upgrade
@@ -95,13 +95,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/beta/container/fleet/create b/gcloud/beta/container/fleet/create
index 4586aa65d..cc7a717ac 100644
--- a/gcloud/beta/container/fleet/create
+++ b/gcloud/beta/container/fleet/create
@@ -66,7 +66,7 @@ FLAGS
 
                 $ gcloud beta container fleet create --security-posture=standard
 
-            SECURITY_POSTURE must be one of: disabled, standard.
+            SECURITY_POSTURE must be one of: disabled, standard, enterprise.
 
          --workload-vulnerability-scanning=WORKLOAD_VULNERABILITY_SCANNING
             To apply standard vulnerability scanning to clusters in the fleet,
diff --git a/gcloud/beta/container/fleet/update b/gcloud/beta/container/fleet/update
index 9b132b71d..c116d95f8 100644
--- a/gcloud/beta/container/fleet/update
+++ b/gcloud/beta/container/fleet/update
@@ -67,7 +67,7 @@ FLAGS
 
                 $ gcloud beta container fleet update --security-posture=standard
 
-            SECURITY_POSTURE must be one of: disabled, standard.
+            SECURITY_POSTURE must be one of: disabled, standard, enterprise.
 
          --workload-vulnerability-scanning=WORKLOAD_VULNERABILITY_SCANNING
             To apply standard vulnerability scanning to clusters in the fleet,
diff --git a/gcloud/beta/container/get-server-config b/gcloud/beta/container/get-server-config
index 00cd57519..860f162a8 100644
--- a/gcloud/beta/container/get-server-config
+++ b/gcloud/beta/container/get-server-config
@@ -21,13 +21,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 LIST COMMAND FLAGS
diff --git a/gcloud/beta/container/hub/create b/gcloud/beta/container/hub/create
index f5b6821df..fa8e9717e 100644
--- a/gcloud/beta/container/hub/create
+++ b/gcloud/beta/container/hub/create
@@ -66,7 +66,7 @@ FLAGS
 
                 $ gcloud beta container hub create --security-posture=standard
 
-            SECURITY_POSTURE must be one of: disabled, standard.
+            SECURITY_POSTURE must be one of: disabled, standard, enterprise.
 
          --workload-vulnerability-scanning=WORKLOAD_VULNERABILITY_SCANNING
             To apply standard vulnerability scanning to clusters in the fleet,
diff --git a/gcloud/beta/container/hub/update b/gcloud/beta/container/hub/update
index 9d0b23460..d7eb6294e 100644
--- a/gcloud/beta/container/hub/update
+++ b/gcloud/beta/container/hub/update
@@ -67,7 +67,7 @@ FLAGS
 
                 $ gcloud beta container hub update --security-posture=standard
 
-            SECURITY_POSTURE must be one of: disabled, standard.
+            SECURITY_POSTURE must be one of: disabled, standard, enterprise.
 
          --workload-vulnerability-scanning=WORKLOAD_VULNERABILITY_SCANNING
             To apply standard vulnerability scanning to clusters in the fleet,
diff --git a/gcloud/beta/container/node-pools/complete-upgrade b/gcloud/beta/container/node-pools/complete-upgrade
index a4dc09bb4..ff8d8caf3 100644
--- a/gcloud/beta/container/node-pools/complete-upgrade
+++ b/gcloud/beta/container/node-pools/complete-upgrade
@@ -33,13 +33,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/beta/container/node-pools/create b/gcloud/beta/container/node-pools/create
index 3b5729bf0..b68da2eea 100644
--- a/gcloud/beta/container/node-pools/create
+++ b/gcloud/beta/container/node-pools/create
@@ -21,10 +21,11 @@ SYNOPSIS
         [--enable-autorepair] [--no-enable-autoupgrade]
         [--enable-blue-green-upgrade] [--enable-confidential-nodes]
         [--enable-confidential-storage] [--enable-gvnic]
-        [--enable-image-streaming] [--enable-nested-virtualization]
-        [--enable-private-nodes] [--enable-queued-provisioning]
-        [--enable-surge-upgrade] [--image-type=IMAGE_TYPE]
-        [--labels=[KEY=VALUE,...]] [--logging-variant=LOGGING_VARIANT]
+        [--enable-image-streaming] [--enable-insecure-kubelet-readonly-port]
+        [--enable-nested-virtualization] [--enable-private-nodes]
+        [--enable-queued-provisioning] [--enable-surge-upgrade]
+        [--image-type=IMAGE_TYPE] [--labels=[KEY=VALUE,...]]
+        [--logging-variant=LOGGING_VARIANT]
         [--machine-type=MACHINE_TYPE, -m MACHINE_TYPE]
         [--max-pods-per-node=MAX_PODS_PER_NODE]
         [--max-surge-upgrade=MAX_SURGE_UPGRADE; default=1]
@@ -260,6 +261,12 @@ FLAGS
      --enable-image-streaming
         Specifies whether to enable image streaming on node pool.
 
+     --enable-insecure-kubelet-readonly-port
+        Enables the Kubelet's insecure read only port.
+
+        To disable the readonly port on a cluster or node-pool set the flag to
+        --no-enable-insecure-kubelet-readonly-port.
+
      --enable-nested-virtualization
         Enables the use of nested virtualization on the node pool. Defaults to
         false. Can only be enabled on UBUNTU_CONTAINERD base image or
@@ -968,13 +975,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
      Specifies the reservation for the node pool.
diff --git a/gcloud/beta/container/node-pools/delete b/gcloud/beta/container/node-pools/delete
index 3bd8ec0c3..243a6284e 100644
--- a/gcloud/beta/container/node-pools/delete
+++ b/gcloud/beta/container/node-pools/delete
@@ -40,13 +40,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/beta/container/node-pools/describe b/gcloud/beta/container/node-pools/describe
index f8000ecaa..08754d609 100644
--- a/gcloud/beta/container/node-pools/describe
+++ b/gcloud/beta/container/node-pools/describe
@@ -30,13 +30,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/beta/container/node-pools/help b/gcloud/beta/container/node-pools/help
index ea5b9916f..ed2865545 100644
--- a/gcloud/beta/container/node-pools/help
+++ b/gcloud/beta/container/node-pools/help
@@ -16,13 +16,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/beta/container/node-pools/list b/gcloud/beta/container/node-pools/list
index 2a44425fb..252646a96 100644
--- a/gcloud/beta/container/node-pools/list
+++ b/gcloud/beta/container/node-pools/list
@@ -26,13 +26,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 LIST COMMAND FLAGS
diff --git a/gcloud/beta/container/node-pools/rollback b/gcloud/beta/container/node-pools/rollback
index c098fa117..e3dbe8d33 100644
--- a/gcloud/beta/container/node-pools/rollback
+++ b/gcloud/beta/container/node-pools/rollback
@@ -41,13 +41,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/beta/container/node-pools/update b/gcloud/beta/container/node-pools/update
index 89f0092b4..a442b00d0 100644
--- a/gcloud/beta/container/node-pools/update
+++ b/gcloud/beta/container/node-pools/update
@@ -6,9 +6,9 @@ SYNOPSIS
     gcloud beta container node-pools update NAME
         (--containerd-config-from-file=CONTAINERD_CONFIG_FROM_FILE
           | --enable-confidential-nodes | --enable-gvnic
-          | --enable-image-streaming | --enable-private-nodes
-          | --enable-queued-provisioning | --labels=[KEY=VALUE,...]
-          | --logging-variant=LOGGING_VARIANT
+          | --enable-image-streaming | --enable-insecure-kubelet-readonly-port
+          | --enable-private-nodes | --enable-queued-provisioning
+          | --labels=[KEY=VALUE,...] | --logging-variant=LOGGING_VARIANT
           | --network-performance-configs=[PROPERTY=VALUE,...]
           | --node-labels=[NODE_LABEL,...] | --node-locations=ZONE,[ZONE,...]
           | --node-taints=[NODE_TAINT,...]
@@ -72,6 +72,12 @@ REQUIRED FLAGS
        --enable-image-streaming
           Specifies whether to enable image streaming on node pool.
 
+       --enable-insecure-kubelet-readonly-port
+          Enables the Kubelet's insecure read only port.
+
+          To disable the readonly port on a cluster or node-pool set the flag
+          to --no-enable-insecure-kubelet-readonly-port.
+
        --enable-private-nodes
           Enables provisioning nodes with private IP addresses only.
 
@@ -497,13 +503,13 @@ OPTIONAL FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/beta/container/operations/cancel b/gcloud/beta/container/operations/cancel
index 0e7459f12..4cf5e24c9 100644
--- a/gcloud/beta/container/operations/cancel
+++ b/gcloud/beta/container/operations/cancel
@@ -31,13 +31,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/beta/container/operations/describe b/gcloud/beta/container/operations/describe
index 87cf73baa..9ef99039c 100644
--- a/gcloud/beta/container/operations/describe
+++ b/gcloud/beta/container/operations/describe
@@ -23,13 +23,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/beta/container/operations/help b/gcloud/beta/container/operations/help
index f3ca0a813..12b47e9a6 100644
--- a/gcloud/beta/container/operations/help
+++ b/gcloud/beta/container/operations/help
@@ -15,13 +15,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/beta/container/operations/list b/gcloud/beta/container/operations/list
index 0d9255abb..c9b50a18f 100644
--- a/gcloud/beta/container/operations/list
+++ b/gcloud/beta/container/operations/list
@@ -21,13 +21,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 LIST COMMAND FLAGS
diff --git a/gcloud/beta/container/operations/wait b/gcloud/beta/container/operations/wait
index 15b41bbb1..ac04576aa 100644
--- a/gcloud/beta/container/operations/wait
+++ b/gcloud/beta/container/operations/wait
@@ -23,13 +23,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/beta/datapipelines/pipeline/create b/gcloud/beta/datapipelines/pipeline/create
index ca88da1fd..c9997f7fe 100644
--- a/gcloud/beta/datapipelines/pipeline/create
+++ b/gcloud/beta/datapipelines/pipeline/create
@@ -12,8 +12,9 @@ SYNOPSIS
         [--enable-streaming-engine] [--flexrs-goal=FLEXRS_GOAL]
         [--max-workers=MAX_WORKERS] [--network=NETWORK]
         [--num-workers=NUM_WORKERS] [--parameters=[PARAMETERS,...]]
-        [--schedule=SCHEDULE] [--subnetwork=SUBNETWORK]
-        [--temp-location=TEMP_LOCATION]
+        [--schedule=SCHEDULE]
+        [--scheduler-service-account-email=SCHEDULER_SERVICE_ACCOUNT_EMAIL]
+        [--subnetwork=SUBNETWORK] [--temp-location=TEMP_LOCATION]
         [--template-file-gcs-location=TEMPLATE_FILE_GCS_LOCATION]
         [--template-type=TEMPLATE_TYPE; default="FLEX"] [--time-zone=TIME_ZONE]
         [--worker-machine-type=WORKER_MACHINE_TYPE]
@@ -127,6 +128,10 @@ OPTIONAL FLAGS
      --schedule=SCHEDULE
         Unix-cron format of the schedule for scheduling recurrent jobs.
 
+     --scheduler-service-account-email=SCHEDULER_SERVICE_ACCOUNT_EMAIL
+        Default service account used by the Cloud Scheduler job for launching
+        jobs.
+
      --subnetwork=SUBNETWORK
         Default Compute Engine subnetwork for launching instances to run your
         pipeline.
diff --git a/gcloud/beta/datapipelines/pipeline/update b/gcloud/beta/datapipelines/pipeline/update
index 43b50cc99..acd45ef39 100644
--- a/gcloud/beta/datapipelines/pipeline/update
+++ b/gcloud/beta/datapipelines/pipeline/update
@@ -12,8 +12,9 @@ SYNOPSIS
         [--enable-streaming-engine] [--flexrs-goal=FLEXRS_GOAL]
         [--max-workers=MAX_WORKERS] [--network=NETWORK]
         [--num-workers=NUM_WORKERS] [--parameters=[PARAMETERS,...]]
-        [--schedule=SCHEDULE] [--subnetwork=SUBNETWORK]
-        [--temp-location=TEMP_LOCATION]
+        [--schedule=SCHEDULE]
+        [--scheduler-service-account-email=SCHEDULER_SERVICE_ACCOUNT_EMAIL]
+        [--subnetwork=SUBNETWORK] [--temp-location=TEMP_LOCATION]
         [--template-file-gcs-location=TEMPLATE_FILE_GCS_LOCATION]
         [--template-type=TEMPLATE_TYPE; default="FLEX"] [--time-zone=TIME_ZONE]
         [--worker-machine-type=WORKER_MACHINE_TYPE]
@@ -113,6 +114,10 @@ FLAGS
      --schedule=SCHEDULE
         Unix-cron format of the schedule for scheduling recurrent jobs.
 
+     --scheduler-service-account-email=SCHEDULER_SERVICE_ACCOUNT_EMAIL
+        Default service account used by the Cloud Scheduler job for launching
+        jobs.
+
      --subnetwork=SUBNETWORK
         Default Compute Engine subnetwork for launching instances to run your
         pipeline.
diff --git a/gcloud/beta/iam/workforce-pools/providers/create-oidc b/gcloud/beta/iam/workforce-pools/providers/create-oidc
index e1a4e4ab3..25dca16a4 100644
--- a/gcloud/beta/iam/workforce-pools/providers/create-oidc
+++ b/gcloud/beta/iam/workforce-pools/providers/create-oidc
@@ -286,7 +286,7 @@ OPTIONAL FLAGS
      --extra-attributes-type=EXTRA_ATTRIBUTES_TYPE
         Represents the identity provider and type of claims that should be
         fetched. EXTRA_ATTRIBUTES_TYPE must be one of:
-        attributes-type-unspecified, azure-ad-groups-mail.
+        attributes-type-unspecified, azure-ad-groups-id, azure-ad-groups-mail.
 
      --extra-attributes-filter=EXTRA_ATTRIBUTES_FILTER
         The filter used to request specific records from IdP. In case of
diff --git a/gcloud/beta/iam/workforce-pools/providers/update-oidc b/gcloud/beta/iam/workforce-pools/providers/update-oidc
index fa9b6724c..71a73b3a2 100644
--- a/gcloud/beta/iam/workforce-pools/providers/update-oidc
+++ b/gcloud/beta/iam/workforce-pools/providers/update-oidc
@@ -287,7 +287,8 @@ FLAGS
        --extra-attributes-type=EXTRA_ATTRIBUTES_TYPE
           Represents the identity provider and type of claims that should be
           fetched. EXTRA_ATTRIBUTES_TYPE must be one of:
-          attributes-type-unspecified, azure-ad-groups-mail.
+          attributes-type-unspecified, azure-ad-groups-id,
+          azure-ad-groups-mail.
 
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
diff --git a/gcloud/beta/network-connectivity/help b/gcloud/beta/network-connectivity/help
index 0d0d8df59..55d6e7907 100644
--- a/gcloud/beta/network-connectivity/help
+++ b/gcloud/beta/network-connectivity/help
@@ -16,6 +16,9 @@ GCLOUD WIDE FLAGS
 GROUPS
     GROUP is one of the following:
 
+     policy-based-routes
+        (BETA) Manage Policy-based Routes.
+
      regional-endpoints
         (BETA) Manage Network Connectivity RegionalEndpoints.
 
diff --git a/gcloud/beta/network-connectivity/policy-based-routes/create b/gcloud/beta/network-connectivity/policy-based-routes/create
new file mode 100644
index 000000000..f95f4a7e8
--- /dev/null
+++ b/gcloud/beta/network-connectivity/policy-based-routes/create
@@ -0,0 +1,147 @@
+NAME
+    gcloud beta network-connectivity policy-based-routes create - create a new
+        policy-based route
+
+SYNOPSIS
+    gcloud beta network-connectivity policy-based-routes create
+        POLICY_BASED_ROUTE --network=NETWORK [--async]
+        [--description=DESCRIPTION] [--destination-range=DESTINATION_RANGE]
+        [--ip-protocol=IP_PROTOCOL] [--labels=[KEY=VALUE,...]]
+        [--priority=PRIORITY]
+        [--protocol-version=PROTOCOL_VERSION; default="IPV4"]
+        [--source-range=SOURCE_RANGE]
+        [--interconnect-attachment-region=INTERCONNECT_ATTACHMENT_REGION
+          | --tags=[TAGS,...]]
+        [--next-hop-ilb-ip=NEXT_HOP_ILB_IP
+          | --next-hop-other-routes=NEXT_HOP_OTHER_ROUTES]
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Create a new policy-based route with the given name.
+
+EXAMPLES
+    To create a policy-based route with the name my-pbr to route all traffic in
+    default network to an internal load balancer with IP 10.0.0.1, run:
+
+        $ gcloud beta network-connectivity policy-based-routes create \
+            my-pbr --network="projects/my-project/global/networks/default" \
+            --next-hop-ilb-ip=10.0.0.1
+
+POSITIONAL ARGUMENTS
+     Policy based route resource - Name of the policy-based route to be
+     created. This represents a Cloud resource. (NOTE) Some attributes are not
+     given arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument policy_based_route on the command line with a
+        fully specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       POLICY_BASED_ROUTE
+          ID of the policy based route or fully qualified identifier for the
+          policy based route.
+
+          To set the policy_based_route attribute:
+          ▸ provide the argument policy_based_route on the command line.
+
+REQUIRED FLAGS
+     --network=NETWORK
+        Fully-qualified URL of the network that this route applies to. E.g.
+        projects/my-project/global/networks/my-network
+
+OPTIONAL FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+     --description=DESCRIPTION
+        Optional description of this resource. Provide this field when you
+        create the resource.
+
+     --destination-range=DESTINATION_RANGE
+        Destination IP range of outgoing packets that this policy-based route
+        applies to.
+
+     --ip-protocol=IP_PROTOCOL
+        IP protocol that this policy-based route applies to. Valid values are
+        TCP, UDP, and ALL. Default is ALL.
+
+     --labels=[KEY=VALUE,...]
+        List of label KEY=VALUE pairs to add.
+
+        Keys must start with a lowercase character and contain only hyphens
+        (-), underscores (_), lowercase characters, and numbers. Values must
+        contain only hyphens (-), underscores (_), lowercase characters, and
+        numbers.
+
+     --priority=PRIORITY
+        Priority of this policy-based route. Priority is used to break ties in
+        cases where there are more than one matching policy-based routes found.
+        In cases where multiple policy-based routes are matched, the one with
+        the lowest-numbered priority value wins. The default value is 1000. The
+        priority value must be from 1 to 65535, inclusive. Note the priority of
+        policy-based route is always higher than other types of route (e.g.
+        static routes/advanced routes)
+
+     --protocol-version=PROTOCOL_VERSION; default="IPV4"
+        Internet protocol versions that this policy-based route applies to.
+        Valid values are IPV4, and IPV6. Default is IPV4'. PROTOCOL_VERSION
+        must be one of: *ipv4*, *ipv6*, *protocol-version-unspecified*.
+
+     --source-range=SOURCE_RANGE
+        Source IP range of outgoing packets that this policy-based route
+        applies to.
+
+     At most one of these can be specified:
+
+       --interconnect-attachment-region=INTERCONNECT_ATTACHMENT_REGION
+          Cloud region to install this policy-based route on interconnect
+          attachment. Use all to install it on all interconnect attachments.
+          Note if both --tags and --interconnect-attachment-region are not set,
+          then the policy-based route will be installed in all network
+          endpoints, including VMs, VPNs, and Interconnect attachements, in the
+          network.
+
+       --tags=[TAGS,...]
+          List of VM instance tags that this route applies to. VM instances
+          that have ANY of tags specified here installs this route. Note if
+          both --tags and --interconnect-attachment-region are not set, then
+          the policy-based route will be installed in all endpoints, including
+          VMs, VPNs, and Interconnect attachements, in the network.
+
+     At most one of these can be specified:
+
+       --next-hop-ilb-ip=NEXT_HOP_ILB_IP
+          IP of a global access enabled L4 ILB that should be the next hop to
+          handle packets.
+
+       --next-hop-other-routes=NEXT_HOP_OTHER_ROUTES
+          Next hop should be other routes that handle packets. This effectively
+          excludes matching packets being applied on other policy-based routes
+          with a lower priority. NEXT_HOP_OTHER_ROUTES must be one of:
+          default-routing, other-routes-unspecified.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networkconnectivity/v1beta API. The full
+    documentation for this API can be found at:
+    https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud network-connectivity policy-based-routes create
+
+        $ gcloud alpha network-connectivity policy-based-routes create
+
diff --git a/gcloud/beta/network-connectivity/policy-based-routes/delete b/gcloud/beta/network-connectivity/policy-based-routes/delete
new file mode 100644
index 000000000..d11cbcc90
--- /dev/null
+++ b/gcloud/beta/network-connectivity/policy-based-routes/delete
@@ -0,0 +1,62 @@
+NAME
+    gcloud beta network-connectivity policy-based-routes delete - delete a
+        policy-based route
+
+SYNOPSIS
+    gcloud beta network-connectivity policy-based-routes delete
+        POLICY_BASED_ROUTE [--async] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Delete the specified policy-based route.
+
+EXAMPLES
+    To delete a policy-based route named my-pbr, run:
+
+        $ gcloud beta network-connectivity policy-based-routes delete my-pbr
+
+POSITIONAL ARGUMENTS
+     Policy based route resource - Name of the policy-based route to be
+     deleted. This represents a Cloud resource. (NOTE) Some attributes are not
+     given arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument policy_based_route on the command line with a
+        fully specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       POLICY_BASED_ROUTE
+          ID of the policy based route or fully qualified identifier for the
+          policy based route.
+
+          To set the policy_based_route attribute:
+          ▸ provide the argument policy_based_route on the command line.
+
+FLAGS
+     --async
+        Return immediately, without waiting for the operation in progress to
+        complete.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networkconnectivity/v1beta API. The full
+    documentation for this API can be found at:
+    https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud network-connectivity policy-based-routes delete
+
+        $ gcloud alpha network-connectivity policy-based-routes delete
+
diff --git a/gcloud/beta/network-connectivity/policy-based-routes/describe b/gcloud/beta/network-connectivity/policy-based-routes/describe
new file mode 100644
index 000000000..f7810e547
--- /dev/null
+++ b/gcloud/beta/network-connectivity/policy-based-routes/describe
@@ -0,0 +1,58 @@
+NAME
+    gcloud beta network-connectivity policy-based-routes describe - describe a
+        policy-based route
+
+SYNOPSIS
+    gcloud beta network-connectivity policy-based-routes describe
+        POLICY_BASED_ROUTE [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Retrieve and display details about a policy-based route.
+
+EXAMPLES
+    To display details about a policy-based route named my-pbr, run:
+
+        $ gcloud beta network-connectivity policy-based-routes describe \
+            my-pbr
+
+POSITIONAL ARGUMENTS
+     Policy based route resource - Name of the policy-based route to be
+     described. This represents a Cloud resource. (NOTE) Some attributes are
+     not given arguments in this group but can be set in other ways.
+
+     To set the project attribute:
+      ◆ provide the argument policy_based_route on the command line with a
+        fully specified name;
+      ◆ set the property core/project;
+      ◆ provide the argument --project on the command line.
+
+     This must be specified.
+
+       POLICY_BASED_ROUTE
+          ID of the policy based route or fully qualified identifier for the
+          policy based route.
+
+          To set the policy_based_route attribute:
+          ▸ provide the argument policy_based_route on the command line.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networkconnectivity/v1beta API. The full
+    documentation for this API can be found at:
+    https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud network-connectivity policy-based-routes describe
+
+        $ gcloud alpha network-connectivity policy-based-routes describe
+
diff --git a/gcloud/beta/network-connectivity/policy-based-routes/help b/gcloud/beta/network-connectivity/policy-based-routes/help
new file mode 100644
index 000000000..0806efb03
--- /dev/null
+++ b/gcloud/beta/network-connectivity/policy-based-routes/help
@@ -0,0 +1,39 @@
+NAME
+    gcloud beta network-connectivity policy-based-routes - manage Policy-based
+        Routes
+
+SYNOPSIS
+    gcloud beta network-connectivity policy-based-routes COMMAND
+        [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Manage Policy-based Routes.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --help.
+
+    Run $ gcloud help for details.
+
+COMMANDS
+    COMMAND is one of the following:
+
+     create
+        (BETA) Create a new policy-based route.
+
+     delete
+        (BETA) Delete a policy-based route.
+
+     describe
+        (BETA) Describe a policy-based route.
+
+     list
+        (BETA) List policy-based routes.
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud network-connectivity policy-based-routes
+
+        $ gcloud alpha network-connectivity policy-based-routes
+
diff --git a/gcloud/beta/network-connectivity/policy-based-routes/list b/gcloud/beta/network-connectivity/policy-based-routes/list
new file mode 100644
index 000000000..f7a8ea155
--- /dev/null
+++ b/gcloud/beta/network-connectivity/policy-based-routes/list
@@ -0,0 +1,65 @@
+NAME
+    gcloud beta network-connectivity policy-based-routes list - list
+        policy-based routes
+
+SYNOPSIS
+    gcloud beta network-connectivity policy-based-routes list
+        [--filter=EXPRESSION] [--limit=LIMIT] [--page-size=PAGE_SIZE]
+        [--sort-by=[FIELD,...]] [GCLOUD_WIDE_FLAG ...]
+
+DESCRIPTION
+    (BETA) Retrieve and display a list of all policy-based routes in the
+    specified project.
+
+EXAMPLES
+    To display details about a policy-based route named my-pbr, run:
+
+        $ gcloud beta network-connectivity policy-based-routes list my-pbr
+
+LIST COMMAND FLAGS
+     --filter=EXPRESSION
+        Apply a Boolean filter EXPRESSION to each resource item to be listed.
+        If the expression evaluates True, then that item is listed. For more
+        details and examples of filter expressions, run $ gcloud topic filters.
+        This flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --limit=LIMIT
+        Maximum number of resources to list. The default is unlimited. This
+        flag interacts with other flags that are applied in this order:
+        --flatten, --sort-by, --filter, --limit.
+
+     --page-size=PAGE_SIZE
+        Some services group resource list output into pages. This flag
+        specifies the maximum number of resources per page. The default is
+        determined by the service if it supports paging, otherwise it is
+        unlimited (no paging). Paging may be applied before or after --filter
+        and --limit depending on the service.
+
+     --sort-by=[FIELD,...]
+        Comma-separated list of resource field key names to sort by. The
+        default order is ascending. Prefix a field with ``~'' for descending
+        order on that field. This flag interacts with other flags that are
+        applied in this order: --flatten, --sort-by, --filter, --limit.
+
+GCLOUD WIDE FLAGS
+    These flags are available to all commands: --access-token-file, --account,
+    --billing-project, --configuration, --flags-file, --flatten, --format,
+    --help, --impersonate-service-account, --log-http, --project, --quiet,
+    --trace-token, --user-output-enabled, --verbosity.
+
+    Run $ gcloud help for details.
+
+API REFERENCE
+    This command uses the networkconnectivity/v1beta API. The full
+    documentation for this API can be found at:
+    https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
+
+NOTES
+    This command is currently in beta and might change without notice. These
+    variants are also available:
+
+        $ gcloud network-connectivity policy-based-routes list
+
+        $ gcloud alpha network-connectivity policy-based-routes list
+
diff --git a/gcloud/beta/redis/clusters/create b/gcloud/beta/redis/clusters/create
index 546b2957e..a7cd90764 100644
--- a/gcloud/beta/redis/clusters/create
+++ b/gcloud/beta/redis/clusters/create
@@ -6,7 +6,8 @@ SYNOPSIS
     gcloud beta redis clusters create (CLUSTER : --region=REGION)
         --network=NETWORK --shard-count=SHARD_COUNT
         [--aof-append-fsync=AOF_APPEND_FSYNC] [--async] [--auth-mode=AUTH_MODE]
-        [--node-type=NODE_TYPE] [--persistence-mode=PERSISTENCE_MODE]
+        [--deletion-protection] [--node-type=NODE_TYPE]
+        [--persistence-mode=PERSISTENCE_MODE]
         [--rdb-snapshot-period=RDB_SNAPSHOT_PERIOD]
         [--rdb-snapshot-start-time=RDB_SNAPSHOT_START_TIME]
         [--redis-config=[KEY=VALUE,...]] [--replica-count=REPLICA_COUNT]
@@ -114,6 +115,10 @@ OPTIONAL FLAGS
          iam-auth
             IAM basic authorization is enabled for the cluster.
 
+     --deletion-protection
+        Enable deletion protection for the Redis Cluster. Use
+        --deletion-protection/--no-deletion-protection to enable/disable it.
+
      --node-type=NODE_TYPE
         Node Type of the redis cluster Node. NODE_TYPE must be one of:
         redis-highmem-medium, redis-highmem-xlarge, redis-shared-core-nano,
diff --git a/gcloud/beta/redis/clusters/update b/gcloud/beta/redis/clusters/update
index fd405f038..b7eb6b532 100644
--- a/gcloud/beta/redis/clusters/update
+++ b/gcloud/beta/redis/clusters/update
@@ -4,7 +4,7 @@ NAME
 
 SYNOPSIS
     gcloud beta redis clusters update (CLUSTER : --region=REGION)
-        [--aof-append-fsync=AOF_APPEND_FSYNC] [--async]
+        [--aof-append-fsync=AOF_APPEND_FSYNC] [--async] [--deletion-protection]
         [--persistence-mode=PERSISTENCE_MODE]
         [--rdb-snapshot-period=RDB_SNAPSHOT_PERIOD]
         [--rdb-snapshot-start-time=RDB_SNAPSHOT_START_TIME]
@@ -77,6 +77,10 @@ FLAGS
         Return immediately, without waiting for the operation in progress to
         complete.
 
+     --deletion-protection
+        Enable deletion protection for the Redis Cluster. Use
+        --deletion-protection/--no-deletion-protection to enable/disable it.
+
      --persistence-mode=PERSISTENCE_MODE
         Operation mode for persistence. PERSISTENCE_MODE must be one of:
 
diff --git a/gcloud/compute/instance-templates/create-with-container b/gcloud/compute/instance-templates/create-with-container
index 4098b5232..a6a34a870 100644
--- a/gcloud/compute/instance-templates/create-with-container
+++ b/gcloud/compute/instance-templates/create-with-container
@@ -38,10 +38,10 @@ SYNOPSIS
         [--network-tier=NETWORK_TIER] [--preemptible]
         [--private-ipv6-google-access-type=PRIVATE_IPV6_GOOGLE_ACCESS_TYPE]
         [--private-network-ip=PRIVATE_NETWORK_IP] [--region=REGION]
-        [--no-restart-on-failure] [--shielded-integrity-monitoring]
-        [--shielded-secure-boot] [--shielded-vtpm] [--stack-type=STACK_TYPE]
-        [--subnet=SUBNET] [--tags=TAG,[TAG,...]]
-        [--address=ADDRESS | --no-address]
+        [--resource-policies=[RESOURCE_POLICY,...]] [--no-restart-on-failure]
+        [--shielded-integrity-monitoring] [--shielded-secure-boot]
+        [--shielded-vtpm] [--stack-type=STACK_TYPE] [--subnet=SUBNET]
+        [--tags=TAG,[TAG,...]] [--address=ADDRESS | --no-address]
         [--custom-cpu=CUSTOM_CPU --custom-memory=CUSTOM_MEMORY
           : --custom-extensions --custom-vm-type=CUSTOM_VM_TYPE]
         [--image-project=IMAGE_PROJECT --image=IMAGE
@@ -638,6 +638,14 @@ FLAGS
         Alternatively, the region can be stored in the environment variable
         CLOUDSDK_COMPUTE_REGION.
 
+     --resource-policies=[RESOURCE_POLICY,...]
+        A list of resource policy names (not URLs) to be added to each instance
+        created using this instance template. If you attach any resource
+        policies to an instance template, you can only use that instance
+        template to create instances that are in the same region as the
+        resource policies. Do not include resource policies that are located in
+        different regions in the same instance template.
+
      --restart-on-failure
         The instances will be restarted if they are terminated by Compute
         Engine. This does not affect terminations performed by the user.
diff --git a/gcloud/compute/instances/create-with-container b/gcloud/compute/instances/create-with-container
index 5d96d1599..a58b430a5 100644
--- a/gcloud/compute/instances/create-with-container
+++ b/gcloud/compute/instances/create-with-container
@@ -43,7 +43,8 @@ SYNOPSIS
         [--network-tier=NETWORK_TIER] [--preemptible]
         [--private-ipv6-google-access-type=PRIVATE_IPV6_GOOGLE_ACCESS_TYPE]
         [--private-network-ip=PRIVATE_NETWORK_IP]
-        [--provisioning-model=PROVISIONING_MODEL] [--no-restart-on-failure]
+        [--provisioning-model=PROVISIONING_MODEL]
+        [--resource-policies=[RESOURCE_POLICY,...]] [--no-restart-on-failure]
         [--shielded-integrity-monitoring] [--shielded-secure-boot]
         [--shielded-vtpm] [--source-instance-template=SOURCE_INSTANCE_TEMPLATE]
         [--stack-type=STACK_TYPE] [--subnet=SUBNET] [--tags=TAG,[TAG,...]]
@@ -702,6 +703,10 @@ FLAGS
             Default. Standard provisioning model for VM instances, which has
             user-controlled runtime but no Spot discounts.
 
+     --resource-policies=[RESOURCE_POLICY,...]
+        A list of resource policy names to be added to the instance. The
+        policies must exist in the same region as the instance.
+
      --restart-on-failure
         The instances will be restarted if they are terminated by Compute
         Engine. This does not affect terminations performed by the user.
diff --git a/gcloud/container/clusters/check-autopilot-compatibility b/gcloud/container/clusters/check-autopilot-compatibility
index 0c0d16814..14b1fa4de 100644
--- a/gcloud/container/clusters/check-autopilot-compatibility
+++ b/gcloud/container/clusters/check-autopilot-compatibility
@@ -26,13 +26,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 LIST COMMAND FLAGS
diff --git a/gcloud/container/clusters/create b/gcloud/container/clusters/create
index 7891b7c0e..20cfc7f73 100644
--- a/gcloud/container/clusters/create
+++ b/gcloud/container/clusters/create
@@ -9,6 +9,7 @@ SYNOPSIS
           gpu-sharing-strategy=GPU_SHARING_STRATEGY,
           max-shared-clients-per-gpu=MAX_SHARED_CLIENTS_PER_GPU],...]]
         [--additional-zones=ZONE,[ZONE,...]] [--addons=[ADDON,...]] [--async]
+        [--autoprovisioning-enable-insecure-kubelet-readonly-port]
         [--autoprovisioning-network-tags=TAGS,[TAGS,...]]
         [--autoprovisioning-resource-manager-tags=[KEY=VALUE,...]]
         [--autoscaling-profile=AUTOSCALING_PROFILE]
@@ -29,6 +30,7 @@ SYNOPSIS
         [--enable-dataplane-v2] [--enable-fleet] [--enable-fqdn-network-policy]
         [--enable-google-cloud-access] [--enable-gvnic]
         [--enable-identity-service] [--enable-image-streaming]
+        [--enable-insecure-kubelet-readonly-port]
         [--enable-intra-node-visibility] [--enable-ip-alias]
         [--enable-kubernetes-alpha]
         [--enable-kubernetes-unstable-apis=API,[API,...]]
@@ -215,6 +217,16 @@ FLAGS
         Return immediately, without waiting for the operation in progress to
         complete.
 
+     --autoprovisioning-enable-insecure-kubelet-readonly-port
+        Enables the Kubelet's insecure read only port for Autoprovisioned Node
+        Pools.
+
+        If not set, the value from nodePoolDefaults.nodeConfigDefaults will be
+        used.
+
+        To disable the readonly port
+        --no-autoprovisioning-enable-insecure-kubelet-readonly-port.
+
      --autoprovisioning-network-tags=TAGS,[TAGS,...]
         Applies the given Compute Engine tags (comma separated) on all nodes in
         the auto-provisioned node pools of the new Standard cluster or the new
@@ -515,6 +527,12 @@ FLAGS
      --enable-image-streaming
         Specifies whether to enable image streaming on cluster.
 
+     --enable-insecure-kubelet-readonly-port
+        Enables the Kubelet's insecure read only port.
+
+        To disable the readonly port on a cluster or node-pool set the flag to
+        --no-enable-insecure-kubelet-readonly-port.
+
      --enable-intra-node-visibility
         Enable Intra-node visibility for this cluster.
 
@@ -716,7 +734,7 @@ FLAGS
         The maximum number of nodes to allocate per default initial node pool.
         Kubernetes Engine will automatically create enough nodes pools such
         that each node pool contains less than --max-nodes-per-pool nodes.
-        Defaults to 1000 nodes, but can be set as low as 100 nodes per pool on
+        Defaults to 2000 nodes, but can be set as low as 100 nodes per pool on
         initial create.
 
      --max-pods-per-node=MAX_PODS_PER_NODE
@@ -1773,13 +1791,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
      One of either maintenance-window or the group of maintenance-window flags
diff --git a/gcloud/container/clusters/create-auto b/gcloud/container/clusters/create-auto
index c4ca367db..62220a4eb 100644
--- a/gcloud/container/clusters/create-auto
+++ b/gcloud/container/clusters/create-auto
@@ -4,6 +4,7 @@ NAME
 
 SYNOPSIS
     gcloud container clusters create-auto NAME [--async]
+        [--autoprovisioning-enable-insecure-kubelet-readonly-port]
         [--autoprovisioning-network-tags=TAGS,[TAGS,...]]
         [--autoprovisioning-resource-manager-tags=[KEY=VALUE,...]]
         [--binauthz-evaluation-mode=BINAUTHZ_EVALUATION_MODE]
@@ -58,6 +59,16 @@ FLAGS
         Return immediately, without waiting for the operation in progress to
         complete.
 
+     --autoprovisioning-enable-insecure-kubelet-readonly-port
+        Enables the Kubelet's insecure read only port for Autoprovisioned Node
+        Pools.
+
+        If not set, the value from nodePoolDefaults.nodeConfigDefaults will be
+        used.
+
+        To disable the readonly port
+        --no-autoprovisioning-enable-insecure-kubelet-readonly-port.
+
      --autoprovisioning-network-tags=TAGS,[TAGS,...]
         Applies the given Compute Engine tags (comma separated) on all nodes in
         the auto-provisioned node pools of the new Standard cluster or the new
@@ -485,13 +496,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
      Options to specify the node identity.
diff --git a/gcloud/container/clusters/delete b/gcloud/container/clusters/delete
index a9571ef75..696c55690 100644
--- a/gcloud/container/clusters/delete
+++ b/gcloud/container/clusters/delete
@@ -42,13 +42,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/container/clusters/describe b/gcloud/container/clusters/describe
index b9ed207d4..a929cb171 100644
--- a/gcloud/container/clusters/describe
+++ b/gcloud/container/clusters/describe
@@ -24,13 +24,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/container/clusters/get-credentials b/gcloud/container/clusters/get-credentials
index e876b125f..44745a42f 100644
--- a/gcloud/container/clusters/get-credentials
+++ b/gcloud/container/clusters/get-credentials
@@ -56,13 +56,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/container/clusters/help b/gcloud/container/clusters/help
index 0f4f3e049..7273649c6 100644
--- a/gcloud/container/clusters/help
+++ b/gcloud/container/clusters/help
@@ -19,13 +19,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/container/clusters/list b/gcloud/container/clusters/list
index ffd7d902a..ef01d30ad 100644
--- a/gcloud/container/clusters/list
+++ b/gcloud/container/clusters/list
@@ -24,13 +24,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 LIST COMMAND FLAGS
diff --git a/gcloud/container/clusters/resize b/gcloud/container/clusters/resize
index 483a199f8..3a05e730d 100644
--- a/gcloud/container/clusters/resize
+++ b/gcloud/container/clusters/resize
@@ -68,13 +68,13 @@ OPTIONAL FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/container/clusters/update b/gcloud/container/clusters/update
index c75a4d79d..00261caf9 100644
--- a/gcloud/container/clusters/update
+++ b/gcloud/container/clusters/update
@@ -4,7 +4,8 @@ NAME
 
 SYNOPSIS
     gcloud container clusters update NAME
-        (--autoprovisioning-network-tags=[TAGS,...]
+        (--autoprovisioning-enable-insecure-kubelet-readonly-port
+          | --autoprovisioning-network-tags=[TAGS,...]
           | --autoprovisioning-resource-manager-tags=[KEY=VALUE,...]
           | --autoscaling-profile=AUTOSCALING_PROFILE | --clear-fleet-project
           | --complete-credential-rotation | --complete-ip-rotation
@@ -16,6 +17,7 @@ SYNOPSIS
           | --enable-cost-allocation | --enable-fleet
           | --enable-fqdn-network-policy | --enable-google-cloud-access
           | --enable-identity-service | --enable-image-streaming
+          | --enable-insecure-kubelet-readonly-port
           | --enable-intra-node-visibility
           | --enable-kubernetes-unstable-apis=API,[API,...]
           | --enable-l4-ilb-subsetting | --enable-legacy-authorization
@@ -112,6 +114,16 @@ POSITIONAL ARGUMENTS
 REQUIRED FLAGS
      Exactly one of these must be specified:
 
+       --autoprovisioning-enable-insecure-kubelet-readonly-port
+          Enables the Kubelet's insecure read only port for Autoprovisioned
+          Node Pools.
+
+          If not set, the value from nodePoolDefaults.nodeConfigDefaults will
+          be used.
+
+          To disable the readonly port
+          --no-autoprovisioning-enable-insecure-kubelet-readonly-port.
+
        --autoprovisioning-network-tags=[TAGS,...]
           Replaces the user specified Compute Engine tags on all nodes in all
           the existing auto-provisioned node pools in the Standard cluster or
@@ -296,6 +308,12 @@ REQUIRED FLAGS
        --enable-image-streaming
           Specifies whether to enable image streaming on cluster.
 
+       --enable-insecure-kubelet-readonly-port
+          Enables the Kubelet's insecure read only port.
+
+          To disable the readonly port on a cluster or node-pool set the flag
+          to --no-enable-insecure-kubelet-readonly-port.
+
        --enable-intra-node-visibility
           Enable Intra-node visibility for this cluster.
 
@@ -1290,13 +1308,13 @@ OPTIONAL FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
      Cluster autoscaling
diff --git a/gcloud/container/clusters/upgrade b/gcloud/container/clusters/upgrade
index b3a2b0f0c..4fa2693e1 100644
--- a/gcloud/container/clusters/upgrade
+++ b/gcloud/container/clusters/upgrade
@@ -94,13 +94,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/container/fleet/create b/gcloud/container/fleet/create
index d4c7058ad..872ff34b1 100644
--- a/gcloud/container/fleet/create
+++ b/gcloud/container/fleet/create
@@ -66,7 +66,7 @@ FLAGS
 
                 $ gcloud container fleet create --security-posture=standard
 
-            SECURITY_POSTURE must be one of: disabled, standard.
+            SECURITY_POSTURE must be one of: disabled, standard, enterprise.
 
          --workload-vulnerability-scanning=WORKLOAD_VULNERABILITY_SCANNING
             To apply standard vulnerability scanning to clusters in the fleet,
diff --git a/gcloud/container/fleet/update b/gcloud/container/fleet/update
index e52530321..bc16186f3 100644
--- a/gcloud/container/fleet/update
+++ b/gcloud/container/fleet/update
@@ -67,7 +67,7 @@ FLAGS
 
                 $ gcloud container fleet update --security-posture=standard
 
-            SECURITY_POSTURE must be one of: disabled, standard.
+            SECURITY_POSTURE must be one of: disabled, standard, enterprise.
 
          --workload-vulnerability-scanning=WORKLOAD_VULNERABILITY_SCANNING
             To apply standard vulnerability scanning to clusters in the fleet,
diff --git a/gcloud/container/get-server-config b/gcloud/container/get-server-config
index 01a03f8d1..f76068f25 100644
--- a/gcloud/container/get-server-config
+++ b/gcloud/container/get-server-config
@@ -20,13 +20,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 LIST COMMAND FLAGS
diff --git a/gcloud/container/hub/create b/gcloud/container/hub/create
index 4d3c41d57..104e0d945 100644
--- a/gcloud/container/hub/create
+++ b/gcloud/container/hub/create
@@ -66,7 +66,7 @@ FLAGS
 
                 $ gcloud container hub create --security-posture=standard
 
-            SECURITY_POSTURE must be one of: disabled, standard.
+            SECURITY_POSTURE must be one of: disabled, standard, enterprise.
 
          --workload-vulnerability-scanning=WORKLOAD_VULNERABILITY_SCANNING
             To apply standard vulnerability scanning to clusters in the fleet,
diff --git a/gcloud/container/hub/update b/gcloud/container/hub/update
index eb3dcdde2..f3f2d2bb1 100644
--- a/gcloud/container/hub/update
+++ b/gcloud/container/hub/update
@@ -67,7 +67,7 @@ FLAGS
 
                 $ gcloud container hub update --security-posture=standard
 
-            SECURITY_POSTURE must be one of: disabled, standard.
+            SECURITY_POSTURE must be one of: disabled, standard, enterprise.
 
          --workload-vulnerability-scanning=WORKLOAD_VULNERABILITY_SCANNING
             To apply standard vulnerability scanning to clusters in the fleet,
diff --git a/gcloud/container/node-pools/complete-upgrade b/gcloud/container/node-pools/complete-upgrade
index 6018dc54f..2dcbf0fdc 100644
--- a/gcloud/container/node-pools/complete-upgrade
+++ b/gcloud/container/node-pools/complete-upgrade
@@ -32,13 +32,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/container/node-pools/create b/gcloud/container/node-pools/create
index 3c34b86cb..b8eee14a6 100644
--- a/gcloud/container/node-pools/create
+++ b/gcloud/container/node-pools/create
@@ -20,10 +20,11 @@ SYNOPSIS
         [--enable-autoprovisioning] [--enable-autorepair]
         [--no-enable-autoupgrade] [--enable-blue-green-upgrade]
         [--enable-confidential-nodes] [--enable-gvnic]
-        [--enable-image-streaming] [--enable-nested-virtualization]
-        [--enable-private-nodes] [--enable-queued-provisioning]
-        [--enable-surge-upgrade] [--image-type=IMAGE_TYPE]
-        [--labels=[KEY=VALUE,...]] [--logging-variant=LOGGING_VARIANT]
+        [--enable-image-streaming] [--enable-insecure-kubelet-readonly-port]
+        [--enable-nested-virtualization] [--enable-private-nodes]
+        [--enable-queued-provisioning] [--enable-surge-upgrade]
+        [--image-type=IMAGE_TYPE] [--labels=[KEY=VALUE,...]]
+        [--logging-variant=LOGGING_VARIANT]
         [--machine-type=MACHINE_TYPE, -m MACHINE_TYPE]
         [--max-pods-per-node=MAX_PODS_PER_NODE]
         [--max-surge-upgrade=MAX_SURGE_UPGRADE; default=1]
@@ -249,6 +250,12 @@ FLAGS
      --enable-image-streaming
         Specifies whether to enable image streaming on node pool.
 
+     --enable-insecure-kubelet-readonly-port
+        Enables the Kubelet's insecure read only port.
+
+        To disable the readonly port on a cluster or node-pool set the flag to
+        --no-enable-insecure-kubelet-readonly-port.
+
      --enable-nested-virtualization
         Enables the use of nested virtualization on the node pool. Defaults to
         false. Can only be enabled on UBUNTU_CONTAINERD base image or
@@ -912,13 +919,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
      Specifies the reservation for the node pool.
diff --git a/gcloud/container/node-pools/delete b/gcloud/container/node-pools/delete
index 3d0bc427d..bc6a537ba 100644
--- a/gcloud/container/node-pools/delete
+++ b/gcloud/container/node-pools/delete
@@ -40,13 +40,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/container/node-pools/describe b/gcloud/container/node-pools/describe
index 1d4f05498..1d5c41219 100644
--- a/gcloud/container/node-pools/describe
+++ b/gcloud/container/node-pools/describe
@@ -30,13 +30,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/container/node-pools/help b/gcloud/container/node-pools/help
index dbd41eced..b0397ad9f 100644
--- a/gcloud/container/node-pools/help
+++ b/gcloud/container/node-pools/help
@@ -15,13 +15,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/container/node-pools/list b/gcloud/container/node-pools/list
index 5869da1b5..b8d9bc417 100644
--- a/gcloud/container/node-pools/list
+++ b/gcloud/container/node-pools/list
@@ -25,13 +25,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 LIST COMMAND FLAGS
diff --git a/gcloud/container/node-pools/rollback b/gcloud/container/node-pools/rollback
index 5cdd9f2e8..0457bee8d 100644
--- a/gcloud/container/node-pools/rollback
+++ b/gcloud/container/node-pools/rollback
@@ -41,13 +41,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/container/node-pools/update b/gcloud/container/node-pools/update
index f9f8fea29..3f856b12e 100644
--- a/gcloud/container/node-pools/update
+++ b/gcloud/container/node-pools/update
@@ -6,9 +6,9 @@ SYNOPSIS
     gcloud container node-pools update NAME
         (--containerd-config-from-file=CONTAINERD_CONFIG_FROM_FILE
           | --enable-confidential-nodes | --enable-gvnic
-          | --enable-image-streaming | --enable-private-nodes
-          | --enable-queued-provisioning | --labels=[KEY=VALUE,...]
-          | --logging-variant=LOGGING_VARIANT
+          | --enable-image-streaming | --enable-insecure-kubelet-readonly-port
+          | --enable-private-nodes | --enable-queued-provisioning
+          | --labels=[KEY=VALUE,...] | --logging-variant=LOGGING_VARIANT
           | --network-performance-configs=[PROPERTY=VALUE,...]
           | --node-labels=[NODE_LABEL,...] | --node-locations=ZONE,[ZONE,...]
           | --node-taints=[NODE_TAINT,...]
@@ -73,6 +73,12 @@ REQUIRED FLAGS
        --enable-image-streaming
           Specifies whether to enable image streaming on node pool.
 
+       --enable-insecure-kubelet-readonly-port
+          Enables the Kubelet's insecure read only port.
+
+          To disable the readonly port on a cluster or node-pool set the flag
+          to --no-enable-insecure-kubelet-readonly-port.
+
        --enable-private-nodes
           Enables provisioning nodes with private IP addresses only.
 
@@ -480,13 +486,13 @@ OPTIONAL FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/container/operations/cancel b/gcloud/container/operations/cancel
index c5cffa1c1..4edaaf2f4 100644
--- a/gcloud/container/operations/cancel
+++ b/gcloud/container/operations/cancel
@@ -31,13 +31,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/container/operations/describe b/gcloud/container/operations/describe
index 77909698a..c69de2afd 100644
--- a/gcloud/container/operations/describe
+++ b/gcloud/container/operations/describe
@@ -23,13 +23,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/container/operations/help b/gcloud/container/operations/help
index b31aef337..5b05839e8 100644
--- a/gcloud/container/operations/help
+++ b/gcloud/container/operations/help
@@ -15,13 +15,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/container/operations/list b/gcloud/container/operations/list
index a4299454c..cf831fd9b 100644
--- a/gcloud/container/operations/list
+++ b/gcloud/container/operations/list
@@ -20,13 +20,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 LIST COMMAND FLAGS
diff --git a/gcloud/container/operations/wait b/gcloud/container/operations/wait
index 8da51d186..b4ca4bf34 100644
--- a/gcloud/container/operations/wait
+++ b/gcloud/container/operations/wait
@@ -23,13 +23,13 @@ FLAGS
 
        --location=LOCATION
           Compute zone or region (e.g. us-central1-a or us-central1) for the
-          cluster.
+          cluster. Prefer using this flag over the --region or --zone flags.
 
        --region=REGION
-          Compute region (e.g. us-central1) for the cluster.
+          Compute region (e.g. us-central1) for a regional cluster.
 
        --zone=ZONE, -z ZONE
-          Compute zone (e.g. us-central1-a) for the cluster. Overrides the
+          Compute zone (e.g. us-central1-a) for a zonal cluster. Overrides the
           default compute/zone property value for this command invocation.
 
 GCLOUD WIDE FLAGS
diff --git a/gcloud/iam/workforce-pools/providers/create-oidc b/gcloud/iam/workforce-pools/providers/create-oidc
index d5decfb9e..5c7ffc580 100644
--- a/gcloud/iam/workforce-pools/providers/create-oidc
+++ b/gcloud/iam/workforce-pools/providers/create-oidc
@@ -286,7 +286,7 @@ OPTIONAL FLAGS
      --extra-attributes-type=EXTRA_ATTRIBUTES_TYPE
         Represents the identity provider and type of claims that should be
         fetched. EXTRA_ATTRIBUTES_TYPE must be one of:
-        attributes-type-unspecified, azure-ad-groups-mail.
+        attributes-type-unspecified, azure-ad-groups-id, azure-ad-groups-mail.
 
      --extra-attributes-filter=EXTRA_ATTRIBUTES_FILTER
         The filter used to request specific records from IdP. In case of
diff --git a/gcloud/iam/workforce-pools/providers/update-oidc b/gcloud/iam/workforce-pools/providers/update-oidc
index 54b037a31..b5578b893 100644
--- a/gcloud/iam/workforce-pools/providers/update-oidc
+++ b/gcloud/iam/workforce-pools/providers/update-oidc
@@ -287,7 +287,8 @@ FLAGS
        --extra-attributes-type=EXTRA_ATTRIBUTES_TYPE
           Represents the identity provider and type of claims that should be
           fetched. EXTRA_ATTRIBUTES_TYPE must be one of:
-          attributes-type-unspecified, azure-ad-groups-mail.
+          attributes-type-unspecified, azure-ad-groups-id,
+          azure-ad-groups-mail.
 
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --access-token-file, --account,
diff --git a/gcloud/network-connectivity/help b/gcloud/network-connectivity/help
index 658f3898e..83673cce2 100644
--- a/gcloud/network-connectivity/help
+++ b/gcloud/network-connectivity/help
@@ -28,7 +28,7 @@ GROUPS
         Manage Network Connectivity Center operations.
 
      policy-based-routes
-        Manage Policy Based Routes.
+        Manage Policy-based Routes.
 
      regional-endpoints
         Manage Network Connectivity RegionalEndpoints.
diff --git a/gcloud/network-connectivity/policy-based-routes/create b/gcloud/network-connectivity/policy-based-routes/create
index d23692149..eb9b7da79 100644
--- a/gcloud/network-connectivity/policy-based-routes/create
+++ b/gcloud/network-connectivity/policy-based-routes/create
@@ -1,13 +1,13 @@
 NAME
     gcloud network-connectivity policy-based-routes create - create a new
-        policy based route
+        policy-based route
 
 SYNOPSIS
     gcloud network-connectivity policy-based-routes create POLICY_BASED_ROUTE
         --network=NETWORK [--async] [--description=DESCRIPTION]
         [--destination-range=DESTINATION_RANGE] [--ip-protocol=IP_PROTOCOL]
         [--labels=[KEY=VALUE,...]] [--priority=PRIORITY]
-        [--protocol-version=PROTOCOL_VERSION; default="IPv4"]
+        [--protocol-version=PROTOCOL_VERSION; default="IPV4"]
         [--source-range=SOURCE_RANGE]
         [--interconnect-attachment-region=INTERCONNECT_ATTACHMENT_REGION
           | --tags=[TAGS,...]]
@@ -16,18 +16,18 @@ SYNOPSIS
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    Create a new policy based route with the given name.
+    Create a new policy-based route with the given name.
 
 EXAMPLES
-    To create a policy based route with the name my-pbr to route all l4 traffic
-    in default network to a ilb with vip 10.0.0.1, run:
+    To create a policy-based route with the name my-pbr to route all traffic in
+    default network to an internal load balancer with IP 10.0.0.1, run:
 
         $ gcloud network-connectivity policy-based-routes create my-pbr \
             --network="projects/my-project/global/networks/default" \
             --next-hop-ilb-ip=10.0.0.1
 
 POSITIONAL ARGUMENTS
-     Policy based route resource - Name of the policy based route to be
+     Policy based route resource - Name of the policy-based route to be
      created. This represents a Cloud resource. (NOTE) Some attributes are not
      given arguments in this group but can be set in other ways.
 
@@ -61,11 +61,11 @@ OPTIONAL FLAGS
         create the resource.
 
      --destination-range=DESTINATION_RANGE
-        Destination IP range of outgoing packets that this policy based route
+        Destination IP range of outgoing packets that this policy-based route
         applies to.
 
      --ip-protocol=IP_PROTOCOL
-        IP protocol that this policy based route applies to. Valid values are
+        IP protocol that this policy-based route applies to. Valid values are
         TCP, UDP, and ALL. Default is ALL.
 
      --labels=[KEY=VALUE,...]
@@ -77,38 +77,38 @@ OPTIONAL FLAGS
         numbers.
 
      --priority=PRIORITY
-        Priority of this policy based route. Priority is used to break ties in
-        cases where there are more than one matching policy based routes found.
-        In cases where multiple policy based routes are matched, the one with
+        Priority of this policy-based route. Priority is used to break ties in
+        cases where there are more than one matching policy-based routes found.
+        In cases where multiple policy-based routes are matched, the one with
         the lowest-numbered priority value wins. The default value is 1000. The
         priority value must be from 1 to 65535, inclusive. Note the priority of
-        policy based route is always higher than other types of route (e.g.
+        policy-based route is always higher than other types of route (e.g.
         static routes/advanced routes)
 
-     --protocol-version=PROTOCOL_VERSION; default="IPv4"
-        Internet protocol versions this policy based route applies to. For this
-        version, only IPV4 is supported. PROTOCOL_VERSION must be one of: ipv4,
-        protocol-version-unspecified.
+     --protocol-version=PROTOCOL_VERSION; default="IPV4"
+        Internet protocol versions that this policy-based route applies to. For
+        this version, only IPV4 is supported. PROTOCOL_VERSION must be one of:
+        ipv4, protocol-version-unspecified.
 
      --source-range=SOURCE_RANGE
-        Source IP range of outgoing packets that this policy based route
+        Source IP range of outgoing packets that this policy-based route
         applies to.
 
      At most one of these can be specified:
 
        --interconnect-attachment-region=INTERCONNECT_ATTACHMENT_REGION
-          Cloud region to install this policy based route on interconnect
+          Cloud region to install this policy-based route on interconnect
           attachment. Use all to install it on all interconnect attachments.
           Note if both --tags and --interconnect-attachment-region are not set,
-          then the policy based route will be installed in all network
+          then the policy-based route will be installed in all network
           endpoints, including VMs, VPNs, and Interconnect attachements, in the
           network.
 
        --tags=[TAGS,...]
-          List of VM instance tags to which this route applies to. VM instances
-          that have ANY of tags specified here will install this route. Note if
+          List of VM instance tags that this route applies to. VM instances
+          that have ANY of tags specified here installs this route. Note if
           both --tags and --interconnect-attachment-region are not set, then
-          the policy based route will be installed in all endpoints, including
+          the policy-based route will be installed in all endpoints, including
           VMs, VPNs, and Interconnect attachements, in the network.
 
      At most one of these can be specified:
@@ -118,9 +118,9 @@ OPTIONAL FLAGS
           handle packets.
 
        --next-hop-other-routes=NEXT_HOP_OTHER_ROUTES
-          Next hop should be other routes that handle packets. This will
-          effectively exclude matching packets being applied on other PBRs with
-          a lower priority. NEXT_HOP_OTHER_ROUTES must be one of:
+          Next hop should be other routes that handle packets. This effectively
+          excludes matching packets being applied on other policy-based routes
+          with a lower priority. NEXT_HOP_OTHER_ROUTES must be one of:
           default-routing, other-routes-unspecified.
 
 GCLOUD WIDE FLAGS
@@ -137,7 +137,9 @@ API REFERENCE
     https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
 
 NOTES
-    This variant is also available:
+    These variants are also available:
 
         $ gcloud alpha network-connectivity policy-based-routes create
 
+        $ gcloud beta network-connectivity policy-based-routes create
+
diff --git a/gcloud/network-connectivity/policy-based-routes/delete b/gcloud/network-connectivity/policy-based-routes/delete
index a940d37f5..e3a6bc1ba 100644
--- a/gcloud/network-connectivity/policy-based-routes/delete
+++ b/gcloud/network-connectivity/policy-based-routes/delete
@@ -1,21 +1,21 @@
 NAME
-    gcloud network-connectivity policy-based-routes delete - delete a policy
-        based route
+    gcloud network-connectivity policy-based-routes delete - delete a
+        policy-based route
 
 SYNOPSIS
     gcloud network-connectivity policy-based-routes delete POLICY_BASED_ROUTE
         [--async] [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    Delete the specified policy based route.
+    Delete the specified policy-based route.
 
 EXAMPLES
-    To delete a policy based route named my-pbr, run:
+    To delete a policy-based route named my-pbr, run:
 
         $ gcloud network-connectivity policy-based-routes delete my-pbr
 
 POSITIONAL ARGUMENTS
-     Policy based route resource - Name of the policy based route to be
+     Policy based route resource - Name of the policy-based route to be
      deleted. This represents a Cloud resource. (NOTE) Some attributes are not
      given arguments in this group but can be set in other ways.
 
@@ -53,7 +53,9 @@ API REFERENCE
     https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
 
 NOTES
-    This variant is also available:
+    These variants are also available:
 
         $ gcloud alpha network-connectivity policy-based-routes delete
 
+        $ gcloud beta network-connectivity policy-based-routes delete
+
diff --git a/gcloud/network-connectivity/policy-based-routes/describe b/gcloud/network-connectivity/policy-based-routes/describe
index 06f527454..e5fd634d0 100644
--- a/gcloud/network-connectivity/policy-based-routes/describe
+++ b/gcloud/network-connectivity/policy-based-routes/describe
@@ -1,21 +1,21 @@
 NAME
     gcloud network-connectivity policy-based-routes describe - describe a
-        policy based route
+        policy-based route
 
 SYNOPSIS
     gcloud network-connectivity policy-based-routes describe POLICY_BASED_ROUTE
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    Retrieve and display details about a policy based route.
+    Retrieve and display details about a policy-based route.
 
 EXAMPLES
-    To display details about a policy based route named my-pbr, run:
+    To display details about a policy-based route named my-pbr, run:
 
         $ gcloud network-connectivity policy-based-routes describe my-pbr
 
 POSITIONAL ARGUMENTS
-     Policy based route resource - Name of the policy based route to be
+     Policy based route resource - Name of the policy-based route to be
      described. This represents a Cloud resource. (NOTE) Some attributes are
      not given arguments in this group but can be set in other ways.
 
@@ -48,7 +48,9 @@ API REFERENCE
     https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
 
 NOTES
-    This variant is also available:
+    These variants are also available:
 
         $ gcloud alpha network-connectivity policy-based-routes describe
 
+        $ gcloud beta network-connectivity policy-based-routes describe
+
diff --git a/gcloud/network-connectivity/policy-based-routes/help b/gcloud/network-connectivity/policy-based-routes/help
index b203c9ca8..a063ea2d7 100644
--- a/gcloud/network-connectivity/policy-based-routes/help
+++ b/gcloud/network-connectivity/policy-based-routes/help
@@ -1,5 +1,5 @@
 NAME
-    gcloud network-connectivity policy-based-routes - manage Policy Based
+    gcloud network-connectivity policy-based-routes - manage Policy-based
         Routes
 
 SYNOPSIS
@@ -7,7 +7,7 @@ SYNOPSIS
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    Manage Policy Based Routes.
+    Manage Policy-based Routes.
 
 GCLOUD WIDE FLAGS
     These flags are available to all commands: --help.
@@ -18,19 +18,21 @@ COMMANDS
     COMMAND is one of the following:
 
      create
-        Create a new policy based route.
+        Create a new policy-based route.
 
      delete
-        Delete a policy based route.
+        Delete a policy-based route.
 
      describe
-        Describe a policy based route.
+        Describe a policy-based route.
 
      list
-        List policy based routes.
+        List policy-based routes.
 
 NOTES
-    This variant is also available:
+    These variants are also available:
 
         $ gcloud alpha network-connectivity policy-based-routes
 
+        $ gcloud beta network-connectivity policy-based-routes
+
diff --git a/gcloud/network-connectivity/policy-based-routes/list b/gcloud/network-connectivity/policy-based-routes/list
index 5d8b08226..399b62644 100644
--- a/gcloud/network-connectivity/policy-based-routes/list
+++ b/gcloud/network-connectivity/policy-based-routes/list
@@ -1,5 +1,5 @@
 NAME
-    gcloud network-connectivity policy-based-routes list - list policy based
+    gcloud network-connectivity policy-based-routes list - list policy-based
         routes
 
 SYNOPSIS
@@ -8,11 +8,11 @@ SYNOPSIS
         [GCLOUD_WIDE_FLAG ...]
 
 DESCRIPTION
-    Retrieve and display a list of all policy based routes in the specified
+    Retrieve and display a list of all policy-based routes in the specified
     project.
 
 EXAMPLES
-    To display details about a policy based route named my-pbr, run:
+    To display details about a policy-based route named my-pbr, run:
 
         $ gcloud network-connectivity policy-based-routes list my-pbr
 
@@ -56,7 +56,9 @@ API REFERENCE
     https://cloud.google.com/network-connectivity/docs/reference/networkconnectivity/rest
 
 NOTES
-    This variant is also available:
+    These variants are also available:
 
         $ gcloud alpha network-connectivity policy-based-routes list
 
+        $ gcloud beta network-connectivity policy-based-routes list
+
diff --git a/gcloud/redis/clusters/create b/gcloud/redis/clusters/create
index b01c2a962..8caafc3d2 100644
--- a/gcloud/redis/clusters/create
+++ b/gcloud/redis/clusters/create
@@ -5,8 +5,8 @@ NAME
 SYNOPSIS
     gcloud redis clusters create (CLUSTER : --region=REGION) --network=NETWORK
         --shard-count=SHARD_COUNT [--aof-append-fsync=AOF_APPEND_FSYNC]
-        [--async] [--auth-mode=AUTH_MODE] [--node-type=NODE_TYPE]
-        [--persistence-mode=PERSISTENCE_MODE]
+        [--async] [--auth-mode=AUTH_MODE] [--deletion-protection]
+        [--node-type=NODE_TYPE] [--persistence-mode=PERSISTENCE_MODE]
         [--rdb-snapshot-period=RDB_SNAPSHOT_PERIOD]
         [--rdb-snapshot-start-time=RDB_SNAPSHOT_START_TIME]
         [--redis-config=[KEY=VALUE,...]] [--replica-count=REPLICA_COUNT]
@@ -113,6 +113,10 @@ OPTIONAL FLAGS
          iam-auth
             IAM basic authorization is enabled for the cluster.
 
+     --deletion-protection
+        Enable deletion protection for the Redis Cluster. Use
+        --deletion-protection/--no-deletion-protection to enable/disable it.
+
      --node-type=NODE_TYPE
         Node Type of the redis cluster Node. NODE_TYPE must be one of:
         redis-highmem-medium, redis-highmem-xlarge, redis-shared-core-nano,
diff --git a/gcloud/redis/clusters/update b/gcloud/redis/clusters/update
index f000b4e16..c7ccccd80 100644
--- a/gcloud/redis/clusters/update
+++ b/gcloud/redis/clusters/update
@@ -4,7 +4,7 @@ NAME
 
 SYNOPSIS
     gcloud redis clusters update (CLUSTER : --region=REGION)
-        [--aof-append-fsync=AOF_APPEND_FSYNC] [--async]
+        [--aof-append-fsync=AOF_APPEND_FSYNC] [--async] [--deletion-protection]
         [--persistence-mode=PERSISTENCE_MODE]
         [--rdb-snapshot-period=RDB_SNAPSHOT_PERIOD]
         [--rdb-snapshot-start-time=RDB_SNAPSHOT_START_TIME]
@@ -76,6 +76,10 @@ FLAGS
         Return immediately, without waiting for the operation in progress to
         complete.
 
+     --deletion-protection
+        Enable deletion protection for the Redis Cluster. Use
+        --deletion-protection/--no-deletion-protection to enable/disable it.
+
      --persistence-mode=PERSISTENCE_MODE
         Operation mode for persistence. PERSISTENCE_MODE must be one of:
 
diff --git a/gcloud/scc/manage/services/describe b/gcloud/scc/manage/services/describe
index bf6dd0187..85c5defea 100644
--- a/gcloud/scc/manage/services/describe
+++ b/gcloud/scc/manage/services/describe
@@ -36,7 +36,20 @@ EXAMPLES
 POSITIONAL ARGUMENTS
      SERVICE_NAME
         The service name, provided either in lowercase hyphenated form (e.g.
-        security-health-analytics), or in abbreviated form (e.g. sha)
+        security-health-analytics), or in abbreviated form (e.g. sha) if
+        applicable.
+
+        The list of supported services is:
+
+        ◆ security-health-analytics (can be abbreviated as sha)
+
+        ◆ event-threat-detection (can be abbreviated as etd)
+
+        ◆ container-threat-detection (can be abbreviated as ctd)
+
+        ◆ vm-threat-detection (can be abbreviated as vmtd)
+
+        ◆ web-security-scanner (can be abbreviated as wss)
 
 REQUIRED FLAGS
      Exactly one of these must be specified:
diff --git a/gcloud/scc/manage/services/update b/gcloud/scc/manage/services/update
index 19ce23add..9faed96de 100644
--- a/gcloud/scc/manage/services/update
+++ b/gcloud/scc/manage/services/update
@@ -38,7 +38,20 @@ EXAMPLES
 POSITIONAL ARGUMENTS
      SERVICE_NAME
         The service name, provided either in lowercase hyphenated form (e.g.
-        security-health-analytics), or in abbreviated form (e.g. sha)
+        security-health-analytics), or in abbreviated form (e.g. sha) if
+        applicable.
+
+        The list of supported services is:
+
+        ◆ security-health-analytics (can be abbreviated as sha)
+
+        ◆ event-threat-detection (can be abbreviated as etd)
+
+        ◆ container-threat-detection (can be abbreviated as ctd)
+
+        ◆ vm-threat-detection (can be abbreviated as vmtd)
+
+        ◆ web-security-scanner (can be abbreviated as wss)
 
 REQUIRED FLAGS
      At least one of these must be specified:
diff --git a/gcloud/vmware/network-peerings/create b/gcloud/vmware/network-peerings/create
index 4457c16b5..641d59e9b 100644
--- a/gcloud/vmware/network-peerings/create
+++ b/gcloud/vmware/network-peerings/create
@@ -90,10 +90,12 @@ REQUIRED FLAGS
           of reverse peering on the VPC network associated with the third-party
           service.
         ◆ DELL_POWERSCALE: Peering connection used for connecting to Dell
-          PowerScale Filers. PEER_NETWORK_TYPE must be one of:
+          PowerScale Filers.
+        ◆ GOOGLE_CLOUD_NETAPP_VOLUMES: Peering connection used for connecting
+          to Google Cloud NetApp Volumes. PEER_NETWORK_TYPE must be one of:
           PEER_NETWORK_TYPE_UNSPECIFIED, STANDARD, VMWARE_ENGINE_NETWORK,
           PRIVATE_SERVICES_ACCESS, NETAPP_CLOUD_VOLUMES, THIRD_PARTY_SERVICE,
-          DELL_POWERSCALE.
+          DELL_POWERSCALE, GOOGLE_CLOUD_NETAPP_VOLUMES.
 
      --vmware-engine-network=VMWARE_ENGINE_NETWORK
         ID of the VMware Engine network to attach the new peering to.